Non-cooperative network attack tracing method based on multiple stages

Abstract

The invention relates to the technical field of network security, in particular to a non-cooperative network attack tracing method based on multiple stages. The method comprises the following steps: providing security verification for network equipment and a terminal in a traceability process based on a collaborative authentication code, and ensuring credibility and integrity of the traceability process; converting the network attack into behavior feature data based on the feature extraction of the attack behavior; extracting event-level features, revealing a sequential relationship and a dependency relationship of attack behaviors, and identifying a potential attack mode; performing time alignment on the events by using causal analysis to form a standardized causal chain; performing multi-dimensional feature fusion in combination with a Transform network and an NLP pre-training model, and identifying an attack mode; an IP address database, a self-built organization library and a code author library are combined, and a multi-cascade CNN structure is adopted to carry out attack source positioning and attacker tracing. According to the invention, through multi-level feature analysis, accurate identification and traceability of complex network attacks are realized.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a multi-stage non-cooperative network attack tracing method. Background Art

[0002] With the rapid development and widespread application of network technology, network security issues have received increasing attention. Network attack behaviors are becoming increasingly complex and covert. Traditional single information source analysis methods have certain limitations in dealing with these attacks. In order to fully perceive and analyze attack behaviors, multi-source information fusion technology has become one of the important directions of network attack tracing research. By integrating information from different dimensions, such as network traffic logs, system event records, host behavior logs and threat intelligence data, cross-source correlation analysis and deep mining can be achieved, providing important support for revealing attack paths, identifying attackers' identities and their behavior patterns. This technology provides a reliable technical foundation for tracking the source of network attacks, threat assessment and defense strategy formulation.

[0003] However, existing network attack tracing technologies still face some challenges in their application: first, current technologies often have certain limitations in the use of information sources, and a single data source is difficult to fully reflect the full picture of attack behaviors; second, traditional rule-based analysis methods show certain deficiencies in the correlation analysis of multi-source data, especially when dealing with complex attack behaviors across levels, time, and regions. It is difficult to effectively extract attack paths and key nodes; in addition, existing technologies face certain challenges in dealing with dynamically changing attack behaviors and tracing tasks with high real-time requirements; finally, the adaptability of the tracing model to new or variant attacks needs to be improved.

[0004] Based on this, there is an urgent need for a network attack tracing technology based on multi-source information fusion, which can further improve the accuracy, real-time and adaptability of tracing technology through deep fusion and intelligent analysis of multi-dimensional data. Summary of the invention

[0005] The purpose of the present invention is to propose a multi-stage non-cooperative network attack tracing method to address the problems existing in the background technology.

[0006] The technical solution of the present invention is a multi-stage non-cooperative network attack source tracing method, which includes the following specific implementation steps: S1. Construct a multi-stage non-cooperative network attack tracing system, including: data collection module, feature extraction module, context alignment module, deep learning analysis module and tracing analysis module; S2. By integrating external threat intelligence and internal information, the threat database Threat_DB and security situation map SS_DB are constructed, and a collaborative authentication code is generated; S3. Perform credibility verification by extracting collaborative authentication codes from threat libraries and security situation maps, analyze the gene-level features of malicious code, clean system logs and extract system log-level features, identify abnormal behaviors, and analyze event-level features. By building entity relationship diagrams, deeply explore attack paths between entities and identify attack behaviors. S4. Align events through time sorting and causal relationship analysis to generate structured causal chain data. Use the Transformer network to convert the causal chain data into processable basic grammatical units. Generate input matrix through time position encoding and feature embedding. Use multi-head attention mechanism to capture the relationship between events. Finally, predict attack mode through the fully connected layer and output corresponding attack features. S5. Based on the tracing of regions, organizations, and attackers, we use the IP address database, self-built organization library, and code author library, combined with a multi-cascade convolutional neural network structure, to build a tracing model, and ultimately trace the attack back to the source region, organization, and attacker.

[0007] Preferably, the construction process of the threat database Threat_DB and the security situation map SS_DB is as follows: S21. External knowledge includes security intelligence from public and private sources, including: Public threat intelligence platforms: including VirusTotal (VT), AlienVaultOTX (AV_OTX), and MISP (MISP platform); Security communities and forums: including ExploitDatabase, EDB and other vulnerability disclosure sites; Network security vendors: including security reports released by Palo Alto Networks (PAN), FireEye (FE), and Kaspersky (KAS); Based on this, the threat library Threat_DB is constructed: ; S22. Internal information is core data collected directly from internal networks and systems, including: System logs: from the operating system WindowsEventLog, namely WEL, LinuxSyslog, namely LS, database audit log DB_AUDIT, firewall log FW_LOG, and intrusion detection system log IDS_LOG; Network flow records: NF, packet capture files (including PCAP in pcap format), and router communication records (RT_LOG) are recorded through NetFlow; User behavior data: monitored by the terminal, including UserBehaviorAnalytics, i.e. login time, access records and operation behaviors collected by UBA and identity authentication system IAM; Access Control List (ACL): A set of rules that provide access rights to system resources. System configuration and status information: including host configuration file CFG, network topology information TOPO, system version number SYS_VER, and installed patch list PATCHES; Based on this, the internal security situation map SS_DB is constructed: .

[0008] Preferably, the code gene level feature construction process is as follows: S31. The data comes from known malicious code samples in Threat_DB. If the sample is a binary file, use the disassembly tool to extract the pseudo code. If it is a script or source code, use it directly as input. S32. Standardize codes from different sources into text code form, and organize the suspicious code snippets triggered by malicious traffic behaviors recorded in IDS_LOG in SS_DB and the suspicious payloads extracted by decoding in PCAP files into independent code modules; Among them, if the extracted code fragment is a binary code, it is first disassembled; S33, perform lexical analysis on the standardized text code, extract the basic grammatical unit Token, and use the parser defined by the context-free grammar to generate an abstract syntax tree AST; S34. By calculating the maximum depth of AST, counting the number of function definition FunctionDef and class definition ClassDef nodes in AST, the code structure feature C_Struct is obtained; searching for function call expression Call type nodes in AST, extracting the names and order of called functions, building a call relationship graph CallGraph, and forming a function call pattern C_Func_Call; locating Call nodes, screening external application programming interface API calls, extracting parameter features, and forming API usage habits C_API_Use; S35. Extract all Name nodes in AST to analyze variable naming styles, detect the number of comment nodes, analyze comment coverage, and form a coding style feature C_Style; locate encryption function call nodes in AST, analyze encryption algorithm names and parameters to form encryption algorithm features C_Enc_Algo; search for function calls involving network communication in AST, extract parameters, parse communication protocol types, and form network protocol features C_Prpto; S36. Construct AST method to extract code gene-level features C_AST: .

[0009] Preferably, the process of extracting system log-level features is as follows: S41. Extract some basic information directly from SS_DB as the basic features F for model training, including source IP, i.e. src_ip, destination IP, i.e. dst_ip, port number, host, user, traffic pcap, process, and file, i.e.: F={src_ip, dst_ip, port, host, user, pcap, process, file}; S42. By analyzing the information in SS_DB, abnormal time characteristics, abnormal login times, abnormal event times, abnormal connection times, and malicious traffic label characteristics are formed: S4201, abnormal time feature: analyze the event timestamps recorded in the log, identify the event distribution of high frequency or abnormal time period, and form the abnormal time feature U_Time; S4202, abnormal login times feature: in the log, count the number of user login failures and success rates to identify abnormal login behavior, and form an abnormal login times feature U_Login accordingly; S4203, abnormal event frequency feature: extract the records marked as "Error" or "Warning" in the log, count the frequency and type of abnormal events, and form the abnormal event frequency feature U_Case; S4204, abnormal connection frequency feature: count the connection frequency of each IP to form an abnormal connection frequency feature U_Corn; S4205, malicious traffic label feature: discover problems by performing a simple analysis of the traffic rate and packet size, and generate a malicious traffic label feature U_Flow; S43. Generate system log-level features OSL={F, U_Time, U_Login, U_Case, U_Corn, U_Flow}.

[0010] Preferably, the event-level feature construction process is as follows: S51, extracting relational analysis level features, including: system log, database audit log DB_AUDIT, network traffic record PCAP, NF, access control list ACL and configuration file CFG; S52. Build an entity relationship graph, parse the log data into entities and their relationships, and use Neo4j tools to detect common malicious behavior patterns in the triple relationship graph, including: Lateral movement mode: the connection path from a low-privilege host to a high-privilege host, marking abnormal behavior Lat_Mov_Mode; Permission abuse mode: high-privilege users access sensitive files or configurations. By storing user permissions and file sensitivity as node attributes, rule-based matching is used to mark the matching behavior as Rel_Priv_Abuse; Malware propagation mode: one process connects to multiple hosts, marking abnormal behavior as Malware_Propagation; Command and control center C&C communication mode: The host repeatedly communicates with the malicious IP address recorded in the threat library Threat_DB, extracts the communication relationship graph from the network traffic log, and uses the frequent subgraph mining algorithm gSpan algorithm to match the frequent subgraph pattern in the communication relationship graph. If the subgraph pattern meets the preset C&C communication feature template, it is marked as C&C_Communication; Covert tunnel communication mode: the connection path with abnormal traffic volume is marked as Covert_Tunnel; S53, perform statistical analysis on the relationship graph and extract characteristic indicators: relationship density, centrality index, and path characteristics; S54, generating relational pattern features Rel_Patterns, key entity features key_entities, and graph structure features Rel_Graph_Struct from relational analysis; Rel_Patterns={Lat_Mov_Mode,Rel_Priv_Abuse,Malware_Propagation,C&C_Communication,Covert_Tunnel}; S55. Generate event-level features EF={Rel_Patterns, key_entities, Rel_Graph_Struct}.

[0011] Preferably, the collaborative authentication code generation process is as follows: S61, converting the data in the threat database Threat_DB into a binary data string sequence data1 and converting the data in the internal security situation map SS_DB into a binary data string sequence data2; S62, calculation-assisted generation parameter Pa=H(data1||data2); Where H is a predefined hash function, H: {0,1} k →G; k represents a predefined security parameter; G is a cyclic group whose order is a prime number q; || is a string concatenation symbol; S63, calculate collaborative authentication code Ca = (Pa) α ; Among them, α is the predefined authentication generation parameter, x∈Z p ; Z p is the ring of integers modulo p.

[0012] Preferably, the verification process of performing credibility verification by extracting the collaborative authentication code of the threat library and the security situation map is as follows: S71, extracting data from the threat database Threat_DB and the internal security situation map SS_DB, converting the threat database Threat_DB into a binary data string sequence data1 and converting the internal security situation map SS_DB into a binary data string sequence data2; S72, calculate the first-order analytical parameter Pe1=e(Ca,g); Where e is a predefined bilinear mapping, e: G×G→G T ; G T is a predefined cyclic group; g is a generator of a predefined q-order cyclic group; S73, calculate the second-order analytical parameter Pe2=e(H(data1||data2),β); Among them, β is the analytical code, β=g α ; H is a predefined hash function; || is a string concatenation symbol; S74. If Pe1=Pe2, the verification passes.

[0013] Preferably, the implementation process based on tracing the region, organization, and attacker source is as follows: S81. Build databases, including: IP address geographic location database, self-built organization database, and code author database; S82, Feature Fusion: Treat each piece of training data and its newly added regional dimension, organizational information dimension, code author information, existing attack pattern recognition output, and malicious code gene-level features as a piece of structured semantic information, and use natural language processing (NLP) methods for unified modeling and fusion; S83. Construct a multi-cascade composite CNN model TriCascadeCNN, which effectively integrates the convolution decomposition neural network and the deep separable convolution neural network to form a three-layer cascade composite structure unit: During the convolution process, the composite CNN structure uses the convolution decomposition neural network to perform preliminary convolution processing on the input feature map to extract basic features; the feature extraction is further refined through the deep separable convolution to generate the final output feature map; S84. In the process of attack tracing, for different tracing objects, a multi-cascade composite CNN model TriCascadeCNN is used to perform semantic modeling and deep feature extraction on the above features to obtain a comprehensive representation of the tracing task: Z = TriCascadeCNN(T); In the formula, T represents input data, i.e., various information related to attack events; Z represents the comprehensive representation vector of attack events; S8401, Regional tracing: The geographic information extracted from the geographic location database is combined with the output of the TriCascadeCNN model to identify the source area of ​​the attack incident: region =Softmax(W region Z+b region ); Where P region represents the regional distribution probability of attack events; W region represents the weight matrix; b region represents the bias vector; S8402, Organization Tracing: Based on the information in the self-built organization database, identify and classify related organizations through matching organizational information dimension characteristics and attack patterns: P Org =Softmax(W Org Z+b Org ); Where P Org W represents the probability vector of the organization category involved in the attack event; Org represents the weight matrix; b Org represents the bias vector; Based on this model, potential organizational categories and their associated network behaviors are output; S8403, Attacker tracing: Through the code author library and code gene matching technology, extract the potential attacker profile, specifically: Code gene matching: Calculate the similarity between the malicious code features in the attack event and the samples in the code author library, and use the similarity threshold Th=0.7 to identify potential attackers; Attacker classification: Combine the information of potential attackers with the output of the TriCascadeCNN model to construct an attacker profile: P Attacker =Softmax(W Attacker Z+b Attacker ); Where P Attacker W represents the attacker's identity information and its correlation score vector with the event; Attacker represents the weight matrix; b Attacker represents the bias vector; Based on this: Output the identity information of the potential attacker and its correlation score with the incident.

[0014] Preferably, the fusion process of unified modeling and fusion using natural language processing (NLP) method is as follows: S91, structurally describing each dimension of information in each piece of training data, and converting it into a pseudo natural language text in a templated manner; S92. For the generated pseudo natural language text, a pre-trained language model is used for encoding, deep semantic features are extracted, the high-dimensional data of the language expression is mapped to a unified vector space, a semantic representation vector is generated, and the fusion of features of different dimensions is completed.

[0015] Preferably, a multi-stage non-cooperative network attack tracing system includes: Data collection module, used to collect internal log information and external threat intelligence to form a complete data set; Feature extraction module, used to extract code gene-level features, system log-level features and event-level features from code, system logs and event-level behaviors, and construct attack behavior patterns; The context alignment module is used to align the time series of attack events based on the causal analysis method and generate a standardized causal chain; The deep learning analysis module uses the Transformer network structure and the NLP pre-training model to perform fusion analysis on multi-dimensional features and realize attack pattern recognition; The source tracing analysis module is used to use the IP address database, self-built organization library and code author library, combined with a multi-cascade CNN structure, to ultimately trace the attack source area, organization and attacker.

[0016] Compared with the prior art, the above technical solution of the present invention has the following beneficial technical effects: The present invention designs a multi-stage non-cooperative network attack tracing method, which divides the tracing process into two stages: in the first stage, by collecting security intelligence from public or private channels and core data in internal networks and systems, these data features are extracted as malicious code gene-level features, system log-level features and event-level features, and the attack mode is inferred through the Transformer model, such as organization, individual, VPN, free host, and the basic features (source IP, destination IP, port) in the system log-level features are output at the same time; in the second stage, by integrating the public IP geographic library, the self-built organization library, the code author library and the malicious code gene-level features in the first stage and the output attack mode recognition content, the content is sent into a multi-cascade composite structure to trace the region, organization and attacker, and the accuracy of tracing is improved through diversified data fusion: (1) Improving attack tracing accuracy: Through multi-level feature extraction, including event-level features and network traffic behavior features, the present invention can accurately identify and analyze the different stages and behavior patterns of attacks. Based on deep learning models, especially the combination of Transformer and CNN structures, it can improve tracing accuracy and accurately locate the attack source and attack chain. (2) Enhanced attack pattern recognition capability: The multi-dimensional feature fusion analysis method adopted effectively improves the recognition capability of diversified attack patterns. By combining multiple data sources (such as logs, traffic, behavior, etc.), the present invention can comprehensively analyze attack behaviors, identify potential threats, and avoid the recognition blind spots caused by single feature reliance. (3) Solve the time alignment problem of multiple data sources: The context alignment module is used to align the time series of multiple data sources such as logs, network traffic, and user behavior, providing a consistent time frame for the deep learning model to ensure that the accuracy of the results will not be affected by data time misalignment when conducting attack behavior analysis; (4) Efficient attack chain tracking and tracing: The present invention can combine attack behaviors with external information such as IP address databases, organization libraries, and code author libraries through the tracing analysis module, accurately track the attacker's region, organization information, and possible attack motives. Combined with the CNN cascade analysis structure, it can effectively track the entire attack process and the potential attacker's identity. (5) Improving response speed and real-time performance: This method can respond to network attack incidents in real time through the automated identification and source tracing analysis of deep learning models, and promptly provide detailed information on the attack source and behavior, helping the security team to quickly respond to emergencies and deploy defenses, thereby reducing losses and risks. (6) Enhance data integrity and credibility. The collaborative authentication code jointly verifies multi-source data to ensure the consistency and integrity of various types of data during the feature extraction process, effectively avoid data tampering or loss, and improve the accuracy of attack pattern recognition results; ensure the reliability of attack tracing. In the multi-stage attack tracing process, the collaborative authentication code can provide reliable authentication information for the attack behavior at each stage, ensuring that each analysis link is supported by reliable evidence, thereby improving the credibility and traceability of the entire tracing process. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A method flow chart of a multi-stage non-cooperative network attack tracing method proposed by the present invention; Figure 2 This is a system architecture diagram of a multi-stage non-cooperative network attack tracing system proposed by the present invention; Figure 3 A flowchart of a method for tracing the region, organization, and attacker proposed by the present invention; Figure 4 This is a schematic diagram of the overall design structure of a multiple cascade composite structural unit proposed by the present invention. DETAILED DESCRIPTION

[0018] Embodiment 1, the present invention proposes a multi-stage non-cooperative network attack tracing method, such as Figure 1 As shown, the specific implementation steps include the following: S1. Construct a multi-stage non-cooperative network attack tracing system, such as Figure 2 As shown, it includes: data acquisition module, feature extraction module, context alignment module, deep learning analysis module and traceability analysis module; The data collection module is used to collect internal log information and external threat intelligence to form a complete data set; The feature extraction module is used to extract key features from code, system logs, and event-level behaviors, and construct attack behavior patterns; The context alignment module is used to align the time series of attack events based on the causal analysis method and generate a standardized causal chain; The deep learning analysis module uses the Transformer network structure and combines it with the NLP pre-training model to perform fusion analysis on multi-dimensional features and realize attack pattern recognition; The source tracing analysis module is used to utilize the IP address database, self-built organization library and code author library, combined with a multi-cascade CNN structure, to ultimately trace the attack source to the region, organization and attacker.

[0019] S2. Data Collection Module In the data collection stage of attack tracing, two types of key information need to be collected first: external knowledge and internal information. This information is the basis for building an attack tracing framework and is crucial for subsequent feature extraction and analysis. Specifically: S21. External knowledge mainly includes security intelligence from public and private channels. This intelligence provides important contextual support for attack tracing, including but not limited to: Public threat intelligence platforms: including but not limited to VirusTotal (VT), AlienVaultOTX (AV_OTX), MISP (MISP), which provide malware samples, attack patterns, and known malicious IP addresses or domain names; Security communities and forums: including but not limited to ExploitDatabase (EDB) and other vulnerability disclosure websites, helping to obtain the latest vulnerability information and attack technology details; Network security vendors: including but not limited to security reports released by Palo Alto Networks (PAN), FireEye (FE), and Kaspersky (KAS), which cover security incident analysis, attack trends, and the latest developments in threat intelligence; Based on this, we integrate the above external knowledge to build a comprehensive threat library Threat_DB: ; It should be noted that the threat library provides a solid foundation for identifying and understanding potential attack behaviors, and provides an important reference for the subsequent construction of attack tracing models; S22. Internal information is core data collected directly from internal networks and systems. This data is directly related to the enterprise's operating environment and potential security threats and is an indispensable part of the attack tracing process. Specifically, it includes: System logs: from the operating system {WindowsEventLog (WEL), LinuxSyslog (LS)}, database audit log (DB_AUDIT), firewall log (FW_LOG), and intrusion detection system log (IDS_LOG), which detail abnormal activities, unauthorized access attempts, and system configuration changes; Network flow logging: Analyze communication patterns, data transmission, and potential malicious communication behaviors through NetFlow records (NF), packet capture files {including but not limited to pcap format (PCAP)}, and router communication logs (RT_LOG); User behavior data: login time, access records, and operation behaviors collected by terminal monitoring {including but not limited to User Behavior Analytics (UBA)} and identity authentication system (IAM) to identify abnormal user activities; Access Control List (ACL): A set of rules that provides access rights to system resources and is used to analyze potential vulnerability exploitation scenarios; System configuration and status information: including but not limited to host configuration file (CFG), network topology information (TOPO), system version number (SYS_VER), and installed patch list (PATCHES); Based on this, through comprehensive analysis of these internal information, a detailed internal security situation map SS_DB is constructed: ; It should be noted that this security situation map not only provides rich data support for feature extraction and subsequent analysis, but also helps identify current security threats and provides a basis for predicting future attack trends; S23. To ensure the accuracy of data processing when extracting features, a collaborative authentication code is generated for the threat database Threat_DB and the internal security situation map SS_DB. The generation process is as follows: S2301, converting the data of the threat database Threat_DB into a binary data string sequence data1 and converting the data of the internal security situation map SS_DB into a binary data string sequence data2; S2302, calculation-assisted generation parameter Pa=H(data1||data2); Where H is a predefined hash function, H: {0,1} k →G; k represents a predefined security parameter; G is a cyclic group whose order is a prime number q; || is a string concatenation symbol; S2303, calculate collaborative authentication code Ca = (Pa) α ; Among them, α is the predefined authentication generation parameter, x∈Z p ; Z p is the ring of integers modulo p.

[0020] S3. Feature extraction module In the feature extraction stage of attack tracing, key features that are helpful for identifying and analyzing attack behaviors are extracted from the collected data. These features are divided into several different levels, each of which contains rich information for tracing the attack object, specifically: S31. Verify the credibility and integrity of the data. The verification process is as follows: S3101, extracting data from the threat database Threat_DB and the internal security situation map SS_DB, converting the threat database Threat_DB into a binary data string sequence data1 and converting the internal security situation map SS_DB into a binary data string sequence data2; S3102, calculate the first-order analytical parameter Pe1=e(Ca,g); Where e is a predefined bilinear mapping, e: G×G→G T ; G T is a predefined cyclic group; g is a generator of a predefined q-order cyclic group; S3103, calculate the second-order analytical parameter Pe2=e(H(data1||data2),β); Among them, β is the analytical code, β=g α ; H is a predefined hash function; || is a string concatenation symbol; S3104, if Pe1=Pe2, the verification is passed; S32, Malicious code gene-level features: Code gene-level features are obtained by analyzing the code structure and behavior of malware samples. This level of features mainly focuses on the static analysis of malicious code, including but not limited to the code structure, function call mode, API usage habits, and pre-defined coding habits; The AST method is constructed to extract the code gene-level feature C_AST. The construction process is as follows: S3201. The data comes from Threat_DB, including but not limited to known malicious code samples obtained from VT and AV_OTX platforms. If the obtained sample is a binary file, use a disassembly tool (including but not limited to IDAPro) to extract pseudo code. If it is a script or source code, use it directly as input. S3202. Standardize the codes from different sources and unify them into text code form. In addition to the data in Threat_DB, the suspicious code snippets triggered by the malicious traffic behavior recorded in IDS_LOG in SS_DB and the suspicious payloads extracted by decoding in the PCAP file are also required, including but not limited to scripts or instruction sets. Finally, organize the extracted code snippets into independent code modules. Among them, if it is binary code, disassemble it first; S3203. Perform lexical analysis on the standardized text code (generated by Threat_DB and SS_DB), extract basic grammatical units (Tokens), and generate AST using the parser defined by the context-free grammar (using tools including but not limited to Python's ast module or ANTLR); S3204. Calculate the maximum depth of AST and count the number of FunctionDef and ClassDef nodes in AST to obtain code structure features (C_Struct); search for Call type nodes in AST, extract the names and order of called functions, build a call graph (CallGraph), and form a function call pattern (C_Func_Call); locate Call nodes, filter external API calls (including but not limited to dynamic library loading functions, Win32API), extract parameter features {including but not limited to DLL name, API type}, and form API usage habits (C_API_Use); S3205. Extract all Name nodes in AST to analyze variable naming styles, detect the number of comment nodes, and analyze comment coverage, including but not limited to naming style: {camel case naming, comment coverage: 60%}, to form coding style features (C_Style); locate encryption function call nodes in AST (including but not limited to AES_encrypt), analyze encryption algorithm names and parameters to form encryption algorithm features (C_Enc_Algo); search for function calls involving network communication in AST (including but not limited to socket, send), extract parameters, parse communication protocol types, and form network protocol features (C_Proto); S3206. Construct AST method to extract code gene-level features C_AST: ; It should be noted that these features help identify malware families or attackers’ toolsets; For example, some malware may use encryption algorithms or network communication protocols, which can be part of the code genetic level features; S33. System log-level features: System log-level features are actually the process of cleaning, structuring and feature extraction of massive and messy data in SS_DB, making it more suitable for attack tracing tasks: some basic information is directly extracted from SS_DB as the basic features (F) for model training, including source IP (src_ip), destination IP (dst_ip), port number (port), host (host), user (user), traffic (pcap), process (process), and file (file), namely: F={src_ip, dst_ip, port, host, user, pcap, process, file}; S3301. By analyzing the information in SS_DB, abnormal time characteristics, abnormal login times, abnormal event times, abnormal connection times, and malicious traffic label characteristics are formed: (1) Abnormal time characteristics: In the process of attack tracing, the time characteristics reveal the temporal regularity and potential abnormal patterns of attack behaviors by analyzing the event timestamps recorded in the logs. In order to identify the distribution of events in high-frequency or abnormal time periods, the 3σ criterion is used for detection. That is, the time is used as a window, and a day is divided into several time periods (including but not limited to 1 hour or 30 minutes). The number of events in each time period N is counted, and the mean μ and standard deviation σ of the number of events are calculated. Detect abnormal time periods and form abnormal time features (U_Time); Where N t represents the number of events in the tth time period; (2) Abnormal login times feature: In the log, we identify abnormal login behaviors by counting the number of failed logins and the success rate (focusing on accounts with an abnormally high number of failed logins, as this may reflect brute force attempts), and thus form the abnormal login times feature (U_Login); For example, if a user fails to log in multiple times in a short period of time (including but not limited to more than 3 times in 1 hour), and the attempts come from different IP addresses or abnormal geographical locations, then this can be considered a potential threat and form an abnormal number of logins feature (U_Login); (3) Abnormal event frequency feature: Abnormal events that occur during system operation often indicate potential problems or attack activities. By extracting records marked as "Error" or "Warning" in the log, the frequency and type of abnormal events can be quickly counted. If a certain type of abnormal event increases significantly in a short period of time, for example, the same type of errors occurring within 1 hour account for more than 50% of all errors, then this may indicate that the system is under attack or encountering a failure, forming an abnormal event frequency feature (U_Case); (4) Abnormal connection frequency characteristics: The connection pattern in the network log can reveal whether the system has abnormal communication behavior, and count the connection frequency of each IP, especially the devices that frequently communicate with external IPs, or the records of connections with known malicious IPs; For example, when one IP has a much higher number of target connections than other devices on the network, this could be a sign of a data breach or botnet activity; Based on this: Based on such rule judgment, the abnormal connection times feature (U_Corn) is formed; (5) Malicious traffic label characteristics: The detection of malicious traffic is the key point in analyzing network security. Problems can be discovered by simply analyzing the traffic rate and packet size. For example, when the transmission rate of certain traffic far exceeds the normal value, or the packet size is abnormal (too large or too small), it is likely a manifestation of malicious behavior; Based on this: Generate malicious traffic label features (U_Flow); (6) Generate system log-level features OSL = {F, U_Time, U_Login, U_Case, U_Corn, U_Flow}; S34, event-level features: Relationship analysis-level features reveal potential attack paths and system weaknesses by mining the associations between different entities within the system. This analysis focuses on the interactions between users, processes, files, and network connection entities. By building entity relationship graphs and in-depth association mining, it can identify attacker behavior patterns. Specifically: S3401, Relational analysis level features rely on multi-dimensional data obtained during the data collection phase, including: System log (WEL, LS): records the interaction between users and system resources (including but not limited to user login, process startup, and file access); Database audit log (DB_AUDIT): captures user queries, modifications, and deletions on database tables; Network traffic records (PCAP, NF): provide detailed information about host-to-host communication, protocol usage, and data transfer; Access Control List (ACL) and Configuration File (CFG): clarify user permissions, resource access rules and system configuration; S3402. Build an entity relationship diagram. The construction process is as follows: (1) Parse log data into entities and their relationships: Entity types include but are not limited to users, processes, files, hosts, and network connections. Build a relationship graph based on nodes (entities) and edges (relationships). Edge types include: user access to files, process initiating network connections, user starting processes, and communication between hosts. By analyzing the WEL log, it is found that "user A started process P1 and accessed file F1", and a triplet relationship graph Triplet={(User_A→Process_P1→File_F1)} is generated; (2) Use Neo4j tools to detect common malicious behavior patterns in triplet relationship graphs, including the following five: Lateral movement mode: The connection path from a low-privilege host to a high-privilege host, Host_Comp1(Low)→Host_Comp2(High), is constructed by building an entity relationship graph, where nodes represent hosts and edges represent network connections, and then using Node1.permission<Node2.permission AND Node1-> The matching mode of Node2 generates a detection report and marks the abnormal behavior Lat_Mov_Mode; Permission abuse mode: high-privilege users access sensitive files or configurations, User (Admin) → File (Sensitive), by storing user permissions and file sensitivity as node attributes, using rule-based matching, querying User.permission=='Admin' AND File.sensitivity=='High' AND User->File, marking the matching behavior as Rel_Priv_Abuse; Malware propagation mode: A process connected to multiple hosts may be malware propagation, Process(Malicious)→Host1,Host2,..., construct a graph where nodes represent processes and hosts, and edges represent communication relationships. Detect when the node out-degree is greater than the threshold, such as Process.out_degree>threshold, and mark the abnormal behavior as Malware_Propagation; C&C communication mode of the command control center: the host repeatedly communicates with the malicious IP address recorded in the threat library Threat_DB (the communication frequency with the host is ≥50 times within 1 consecutive hour), extracts the communication relationship graph from the network traffic log, and uses the frequent subgraph mining algorithm gSpan algorithm to match the frequent subgraph pattern in the communication relationship graph. If the subgraph pattern meets the preset C&C communication feature template, it is marked as C&C_Communication; the preset C&C communication feature template includes but is not limited to the heartbeat packet period (the heartbeat packet period is 60 seconds ± 10 seconds) and the instruction encoding rule (the instruction encoding is encrypted using Base64); Covert tunnel communication mode: the connection path with abnormal traffic volume, Host→Server(Low)→Server(High), build a communication graph with nodes containing traffic information, detection mode: abnormal fluctuation of path bandwidth Bandwidth.path>Threshold (set threshold), marked as Covert_Tunnel; (3) Perform statistical analysis on the relationship diagram and extract characteristic indicators: Relationship density: the ratio of the number of edges to the number of nodes in a graph, reflecting the complexity of system interactions; Centrality indicators: Identify key entities (most accessed processes, most communicating hosts, high-privileged users, frequently accessed files); Path characteristics: attack path length, communication frequency between nodes; (4) Generate the following features from the relationship analysis: Rel_Patterns: attack behavior patterns extracted based on pattern analysis; Rel_Patterns={Lat_Mov_Mode,Rel_Priv_Abuse,Malware_Propagation,C&C_Communication,Covert_Tunnel}; Key entity feature (key_entities): identifies key nodes, i.e., the most accessed processes, the most communicating hosts, high-privilege users, and frequently accessed files, which are connected to F in the system log-level feature; Graph structure features (Rel_Graph_Struct): including but not limited to relationship density and path length structural indicators; S35. Generate event-level features EF={Rel_Patterns, key_entities, Rel_Graph_Struct}.

[0021] S4. The context alignment module performs deep correlation analysis on different levels of features (malicious code gene-level features, system log-level features, and event-level features) from the time dimension to generate a series of complete event chains with causal relationships. The aligned data is stored in a standardized JSON format to provide an accurate basis for model training and attack pattern recognition. Specifically: S41, event alignment and correlation analysis, as follows: Time sorting: Using timestamp as the key, arrange the features at all levels in the order of occurrence to form a basic timeline; Causal association analysis: For features within the same time window, causal relationship mining techniques (including but not limited to Granger causality test and causal tree modeling) are used to establish causal relationships between events; Multi-level feature association: associate malicious code, system log, and event features into the same causal chain. For example, the genetic features of malicious code reveal the technical features of attack tools, system log features provide real-time data support for attack behaviors, and event features provide high-level pattern analysis and path mining. S42. Causal chain generation and structured storage, as follows: Causal chain generation: Based on the results of causal analysis, an event chain including time, entity, behavior and causal relationship is constructed; JSON format storage: The complete causal chain is represented in structured JSON, including the time dimension (timestamp of each event), feature dimension (including malicious code gene level, system log level, event level features), and causal relationship (causal chain description of previous and subsequent events); S43. The aligned causal chain data includes: Time sequence: timestamps of events to clarify the sequence of the attack chain; Multi-level features: malicious code gene-level features (static analysis extraction), system log-level features (network and host behavior), event-level features (high-level relationship patterns); Causality: The triggering logic of each event, helping to infer the attack path and intent; An example of visualization after generating the event chain is shown in Table 1: Table 1 Example table of post-event chain visualization .

[0022] S5, deep learning analysis module is used to adopt the Transformer network structure. The input JSON data needs to be split into timestamp (used to generate time position coding), multi-level features (extracting C_AST, F log features, EF relationship features of code_features), causal relationship (used as information for semantic connection between events), and convert this information into numerical representation to adapt to the input of Transformer. Specifically: S51. Tokenizer-based input encoding: The Tokenizer method is used to process the input JSON data, and the text features, numerical features, and nested features in the features are structured into Tokens. The Token conversion process is as follows: The construction process of S5101 and Tokenizer is as follows: The nested features that can be split on demand include but are not limited to: code_features: treat the sub-features of C_AST (including but not limited to C_Struct, C_Func_Call) as tokens; F: Log-level features, including but not limited to src_ip, dst_ip, generate tokens in the form of "key=value", such as "src_ip=192.168.1.100", "port=443", "process=svchost.exe"; EF: Directly tokenize relational features; Rel_Patterns=Lat_Mov_Mode","density=0.5","key_entities=User_admin; Causality: Use the standard Tokenizer to process the string, such as "File upload triggeredmalicious process." S5102, Token encoding: Use the dictionary in Python combined with the enumerate index method to dynamically assign a unique index to each Token i ,In the specific implementation, the key-value pairs of the feature data are parsed and ,added to the dictionary gradually, and each newly appearing Token is assigned an ,increasing index value; For example: "The initial dictionary is empty {}; When encountering "src_ip=192.168.1.100", the dictionary is updated to: {"src_ip=192.168.1.100": 0}; When "port=443" is encountered, the dictionary is updated to: {"src_ip=192.168.1.100": 0, "port=443": 1}; final: "src_ip=192.168.1.100" → Token: 0; "port=443" → Token: 1;"; It should be noted that this method does not require a predefined vocabulary, can dynamically expand the Token index space according to the feature data, and flexibly and efficiently complete the numerical representation of the features; S52, Embedding Representation: Map Token to the embedding vector space and generate the input embedding matrix E features : E features =Embed(t1,t2,…,t i ,…,t n ); Among them, t i is the ith Token index, and the embedding vector dimension is d model ; Embed() represents the embedding operation; S53, time position coding: The timestamp captures the temporal order relationship of events PE(t) through position coding; ; Where t is the normalized time value; d represents the total dimension of the position encoding vector; i represents the dimension index of the vector; Based on this: add the position encoding and feature embedding to generate the input matrix X: X=E features +PE(t); S54, Multi-head Attention Mechanism: The core of the multi-head attention mechanism is to calculate the query Q, key K, value V from the input X1; The calculation formula is: ; ; ; ; ; ; Where W Q , W K and W V represents the linear transformation weight matrix; d k Indicates the dimension of the key vector; d vrepresents the dimension of the value vector; h represents the number of independent heads in the multi-head attention mechanism; Based on this, the dot product of Q and K is used to calculate the attention score (capturing the correlation between events): ; In the formula, QK T is the similarity score matrix between query and key; is a scaling factor used to avoid excessively large scores; The multi-head attention mechanism concatenates the attention outputs of h independent heads and generates the final result through linear transformation: MultiHead(Q,K,V)=Concat(head1,head2,…,head i ,…,head h )W o ; Among them, head i represents the attention of the i-th independent head; head i =Attention(Qi,K i ,V i );W o is the output weight matrix, ;Concat() represents the concatenation operation; S55, Output: Input the context features processed by the multi-head attention mechanism into the fully connected layer to generate attack pattern predictions, and use the fully connected layer and softamx to output the attack pattern (VPN, free host, organization, individual, means) and basic information.

[0023] S6, the source tracing analysis module is based on the tracing of regions, organizations, and attackers. It uses the IP address database, self-built organization library, and code author library, combined with a multi-cascade CNN structure, to build a tracing model, and ultimately traces the attack source to the region, organization, and attacker.

[0024] Embodiment 2, the present invention proposes a method for tracing the source of a non-cooperative network attack based on multiple stages, which also includes a method for tracing the source of a region, organization, or attacker, such as Figure 3 As shown, the specific implementation steps include the following: S1. Build a database. The specific implementation process is as follows: S11. IP address geolocation database: This database is built based on the global open IP address geolocation database. It provides detailed mapping of IP addresses to geolocations (country, province, city, longitude and latitude) and network information (including but not limited to ISP, organization name, domain name), and supports regional-level network tracing. For example, MaxMind GeoIP2 provides high-precision mapping of IP addresses to geolocations, including country, province, city, postal code, longitude and latitude, as well as ISP and organization name. IP2Location provides geolocation resolution of IP addresses, accurate to cities and time zones, and has detailed network information (including but not limited to domain names, ISPs, ASNs). The content of the geolocation database is associated with the IP address information output in the first stage to form regional tracing information, adding a regional dimension to the training data. Self-built organization database: Relying on the Cyber ​​Army and Encyclopedia 2.0 released by Thailand Cert, a self-built organization database is formed by extracting the organization information and country information contained in the book and the Techniques field content in the Software of the corresponding MITRE ATT&CK library; the MITRE ATT&CK library is a public database for understanding the various strategies and techniques used by attackers during network attacks. Combined with the attack pattern recognition results output in the first phase and the regional dimension information added based on IP in the geographic location database, these data are associated with the relevant information in the self-built organization database. Specifically, the associated information needs to meet two conditions: Condition 1: The country information in the book is associated with the regional dimension information in the previous step; Condition 2: The attack pattern recognition content output in the first stage is matched with the content in the Techniques field in the Software of the corresponding MITRE ATT&CK library. If the matching degree is greater than the threshold (0.7), this condition is met. When both conditions are met, an organizational information dimension is added to the training data; Code author library: In order to build an attacker portrait, a code author library is built. The construction process is as follows: First, through automated crawler technology and the API provided by the platform, systematically collect projects related to network attacks and network security on the GitHub and Gitee open source platforms, including but not limited to vulnerability exploitation tools, attack frameworks, and protection mechanism implementation content, and focus on collecting the author information, contributor history, and code samples submitted by the repository; after the collection is completed, the code samples are statically analyzed, and the code structure features, function call patterns, and coding style fine-grained information are extracted by parsing the abstract syntax tree (AST). These features are then matched with the first-stage malicious code gene-level feature library. Specifically, the cosine similarity method is used to measure the similarity between code feature vectors. When the matching degree exceeds the set threshold (0.8), it is inferred that the malicious code has a high correlation with an author in the library and is marked as a possible code author.

[0025] S2. Feature fusion: In the feature fusion stage, each piece of training data and its newly added regional dimension, organizational information dimension, code author information, existing attack pattern recognition output, and malicious code gene-level features are regarded as a piece of structured semantic information, and unified modeling and fusion are performed using natural language processing (NLP) methods. The specific process is as follows: S21. Structural description of each dimension of information in each training data (including but not limited to IP geographic location, organizational information, code author information, attack mode label and gene-level features) is performed and converted into pseudo-natural language text through template-based method; For example, a piece of training data can be described as: "Traffic from IP address FF originates from a certain region, is associated with company XX, may be written by code author YY, triggers attack mode ZZ, and has a preset gene-level feature WW." This conversion method aims to map multi-dimensional numerical and categorical data into language form, which is convenient for subsequent NLP model processing; S22. For the generated pseudo natural language text, a pre-trained language model (including but not limited to BERT or GPT series) is used for encoding to extract deep semantic features. This process maps the high-dimensional data of the language expression into a unified vector space and generates a semantic representation vector, thereby achieving efficient fusion of features of different dimensions.

[0026] S3. Construct a multi-cascade composite CNN model (TriCascadeCNN), which effectively integrates the convolutional neural network and the deep separable convolutional neural network to form a three-layer cascade composite structure unit. During the convolution process, the composite CNN structure first uses the convolutional neural network to perform preliminary convolution processing on the input feature map to extract basic features; then, the feature extraction is further refined through deep separable convolution to generate the final output feature map; the overall design of the multi-cascade composite structure unit is as follows: Figure 4 As shown; Specifically, the structure of the multi-cascade composite CNN model (TriCascadeCNN) consists of the first two layers of convolutional network structure and the third layer of pooling layer structure: In the first convolutional layer, the convolution kernel size is set to 1×M to capture the horizontal correlation of the feature map. The convolution calculation can be expressed as: ; Among them, X is the input feature map; W1 is the convolution kernel of the first layer; C in and C out They represent the number of input and output channels respectively. The number of convolution channels is adjusted according to the actual network requirements to balance the amount of computation and performance. In the second convolutional layer, the number of convolution channels remains the same as the first layer, while the size of the convolution kernel is set to N×1, and features are extracted in the vertical direction. The calculation formula is: ; Among them, W2 is the convolution kernel of the second layer; Through this decomposition method, the computational complexity of the convolution operation is reduced from the traditional K×K×C in ×C out Reduced to K×C in ×C out +K×C out ×C out ; The third layer uses a hybrid pooling strategy, including 2×2 pooling and 1×1 pooling, to compress the feature dimension and retain key information: ; Among them, MaxPooling represents the maximum pooling operation; Through this structural setting, the composite CNN can not only fully explore the spatial and channel relationships of network features, but also significantly reduce the number of parameters and computational complexity, thereby effectively reducing model training time and memory consumption. This optimized design not only improves the network feature extraction capability, but also further improves the performance and efficiency of the network security perception model.

[0027] S4. In the process of attack tracing, for different tracing objects, a multi-cascade composite CNN model TriCascadeCNN is used to perform semantic modeling and deep feature extraction on the above features to obtain a comprehensive representation of the tracing task: Z = TriCascadeCNN(T); In the formula, T represents input data, i.e., various information related to attack events, including but not limited to network traffic and malicious code features; Z represents the comprehensive representation vector of attack events; Specifically, the detailed description of each object is as follows: Regional tracing: The geographic information extracted from the geographic location database is combined with the output of the TriCascadeCNN model to identify the source area of ​​the attack incident and locate it to a specific country, city or ISP level: region =Softmax(W region Z+b region ); Where P region represents the regional distribution probability of attack events; W region represents the weight matrix, which is used to map the comprehensive representation vector Z to the regional distribution space; b region Represents the bias vector, which is used to adjust the initial offset of the regional distribution; Organization tracing: Based on the information in the self-built organization database, the relevant organizations are identified and classified by matching the organizational information dimension characteristics with the attack pattern: Org =Softmax(W Org Z+b Org ); Where P Org W represents the probability vector of the organization category involved in the attack event, that is, the probability of different organizations (including but not limited to enterprises, institutions, and hacker organizations) participating in the event; Org represents the weight matrix, which is used to map the comprehensive representation vector Z to the tissue category space; b Org represents the bias vector, which is used to adjust the initial offset of the tissue category; The model outputs potential organizational categories (including but not limited to enterprises, institutions, and hacker groups) and their associated network behaviors; Attacker tracing: Through the code author library and code gene matching technology, the potential attacker profile is extracted. The specific steps are as follows: (1) Code gene matching: Calculate the similarity between the malicious code features in the attack event and the samples in the code author library, and use the similarity threshold Th=0.7 to identify potential attackers; (2) Attacker classification: Combine the information of potential attackers with the output of the TriCascadeCNN model to construct an attacker profile: P Attacker=Softmax(W Attacker Z+b Attacker ); Where P Attacker represents the attacker identity information and its correlation score vector with the event, that is, the probability and correlation of different potential attackers participating in the event; W Attacker represents the weight matrix, which is used to map the comprehensive representation vector Z to the attacker category space; b Attacker represents the bias vector, which is used to adjust the initial offset of the attacker category; Based on this: Output the identity information of the potential attacker and its correlation score with the incident.

[0028] The embodiments of the present invention are described in detail above with reference to the accompanying drawings, but the present invention is not limited thereto, and various changes can be made within the knowledge scope of technicians in the relevant technical field without departing from the purpose of the present invention.

Claims

1. A multi-stage non-cooperative network attack tracing method, characterized in that: The specific implementation steps include the following: S1. Construct a multi-stage non-cooperative network attack tracing system, including: data collection module, feature extraction module, context alignment module, deep learning analysis module and tracing analysis module; S2. By integrating external threat intelligence and internal information, the threat database Threat_DB and security situation map SS_DB are constructed, and a collaborative authentication code is generated; S3. Perform credibility verification by extracting collaborative authentication codes from threat libraries and security situation maps, analyze the gene-level features of malicious code, clean system logs and extract system log-level features, identify abnormal behaviors, and analyze event-level features. By building entity relationship diagrams, deeply explore attack paths between entities and identify attack behaviors. S4. Align events through time sorting and causal relationship analysis to generate structured causal chain data. Use the Transformer network to convert the causal chain data into processable basic grammatical units. Generate input matrix through time position encoding and feature embedding. Use multi-head attention mechanism to capture the relationship between events. Finally, predict attack mode through the fully connected layer and output corresponding attack features. S5. Based on the tracing of regions, organizations, and attackers, we use the IP address database, self-built organization library, and code author library, combined with a multi-cascade convolutional neural network structure, to build a tracing model, and ultimately trace the attack back to the source region, organization, and attacker.

2. According to claim 1, a multi-stage non-cooperative network attack tracing method is characterized in that: The construction process of the threat database Threat_DB and the security situation map SS_DB is as follows: S21. External knowledge includes security intelligence from public and private sources, including: Public threat intelligence platforms: including VirusTotal (VT), AlienVaultOTX (AV_OTX), and MISP (MISP platform); Security communities and forums: including ExploitDatabase, EDB and other vulnerability disclosure sites; Network security vendors: including security reports released by Palo Alto Networks (PAN), FireEye (FE), and Kaspersky (KAS); Based on this, the threat library Threat_DB is constructed: ； S22. Internal information is core data collected directly from internal networks and systems, including: System logs: from the operating system WindowsEventLog, namely WEL, LinuxSyslog, namely LS, database audit log DB_AUDIT, firewall log FW_LOG, and intrusion detection system log IDS_LOG; Network flow records: NF, packet capture files (including PCAP in pcap format), and router communication records (RT_LOG) are recorded through NetFlow; User behavior data: monitored by the terminal, including UserBehaviorAnalytics, i.e. login time, access records and operation behaviors collected by UBA and identity authentication system IAM; Access Control List (ACL): A set of rules that provide access rights to system resources. System configuration and status information: including host configuration file CFG, network topology information TOPO, system version number SYS_VER, and installed patch list PATCHES; Based on this, the internal security situation map SS_DB is constructed: 。 3. A multi-stage non-cooperative network attack tracing method according to claim 2, characterized in that: The process of constructing code gene-level features is as follows: S31. The data comes from known malicious code samples in Threat_DB. If the sample is a binary file, use the disassembly tool to extract the pseudo code. If it is a script or source code, use it directly as input. S32. Standardize codes from different sources into text code form, and organize the suspicious code snippets triggered by malicious traffic behaviors recorded in IDS_LOG in SS_DB and the suspicious payloads extracted by decoding in PCAP files into independent code modules; Among them, if the extracted code fragment is a binary code, it is first disassembled; S33, perform lexical analysis on the standardized text code, extract the basic grammatical unit Token, and use the parser defined by the context-free grammar to generate an abstract syntax tree AST; S34. By calculating the maximum depth of AST, counting the number of function definition FunctionDef and class definition ClassDef nodes in AST, the code structure feature C_Struct is obtained; searching for function call expression Call type nodes in AST, extracting the names and order of called functions, building a call relationship graph CallGraph, and forming a function call pattern C_Func_Call; locating Call nodes, screening external application programming interface API calls, extracting parameter features, and forming API usage habits C_API_Use; S35. Extract all Name nodes in AST to analyze variable naming styles, detect the number of comment nodes, analyze comment coverage, and form a coding style feature C_Style; locate encryption function call nodes in AST, analyze encryption algorithm names and parameters to form encryption algorithm features C_Enc_Algo; search for function calls involving network communication in AST, extract parameters, parse communication protocol types, and form network protocol features C_Prpto; S36. Construct AST method to extract code gene-level features C_AST: 。 4. A multi-stage non-cooperative network attack tracing method according to claim 2, characterized in that: The process of extracting system log-level features is as follows: S41. Extract some basic information directly from SS_DB as the basic features F for model training, including source IP, i.e. src_ip, destination IP, i.e. dst_ip, port number, host, user, traffic pcap, process, and file, i.e.: F={src_ip, dst_ip, port, host, user, pcap, process, file}; S42. By analyzing the information in SS_DB, abnormal time characteristics, abnormal login times, abnormal event times, abnormal connection times, and malicious traffic label characteristics are formed: S4201, abnormal time feature: analyze the event timestamps recorded in the log, identify the event distribution of high frequency or abnormal time period, and form the abnormal time feature U_Time; S4202, abnormal login times feature: in the log, count the number of user login failures and success rates to identify abnormal login behavior, and form an abnormal login times feature U_Login accordingly; S4203, abnormal event frequency feature: extract the records marked as "Error" or "Warning" in the log, count the frequency and type of abnormal events, and form the abnormal event frequency feature U_Case; S4204, abnormal connection frequency feature: count the connection frequency of each IP to form an abnormal connection frequency feature U_Corn; S4205, malicious traffic label feature: discover problems by performing a simple analysis of the traffic rate and packet size, and generate a malicious traffic label feature U_Flow; S43. Generate system log-level features OSL={F, U_Time, U_Login, U_Case, U_Corn, U_Flow}.

5. According to claim 1, a multi-stage non-cooperative network attack tracing method is characterized in that: The process of constructing event-level features is as follows: S51, extracting relational analysis level features, including: system log, database audit log DB_AUDIT, network traffic record PCAP, NF, access control list ACL and configuration file CFG; S52. Build an entity relationship graph, parse the log data into entities and their relationships, and use Neo4j tools to detect common malicious behavior patterns in the triple relationship graph, including: Lateral movement mode: the connection path from a low-privilege host to a high-privilege host, marking abnormal behavior Lat_Mov_Mode; Permission abuse mode: high-privilege users access sensitive files or configurations. By storing user permissions and file sensitivity as node attributes, rule-based matching is used to mark the matching behavior as Rel_Priv_Abuse; Malware propagation mode: one process connects to multiple hosts, marking abnormal behavior as Malware_Propagation; Command and control center C&C communication mode: The host repeatedly communicates with the malicious IP address recorded in the threat library Threat_DB, extracts the communication relationship graph from the network traffic log, and uses the frequent subgraph mining algorithm gSpan algorithm to match the frequent subgraph pattern in the communication relationship graph. If the subgraph pattern meets the preset C&C communication feature template, it is marked as C&C_Communication; Covert tunnel communication mode: the connection path with abnormal traffic volume is marked as Covert_Tunnel; S53, perform statistical analysis on the relationship graph and extract characteristic indicators: relationship density, centrality index, and path characteristics; S54, generating relational pattern features Rel_Patterns, key entity features key_entities, and graph structure features Rel_Graph_Struct from relational analysis; Rel_Patterns={Lat_Mov_Mode,Rel_Priv_Abuse,Malware_Propagation,C&C_Communication,Covert_Tunnel}; S55. Generate event-level features EF={Rel_Patterns, key_entities, Rel_Graph_Struct}.

6. A multi-stage non-cooperative network attack tracing method according to claim 1, characterized in that: The collaborative authentication code generation process is as follows: S61, converting the data in the threat database Threat_DB into a binary data string sequence data1 and converting the data in the internal security situation map SS_DB into a binary data string sequence data2; S62, calculation-assisted generation parameter Pa=H(data1||data2); Where H is a predefined hash function, H: {0,1} k →G; k represents a predefined security parameter; G is a cyclic group whose order is a prime number q; || is a string concatenation symbol; S63, calculate collaborative authentication code Ca = (Pa) α ; Among them, α is the predefined authentication generation parameter, x∈Z p ; Z p is the ring of integers modulo p.

7. A multi-stage non-cooperative network attack tracing method according to claim 6, characterized in that: The verification process of extracting the collaborative authentication code of the threat library and the security situation map to perform credibility verification is as follows: S71, extracting data from the threat database Threat_DB and the internal security situation map SS_DB, converting the threat database Threat_DB into a binary data string sequence data1 and converting the internal security situation map SS_DB into a binary data string sequence data2; S72, calculate the first-order analytical parameter Pe1=e(Ca,g); Where e is a predefined bilinear mapping, e: G×G→G T ; G T is a predefined cyclic group; g is a generator of a predefined q-order cyclic group; S73, calculate the second-order analytical parameter Pe2=e(H(data1||data2),β); Among them, β is the analytical code, β=g α ; H is a predefined hash function; || is a string concatenation symbol; S74. If Pe1=Pe2, the verification passes.

8. The method for tracing the source of a non-cooperative network attack based on multiple stages according to claim 1 is characterized in that: The implementation process based on tracing the region, organization, and attacker source is as follows: S81. Build databases, including: IP address geographic location database, self-built organization database, and code author database; S82, Feature Fusion: Treat each piece of training data and its newly added regional dimension, organizational information dimension, code author information, existing attack pattern recognition output, and malicious code gene-level features as a piece of structured semantic information, and use natural language processing (NLP) methods for unified modeling and fusion; S83. Construct a multi-cascade composite CNN model TriCascadeCNN, which effectively integrates the convolution decomposition neural network and the deep separable convolution neural network to form a three-layer cascade composite structure unit: During the convolution process, the composite CNN structure uses the convolution decomposition neural network to perform preliminary convolution processing on the input feature map to extract basic features; the feature extraction is further refined through the deep separable convolution to generate the final output feature map; S84. In the process of attack tracing, for different tracing objects, a multi-cascade composite CNN model TriCascadeCNN is used to perform semantic modeling and deep feature extraction on the above features to obtain a comprehensive representation of the tracing task: Z = TriCascadeCNN(T); In the formula, T represents input data, i.e., various information related to attack events; Z represents the comprehensive representation vector of attack events; S8401, Regional tracing: The geographic information extracted from the geographic location database is combined with the output of the TriCascadeCNN model to identify the source area of ​​the attack incident: region =Softmax(W region Z+b region ); Where P region represents the regional distribution probability of attack events; W region represents the weight matrix; b region represents the bias vector; S8402, Organization Tracing: Based on the information in the self-built organization database, identify and classify related organizations through matching the organizational information dimension characteristics and attack patterns: P Org =Softmax(W Org Z+b Org ); Where P Org W represents the probability vector of the organization category involved in the attack event; Org represents the weight matrix; b Org represents the bias vector; Based on this model, potential organizational categories and their associated network behaviors are output; S8403, Attacker tracing: Through the code author library and code gene matching technology, extract the potential attacker portrait, specifically: Code gene matching: Calculate the similarity between the malicious code features in the attack event and the samples in the code author library, and use the similarity threshold Th=0.7 to identify potential attackers; Attacker classification: Combine the information of potential attackers with the output of the TriCascadeCNN model to construct an attacker profile: P Attacker =Softmax(W Attacker Z+b Attacker ); Where P Attacker W represents the attacker's identity information and its correlation score vector with the event; Attacker represents the weight matrix; b Attacker represents the bias vector; Based on this: Output the identity information of the potential attacker and its correlation score with the incident.

9. A multi-stage non-cooperative network attack tracing method according to claim 8, characterized in that: The fusion process of unified modeling and fusion using natural language processing (NLP) method is as follows: S91, structurally describing each dimension of information in each piece of training data, and converting it into a pseudo natural language text in a templated manner; S92. For the generated pseudo natural language text, a pre-trained language model is used for encoding, deep semantic features are extracted, the high-dimensional data of the language expression is mapped to a unified vector space, a semantic representation vector is generated, and the fusion of features of different dimensions is completed.

10. A multi-stage non-cooperative network attack tracing method according to claim 1, characterized in that: A multi-stage non-cooperative cyber attack tracing system, including: Data collection module, used to collect internal log information and external threat intelligence to form a complete data set; Feature extraction module, used to extract code gene-level features, system log-level features and event-level features from code, system logs and event-level behaviors, and construct attack behavior patterns; The context alignment module is used to align the time series of attack events based on the causal analysis method and generate a standardized causal chain; The deep learning analysis module uses the Transformer network structure and the NLP pre-training model to perform fusion analysis on multi-dimensional features and realize attack pattern recognition; The source tracing analysis module is used to use the IP address database, self-built organization library and code author library, combined with a multi-cascade CNN structure, to ultimately trace the attack source area, organization and attacker.

Images