An APT attack threat judgment method based on a traceability graph matching and a storage medium

Abstract

The application discloses an APT attack threat judgment method based on a traceability graph matching and a storage medium, the method finds out how an attacker penetrates a system step by step through in-depth analysis of system logs, network traffic and other data, and comprehensively judges the threat degree of a current event in combination with threat scores of past attack events, so that deep analysis and accurate detection of APT threat attack behaviors are realized.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method and storage medium for judging APT attack threats based on source graph matching. Background Technology

[0002] With the rapid development of internet technology, cybersecurity issues have become increasingly prominent, especially cyberattacks represented by Advanced Persistent Threats (APTs), which pose unprecedented challenges to national information security and the protection of personal privacy. APT attacks, characterized by their complex techniques, high degree of stealth, and long duration, can bypass traditional security measures, posing a significant threat to critical infrastructure and sensitive data. Therefore, conducting research on APT detection technologies and improving cybersecurity protection capabilities has become an important issue in the field of cyberspace security.

[0003] An APT attack is a form of cyberattack that utilizes advanced attack techniques to launch a long-term, persistent cyberattack against a specific target. Its main characteristics include the ability to continuously monitor target machines and extract data from them. It is highly stealthy, targeted, and persistent, typically driven by commercial or political motives, meticulously planned by certain individuals, and then carries out complex threats and attacks against specific organizations or countries. APT attacks have a very long incubation period, making them extremely difficult to detect.

[0004] Traditional APT attack detection methods face many challenges in dealing with APT attacks. For example, the stealth of APT attacks makes real-time detection difficult, traditional methods struggle to detect anomalies in the early stages of an attack, and because APT attacks last for a long time, machine learning models gradually learn malicious behavior as normal behavior when learning attack characteristics. Summary of the Invention

[0005] This invention provides an APT attack threat assessment method and storage medium based on source graph matching to solve the problem that existing methods cannot accurately and quickly detect threats.

[0006] In a first aspect, the present invention provides an APT attack threat assessment method based on source graph matching. The method includes: determining the causal relationship between various events and actions in a network attack by analyzing and associating them, and constructing an associated source graph; matching the associated source graph with a historical attack event source graph using a graph kernel isomorphism algorithm to obtain the similarity between each event and the historical event, and setting the calculated similarity as a genetic factor; scoring the real-time source graph according to the genetic factor and the threat score of the historical attack event, and scoring the individual events associated with the source graph to obtain the threat assessment score of the attack event; and determining the threat level of the current event according to the threat assessment score.

[0007] Optionally, before analyzing and correlating the various events and actions in the network attack, the method further includes: acquiring system event-related data and preprocessing the acquired data.

[0008] Optionally, the preprocessing includes: cleaning, parsing, formatting, and noise removal of the data, and extracting key information, wherein the key information includes: timestamp, IP address, and process ID.

[0009] Optionally, the step of analyzing and correlating various events and actions in a network attack to determine the causal relationships between them and constructing a correlated source graph includes:

[0010] The Lightweight Dual Execution (LDX) engine, based on a causal inference model, is used to analyze and correlate the causal relationships between various events in a network attack, as well as the causal relationships between various events and actions.

[0011] The causal relationships obtained from the analysis are integrated to form a preliminary causal relationship network;

[0012] The source graph is constructed based on the causal relationship network.

[0013] Optionally, the graph kernel isomorphism algorithm is used to match the associated source graph with the source graph of historical attack events to obtain the similarity between each event and the historical events. The calculated similarity is then set as a genetic factor, including:

[0014] Given two source graphs G1(V1,E1) and G2(V2,E2), design a graph decomposition method F, the substructure after decomposition is as follows:

[0015] The kernel values ​​of G1 and G2 are represented as follows:

[0016]

[0017] Where δ is in S 1,n1 and S 2,n2 The value is 1 when they are isomorphic and 0 when they are not.

[0018] Encode the node labels of the source graph structure and construct a dictionary to store the mapping relationship between labels and codes;

[0019] Based on the decomposition of nodes in the source graph, each node is decomposed into a tree structure containing all its adjacent nodes, with each node as the root node.

[0020] A new code is generated by using the labels of the root node and its neighboring nodes, and the label of the root node is updated to the new code through a preset hash operation.

[0021] Based on all the decomposed substructures, update the encoding of each node in the original source graph structure to obtain a new node encoding sequence.

[0022] The decomposed subtree structure is as follows:

[0023] The original node encoding is:

[0024] The updated node encoding is:

[0025]

[0026] Each node's updated code contains information about its subtree structure, and through multiple iterations, each iteration includes more information. When two nodes have the same updated code, their subtree structures are isomorphic, that is:

[0027] Two updated encoding sequences are obtained using the above decomposition method. and The similarity between two source maps is transformed into the similarity between two coding sequences. The kernel value is calculated using Jaccard similarity and defined as a hereditary factor.

[0028] Optionally, based on the node decomposition of the source graph, each node is decomposed into a tree structure containing all its neighboring nodes, with each node as the root node, including:

[0029] Decompose the tree structure of a given node v with label A. Based on adjacency relationships, v has two adjacent nodes: The label is C, and The label is B.

[0030] Optionally, the real-time source map is scored based on the genetic factors and the threat scores of historical attack events, and individual events associated with the source map are scored to obtain the threat assessment score of the attack event. This includes: assigning an initial extremely low threat level to all input events; calculating the genetic factor score for each successfully matched attack event based on the matching result F; and taking the final score after normalization as the threat level score of the attack event.

[0031] Optionally, the step of assigning an initial, extremely low threat level to all input events, calculating a weighted genetic factor score for each successfully matched attack event based on the matching result F, and taking the final score after normalization as the threat level score of the attack event, includes:

[0032] Define the set of source graphs as A, and the source graph a k Let A be the set of historical attack events, R be the set of historical attack events, and r be the number of historical attack events. i ∈R, the score for each attack event node in the source graph includes:

[0033] Choose a k All corresponding matching results F';

[0034] Regarding the matching result [a] k ,r i ]∈j', from r i Select attack event log node n j ,j∈[1,len(r i )];

[0035] Query historical attack events r i score i traversing r i All nodes, for a k The corresponding node is multiplied by the score and the genetic factor to obtain the initial similarity score. Unmatched related nodes are assigned a score that decreases linearly with distance d. d =score i -d;

[0036] Repeat the above process until traversal of a is complete. k The corresponding matching results;

[0037] For a k The node scores are normalized using the (0,1) normalization method. The highest score among the recorded nodes is denoted as MAX, and the lowest score is denoted as MIN. The formula for calculating the score of each node is as follows:

[0038] Output the threat score of the attack event source map obtained by the genetic cover algorithm.

[0039] Optionally, scoring individual events associated with the source graph includes: setting the set of individual attack event log nodes as S, and the set of IPs of attack events in the matching result set as F. IP The malicious IP set in the threat intelligence database is X. IP ;

[0040] Select node s k ∈S, obtain its attack event type and destination IP, denoted as a type `dip` records the node score (s) k );

[0041] If dip in F IP or dip in X IP If yes, continue; otherwise, select a new node.

[0042] If a is satisfied type In R, query historical attack events. i score(a) type ), for s k Add the score and continue; otherwise, reselect a node until all nodes in the individual attack event log node set have been scored.

[0043] Secondly, the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements any of the above-described methods for judging APT attack threats based on source graph matching.

[0044] The beneficial effects of this invention are as follows:

[0045] This invention provides an APT attack threat assessment method based on source graph matching. The method involves in-depth analysis of system logs, network traffic, and other data to identify how attackers gradually penetrate the system. It also combines threat scores from past attack events to comprehensively assess the threat level of the current event. This enables in-depth analysis and accurate detection of APT threat attack behavior.

[0046] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0047] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0048] Figure 1 This is a flowchart illustrating an APT attack threat assessment method based on source graph matching provided in an embodiment of the present invention.

[0049] Figure 2 This is a schematic diagram of tree structure decomposition provided in an embodiment of the present invention;

[0050] Figure 3 This is a schematic diagram of attack event scoring provided in an embodiment of the present invention. Detailed Implementation

[0051] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and do not limit the scope of the invention.

[0052] To address the shortcomings of existing APT attack detection methods, which struggle to cover the long lifecycle of APT attacks and effectively capture long-running system behavior, as well as the challenges of real-time detection due to the stealth of APT attacks and the difficulty in detecting anomalies in the early stages, and the fact that machine learning models may learn malicious behavior as normal behavior due to the long duration of APT attacks, thus affecting the accuracy and speed of attack detection, this invention provides an APT attack threat assessment method based on source graph matching. This source graph-based APT threat detection method combines the visualization, comprehensive recording, and sequence feature extraction techniques of source graphs, enabling in-depth analysis and accurate detection of APT threat attack behavior.

[0053] Specifically, see Figure 1 This invention provides a method for judging APT attack threats based on source graph matching, the method comprising:

[0054] S101. By analyzing and correlating various events and actions in a network attack, determine the causal relationships between various events and actions in a network attack, and construct the correlation source graph.

[0055] The source graph described in this invention primarily refers to a source relationship graph depicting the interactions between system objects. It is a comprehensive and visual tool for displaying network event information. It abstracts entities in the system (such as processes, files, and network ports) as nodes and the behaviors between entities as edges, thus encoding system behaviors into a directed, labeled graph with time information. No matter how covert or slow a threat attack may be, the corresponding nodes and causal relationships can be found in the source graph, enabling effective detection. The source graph contains rich system behavioral semantics and has strong correlation analysis capabilities, demonstrating excellent performance in detecting unknown threats, correlating alarms, and filtering false alarms. Therefore, research on APT attack detection methods based on source graph matching has significant theoretical and practical application value in the field of information security.

[0056] In specific implementation, this embodiment of the invention first acquires system event-related data and then preprocesses the acquired data. The preprocessing in this embodiment includes: cleaning, parsing, formatting, and noise removal of the data, and extracting key information, including: timestamps, IP addresses, and process IDs.

[0057] Specifically, the embodiments of the present invention utilize the causal inference model LDX to analyze and correlate the causal relationships between various events in a network attack, as well as the causal relationships between various events and actions; integrate the analyzed causal relationships to form a preliminary causal relationship network; and construct the source graph based on the causal relationship network.

[0058] S102. Using the graph kernel isomorphism algorithm, the associated source graph is matched with the source graph of historical attack events to obtain the similarity between each event and the historical events. The calculated similarity is set as a genetic factor.

[0059] Specifically, in this embodiment of the invention, two source graphs G1(V1,E1) and G2(V2,E2) are defined, and a graph decomposition method F is designed. The decomposed substructure is as follows:

[0060] The kernel values ​​of G1 and G2 are represented as follows: Where δ is in S 1,n1 and S 2,n2 The value is 1 when they are isomorphic and 0 when they are not.

[0061] Encode the node labels of the source graph structure and construct a dictionary to store the mapping relationship between labels and codes;

[0062] Based on the decomposition of nodes in the source graph, each node is decomposed into a tree structure containing all its adjacent nodes, with each node as the root node.

[0063] A new code is generated by using the labels of the root node and its neighboring nodes, and the label of the root node is updated to the new code through a preset hash operation.

[0064] Based on all the decomposed substructures, update the encoding of each node in the original source graph structure to obtain a new node encoding sequence.

[0065] The decomposed subtree structure is as follows:

[0066] The original node encoding is:

[0067] The updated node encoding is:

[0068]

[0069] Each node's updated code contains information about its subtree structure, and through multiple iterations, each iteration includes more information. When two nodes have the same updated code, their subtree structures are isomorphic, that is:

[0070] Two updated encoding sequences are obtained using the above decomposition method. and The similarity between two source maps is transformed into the similarity between two coding sequences. The kernel value is calculated using Jaccard similarity and defined as a hereditary factor.

[0071] S103. The real-time source map is scored based on the genetic factors and the threat scores of historical attack events, and the individual events associated with the source map are scored to obtain the threat assessment score of the attack event. The threat level of the current event is determined based on the threat assessment score.

[0072] That is, in this embodiment of the invention, all input events are assigned an initial extremely low threat level. Based on the matching result F, a genetic factor score is calculated for each successfully matched attack event. The final score is then normalized and used as the threat level score of the attack event.

[0073] As can be seen from the above, the embodiments of the present invention identify how attackers penetrate the system step by step by conducting in-depth analysis of data such as system logs and network traffic, and combine the threat scores of past attack events to comprehensively judge the threat level of the current event, thereby accurately and quickly identifying and detecting attacks.

[0074] The following will combine Figure 1 , Figure 2 and Figure 3 The method described in the embodiments of the present invention will be explained and illustrated in detail through a specific example:

[0075] See Figure 1 This invention provides a method for judging APT attack threats based on source graph matching, including:

[0076] Source graph construction based on causal relationships involves analyzing and correlating various events and actions in a cyberattack to reveal the causal relationships between them, thus obtaining a correlated source graph.

[0077] The source graph matching based on graph kernel isomorphism algorithm, specifically, uses graph kernel isomorphism algorithm to match the associated source graph with the source graph of historical attack events, obtains the similarity between each event and the historical events, and defines the similarity as a genetic factor;

[0078] The attack threat assessment based on genetic coverage, that is, the embodiments of the present invention score the real-time source map based on the threat scores of genetic factors and historical attack events, and score the individual events associated with the source map to obtain the threat assessment score of the attack event.

[0079] The following will provide a detailed explanation and description of each step in the embodiments of the present invention:

[0080] Step 101: Construct a causal origin graph.

[0081] Specifically, in this embodiment, the process for constructing a causal origin graph is as follows: First, collect system event-related data and perform data preprocessing; then, associate the related events to construct an origin graph, specifically including:

[0082] S1. Collect data such as various security events, network traffic, system logs, and application logs that occur in the network environment and system activities;

[0083] S2. Clean, parse, and format the collected raw data, including removing noisy data and extracting key information (timestamps, IP addresses, process IDs, etc.);

[0084] S3. Based on the preprocessed data, analyze the causal relationships between events using the causal inference model (LDX model);

[0085] S4. Integrate the causal relationships obtained from the analysis to form a preliminary causal relationship network;

[0086] S5. Construct a source graph based on the causal relationship network.

[0087] Once the source graph is constructed, the source graph G is output for use by subsequent matching methods.

[0088] Step 102: Source graph matching based on graph kernel isomorphism algorithm.

[0089] In this specific implementation, the source graph matching based on the graph kernel isomorphism algorithm is processed as follows: After obtaining the source graph, the obtained source graph is matched with the source graphs of historical attack events using the graph kernel isomorphism algorithm. The graph kernel isomorphism algorithm directly targets graph structure data, retaining the advantages of efficient kernel function computation while also incorporating the structured information of graph data in the Hilbert high-dimensional space. Different graph kernels are used for different graph structures. By mapping the graph to a unified space, the similarity is calculated using the inner product of the graphs. The specific steps are as follows:

[0090] S1. Given two graphs G1(V1,E1) and G2(V2,E2), design a graph decomposition method F, with the following substructure:

[0091]

[0092] S2. Based on the above substructure, the kernel values ​​of G1 and G2 can be expressed as:

[0093]

[0094] Where δ is in S 1,n1 and S 2,n2 A value of 1 indicates isomorphism, while a value of 0 indicates non-isomorphism. Therefore, any combination of graph decomposition methods and substructure isomorphism judgment methods can define a new graph kernel.

[0095] S3. Taking a subtree-based graph kernel as an example, the node labels of the graph structure are encoded (e.g., A: #1000), and a dictionary is constructed to store the mapping relationship between the labels and the encodings;

[0096] S4. Graph-based node decomposition: Using each node as the root, decompose it into a tree structure containing all its neighboring nodes, as follows:

[0097] Decompose the tree structure of a node v (labeled A). Based on adjacency relationships, v has two adjacent nodes: (labeled C) and (Labeled as B), the tree structure derived from v decomposition is as follows: Figure 2 As shown;

[0098] S5. Based on the decomposed tree structure and the mapping between labels and codes, define a hash operation, such as a combination of bitwise operations, to generate a new code using the label codes of the root node and its adjacent nodes, and update the label code of the root node to the new code;

[0099] S6. Update the encoding of each node in the original graph structure based on all the decomposed substructures to obtain a new node encoding sequence;

[0100] The decomposed subtree structure is as follows:

[0101]

[0102] The original node encoding is as follows:

[0103]

[0104] The updated node encoding is as follows:

[0105]

[0106] Each updated node's code contains information about its subtree structure, and this process can be iterated multiple times, with each iteration containing more information. For example, the first update includes information about its directly adjacent nodes, while the second iteration includes information about directly adjacent nodes and nodes with a 1-bit gap, and so on. Because it's a hash function, we can assume that when two nodes have the same updated code, their subtree structures are isomorphic, i.e.:

[0107]

[0108] Finally, the above decomposition method is used to obtain two updated encoding sequences. and The similarity between the two source maps can be transformed into the similarity between the two coding sequences. The kernel value is then calculated using Jaccard similarity and defined as a genetic factor.

[0109]

[0110] Step 103, attack threat assessment based on genetic coverage.

[0111] In this embodiment, the specific processing method for attack threat assessment based on genetic coverage is as follows: After completing the source map matching, the genetic coverage algorithm is used to score system events. First, all input events are assigned an initial, extremely low threat level (value 1) to ensure that no events are missed during source tracing.

[0112] Based on the matching result F, a weighted genetic factor score is calculated for each successfully matched attack event. The final score, after normalization, is taken as the threat score of that attack event. Figure 2 As shown.

[0113] The nodes on the left side of the diagram represent the logs of attack events in the source map. After scoring, they include threat score, type, source IP, destination IP, and time information. The nodes on the right side represent matching nodes for historical attack events, and their information includes threat score and type. Specifically, the red dashed outline of attack event logs 1-3 indicates that nodes 1-3 successfully match nodes 1-3 in the source map, and are assigned the same score of 6 points in the source map. Then, other attack event nodes that did not match are assigned a score that decreases linearly with distance.

[0114] Define the source graph set as A, a k Let A be the set of historical attack events, and R be the set of events. i For each attack event node in the source graph, the scoring steps are as follows:

[0115] S1. Choose a k All corresponding matching results F';

[0116] S2. Regarding the matching result [a] k ,r i ]∈F', from r i Select attack event log node n j ,j∈[1,len(r i )];

[0117] S3. Query historical attack events r i score i traversing r i All nodes, for a k The corresponding node is multiplied by the score and the genetic factor to obtain the initial similarity score. Unmatched related nodes are assigned a score that decreases linearly with distance d. d =score i -d;

[0118] S4. Repeat the above process until a is traversed completely. k The corresponding matching results;

[0119] S5. Regarding a k The node scores are normalized using the (0,1) normalization method. The node with the highest score is denoted as MAX, and the node with the lowest score is denoted as MIN. The score calculation method for each node is as follows:

[0120]

[0121] S6. Output the threat score of the attack event source map obtained by the genetic cover algorithm.

[0122] In addition, to ensure that relevant parts are not lost in subsequent long-term attack event correlations, individual attack events in the correlation results will be scored. The scoring process is as follows:

[0123] In specific implementation, this embodiment of the invention sets the set of individual attack event log nodes as S, and the set of IPs of attack events in the matching result set as F. IP The malicious IP set in the threat intelligence database is X. IP .

[0124] S1. Select node s k ∈S, obtain its attack event type and destination IP, denoted as a type `dip` records the node score (s) k );

[0125] S2. If dip in F IP or dip in X IP Continue; otherwise, return to S1, that is, reselect a node.

[0126] S3. If a is satisfied type In R, query historical attack events. i score(a) type ), for s k Add the score and continue; otherwise, return 1.

[0127] S4. Repeat S1-S3 until S is completed.

[0128] By scoring attack events using a genetic overlay algorithm, the results can help in assessing the threat of APT attacks.

[0129] In summary, this invention provides an APT attack threat assessment method based on source graph matching. The method described in this invention, through in-depth analysis of system logs, network traffic, and other data, identifies how attackers gradually penetrate the system and, combined with threat scores from past attack events, comprehensively assesses the threat level of the current event. This enables in-depth analysis and accurate detection of APT threat attack behavior.

[0130] Accordingly, embodiments of the present invention also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements any of the aforementioned methods for determining APT attack threats based on source graph matching. For further understanding of the relevant content of the storage medium embodiments of the present invention, please refer to the method embodiments of the present invention; detailed descriptions are not provided here.

[0131] The various embodiments in this description are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0132] Although preferred embodiments of the invention have been disclosed for illustrative purposes, those skilled in the art will recognize that various modifications, additions, and substitutions are possible, and therefore the scope of the invention should not be limited to the embodiments described above.

Claims

1. A method for judging APT attack threats based on source graph matching, characterized in that, The method includes: By analyzing and correlating various events and actions in a cyberattack, the causal relationships between these events and actions are determined, and a correlation-based source graph is constructed. Using the graph kernel isomorphism algorithm, the associated source graph is matched with the source graph of historical attack events to obtain the similarity between each event and the historical events. The calculated similarity is set as a genetic factor. The real-time source map is scored based on the genetic factors and the threat scores of historical attack events, and individual events associated with the source map are scored to obtain the threat assessment score of the attack event. The threat level of the current event is determined based on the threat assessment score. The process of analyzing and correlating various events and actions in a network attack to determine the causal relationships between them and constructing a correlated source graph includes: using the lightweight dual-execution engine LDX, a causal inference model, to analyze and correlate the causal relationships between various events and actions in the network attack; integrating the analyzed causal relationships to form a preliminary causal relationship network; and constructing the source graph based on the causal relationship network. The graph kernel isomorphism algorithm is used to match the associated source graph with the source graph of historical attack events to obtain the similarity between each event and the historical events. The calculated similarity is set as a genetic factor, including setting two source graphs. and And design a graph decomposition method F, the substructure after decomposition is: Will and The kernel value is represented as: Where δ is and The value is 1 when they are isomorphic and 0 when they are not. Encode the node labels of the source graph structure and construct a dictionary to store the mapping relationship between labels and codes; Based on the decomposition of nodes in the source graph, each node is decomposed into a tree structure containing all its adjacent nodes, with each node as the root node. A new code is generated by using the labels of the root node and its neighboring nodes, and the label of the root node is updated to the new code through a preset hash operation. Based on all the decomposed substructures, update the encoding of each node in the original source graph structure to obtain a new node encoding sequence. The decomposed subtree structure is as follows: ; The original node encoding is: ; The updated node encoding is: Each node's updated code contains information about its subtree structure, and through multiple iterations, each iteration includes more information. When two nodes have the same updated code, their subtree structures are isomorphic, that is: ; Two updated encoding sequences are obtained using the above decomposition method. The similarity between two source maps is transformed into the similarity between two coding sequences. The kernel value is calculated using Jaccard similarity and defined as a genetic factor.

2. The method according to claim 1, characterized in that, Prior to analyzing and correlating the various events and actions in a network attack, the method further includes: Acquire system event-related data and preprocess the acquired data.

3. The method according to claim 2, characterized in that, The preprocessing includes cleaning, parsing, formatting, and noise removal of the data, and extracting key information, including timestamps, IP addresses, and process IDs.

4. The method according to claim 1, characterized in that, Based on the decomposition of nodes in the source graph, each node is decomposed into a tree structure containing all its neighboring nodes, with each node as the root node. Decompose a node A tree structure labeled A, whose adjacency relationships are known. There are two adjacent nodes, namely The label is C, and The label is B.

5. The method according to any one of claims 1-4, characterized in that, The real-time attribution graph is scored based on the aforementioned genetic factors and the threat scores of historical attack events. Individual events associated with the attribution graph are also scored to obtain a threat assessment score for each attack event, including: All input events are assigned an initial, very low threat level. Based on the matching result F, a weighted genetic factor score is calculated for each successfully matched attack event. The final score is then normalized and used as the threat level score for that attack event.

6. The method according to claim 5, characterized in that, The process involves assigning an initial, extremely low threat level to all input events. Based on the matching result F, a weighted genetic factor score is calculated for each successfully matched attack event. The final score, after normalization, is taken as the threat level score for that attack event, including: Define the source graph set as A, and the source graph Let R be the set of historical attack events. The score for each attack event node in the source tracing graph includes: choose All corresponding matching results ; Regarding the matching results ,from Select attack event log node ; Query historical attack events fractions traversal All nodes, for The corresponding node is multiplied by the genetic factor to obtain a preliminary similarity score. Unmatched related nodes are assigned a bonus that decreases linearly with distance d. ; Until the traversal is complete The corresponding matching results; right The node scores are normalized using the (0, 1) normalization method. The highest score among the recorded nodes is denoted as MAX, and the lowest score is denoted as MIN. The formula for calculating the score of each node is as follows: ; Output the threat score of the attack event source map obtained by the genetic cover algorithm.

7. The method according to claim 6, characterized in that, The scoring of individual events associated with the source graph includes: Let S be the set of individual attack event log nodes, and let the set of IPs of the attack events in the matching result set be... The malicious IP set in the threat intelligence database is ; Select node Obtain the attack event type and destination IP, and record them as follows: Record node scores ; like If yes, continue; otherwise, select a new node. If satisfied Query historical attack events fractions ,for Add the score and continue; otherwise, reselect a node until all nodes in the individual attack event log node set have been scored.

8. A computer-readable storage medium storing a computer program that, when executed by a processor, implements the APT attack threat assessment method based on source graph matching as described in any one of claims 1-7.

Images