A method and apparatus for identifying APT group homology based on cryptographic elements
By constructing an APT encryption element feature library, matching and calculating the feature weight values and scores of encryption elements, the problem of tracing the source of APT attacks was solved, and rapid source tracing was achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- VIEWINTECH
- Filing Date
- 2024-12-13
- Publication Date
- 2026-05-26
AI Technical Summary
Existing technologies are insufficient for effectively tracing the origins of APT attacks, increasing the difficulty of tracing their origins.
By using a cryptographic element-based approach, an APT cryptographic element feature library is constructed. Cryptographic elements of the data to be attributed are extracted and matched, feature weight values and scores are calculated, and the name of the organization that launched the APT attack is determined.
It enables rapid attribution of APT attackers and reduces the difficulty of attribution.
Smart Images
Figure CN119853966B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of information security technology, and in particular to a method and apparatus for identifying the homology of APT organizations based on encryption elements. Background Technology
[0002] In recent years, Advanced Persistent Threat (APT) incidents have been on the rise, and APT attacks are increasingly becoming a significant threat to cyberspace that cannot be ignored. Compared to traditional network intrusion attacks, APT attacks are more covert, with longer attack durations and latency periods. Furthermore, APT groups frequently update or develop and use new tools to circumvent existing attribution methods, increasing the difficulty of tracing attackers.
[0003] Therefore, providing a method and apparatus for identifying the homology of APT organizations based on cryptographic elements, so as to enable rapid tracing of APT attackers and reduce the difficulty of tracing, has become an urgent problem to be solved by those skilled in the art. Summary of the Invention
[0004] This invention provides a method and apparatus for identifying the homology of APT organizations based on cryptographic elements. By identifying the homology, cryptographic elements of existing clues are extracted, matched with a feature library, and weighted according to a score, and finally the attribution result is obtained, so as to realize the rapid tracing of APT attackers and reduce the difficulty of tracing.
[0005] This invention provides a method for identifying the homology of APT organizations based on cryptographic elements, the method comprising:
[0006] Obtain N encrypted elements of the data to be attributed, where N is a positive integer;
[0007] Each of the encrypted elements is input into a pre-built APT encrypted element feature library. Each encrypted element is matched with the sample encrypted elements stored in the APT encrypted element feature library to obtain a feature weight value. When each encrypted element matches the encrypted elements in the APT encrypted element feature library, the match is considered successful.
[0008] Based on the feature weight values, the scores of each of the cryptographic elements in each APT organization are calculated. The cryptographic elements of each organization are pre-constructed APT features, and the elements to be attributed are unknown cryptographic elements. The APT organization to which an organization belongs is determined by calculating the scores of the cryptographic elements.
[0009] The maximum value among the scores of each of the encrypted elements is obtained. If the maximum value is greater than or equal to a preset threshold, the data to be attributed is determined to be an APT attack, and the name of the organization that launched the APT attack is output.
[0010] In some embodiments, the APT encryption element feature library is pre-built, specifically including:
[0011] Extract sample encryption elements from historical records;
[0012] Calculate the weight value for each of the encrypted elements in the sample;
[0013] The APT encryption element feature library is constructed based on the sample encryption elements and their corresponding weight values.
[0014] In some embodiments, a weight value for each of the sample encryption elements is calculated using a preset expression, wherein the preset expression is:
[0015]
[0016] Where α is a positive constant that controls the rate at which the weight changes with the number of APT organizations n that hit the feature, i.e., the magnitude of the change in the influence of n on the final weight value; n is the number of APT organizations that contain cryptographic feature features, and n is not 0; N is the total number of APT organizations in the APT cryptographic feature library.
[0017] In some embodiments, obtaining N encrypted elements of the data to be attributed specifically includes:
[0018] When an unknown malicious executable program is present, it can be run directly to obtain communication traffic and extract encrypted elements;
[0019] When an IOC such as an IP address or domain name is available, the encrypted elements of the server are obtained through mapping technology.
[0020] When there is existing network traffic, extract the encrypted elements from the existing network traffic.
[0021] In some embodiments, a score is calculated for each of the cryptographic elements in each organization, specifically including:
[0022] Target organization A[1] + Target organization A[2] + ... + Target organization A[N] = Target organization A score;
[0023] Target organization B[1] + Target organization B[2] + ... + Target organization B[N] = Target organization B score;
[0024] ...
[0025] Target organization M[1] + Target organization M[2] + ... + Target organization M[N] = Target organization M score;
[0026] Where 1, 2, ..., N refer to the feature number, and A, B, ..., M refer to the target organization number.
[0027] In some embodiments, the cryptographic elements include TLS features and certificate features.
[0028] The present invention also provides an APT organization homology identification device based on cryptographic elements, the device comprising:
[0029] The data acquisition unit is used to acquire N encrypted elements of the data to be attributed, where N is a positive integer;
[0030] The weight calculation unit is used to input each of the encrypted elements into a pre-built APT encrypted element feature library, and to match each of the encrypted elements with the sample encrypted elements stored in the APT encrypted element feature library to obtain a feature weight value. When each of the encrypted elements is consistent with the encrypted elements in the APT encrypted element feature library, it is considered a successful match.
[0031] The scoring unit is used to calculate the score of each of the cryptographic elements in each APT organization based on the feature weight values. The cryptographic elements of each organization are pre-constructed APT features, and the attributed elements are unknown cryptographic elements. The APT organization to which an element belongs is determined by calculating the score of the cryptographic elements.
[0032] The result generation unit is used to obtain the maximum value among the scores of each of the encrypted elements, and if the maximum value is greater than or equal to a preset threshold, to determine that the data to be attributed is an APT attack, and to output the name of the organization that launched the APT attack.
[0033] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described above.
[0034] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described above.
[0035] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the method described above.
[0036] The present invention provides an APT organization homology identification method based on cryptographic elements. This method acquires N cryptographic elements from the data to be attributed, inputs each cryptographic element into a pre-constructed APT cryptographic element feature library, and matches each cryptographic element with sample cryptographic elements stored in the library to obtain feature weight values. Based on these feature weight values, a score is calculated for each cryptographic element within each APT organization. The maximum score of each cryptographic element is obtained, and if the maximum score is greater than or equal to a preset threshold, the data to be attributed is determined to be an APT attack, and the name of the APT attacking organization is output. Thus, the APT organization homology identification method and apparatus based on cryptographic elements, through homology identification, extracts cryptographic elements from existing clues, matches them against a feature library, and adds weights to obtain the final attribution result, thereby enabling rapid tracing of APT attackers and reducing the difficulty of tracing. Attached Figure Description
[0037] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.
[0038] Figure 1 This is a flowchart of the APT organization homology identification method based on cryptographic elements provided by the present invention;
[0039] Figure 2 This is a structural block diagram of the APT organization homology identification device based on encryption elements provided by the present invention;
[0040] Figure 3 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation
[0041] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.
[0042] This invention proposes a method for identifying the homology of APT organizations based on cryptographic elements. Based on attack traffic captured on the live network, traffic acquired through the execution of attack weapons, and cryptographic element information obtained by mapping existing IOCs, a feature library is constructed by extracting cryptographic elements belonging to each organization, including TLS features and certificate features. Weights are calculated based on feature repetition and directly assigned based on expert experience. In practical applications, homology analysis is performed, and cryptographic elements with existing clues are matched against the feature library, with additional weights added to arrive at the final attribution result.
[0043] In one specific embodiment, the APT organization homology identification method based on cryptographic elements provided by the present invention includes the following steps:
[0044] S110: Obtain N encrypted elements of the data to be attributed, where N is a positive integer; specifically, when there is an unknown malicious executable program, directly run to obtain communication traffic and extract encrypted elements; when there is an IOC such as an IP or domain name, obtain server-side encrypted elements through mapping technology; when there is existing network traffic, extract the encrypted elements from the existing network traffic.
[0045] S120: Input each of the encrypted elements into the pre-built APT encrypted element feature library, and match each of the encrypted elements with the sample encrypted elements stored in the APT encrypted element feature library to obtain the feature weight value. When each of the encrypted elements is consistent with the encrypted elements in the APT encrypted element feature library, it is considered a successful match.
[0046] S130: Based on the feature weight values, calculate the score of each of the cryptographic elements in each APT organization. The cryptographic elements of each organization are pre-constructed APT features, and the elements to be attributed are unknown cryptographic elements. The APT organization to which an element belongs is determined by calculating the score of the cryptographic elements. The specific calculation method is as follows:
[0047] Target organization A[1] + Target organization A[2] + ... + Target organization A[N] = Target organization A score;
[0048] Target organization B[1] + Target organization B[2] + ... + Target organization B[N] = Target organization B score;
[0049] ...
[0050] Target organization M[1] + Target organization M[2] + ... + Target organization M[N] = Target organization M score;
[0051] Wherein, 1,2,...,N refers to the feature number, A,B,...,M refers to the target organization number; target organization A[1] represents the weight value of feature 1 in organization A.
[0052] S140: Obtain the maximum value among the scores of each encrypted element. If the maximum value is greater than or equal to a preset threshold, determine that the data to be attributed is an APT attack, and output the name of the organization that launched the APT attack. Based on the scores of each encrypted element, output and determine whether max[Organization A score, Organization B score, ... Organization M score] reaches a preset threshold. If the maximum score does not reach the preset threshold, output that it is not an APT attack; if it exceeds the preset threshold, output the name of the organization with the highest score. The preset threshold can be, for example, inputting 1000 malicious Trojan test traffic, including 100 APT attack traffic, calculating the lowest score of the APT attack traffic and the highest score of other malicious Trojan traffic, and taking the larger of the two scores as the expected APT alarm threshold.
[0053] In some embodiments, the APT encryption element feature library is pre-built, specifically including:
[0054] Extract sample encryption elements from historical records, including TLS features and certificate features;
[0055] Calculate the weight value for each of the encrypted elements in the sample;
[0056] The APT encryption element feature library is constructed based on the sample encryption elements and their corresponding weight values.
[0057] Specifically, when constructing the encrypted element feature library, encrypted elements can be extracted from three channels: historically accumulated live network captured attack traffic, attack weapon execution traffic, and spatial mapping. The encrypted elements to be extracted are shown in Table 1 below:
[0058] Table 1. Explanation of Encryption Element Values
[0059]
[0060]
[0061] After constructing a feature library based on the extracted cryptographic elements, the weight of each cryptographic element accumulated by each APT organization is calculated according to the following formula. α is a positive constant that controls the rate at which the weight changes with the number of APT organizations (n) that hit the feature, i.e., the magnitude of n's influence on the final weight value; n is the number of APT organizations containing the cryptographic element feature, and n is not zero; N is the total number of APT organizations in the library. The formula for calculating the weight value is:
[0062]
[0063] In this context, α takes 100 average values between 0 and 1 (0.01, 0.02, ..., 0.99), N is 20, and n is an integer between 1 and 10. The influence of each α value on the final weight value is calculated, a curve is plotted, and the value of α corresponding to the case where the curve is in the middle is taken.
[0064] In the above specific embodiments, the APT organization homology identification method based on encryption elements provided by the present invention obtains N encryption elements of the data to be attributed, inputs each encryption element into a pre-constructed APT encryption element feature library, matches each encryption element with sample encryption elements stored in the APT encryption element feature library to obtain feature weight values, calculates the score of each encryption element in each APT organization based on the feature weight values, obtains the maximum value among the scores of each encryption element, and if the maximum value is greater than or equal to a preset threshold, determines that the data to be attributed is an APT attack, and outputs the name of the APT attack organization. Thus, the APT organization homology identification method and apparatus based on encryption elements, through homology identification, extracts encryption elements of existing clues, matches them according to the feature library, and adds scores according to weights, ultimately obtaining the attribution result, thereby achieving rapid tracing of APT attackers and reducing the difficulty of tracing.
[0065] In addition to the methods described above, this invention also provides an APT organization homology identification device based on cryptographic elements, such as... Figure 2 As shown, the device includes:
[0066] The data acquisition unit 210 is used to acquire N encrypted elements of the data to be attributed, where N is a positive integer;
[0067] The weight calculation unit 220 is used to input each of the encrypted elements into a pre-built APT encrypted element feature library, and to match each of the encrypted elements with the sample encrypted elements stored in the APT encrypted element feature library to obtain a feature weight value. When each of the encrypted elements is consistent with the encrypted elements in the APT encrypted element feature library, it is considered a successful match.
[0068] The scoring calculation unit 230 is used to calculate the score of each of the cryptographic elements in each organization based on the feature weight value. The cryptographic elements of each organization are pre-constructed APT features, and the attributed elements are unknown cryptographic elements. The APT organization to which the cryptographic elements belong is determined by calculating the cryptographic element scores.
[0069] The result generation unit 240 is used to obtain the maximum value among the scores of each of the encrypted elements, and if the maximum value is greater than or equal to a preset threshold, to determine that the data to be attributed is an APT attack, and to output the name of the organization that launched the APT attack.
[0070] In some embodiments, the APT encryption element feature library is pre-built, specifically including:
[0071] Extract sample encryption elements from historical records;
[0072] Calculate the weight value for each of the encrypted elements in the sample;
[0073] The APT encryption element feature library is constructed based on the sample encryption elements and their corresponding weight values.
[0074] In some embodiments, a weight value for each of the sample encryption elements is calculated using a preset expression, wherein the preset expression is:
[0075]
[0076] Where α is a positive constant that controls the rate at which the weight changes with the number of APT organizations n that hit the feature, i.e., the magnitude of the change in the influence of n on the final weight value; n is the number of APT organizations that contain cryptographic feature features, and n is not 0; N is the total number of APT organizations in the APT cryptographic feature library.
[0077] In some embodiments, obtaining N encrypted elements of the data to be attributed specifically includes:
[0078] When an unknown malicious executable program is present, it can be run directly to obtain communication traffic and extract encrypted elements;
[0079] When an IOC such as an IP address or domain name is available, the encrypted elements of the server are obtained through mapping technology.
[0080] When there is existing network traffic, extract the encrypted elements from the existing network traffic.
[0081] In some embodiments, a score is calculated for each of the cryptographic elements in each organization, specifically including:
[0082] Target organization A[1] + Target organization A[2] + ... + Target organization A[N] = Target organization A score;
[0083] Target organization B[1] + Target organization B[2] + ... + Target organization B[N] = Target organization B score;
[0084] ...
[0085] Target organization M[1] + Target organization M[2] + ... + Target organization M[N] = Target organization M score;
[0086] Where 1, 2, ..., N refer to the feature number, and A, B, ..., M refer to the target organization number.
[0087] In some embodiments, the cryptographic elements include TLS features and certificate features.
[0088] In the above specific embodiments, the APT organization homology identification device based on encryption elements provided by the present invention acquires N encryption elements of the data to be attributed, inputs each encryption element into a pre-constructed APT encryption element feature library, matches each encryption element with sample encryption elements stored in the APT encryption element feature library to obtain feature weight values, calculates the score of each encryption element in each APT organization based on the feature weight values, obtains the maximum value among the scores of each encryption element, and if the maximum value is greater than or equal to a preset threshold, determines that the data to be attributed is an APT attack, and outputs the name of the APT attack organization. Thus, the APT organization homology identification method and device based on encryption elements, through homology identification, extracts encryption elements of existing clues, matches them according to the feature library, and adds scores according to weights, ultimately obtaining the attribution result, thereby achieving rapid tracing of APT attackers and reducing the difficulty of tracing.
[0089] Figure 3 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 3 As shown, the electronic device may include a processor 310, a communications interface 320, a memory 330, and a communication bus 340, wherein the processor 310, the communications interface 320, and the memory 330 communicate with each other via the communication bus 340. The processor 310 can call logical instructions in the memory 330 to execute the above-described method.
[0090] Furthermore, the logical instructions in the aforementioned memory 330 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0091] On the other hand, the present invention also provides a computer program product, the computer program product including a computer program that can be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer is able to perform the above-described method.
[0092] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.
[0093] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.
[0094] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A method for identifying the homology of APT organizations based on cryptographic elements, characterized in that, The method includes: Obtain N encrypted elements of the data to be attributed, where N is a positive integer; Each of the encrypted elements is input into a pre-built APT encrypted element feature library. Each encrypted element is matched with the sample encrypted elements stored in the APT encrypted element feature library to obtain a feature weight value. When each encrypted element matches the encrypted elements in the APT encrypted element feature library, the match is considered successful. Based on the feature weight values, the scores of each of the cryptographic elements in each APT organization are calculated. The cryptographic elements of each organization are pre-constructed APT features, and the elements to be attributed are unknown cryptographic elements. The APT organization to which an organization belongs is determined by calculating the scores of the cryptographic elements. The maximum value among the scores of each of the encrypted elements is obtained. If the maximum value is greater than or equal to a preset threshold, the data to be attributed is determined to be an APT attack, and the name of the organization that launched the APT attack is output. Specifically, the pre-construction of the APT encryption element feature library includes: Extract sample encryption elements from historical records; Calculate the weight value for each of the encrypted elements in the sample; The APT encryption element feature library is constructed based on the sample encryption elements and their corresponding weight values; The weight value of each encrypted element of the sample is calculated using a preset expression, which is: Where α is a positive constant that controls the rate at which the weight changes with the number of APT organizations n that hit the feature, i.e., the magnitude of the change in the influence of n on the final weight value; n is the number of APT organizations that contain cryptographic feature features, and n is not 0; N is the total number of APT organizations in the APT cryptographic feature library.
2. The method for identifying the homology of APT organizations based on encrypted elements according to claim 1, characterized in that, Obtain N encrypted elements of the data to be attributed, specifically including: When an unknown malicious executable program is present, it can be run directly to obtain communication traffic and extract encrypted elements; When an IOC such as an IP address or domain name is available, the encrypted elements of the server are obtained through mapping technology. When there is existing network traffic, extract the encrypted elements from the existing network traffic.
3. The method for identifying the homology of APT organizations based on encrypted elements according to claim 1, characterized in that, Calculate the score for each of the cryptographic elements in each organization, specifically including: Target organization A[1] + Target organization A[2] + ... + Target organization A[N] = Target organization A score; Target organization B[1] + Target organization B[2] + ... + Target organization B[N] = Target organization B score; Target organization M[1] + Target organization M[2] + ... + Target organization M[N] = Target organization M score; Where 1, 2, ..., N refer to the feature number, and A, B, ..., M refer to the target organization number.
4. The method for identifying the homology of APT organizations based on encrypted elements according to claim 1, characterized in that, The encryption elements include TLS features and certificate features.
5. An APT organization homology identification device based on cryptographic elements, used to implement the method as described in any one of claims 1-4, characterized in that, The device includes: The data acquisition unit is used to acquire N encrypted elements of the data to be attributed, where N is a positive integer; The weight calculation unit is used to input each of the encrypted elements into a pre-built APT encrypted element feature library, and to match each of the encrypted elements with the sample encrypted elements stored in the APT encrypted element feature library to obtain a feature weight value. When each of the encrypted elements is consistent with the encrypted elements in the APT encrypted element feature library, it is considered a successful match. The scoring unit is used to calculate the score of each of the cryptographic elements in each APT organization based on the feature weight values. The cryptographic elements of each organization are pre-constructed APT features, and the attributed elements are unknown cryptographic elements. The APT organization to which an element belongs is determined by calculating the score of the cryptographic elements. The result generation unit is used to obtain the maximum value among the scores of each of the encrypted elements, and if the maximum value is greater than or equal to a preset threshold, to determine that the data to be attributed is an APT attack, and to output the name of the organization that launched the APT attack.
6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1 to 4.
7. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 4.
8. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 4.