APT attack threat judgment method based on traceability graph matching and storage medium

Abstract

The invention discloses an APT (Advanced Persistent Threat) attack threat judgment method based on traceability graph matching and a storage medium, and the method finds out how an attacker permeates a system step by step through deep analysis of data such as system logs and network traffic, and comprehensively judges the threat degree of a current event in combination with threat scores of past attack events. Therefore, deep analysis and accurate detection of APT threat attack behaviors are realized.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to an APT attack threat judgment method based on provenance graph matching and a storage medium. Background Art

[0002] With the rapid development of Internet technology, network security issues have become increasingly prominent, especially network attacks represented by Advanced Persistent Threat (APT), which have brought unprecedented challenges to national information security and personal privacy protection. APT attacks are characterized by complex technical means, strong concealment, and long duration. They can bypass traditional security protection measures and pose a huge threat to critical infrastructure and sensitive data. Therefore, conducting research on APT detection technology and improving network security protection capabilities have become important topics in the field of cyberspace security.

[0003] APT attacks are a form of attack that uses advanced attack methods to carry out long-term and persistent network attacks on specific targets. Its main characteristics are the ability to continuously monitor the target machine and obtain data from the target machine. It is highly concealed, targeted and persistent. It is usually carefully planned by certain personnel for commercial or political motives, and then implements complex threats and attacks against specific organizations or countries. APT attacks have a long incubation period, and it is extremely difficult to detect an APT attack.

[0004] Traditional APT attack detection methods face many challenges when dealing with APT attacks. For example, the concealment of APT attacks makes real-time detection difficult. Traditional methods find it difficult to detect anomalies in the early stages of an attack. In addition, since APT attacks last for a long time, when machine learning models learn attack features, they gradually train malicious behaviors into normal behaviors. Summary of the invention

[0005] The present invention provides an APT attack threat judgment method based on source tracing graph matching and a storage medium to solve the problem that the existing threat cannot be detected accurately, simply and quickly.

[0006] In a first aspect, the present invention provides an APT attack threat judgment method based on traceability graph matching, the method comprising: determining the causal relationship between various events and actions in the network attack by analyzing and correlating various events and actions in the network attack, and constructing a correlated traceability graph; using a graph core isomorphism algorithm, matching the correlated traceability graph with a historical attack event traceability graph to obtain the similarity between each event and the historical event after matching, and setting the calculated similarity as a genetic factor; scoring the real-time traceability graph according to the genetic factor and the threat score of the historical attack event, and scoring the individual events associated with the traceability graph to obtain a threat assessment score of the attack event, and determining the threat level of the current event according to the threat assessment score.

[0007] Optionally, before analyzing and associating various events and actions in the network attack, the method further includes: acquiring system event-related data and preprocessing the acquired data.

[0008] Optionally, the preprocessing includes: cleaning, parsing, formatting, removing noise from the data, and extracting key information, wherein the key information includes: timestamp, IP address and process ID.

[0009] Optionally, the step of analyzing and associating various events and actions in a network attack, determining the causal relationship between various events and actions in the network attack, and constructing a traceability graph after the association includes:

[0010] Use the causal reasoning model Lightweight Dual Execution (LDX) to analyze and correlate the causal relationship between various events in a cyber attack, as well as the causal relationship between various events and actions;

[0011] Integrate the causal relationships obtained from the analysis to form a preliminary causal relationship network;

[0012] The traceability graph is constructed based on the causal relationship network.

[0013] Optionally, the graph core isomorphism algorithm is used to match the associated traceability graph with the historical attack event traceability graph to obtain the similarity between each event and the historical event after matching, and the calculated similarity is set as the genetic factor, including:

[0014] Suppose two traceability graphs G 1 (V 1 ,E 1 ) and G 2 (V 2 ,E 2 ), and design a graph decomposition method F, the substructure after decomposition is:

[0015] G 1 and G 2 The kernel value is expressed as:

[0016]

[0017] Among them, δ in S 1,n1 and S 2,n2 1 if they are isomorphic, 0 if they are not;

[0018] Encode the node labels of the traceability graph structure and construct a dictionary to store the mapping relationship between labels and codes;

[0019] Based on the node decomposition of the traceability graph, each node is taken as the root node and the tree structure containing all its adjacent nodes is decomposed;

[0020] Generate a new code using the label codes of the root node and its adjacent nodes, and update the label of the root node to the new code through a preset hash operation code;

[0021] According to all the decomposed substructures, the code of each node in the original traceability graph structure is updated to obtain a new node code sequence;

[0022] Among them, the decomposed subtree structure is:

[0023] The original node code is:

[0024] The updated node code is:

[0025]

[0026] The updated code of each node contains the relevant information of its subtree structure, and through multiple iterations, each iteration contains more information. When the updated codes of two nodes are the same, their subtree structures are isomorphic, that is:

[0027] Using the above decomposition method, we get two updated encoding sequences: and The similarity between the two traceability graphs is converted into the similarity between the two coding sequences, and the nuclear value is calculated using Jaccard similarity and defined as the genetic factor:

[0028] Optionally, based on the node decomposition of the traceability graph, each node is taken as the root node and a tree structure containing all its adjacent nodes is decomposed, including:

[0029] Decompose the tree structure of a node v and label A. According to the adjacency relationship, it is known that v has two adjacent nodes. Labeled C, and Label is B.

[0030] Optionally, the real-time traceability graph is scored according to the threat scores of the genetic factors and historical attack events, and the individual events associated with the traceability graph are scored to obtain a threat assessment score for the attack event, including: assigning an initial extremely low threat level to all input events, and according to the matching result F, weightedly calculating the genetic factor score for each successfully matched attack event, and taking the normalized final score as the threat score of the attack event.

[0031] Optionally, all input events are assigned an initial extremely low threat level, and according to the matching result F, a weighted genetic factor score is calculated for each successfully matched attack event, and the final score is normalized as the threat level score of the attack event, including:

[0032] Define the traceability graph set as A, traceability graph a k ∈A, the set of historical attack events is R, and the historical attack event r i ∈R, the scoring of each attack event node in the provenance graph includes:

[0033] Select a k All corresponding matching results F';

[0034] For matching results [a k ,r i ]∈j', from r i Select attack event log node n j ,j∈[1,len(r i )];

[0035] Query historical attack events i score i , traverse r i All nodes of a k The corresponding node in the d is added with the product of the score and the genetic factor to obtain a preliminary similarity score. The unmatched associated nodes are given a bonus score that decreases linearly with the distance d. d =score i -d;

[0036] Repeat the above process until the traversal is completed. k The corresponding matching results;

[0037] to a kThe node scores in are normalized using the (0,1) standardization method. The node with the highest score is recorded as MAX, and the node with the lowest score is recorded as MIN. The score calculation formula for each node is:

[0038] Output the threat score of the attack event tracing graph obtained by the genetic coverage algorithm.

[0039] Optionally, the scoring of individual events associated with the traceability graph includes: setting the individual attack event log node set as S, and the IP set of the attack event in the matching result set as F. IP , the malicious IP set in the threat intelligence database is X IP ;

[0040] Select Nodes k ∈S, obtain the attack event type and destination IP, denoted as a type , dip, record the node score(s k );

[0041] If dip in F IP or dip in X IP , then continue, otherwise, reselect the node;

[0042] If a type in R, query historical attack events r i score(a type ), is s k Add the score and continue; otherwise, reselect nodes until all nodes in the individual attack event log node set are scored.

[0043] In a second aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the above-mentioned APT attack threat judgment methods based on provenance graph matching.

[0044] The beneficial effects of the present invention are as follows:

[0045] The present invention provides an APT attack threat judgment method based on traceability graph matching. The method described in the present invention finds out how the attacker penetrates the system step by step through in-depth analysis of system logs, network traffic and other data, and comprehensively judges the threat level of the current event by combining the threat scores of past attack events. This achieves in-depth analysis and accurate detection of APT threat attack behaviors.

[0046] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0048] Figure 1 It is a flow chart of a method for judging APT attack threats based on source graph matching provided by an embodiment of the present invention;

[0049] Figure 2 is a schematic diagram of tree structure decomposition provided by an embodiment of the present invention;

[0050] Figure 3 4 is a schematic diagram of attack event scoring provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0051] The present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and do not limit the present invention.

[0052] In view of the problem that existing APT attack detection methods are difficult to cover the long-term life cycle of APT attacks and cannot effectively capture long-term system behaviors, the concealment of APT attacks makes real-time detection difficult, and it is difficult to find anomalies in the early stages of an attack. In addition, due to the long duration of APT attacks, when machine learning models learn attack features, they will gradually train malicious behaviors into normal behaviors, thereby affecting the accuracy and speed of attack detection. An embodiment of the present invention provides an APT attack threat judgment method based on source graph matching. The APT threat detection method based on source graph described in the embodiment of the present invention combines the visualization, comprehensive recording and sequence feature extraction technology of the source graph, and can achieve in-depth analysis and accurate detection of APT threat attack behaviors.

[0053] Specifically, see Figure 1 The embodiment of the present invention provides a method for judging APT attack threats based on source tracing graph matching, the method comprising:

[0054] S101. Analyze and correlate various events and actions in the network attack, determine the causal relationship between various events and actions in the network attack, and construct a traceability diagram after correlation;

[0055] Among them, the traceability graph described in the embodiment of the present invention mainly refers to the traceability relationship graph of the interactive relationship between system objects, which is a tool that comprehensively displays network event information and is visual. It abstracts the entities in the system (such as processes, files, network ports, etc.) as nodes, and the behaviors between entities as edges, thereby encoding the behaviors in the system into a directed, labeled graph with time information. No matter how hidden and slow the threat attack is, the corresponding nodes and causal relationships can be found in the traceability graph, so as to effectively detect it. The traceability graph contains rich system behavior semantics and has strong correlation analysis capabilities. It has a good effect in detecting unknown threats and alarm associations and false alarm filtering. Therefore, the research on APT attack detection methods based on traceability graph matching has important theoretical significance and practical application value in the field of information security.

[0056] In specific implementation, the embodiment of the present invention first obtains system event related data and pre-processes the obtained data. The pre-processing in the embodiment of the present invention includes: cleaning, parsing, formatting, removing noise from the data, and extracting key information, wherein the key information includes: timestamp, IP address and process ID.

[0057] Specifically, an embodiment of the present invention utilizes the causal reasoning model LDX to analyze and correlate the causal relationship between various events in a network attack, as well as the causal relationship between various events and actions; integrates the causal relationship obtained by the analysis to form a preliminary causal relationship network; and constructs the traceability graph based on the causal relationship network.

[0058] S102, using a graph core isomorphism algorithm, matching the associated traceability graph with the historical attack event traceability graph to obtain the similarity between each event and the historical event after matching, and setting the calculated similarity as a genetic factor;

[0059] Specifically, the embodiment of the present invention sets two traceability graphs G 1 (V 1 ,E 1 ) and G 2 (V 2 ,E 2 ), and design a graph decomposition method F, the substructure after decomposition is:

[0060] G 1 and G 2The kernel value is expressed as: Among them, δ in S 1,n1 and S 2,n2 1 if they are isomorphic, 0 if they are not;

[0061] Encode the node labels of the traceability graph structure and construct a dictionary to store the mapping relationship between labels and codes;

[0062] Based on the node decomposition of the traceability graph, each node is taken as the root node and the tree structure containing all its adjacent nodes is decomposed;

[0063] Generate a new code using the label codes of the root node and its adjacent nodes, and update the label of the root node to the new code through a preset hash operation code;

[0064] According to all the decomposed substructures, the code of each node in the original traceability graph structure is updated to obtain a new node code sequence;

[0065] Among them, the decomposed subtree structure is:

[0066] The original node code is:

[0067] The updated node code is:

[0068]

[0069] The updated code of each node contains the relevant information of its subtree structure, and through multiple iterations, each iteration contains more information. When the updated codes of two nodes are the same, their subtree structures are isomorphic, that is:

[0070] Using the above decomposition method, we get two updated encoding sequences: and The similarity between the two traceability graphs is converted into the similarity between the two coding sequences, and the nuclear value is calculated using Jaccard similarity and defined as the genetic factor:

[0071] S103. Score the real-time traceability graph according to the threat scores of the genetic factors and historical attack events, and score the individual events associated with the traceability graph to obtain a threat assessment score of the attack event, and determine the threat level of the current event according to the threat assessment score.

[0072] That is, the embodiment of the present invention assigns an initial extremely low threat level to all input events, and according to the matching result F, weights and calculates the genetic factor score for each successfully matched attack event, and takes the normalized final score as the threat level score of the attack event.

[0073] From the above, it can be seen that the embodiment of the present invention is to find out how the attacker penetrates the system step by step through in-depth analysis of data such as system logs and network traffic, and combine the threat scores of past attack events to comprehensively judge the threat level of the current event, thereby accurately and quickly realizing the identification and detection of attacks.

[0074] The following will be combined Figure 1 , Figure 2 and Figure 3 The method described in the embodiment of the present invention is explained and illustrated in detail by a specific example:

[0075] See also Figure 1 The embodiment of the present invention provides an APT attack threat judgment method based on source tracing graph matching, comprising:

[0076] The traceability graph is constructed based on causal relationships, that is, by analyzing and correlating various events and actions in network attacks, the causal relationship between them is revealed, and the correlated traceability graph is obtained.

[0077] Provenance graph matching based on graph core isomorphism algorithm. Specifically, the embodiment of the present invention uses the graph core isomorphism algorithm to match the associated provenance graph with the historical attack event provenance graph, obtain the similarity between each event and the historical event after matching, and define the similarity as a genetic factor;

[0078] Attack threat assessment based on genetic coverage, that is, the embodiment of the present invention scores the real-time provenance graph according to the threat scores of genetic factors and historical attack events, scores the individual events associated with the provenance graph, and obtains the threat assessment score of the attack event.

[0079] The following is a detailed explanation and description of each step in the above embodiment of the present invention:

[0080] Step 101, constructing a traceability graph based on causal relationships.

[0081] Specifically, in this embodiment, the specific processing method for constructing a traceability graph based on causal relationships is as follows: first, system event-related data is collected and preprocessed, and then related events are associated to construct a traceability graph, which specifically includes:

[0082] S1. Collect data on various security events, network traffic, system logs, application logs, etc. that occur in the network environment and system activities;

[0083] S2. Clean, parse and format the collected raw data, including removing noise data and extracting key information (timestamp, IP address, process ID, etc.);

[0084] S3. Based on the preprocessed data, the causal relationship between events is analyzed using a causal reasoning model (LDX model);

[0085] S4. Integrate the causal relationships obtained from the analysis to form a preliminary causal relationship network;

[0086] S5. Construct a traceability diagram based on the causal network.

[0087] After the traceability graph is constructed, the traceability graph G is output for use in the following matching method.

[0088] Step 102: Provenance graph matching based on graph core isomorphism algorithm.

[0089] In the specific implementation, in this embodiment, the specific processing method of the traceability graph matching based on the graph core isomorphism algorithm is as follows: after obtaining the traceability graph, the obtained traceability graph is matched with the traceability graph of the historical attack event using the graph core isomorphism algorithm. Among them, the graph core isomorphism algorithm is directly oriented to the graph structure data, which not only retains the advantage of efficient kernel function calculation, but also contains the structured information of the graph data in the Hilbert high-dimensional space. There are different graph cores for different graph structures. The graph is mapped to a unified space, and then the inner product of the graph is used to calculate the similarity. The specific steps are as follows:

[0090] S1. Given two graphs G 1 (V 1 ,E 1 ) and G 2 (V 2 ,E 2 ), design a graph decomposition method F, the substructure after decomposition is:

[0091]

[0092] S2. Based on the above substructure, G 1 and G 2 The kernel value can be expressed as:

[0093]

[0094] Where δ is in S 1,n1 and S 2,n2 When they are isomorphic, it is 1, and when they are not, it is 0. Therefore, any combination of graph decomposition method and substructure isomorphism judgment method can define a new graph kernel;

[0095] S3. Taking the subtree-based graph core as an example, encode the node labels of the graph structure (such as A: #1000), and construct a dictionary to store the mapping relationship between labels and codes;

[0096] S4. Based on the node decomposition of the graph, take each node as the root node and decompose the tree structure containing all its adjacent nodes, as follows:

[0097] Decompose the tree structure of a node v (labeled as A). According to the adjacency relationship, it is known that v has two adjacent nodes. (labeled C) and (labeled as B), the tree structure decomposed based on v is as follows Figure 2 As shown;

[0098] S5. Based on the decomposed tree structure and the mapping between labels and codes, define a hash operation, such as a combination of bit operations, generate a new code using the label codes of the root node and its adjacent nodes, and update the label code of the root node to the new code;

[0099] S6. Update the code of each node of the original graph structure according to all the decomposed substructures to obtain a new node code sequence;

[0100] The decomposed subtree structure is as follows:

[0101]

[0102] The original node encoding is as follows:

[0103]

[0104] The updated node code is as follows:

[0105]

[0106] The updated code of each node contains the relevant information of its subtree structure, and it can be iterated multiple times, each iteration contains more information. For example, the code of the node in the first update contains the information of its directly adjacent nodes, while the second iteration contains the information of directly adjacent nodes and nodes with an interval of 1, and so on. Because it is a hash function, we can assume that when the codes of two nodes are the same after update, their subtree structures are isomorphic, that is:

[0107]

[0108] Finally, the above decomposition method is used to obtain two updated coding sequences and In this way, the similarity between the two traceability graphs can be converted into the similarity between the two coding sequences, and the kernel value is calculated using Jaccard similarity and defined as the genetic factor:

[0109]

[0110] Step 103: Attack threat assessment based on genetic coverage.

[0111] In this embodiment, the specific processing method of attack threat assessment based on genetic coverage is as follows: After completing the traceability graph matching, the genetic coverage algorithm needs to be used to score the system events. First, all input events are assigned an initial extremely low threat level (assigned to 1) to ensure that some events are not missed during traceability.

[0112] According to the matching result F, the genetic factor score is weighted and calculated for each successfully matched attack event, and the final score is normalized as the threat score of the attack event, such as Figure 2 shown.

[0113] The nodes on the left side of the figure represent the logs of attack events in the traceability graph, which contain threat scores, types, source IP addresses, destination IP addresses, and time information after scoring. The nodes on the right side of the figure represent matching nodes of historical attack events, and their information includes threat scores and types. Among them, the red dotted frame of the attack event log 1-3 represents that its node 1-3 successfully matches the traceability graph node 1-3, and the same score of 6 points is given to the traceability graph. Then, other attack event nodes that are not in the match are given bonus points that decrease linearly with the distance.

[0114] Define the traceability graph set as A, a k ∈A, the set of historical attack events is R, r i ∈R, the scoring steps for each attack event node in the provenance graph are as follows:

[0115] S1.Select a k All corresponding matching results F';

[0116] S2. For the matching results [a k ,r i ]∈F', from r i Select attack event log node n j ,j∈[1,len(r i )];

[0117] S3. Query historical attack events r i score i , traverse r i All nodes of a kThe corresponding node in the d is added with the product of the score and the genetic factor to obtain a preliminary similarity score. The unmatched associated nodes are given a bonus score that decreases linearly with the distance d. d =score i -d;

[0118] S4. Repeat the above process until the traversal is completed. k The corresponding matching results;

[0119] S5. k The node scores in are normalized using the (0,1) standardization method. The node with the highest score is recorded as MAX, and the node with the lowest score is recorded as MIN. The score calculation method for each node is as follows:

[0120]

[0121] S6. Output the threat score of the attack event tracing graph obtained by the genetic coverage algorithm.

[0122] At the same time, in order to prevent the subsequent long-term attack event association from losing relevant parts, the individual attack events in the association results will be scored. The scoring process is as follows:

[0123] In specific implementation, the embodiment of the present invention sets the independent attack event log node set as S, and the IP set of the attack event in the matching result set as F. IP , the malicious IP set in the threat intelligence database is X IP .

[0124] S1. Select node s k ∈S, obtain the attack event type and destination IP, denoted as a type , dip, record the node score(s k );

[0125] S2. If dip in F IP or dip in X IP , continue, otherwise return to S1, that is, reselect the node;

[0126] S3. If a is satisfied type in R, query historical attack events r i score(a type ), is s k Add the score and continue, otherwise return 1;

[0127] S4. Repeat S1-S3 until the traversal of S is completed.

[0128] Attack events are scored using a genetic coverage algorithm, and the results can assist in determining APT attack threats.

[0129] In summary, the present invention provides a method for judging APT attack threats based on traceability graph matching. The method described in the present invention finds out how the attacker penetrates the system step by step through in-depth analysis of system logs, network traffic and other data, and comprehensively judges the threat level of the current event by combining the threat scores of past attack events. This enables in-depth analysis and accurate detection of APT threat attack behaviors.

[0130] Accordingly, an embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, any of the above-mentioned APT attack threat judgment methods based on tracing graph matching is implemented. The relevant contents of the storage medium embodiment of the present invention can be understood by referring to the method embodiment of the present invention, and will not be discussed in detail here.

[0131] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0132] Although the preferred embodiments of the present invention have been disclosed for illustrative purposes, those skilled in the art will appreciate that various modifications, additions and substitutions are possible, and thus, the scope of the present invention should not be limited to the above embodiments.

Claims

1. A method for judging APT attack threats based on traceability graph matching, characterized in that: The method comprises: By analyzing and correlating various events and actions in a network attack, the causal relationship between the various events and actions in the network attack is determined, and a traceability diagram after correlation is constructed; Using the graph core isomorphism algorithm, the associated traceability graph is matched with the historical attack event traceability graph to obtain the similarity between each event and the historical event, and the calculated similarity is set as the genetic factor; The real-time traceability graph is scored according to the threat scores of the genetic factors and historical attack events, and the individual events associated with the traceability graph are scored to obtain a threat assessment score of the attack event, and the threat level of the current event is determined according to the threat assessment score.

2. The method according to claim 1, characterized in that Before analyzing and correlating various events and actions in the network attack, the method further includes: Acquire system event related data and pre-process the acquired data.

3. The method according to claim 2, characterized in that The preprocessing includes: cleaning, parsing, formatting, and noise removal of the data, and extracting key information, wherein the key information includes: timestamp, IP address, and process ID.

4. The method according to claim 1, characterized in that: The causal relationship between various events and actions in the network attack is determined by analyzing and correlating various events and actions in the network attack, and a traceability diagram after correlation is constructed, including: LDX, a lightweight dual execution engine, uses causal reasoning models to analyze and correlate the causal relationships between various events in a cyber attack, as well as the causal relationships between various events and actions; Integrate the causal relationships obtained from the analysis to form a preliminary causal relationship network; The traceability graph is constructed based on the causal relationship network.

5. The method according to claim 1, characterized in that The method uses the graph core isomorphism algorithm to match the associated traceability graph with the historical attack event traceability graph to obtain the similarity between each event and the historical event, and sets the calculated similarity as the genetic factor, including: Set up two traceability graphs G1(V1,E1) and G2(V2,E2), and design a graph decomposition method F. The substructure after decomposition is: The kernel value of G1 and G2 is expressed as: Among them, δ in S 1,n1 and S 2,n2 1 if they are isomorphic, 0 if they are not; Encode the node labels of the traceability graph structure and construct a dictionary to store the mapping relationship between labels and codes; Based on the node decomposition of the traceability graph, each node is taken as the root node and the tree structure containing all its adjacent nodes is decomposed; Generate a new code using the label codes of the root node and its adjacent nodes, and update the label of the root node to the new code through a preset hash operation code; According to all the decomposed substructures, the code of each node in the original traceability graph structure is updated to obtain a new node code sequence; Among them, the decomposed subtree structure is: The original node code is: The updated node code is: The updated code of each node contains the relevant information of its subtree structure, and through multiple iterations, each iteration contains more information. When the updated codes of two nodes are the same, their subtree structures are isomorphic, that is: Using the above decomposition method, we get two updated encoding sequences: and The similarity between the two traceability graphs is converted into the similarity between the two coding sequences, and the nuclear value is calculated using Jaccard similarity and defined as the genetic factor:

6. The method according to claim 5, characterized in that Based on the node decomposition of the traceability graph, each node is taken as the root node and the tree structure containing all its adjacent nodes is decomposed, including: Decompose the tree structure of a node v and label A. According to the adjacency relationship, it is known that v has two adjacent nodes. Labeled C, and Label is B.

7. The method according to any one of claims 1 to 6, characterized in that: The real-time traceability graph is scored according to the threat scores of the genetic factors and historical attack events, and the individual events associated with the traceability graph are scored to obtain the threat assessment score of the attack event, including: All input events are assigned an initial extremely low threat level. According to the matching result F, a weighted genetic factor score is calculated for each successfully matched attack event, and the final score is normalized as the threat level score of the attack event.

8. The method according to claim 7, characterized in that The method assigns an initial extremely low threat level to all input events, and calculates a weighted genetic factor score for each successfully matched attack event based on the matching result F, and normalizes the final score as the threat level score of the attack event, including: Define the traceability graph set as A, traceability graph a k ∈A, the set of historical attack events is R, and the historical attack event r i ∈R, the scoring of each attack event node in the provenance graph includes: Select a k All corresponding matching results F'; For matching results [a k ,r i ]∈F', from r i Select attack event log node n j ,j∈[1,len(r i )]; Query historical attack events i score i , traverse r i All nodes of a k The corresponding node in the d is added with the product of the score and the genetic factor to obtain a preliminary similarity score. The unmatched associated nodes are given a bonus score that decreases linearly with the distance d. d =score i -d; Repeat the above process until the traversal is completed. k The corresponding matching results; to a k The node scores in are normalized using the (0,1) standardization method. The node with the highest score is recorded as MAX, and the node with the lowest score is recorded as MIN. The score calculation formula for each node is: Output the threat score of the attack event tracing graph obtained by the genetic coverage algorithm.

9. The method according to claim 8, characterized in that The scoring of individual events associated with the traceability graph includes: Set the set of individual attack event log nodes to S, and the set of IP addresses of attack events in the matching result set to F. IP , the malicious IP set in the threat intelligence database is X IP ; Select Nodes k ∈S, obtain the attack event type and destination IP, denoted as a type , dip, record the node score(s k ); If dip in F IP or dip in X IP , then continue, otherwise, reselect the node; If a type in R, query historical attack events r i score(a type ), is s k Add the score and continue; otherwise, reselect nodes until all nodes in the individual attack event log node set are scored.

10. A computer-readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the APT attack threat judgment method based on provenance graph matching as described in any one of claims 1 to 9.

Images