Intrusion detection and forensic analysis method and device for server application program

Abstract

The invention relates to the technical field of internet security, in particular to an intrusion detection and forensic analysis method and device for a server application program. Comprising the steps of obtaining connection division information between a user and multiple target server application programs in a log, and constructing multiple connection traceability graphs based on the connection division information; using a preset machine learning model to perform anomaly detection on the plurality of connection traceability graphs to determine an abnormal event, the preset machine learning model being obtained by training a connection traceability graph data set generated by caching log data; and displaying the abnormal event as a potential attack factor, and generating an attack abstract containing attack details and a complete attack process based on the abnormal event. Therefore, the connection-oriented characteristic of the server application program is utilized, and the connection is used as a detection unit to identify the attack, so that the problems of alarm fatigue, attack investigation difficulty and the like caused by difficulty in large-scale log data processing and insufficient detection accuracy in the prior art are solved, and the detection performance is improved.

Description

Technical Field

[0001] The present application relates to the field of Internet security technology, and in particular to an intrusion detection and forensic analysis method and device for server application programs. Background Art

[0002] Servers are the basic components of information storage and services. With the explosive growth of Internet services, the security risks they face continue to increase, affecting the normal operation of organizations and user trust. Provenance graphs are introduced as analysis tools and are widely used in the field of intrusion detection. They can help security experts identify intrusion behaviors in a timely manner and take defensive measures, thereby reducing the risk of data leakage and system breaches.

[0003] However, existing threat discovery still faces many challenges, including the pressure of large-scale log data processing, insufficient detection accuracy leading to alarm fatigue, and difficulty in attack investigation, which affect the effectiveness of timely response and defense and need to be solved urgently. Summary of the invention

[0004] The present application provides an intrusion detection and forensic analysis method and device for server applications to solve the problems of the prior art, such as difficulty in processing large-scale log data, insufficient detection accuracy leading to alarm fatigue, and difficulty in attack investigation, thereby improving detection performance.

[0005] To achieve the above objectives, the first embodiment of the present application proposes an intrusion detection and forensic analysis method for server applications, comprising the following steps:

[0006] Acquire connection partition information between the user and multiple target server applications in the log, and construct multiple connection tracing graphs based on the connection partition information;

[0007] Using a preset machine learning model, anomaly detection is performed on the multiple connection traceability graphs to determine abnormal events, wherein the preset machine learning model is trained by a connection traceability graph data set generated by cache log data;

[0008] The abnormal event is displayed as a potential attack factor, and an attack summary including attack details and a complete attack process is generated based on the abnormal event.

[0009] According to an embodiment of the present application, the step of constructing a connection traceability graph based on the connection partitioning information includes:

[0010] Dividing the log based on the connection division information to obtain a plurality of connection units;

[0011] Based on the multiple connection units, the multiple connection traceability graphs are constructed.

[0012] According to an embodiment of the present application, using a preset machine learning model to perform anomaly detection on the multiple connection traceability graphs to determine abnormal events includes:

[0013] Using the encoder in the preset machine learning model, embedding the spatiotemporal information of each event in the plurality of connection traceability graphs into a preset vector representation;

[0014] Using a decoder in the preset machine learning model, based on the preset vector representation, predict the type of event corresponding to the preset vector representation to obtain a prediction result;

[0015] An error between the prediction result and an actual event type corresponding to the prediction result is calculated, and the abnormal event is determined based on the error.

[0016] According to an embodiment of the present application, the using of the encoder in the preset machine learning model to embed the spatiotemporal information of each event in the plurality of connection traceability graphs into a preset vector representation includes:

[0017] Based on a preset hierarchical feature hashing strategy, encode entities with similar hierarchical structures in each of the entities to obtain a first encoding result, wherein the first encoding result is a vector representation that satisfies a preset distance relationship in the feature space;

[0018] Based on a preset one-hot encoding strategy, encode each of the events to obtain a second encoding result, wherein the second encoding result is a vector representation of a corresponding dimension, wherein the corresponding dimension is equal to the total number of types of the corresponding event;

[0019] Based on the first encoding result and the second encoding result, the encoder in the preset machine learning model is used to embed the spatiotemporal information of each event into the preset vector representation.

[0020] According to an embodiment of the present application, before using the preset machine learning model to perform anomaly detection on the multiple connection tracing graphs and determining the abnormal event, it also includes:

[0021] Acquire the cache log data, and generate the connection tracing graph data set based on the cache log data;

[0022] Preprocessing the connection tracing graph dataset, and dividing the preprocessed connection tracing graph dataset into a training set and a validation set;

[0023] The preset neural network is trained using the training set to obtain an initial machine learning model, and the initial machine learning model is verified using the verification set until the initial machine learning model meets the preset criteria, and the iterative training of the initial machine learning model is terminated to obtain the preset machine learning model, otherwise the iterative training continues after adjusting the model parameters.

[0024] According to an embodiment of the present application, generating an attack summary including attack details and a complete attack process based on the abnormal event includes:

[0025] Determine the dependency relationship between the multiple connection traceability graphs based on the entity equivalence principle and the data flows between the multiple connection traceability graphs;

[0026] Determine an abnormal connection tracing graph associated with the abnormal event based on a dependency relationship between the abnormal event and the plurality of connection tracing graphs;

[0027] The abnormal connection source tracing diagram is integrated to generate the attack summary including the attack details and the complete attack process.

[0028] According to the intrusion detection and forensic analysis method for server applications proposed in the embodiment of the present application, by obtaining the connection division information between the user and multiple target server applications in the audit log, multiple connection traceability graphs can be constructed based on the connection division information; by using the preset machine learning model, multiple connection traceability graphs are detected for abnormality, and abnormal events can be determined; abnormal events are displayed as potential attack factors, and an attack summary containing attack details and a complete attack process is generated based on the abnormal events. Therefore, by utilizing the connection-oriented characteristics of the server application and identifying attacks with connections as detection units, the problems of the existing technology such as the difficulty in processing large-scale log data, insufficient detection accuracy leading to alarm fatigue, and difficulty in attack investigation are solved, thereby improving the detection performance.

[0029] To achieve the above-mentioned purpose, the second embodiment of the present application proposes an intrusion detection and forensic analysis device for server applications, comprising:

[0030] A construction module is used to obtain connection division information between a user and multiple target server applications in the log, and to construct multiple connection tracing graphs based on the connection division information;

[0031] A detection module, used to perform anomaly detection on the plurality of connection traceability graphs and determine abnormal events using a preset machine learning model, wherein the preset machine learning model is trained by a connection traceability graph data set generated by cache log data;

[0032] The generating module is used to display the abnormal event as a potential attack factor and generate an attack summary including attack details and a complete attack process based on the abnormal event.

[0033] According to one embodiment of the present application, the building module is specifically used for:

[0034] Dividing the log based on the connection division information to obtain a plurality of connection units;

[0035] Based on the multiple connection units, the multiple connection traceability graphs are constructed.

[0036] According to one embodiment of the present application, the detection module includes:

[0037] An encoding unit, configured to embed the spatiotemporal information of each event in the plurality of connection traceability graphs into a preset vector representation using an encoder in the preset machine learning model;

[0038] A prediction unit, configured to use a decoder in the preset machine learning model to predict a type of event corresponding to the preset vector representation based on the preset vector representation, and obtain a prediction result;

[0039] A calculation unit is used to calculate an error between the prediction result and an actual event type corresponding to the prediction result, and determine the abnormal event based on the error.

[0040] According to one embodiment of the present application, the encoding unit is specifically used to:

[0041] Based on a preset hierarchical feature hashing strategy, encode entities with similar hierarchical structures in each of the entities to obtain a first encoding result, wherein the first encoding result is a vector representation that satisfies a preset distance relationship in the feature space;

[0042] Based on a preset one-hot encoding strategy, encode each of the events to obtain a second encoding result, wherein the second encoding result is a vector representation of a corresponding dimension, wherein the corresponding dimension is equal to the total number of types of the corresponding event;

[0043] Based on the first encoding result and the second encoding result, the encoder in the preset machine learning model is used to embed the spatiotemporal information of each event into the preset vector representation.

[0044] According to an embodiment of the present application, before using the preset machine learning model to perform anomaly detection on the multiple connection tracing graphs and determining the abnormal event, the detection module is further used to:

[0045] Acquire the cache log data, and generate the connection tracing graph data set based on the cache log data;

[0046] Preprocessing the connection tracing graph dataset, and dividing the preprocessed connection tracing graph dataset into a training set and a validation set;

[0047] The preset neural network is trained using the training set to obtain an initial machine learning model, and the initial machine learning model is verified using the verification set until the initial machine learning model meets the preset criteria, and the iterative training of the initial machine learning model is terminated to obtain the preset machine learning model, otherwise the iterative training continues after adjusting the model parameters.

[0048] According to one embodiment of the present application, the generating module is specifically used for:

[0049] Determine the dependency relationship between the multiple connection traceability graphs based on the entity equivalence principle and the data flows between the multiple connection traceability graphs;

[0050] Determine an abnormal connection tracing graph associated with the abnormal event based on a dependency relationship between the abnormal event and the plurality of connection tracing graphs;

[0051] The abnormal connection source tracing diagram is integrated to generate the attack summary including the attack details and the complete attack process.

[0052] According to the intrusion detection and forensic analysis device for server applications proposed in the embodiment of the present application, by obtaining the connection division information between the user and multiple target server applications in the audit log, multiple connection traceability graphs can be constructed based on the connection division information; by using the preset machine learning model, multiple connection traceability graphs are detected for abnormality, and abnormal events can be determined; abnormal events are displayed as potential attack factors, and an attack summary containing attack details and a complete attack process is generated based on the abnormal events. Therefore, by utilizing the connection-oriented characteristics of the server application and identifying attacks with connections as detection units, the problems of the existing technology such as the difficulty in processing large-scale log data, insufficient detection accuracy leading to alarm fatigue, and difficulty in attack investigation are solved, thereby improving the detection performance.

[0053] To achieve the above-mentioned objectives, the third aspect embodiment of the present application proposes an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the intrusion detection and forensic analysis method for server applications as described in the above-mentioned embodiment.

[0054] To achieve the above objectives, the fourth aspect of the present application proposes a computer-readable storage medium on which a computer program is stored, which is executed by a processor to implement the intrusion detection and forensic analysis method for server applications as described in the above embodiments.

[0055] To achieve the above objectives, the fifth aspect of the present application proposes a computer program product, which includes a computer program. When the computer program is executed by a processor, it is used to implement the intrusion detection and forensic analysis method for server applications as described in the above embodiments.

[0056] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0058] Figure 1 A flowchart of an intrusion detection and forensic analysis method for server applications provided according to an embodiment of the present application;

[0059] Figure 2 A schematic diagram of a partitioning method based on an audit log according to an embodiment of the present application;

[0060] Figure 3 A schematic diagram of a connection traceability diagram according to an embodiment of the present application;

[0061] Figure 4 A schematic diagram of an attack investigation algorithm overview according to an embodiment of the present application;

[0062] Figure 5 A schematic block diagram of an intrusion detection and forensic analysis device for server applications provided according to an embodiment of the present application;

[0063] Figure 6 It is a schematic diagram of the structure of an electronic device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0064] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0065] The following describes, with reference to the accompanying drawings, a method and apparatus for intrusion detection and forensic analysis for server applications proposed according to an embodiment of the present application.

[0066] Figure 1 It is a flow chart of an intrusion detection and forensic analysis method for server applications according to an embodiment of the present application.

[0067] It is understandable that the embodiments of the present application are based on an observation that the server program usually needs to handle the needs from multiple users at the same time. Each user will establish a separate connection with the server and perform various operations in this connection. This design ensures that the activities of different users do not interfere with each other, and each user operates in his own "little world". The behavior of most users is normal, but some users may have malicious behavior, and their behavior patterns will be significantly different from those of ordinary users. This difference can better monitor and review the activities of the server. Inspired by this, the embodiments of the present application propose a method for intrusion detection and forensic analysis for server applications, by dividing the logs received by the server according to each connection, treating all events occurring in a connection as an integral unit (i.e., the connection traceability diagram mentioned below), and detecting these units separately, so as to find possible malicious behavior or anomalies.

[0068] The intrusion detection and forensic analysis method for server applications will be explained in detail below.

[0069] For example, Figure 1 As shown, the intrusion detection and forensic analysis method for server applications includes the following steps:

[0070] In step S101, connection division information between a user and multiple target server applications in a log is obtained, and multiple connection tracing graphs are constructed based on the connection division information.

[0071] Among them, server applications refer to software programs that provide services on the Internet, such as website servers, file storage services, etc. A traceability diagram is a graphical representation method used to track and record the flow of data on the Internet, which helps analyze and detect network attacks.

[0072] Specifically, users establish connections with multiple target server programs, which run independently during their lifecycles and interact with the server based on actual needs. When handling concurrent connections, these server programs use efficient technologies such as multithreading or asynchronous processing to ensure that these simultaneous connections can be managed efficiently. During the processing, the server program follows a series of established procedures, including request parsing, data validation, business logic processing, and response generation steps to ensure that each connection request is processed correctly and efficiently. By obtaining relevant information in the log, you can understand the connection status between the user and multiple target server applications (i.e., connection partitioning information) in detail. Based on the connection partitioning information, multiple connection traceability graphs can be constructed, which can show the establishment and interaction process of each connection in detail.

[0073] Next, it is described in detail how the embodiments of the present application construct multiple connection traceability graphs.

[0074] As a possible implementation method, in some embodiments, a connection traceability graph is constructed based on connection partitioning information, including: dividing the log based on the connection partitioning information to obtain multiple connection units; and constructing multiple connection traceability graphs based on the multiple connection units.

[0075] Among them, the connection partitioning information (CPI) specifically refers to the partition boundary (referred to as the boundary), which is usually a system call that marks the beginning or end of the server program's processing of a user connection. Once the boundary is determined, each log event can be assigned to its corresponding connection, thereby completing the log partition and obtaining multiple connection units. The connection provenance graph (CPG) is a provenance graph that records the complete behavior of a user connection in detail. It includes all related entities (processes, files or sockets) and events between entities, and plays a vital role in anomaly detection and attack investigation. In order to obtain a connection provenance graph, the complete event set of each user connection can be obtained based on the connection unit, and the event set corresponding to each connection can be further converted into a connection provenance graph.

[0076] Specifically, (i) selecting a log partitioning scheme according to the server application. The embodiment of the present application can provide four optional log partitioning schemes, namely, a partitioning scheme based on application logs, a partitioning scheme based on audit logs, a partitioning scheme based on plug-ins, and a partitioning scheme based on source code modification.

[0077] (1) Partitioning scheme based on application logs: Each worker process or thread (referred to as worker process, the same below) of the server application processes connections in sequence, that is, it processes the next connection after completing the current one. In the application log, events from different worker processes can be distinguished by process identifiers (PID) or thread identifiers (TID). For a single worker process, the start and end of each connection processing are marked by clear system calls (such as accept and close), and by using them as boundaries, events within the boundaries can be classified as a connection unit. If the application log is available, the timestamp, client IP (Internet Protocol) address, PID or TID and other information it provides can help identify the boundaries.

[0078] (2) Audit log-based partitioning scheme: Each worker process of the server application processes connections sequentially, that is, it processes the next connection after completing the current one. In the audit log, events from different worker processes can be distinguished by process identifiers or thread identifiers. For a single worker process, the start and end of each connection processing are marked by clear system calls (such as accept and close). By using them as boundaries, events within the boundary can be classified as a connection unit. When the application does not print the application log, or the application log cannot provide information such as timestamps, client IP, PID, or TID, the boundary can be identified by traversing the audit log.

[0079] For example, if Figure 2 As shown in (a), a working process based on the audit log processes two connections (connection 1 and connection 2) in sequence. In order to divide the connections, you can first extract the information of the two connections and use this information to obtain the boundaries. For connection 1, you can find its start and end boundaries near time 1 and time 3. These boundaries are the accept event and close event that match its IP address and PID information. In the audit log, it matches the accept event at t=1 and the close event at t=4, and then the events between the two boundaries are marked as belonging to connection 1. Using the same method, you can determine the boundaries of connection 2 and mark its events.

[0080] (3) Plug-in based partitioning: This is suitable for server applications that use an I / O (Input / Output) multiplexing execution model, where multiple connections are interleaved within a single worker process based on operating system mechanisms (such as select, poll, or epoll). If the application provides a non-intrusive mechanism (such as hooks, modules, or code replacement), such a mechanism can be used to insert code without changing the application source code. In this application scenario, the hook function will be responsible for intercepting the creation and execution of all connections. Specifically, there may be two specific locations for code insertion: 1) When the connection is established, a unique identifier (ID) can be assigned to it; 2) Before and after each processing logic is executed, additional system call code can be added to generate a boundary containing the connection ID in the audit log, thereby clarifying the unit to which the processing logic belongs.

[0081] (4) Partitioning scheme based on source code modification: This is also applicable to server applications that use an I / O multiplexing execution model, where multiple connections are interleaved within a single worker process based on operating system mechanisms (such as select, poll, or epoll). When the application does not provide a non-intrusive mechanism, the specified location of the application source code can be modified directly to implement the event logging function.

[0082] For example, if Figure 2 As shown in (b), a worker process interleaves two connections (connection 1 and connection 2). This solution inserts additional start and end partition boundaries (i.e., StartDelimiter and EndDelimiter) before and after the processing logic (i.e., Handler) in advance, so that the connection unit corresponding to each processing logic can be identified.

[0083] Table 1 shows four connection division methods applicable to mainstream server applications based on the research of the embodiments of the present application. The following will describe in detail how each distinction method is used in combination with a specific server application (such as Apache (an open source Web server software), PHP-FPM (PHP Fast CGI Process Manager, PHP (Hypertext Preprocessor, Hypertext Preprocessor) Fast CGI (Fast Common Gateway Interface, Fast Common Gateway Interface) Process Manager), Fast API (Fast Application Programming Interface, Fast Application Programming Interface), Nginx (a proxy server)).

[0084] Table 1

[0085]

[0086]

[0087] Among them, VSFTPD (Very Secure FTP Daemon); ProFTPD (Professional FTP Daemon); PostgreSQL (Postgres Structured Query Language, a free software object-relational database management system with a very complete set of features); asyncio, a library for writing single-threaded concurrent code in Python; Django, an advanced Python Web framework; Express.js, a minimalist and flexible web development framework based on the Node.js platform; libuv, a high-performance, cross-platform asynchronous I / O library; JavaScript, a scripting language running on the client; HAProxy (High Availability Proxy), an open source software project.

[0088] (ii) According to the selected log partitioning scheme, the application can be modified and deployed accordingly so that logs can be collected smoothly. Specifically, when the selected log partitioning scheme is a partitioning scheme based on application logs, it is necessary to complete the configuration of the application log format (for example, define the format, field and output method of the log, etc.); when the selected log partitioning scheme is a partitioning scheme based on plug-ins or source code modification, it is necessary to insert specific boundary printing codes into the source code of the application. Finally, use operating system services (such as Linux Auditd) to collect kernel audit logs.

[0089] (III) By identifying the boundaries in the logs, the server application logs are partitioned and a connection traceability graph is constructed, which specifically includes the following steps:

[0090] Step (1): Divide the server application into units and mark the connection units of the server application log.

[0091] Specifically, ① For partitioning schemes based on application logs, you can extract information such as timestamps, client IP, PID or TID from application logs (such as Web logs), and search for the start and end partition boundaries (such as accept and close system calls) in the audit log based on this information. After the search is completed, the events of the start and end partition boundaries are marked as a connection unit. ② For partitioning schemes based on audit logs, you can also traverse the audit logs and identify the start and end partition boundaries (such as accept and close system calls). After the search is completed, the events of the start and end partition boundaries are marked as a connection unit. ③ For partitioning schemes based on plug-ins and partitioning schemes based on source code modifications, you can identify the start and end partition boundaries inserted in the audit log, as well as the connection ID corresponding to the boundary, and mark the processing logic between the two partition boundaries as the connection unit corresponding to the ID.

[0092] Step (2): Based on the connection unit, obtain a complete event set for each user connection. Since the connection unit may not be able to fully capture all relevant events of the connection, for example, in FTP servers such as VSFTPD, the main process is responsible for accepting connections and generating sub-processes to handle each connection respectively. The unit division often focuses on the events of the main process, and therefore, events generated by these sub-processes may be missed. In order to solve this problem, the present application follows the path of the process control flow and incorporates the events generated by the sub-processes that handle the connection into the event sets of their respective corresponding connections. This ensures that the event set can accurately reflect all events related to each connection.

[0093] Step (3): Convert the event set corresponding to each connection into a connection traceability graph (CPG). Each connection traceability graph is a directed time sequence graph. Used to describe all system activities generated by user connections. is a collection of nodes, consisting of multiple entities, including three types: process, file, and socket. Each type of node has different attributes: the attribute of the process node is the execution path, the attribute of the file node is the file path, and the attribute of the socket node is the IP address and port. ε is the set of ordered events (edges) that occur between these entities during the connection process. Each event E∈ε can be expressed as a four-tuple <v src ,v cst ,e type ,t>, its components include the source node v src 、Target node v dst 、Event Type type ∈E TYPES and timestamp t. In the embodiment of the present application, E TYPESIncludes 97 event types, such as read, recvfrom, clone, etc.

[0094] In step S102, a preset machine learning model is used to perform anomaly detection on multiple connection traceability graphs to determine abnormal events, wherein the preset machine learning model is trained by a connection traceability graph data set generated by cache log data.

[0095] That is to say, by using a preset machine learning model, when a connection traceability graph is input into the model, anomaly detection analysis can be performed on multiple connection traceability graphs, so as to accurately identify abnormal events therein. The preset machine learning model can be trained by a connection traceability graph data set generated by cached log data. The specific training process will be explained in detail later.

[0096] The following describes in detail how to use the preset machine learning model to perform anomaly detection on multiple connection traceability graphs and identify abnormal events.

[0097] As a possible implementation method, in some embodiments, a preset machine learning model is used to perform anomaly detection on multiple connection tracing graphs to determine abnormal events, including: using an encoder in the preset machine learning model to embed the spatiotemporal information of each event in the multiple connection tracing graphs into a preset vector representation; using a decoder in the preset machine learning model to predict the type of event corresponding to the preset vector representation based on the preset vector representation to obtain a prediction result; calculating the error between the prediction result and the actual event type corresponding to the prediction result, and determining the abnormal event based on the error.

[0098] Among them, the preset machine learning model is GraphMixer-MLP (Multi Layer Perceptron), which consists of two parts: GraphMixer and MLP. GraphMixer is the encoder part of the model, and its function is to encode the event information (including information in two dimensions, space and time) in the time series graph (i.e., the connection traceability graph CPG) into an internal representation. MLP is the decoder part of the model, which can use the vector representation generated by GraphMixer to predict the type of event.

[0099] That is to say, first, using the encoder in the preset machine learning model, the spatiotemporal information of a given event in the connection traceability graph (i.e., an edge in the connection traceability graph) can be embedded into the vector representation (i.e., the preset vector representation) to create a vector for the event. Secondly, using the decoder in the preset machine learning model, the type of the event is predicted based on the preset vector representation corresponding to the event. Finally, anomalies are identified by calculating the error between the predicted type and the actual type of the event.

[0100] Next, we explain in detail how to use the encoder in the preset machine learning model to embed the spatiotemporal information of each event in multiple connection traceability graphs into a preset vector representation.

[0101] As a possible implementation method, in some embodiments, an encoder in a preset machine learning model is used to embed the spatiotemporal information of each event in multiple connection traceability graphs into a preset vector representation, including: based on a preset hierarchical feature hashing strategy, entities with similar hierarchical structures in each entity are encoded to obtain a first encoding result, wherein the first encoding result is a vector representation in the feature space that satisfies a preset distance relationship; based on a preset one-hot encoding strategy, each event is encoded to obtain a second encoding result, wherein the second encoding result is a vector representation of a corresponding dimension, wherein the corresponding dimension is equal to the total number of types of the corresponding event; based on the first encoding result and the second encoding result, the encoder in the preset machine learning model is used to embed the spatiotemporal information of each event into a preset vector representation.

[0102] Among them, the preset hierarchical feature hashing strategy is an encoding technology that can map strings with similar structures to points that are closer in the feature space, helping the model to identify and distinguish different entities or events. The preset one-hot encoding strategy is a technology that converts categorical variables into a format that can be understood by machine learning models. In one-hot encoding, each category is converted into a vector with a length equal to the total number of categories, with only one dimension in the vector being 1 and the rest being 0.

[0103] Specifically, given that the connection traceability graph is a time-series directed graph, the entities (i.e., nodes) and events (i.e., edges) therein can be encoded first. Entities include three categories: files, sockets, and executable files, and their corresponding attributes are file paths, IP addresses and port numbers, and executable file paths, respectively. Encoding entities is essentially encoding these attributes. For entity attributes presented in the form of strings, a preset hierarchical feature hashing strategy can be used to embed them into a vector space of fixed length to obtain the first encoding result. This method ensures that attributes with similar hierarchical structures (for example, similar directory paths, similar IP addresses, etc.) are encoded as vectors with similar distances in the feature space. For example, / data / html / index.html and / data / html / about.html will generate similar vector representations, while the vector representation of / etc / passwd is far away. Similarly, the vector representations of IP addresses 192.168.0.1 and 192.168.0.2 are close, but the vector representations of IP addresses 192.168.0.1 are far away. This helps the model effectively detect abnormal behavior when attackers try to access uncommon directories. It is worth noting that the embodiment of the present application does not use the entity type attribute in this process, which simplifies the prediction process of event types between entities. The encoding feature of entity i is

[0104] For event attributes, a preset unique hot encoding strategy can be used to map its type into a d-dimensional vector space (d represents the total number of types) to obtain a second encoding result. In this vector, each dimension corresponds to a specific type. For example, if the third dimension is set to represent the read type, then when encoding events belonging to the read type, a vector of length d will be generated, the third dimension of the vector is assigned a value of 1, and the remaining dimensions are assigned a value of 0. In the embodiment of the present application, the feature mark of event e after encoding is x e .

[0105] Finally, the first encoding result and the second encoding result are combined, and the encoder function in the preset machine learning model is used to further embed the spatiotemporal information of each event into a preset vector representation space. Through this series of encoding processing, the spatiotemporal information of the event can be effectively converted into a structured vector representation, which facilitates further analysis and processing.

[0106] In step S103, the abnormal event is displayed as a potential attack factor, and an attack summary including attack details and a complete attack process is generated based on the abnormal event.

[0107] That is to say, after identifying an abnormal event, the connection traceability graphs containing too many abnormal events can be reported, and the abnormal events can be highlighted. Then, starting from the connection traceability graph containing the abnormal event, all connection traceability graphs that have dependencies with it can be iteratively identified. Finally, these connection traceability graphs are integrated into a complete attack summary and presented so that security experts can conduct in-depth analysis of the attack details and the complete attack process.

[0108] Among them, for the step of displaying abnormal events as potential attack factors, similar to other methods, this application is constructed based on a basic understanding that attack events will cause more significant prediction errors. Accordingly, the embodiment of the present application determines whether an event is abnormal by checking the following two criteria: (1) The prediction error of the event must exceed the preset threshold ∈; (2) The source node and destination node of the event must not be in the whitelist. Regarding the setting of the threshold ∈, it is based on calculations on a verification data set that only contains benign connection traceability graphs. Specifically, for each connection traceability graph, the top m% of events with the highest prediction errors can be screened out, and the top n% of events can be further selected from them. Subsequently, the mean mean and standard deviation std of these errors are calculated, and the threshold is set to ∈=mean+3*std. In addition, when the number of abnormal events in the connection traceability graph exceeds the established threshold T k , the connection traceability diagram will be automatically judged as abnormal and the corresponding alarm mechanism will be triggered.

[0109] The following will explain in detail how to generate an attack summary containing attack details and the complete attack process based on abnormal events.

[0110] As a possible implementation method, in some embodiments, an attack summary containing attack details and a complete attack process is generated based on an abnormal event, including: determining the dependency relationship between multiple connection traceability graphs based on the entity equivalence principle and the data flow between multiple connection traceability graphs; determining an abnormal connection traceability graph associated with the abnormal event based on the dependency relationship between the abnormal event and multiple connection traceability graphs; integrating the abnormal connection traceability graphs to generate an attack summary containing attack details and a complete attack process.

[0111] That is to say, in order to effectively identify and respond to abnormal events, a method based on the principle of entity equivalence is proposed. This method can accurately determine the dependencies between multiple connection traceability graphs by analyzing the data flow between these graphs. By deeply analyzing the dependencies between these graphs, we can better understand the data flow pattern in the network, thereby providing strong support for subsequent anomaly detection and event response. Furthermore, based on the dependencies between abnormal events and multiple connection traceability graphs, the abnormal connection traceability graphs associated with specific abnormal events can be determined. These abnormal connection traceability graphs usually contain data flow paths directly related to the abnormal events. Finally, by integrating these abnormal connection traceability graphs, an attack summary containing attack details and the complete attack process can be generated. This attack summary describes each step of the attack in detail.

[0112] Specifically, when an abnormal connection traceability graph is detected, an attack factor can be automatically generated to explain the triggered alarm. The attack factor is generated by excluding regular benign events (e.g., logging events) that are not directly related to the attack behavior. Specifically, if a file node v meets the following two criteria, it can be removed from consideration:

[0113] (1) Its frequency f v Exceeds the preset threshold T f .f v The calculation is based on the following formula:

[0114]

[0115] Among them, CPG(v) is the number of benign connection traceability graphs containing node v, and CPG represents the total number of benign connection traceability graphs.

[0116] (2) The prediction errors of all interaction events related to node v are lower than the threshold T e In the embodiment of the present application, T can be set e Equal to the mean of all interaction event prediction errors.

[0117] This filtering mechanism is designed to retain only the most characteristic events as attack indicators, making it easier for analysts to quickly grasp the core information of the alert. In addition, an optional function is provided to merge events originating from the same source and destination nodes to further refine the attack indicators.

[0118] Furthermore, in some embodiments, before using a preset machine learning model to perform anomaly detection on multiple connection tracing graphs and determining abnormal events, it also includes: obtaining cached log data, and generating a connection tracing graph data set based on the cached log data; preprocessing the connection tracing graph data set, and dividing the preprocessed connection tracing graph data set into a training set and a verification set; using the training set to train a preset neural network to obtain an initial machine learning model, and using the verification set to verify the initial machine learning model until the initial machine learning model meets preset standards, and then ending the iterative training of the initial machine learning model to obtain the preset machine learning model, otherwise adjusting the model parameters and continuing the iterative training.

[0119] That is, by obtaining cache log data, a connection traceability graph dataset can be generated based on the cache log data. This data contains detailed information about network connections over a period of time in the past, which helps to better understand the normal pattern of network behavior. Then, these connection traceability graph datasets are preprocessed. The purpose of preprocessing is to clean and standardize the data to ensure data quality. This may include operations such as removing noise, filling missing values, and converting data formats. The preprocessed data will be more suitable for training machine learning models. Next, the preprocessed connection traceability graph dataset is divided into a training set and a validation set. The training set is used to train the machine learning model, while the validation set is used to evaluate the performance of the model. In this way, the model parameters can be continuously adjusted during the model training process to improve the accuracy and generalization ability of the model. The preset neural network is trained using the training set to obtain the initial machine learning model. During the training process, the weights and biases of the neural network are continuously adjusted to minimize the prediction error. Through multiple iterations, the model gradually learns the laws and patterns in the data. During the training process, the initial machine learning model also needs to be validated using the validation set. By evaluating the performance of the model on the validation set, the generalization ability of the model, that is, the performance of the model on unseen data, can be understood. If the model meets the preset standards, such as reaching a certain accuracy or error rate, then the iterative training of the initial machine learning model can be ended to obtain the final preset machine learning model. If the initial machine learning model fails to meet the preset standards, the model parameters need to be adjusted and then iterative training continues. This may include adjusting the learning rate, changing the network structure, increasing or decreasing the number of layers, and other operations. Through continuous optimization and adjustment, a machine learning model with excellent performance is finally obtained, which is used to perform anomaly detection on multiple connection traceability graphs, thereby effectively identifying abnormal events.

[0120] Specifically, in the embodiment of the present application, the preset machine learning model is GraphMixer-MLP, where GraphMixer is an encoder that connects any event e in the traceability graph. t∈E (t is the timestamp of the event), GraphMixer can aggregate the event e t The spatiotemporal information of its surrounding area at time t, which covers its one-hop neighbors and the connections between these neighbors and event e t The historical interaction information of t Then, the MLP can be used as a decoder to use the representation z t To predict the event t The probability distribution of the type.

[0121] Next, we will introduce how to get z t .

[0122] z t The representation h derived from the event source node t (v src ) and the representation of the destination node h t (v dst ), the combination is as follows: t =concat(h t (v src ),h t (v dst )). Specifically, h t (i) The spatial feature s of node i at time t t (i) and the interaction feature g t (i) Composition:

[0123] Spatial features t (i) describes the neighbor information of node i at time t. By obtaining all one-hop neighbors of node i with interaction events within the time range T0 Aggregate its original features and add them to the original features of entity i to get s t (i)

[0124]

[0125] Interaction feature g t (i) describes the temporal event information of node i at time t. By retrieving the latest K events ε(i; t) related to node i before time t (excluding e t ). For each event e∈ε(i; t), cos((tt′)ω) is used to encode the time interval between its occurrence time t′ and the current time t, and it is combined with the original feature x of the event. e Stitching:

[0126] H e =concat(cos((tt′)ω),x e ).

[0127] Stack them up to get X and perform zero-padding to make it of length K. Then, use MLP-mixer to generate the interaction feature g t (i)

[0128] X=stack({H e |e∈ε(i;t)});

[0129] g t (i) = Mean(MLPMixer(X)).

[0130] Finally, s t (i) and g t (i) Splicing, we can get h t (i)

[0131] h t (i) = concat(s t (i), g t (i)).

[0132] The decoding method is described below.

[0133] Based on the MLP part of the preset machine learning model, t As input, a probability distribution vector of length d can be output. Each element in the vector corresponds to an event type, indicating that event e t is the probability of this type. By calculating the event e t The original characteristics The cross entropy between the predicted result and the predicted result can determine the prediction error and use it as the loss value.

[0134]

[0135] The design of this application has the following significant advantages. First, it can capture the interaction relationship between entities (which is derived from spatial features) and integrate structural information into the model accordingly. Secondly, by selecting the most recent interaction for sampling, the design effectively integrates temporal information (this information comes from nodes and interaction events), and can learn the dynamic sequence of system entities and events, thereby enhancing the effectiveness of the model. Finally, event-level prediction is achieved, providing a finer granularity for anomaly detection.

[0136] For example, in the process of training the model, the i-th event e i For example, it will happen in e i The previous partial connection traceability graph (containing only the 1st to (i-1)th events) is input into the encoder of the preset machine learning model, and the encoder outputs e iThe spatiotemporal representations of the source and target nodes are then concatenated and fed into the decoder of the pre-set machine learning model to predict e i Then, the preset machine learning model is updated according to the prediction error, and this process is iterated to complete the training of the preset machine learning model.

[0137] To facilitate those skilled in the art to further understand the intrusion detection and forensic analysis method for server applications proposed in the embodiments of the present application, it is further elaborated below with examples.

[0138] Assume that Tom's server is running two long-running server programs, namely, Nginx and PHP-FPM. Figure 3 As shown, the method proposed in the embodiment of the present application can divide its events into connection traceability graphs numbered ① to ⑩ according to the connection, and check them one by one. In each connection traceability graph, a preset machine learning model can be used to predict the type of each event in chronological order, and anomalies can be detected based on the prediction error. For example, when checking the connection traceability graph ⑧, the event e is predicted in sequence. 15 To e 19 , which correctly predicted event e 15 and e 16 type, but for events that deviate from benign behavior patterns 17 -e 19 A large prediction error is generated, so the connection traceability graph⑧ is marked as abnormal. Then, these abnormal events (edges) are highlighted as attack factors, and the attack investigation continues, tracing other connections related to the attack factors through information flow dependencies. For example, the connection traceability graph⑧ contains a write operation to the file wqnf.txt (i.e. event e 19 ), and the connection traceability graph ⑩ then reads this file (i.e. event e 23 ), which indicates the dependency of data flow. Therefore, the connection traceability graph ⑩ is incorporated into the attack story. Similarly, the process can also incorporate the connection traceability graphs ①, ②, and ⑥. Finally, the complete attack chain is obtained, including Trojan horse image upload and confidential file download, while events unrelated to the attack factor are excluded from the attack summary (for example, e 12 、e 13 ).

[0139] It is understandable that a complete attack process includes both abnormal behaviors and the preparations to perform these behaviors. A very likely scenario is that the abnormal behaviors are present in the abnormal connection traceability graph, while the preparations are scattered in the benign connection traceability graph. Although these benign connections lack abnormal operations, they are equally important for forensic analysis and can help security experts sort out the attack chain and identify attackers. Therefore, reconstructing the complete attack story requires starting from the abnormal connection traceability graph and iteratively identifying all related connection traceability graphs (whether benign or abnormal) with dependencies, thereby revealing the entire set of connection traceability graphs related to the attack.

[0140] like Figure 4 The algorithm shown in the figure summarizes an attack investigation process of an embodiment of the present application. Before the attack investigation, on the premise of mastering the data flow of all connection traceability graphs, the entity objects and interaction time (such as Figure 4 Then, starting from the abnormal connection traceability graph, identify other connection traceability graphs with data flow dependencies (such as Figure 4 3-19 of ), and update the search entry (such as Figure 4 In this process, in order to prevent the introduction of irrelevant connection traceability graphs due to common dependencies such as log files and library files, the embodiment of the present application can also allow security experts to control the frequency of occurrence of common files or socket entities (such as Figure 4 The search will continue until no new connection traceability graph is found or the maximum number of iterations is reached (such as Figure 4 Finally, all identified connection traceability graphs are integrated into a comprehensive traceability graph to represent the complete attack story.

[0141] In order to implement the above process, the embodiment of the present application can collect audit logs by using the Linux audit system Auditd (an audit daemon in the Linux operating system, responsible for recording various security-related events on the system, such as file access, system call, user login and logout, etc.). In addition, a Linux kernel module is specially developed to supplement the additional information that Auditd fails to capture, such as thread ID, local IP address and local port number.

[0142] The embodiment of the present application can implement the above process using about 8000 lines of Python code. For the log-based method, a dual-pointer-based stream processing framework is designed, which can accurately map the extracted connection partitioning information to the audit log and mark the event accordingly. For the code insertion-based method, a series of special parsers are developed, which can accurately divide events by reading the partition boundaries in each application audit log. It is worth noting that unoccupied system call numbers are used in all inserted partition boundaries to ensure the unambiguity in the data stream. The connection traceability graph generation module has uniformity. The connection traceability graph anomaly detection module is implemented based on PyG (PyTorchGeometric, a library for graph neural network (Graph Neural Network, referred to as GNN)), and its source code is derived from the open source project of GraphMixer. In addition, the time sampler in the TGL framework is also used, and the connection traceability graph data is stored in the Neo4j database (a graph database). This design enables security experts to easily browse and analyze results during the attack investigation phase.

[0143] The intrusion detection and forensic analysis method for server applications proposed in the embodiments of the present application has been evaluated on 9 server scenario data sets. These data sets cover widely used server applications and frameworks, and their scenarios are derived from previous research results and known security vulnerabilities. Through comparative analysis with the industry's most advanced intrusion detection systems ProvDetector and KAIROS, the experimental results show that the present application can effectively detect malicious connections (average precision of 0.95, recall rate of 1.00), and can provide accurate attack factors (F1 score of 0.906), and its performance indicators are better than ProvDetector and KAIROS. In addition, the method of the present application also has the ability to reconstruct the complete attack process, which can provide strong support for security experts in attack tracing.

[0144] According to the intrusion detection and forensic analysis method for server applications proposed in the embodiment of the present application, by obtaining the connection division information between the user and multiple target server applications in the audit log, multiple connection traceability graphs can be constructed based on the connection division information; by using the preset machine learning model, multiple connection traceability graphs are detected for abnormality, and abnormal events can be determined; abnormal events are displayed as potential attack factors, and an attack summary containing attack details and a complete attack process is generated based on the abnormal events. Therefore, by utilizing the connection-oriented characteristics of the server application and identifying attacks with connections as detection units, the problems of the existing technology such as the difficulty in processing large-scale log data, insufficient detection accuracy leading to alarm fatigue, and difficulty in attack investigation are solved, thereby improving the detection performance.

[0145] Next, an intrusion detection and forensic analysis device for server applications proposed according to an embodiment of the present application will be described with reference to the accompanying drawings.

[0146] Figure 5 It is a block diagram of an intrusion detection and forensic analysis device for server applications according to an embodiment of the present application.

[0147] like Figure 5 As shown, the intrusion detection and forensic analysis device for server applications includes:

[0148] The construction module 100 is used to obtain the connection division information between the user and multiple target server applications in the log, and to construct multiple connection traceability graphs based on the connection division information;

[0149] The detection module 200 is used to perform anomaly detection on multiple connection traceability graphs using a preset machine learning model to determine abnormal events, wherein the preset machine learning model is trained by a connection traceability graph data set generated by cache log data;

[0150] The generating module 300 is used to display the abnormal event as a potential attack factor and generate an attack summary including attack details and a complete attack process based on the abnormal event.

[0151] According to one embodiment of the present application, the construction module 100 is specifically used for:

[0152] Divide the log based on the connection division information to obtain multiple connection units;

[0153] Based on multiple connection units, multiple connection traceability graphs are constructed.

[0154] According to one embodiment of the present application, the detection module 200 includes:

[0155] An encoding unit, used to embed the spatiotemporal information of each event in the plurality of connection traceability graphs into a preset vector representation using an encoder in a preset machine learning model;

[0156] A prediction unit, configured to use a decoder in a preset machine learning model to predict a type of event corresponding to a preset vector representation based on a preset vector representation, and obtain a prediction result;

[0157] The calculation unit is used to calculate the error between the prediction result and the actual event type corresponding to the prediction result, and determine the abnormal event based on the error.

[0158] According to one embodiment of the present application, the encoding unit is specifically used to:

[0159] Based on a preset hierarchical feature hashing strategy, entities with similar hierarchical structures in each entity are encoded to obtain a first encoding result, wherein the first encoding result is a vector representation that satisfies a preset distance relationship in the feature space;

[0160] Based on a preset one-hot encoding strategy, encode each event to obtain a second encoding result, wherein the second encoding result is a vector representation of a corresponding dimension, wherein the corresponding dimension is equal to the total number of types of the corresponding event;

[0161] Based on the first encoding result and the second encoding result, the temporal and spatial information of each event is embedded into a preset vector representation using an encoder in a preset machine learning model.

[0162] According to an embodiment of the present application, before performing anomaly detection on multiple connection traceability graphs using a preset machine learning model to determine an abnormal event, the detection module 200 is further used to:

[0163] Obtain cache log data and generate a connection traceability graph dataset based on the cache log data;

[0164] Preprocess the connection traceability graph dataset, and divide the preprocessed connection traceability graph dataset into a training set and a validation set;

[0165] Use the training set to train the preset neural network to obtain the initial machine learning model, and use the validation set to verify the initial machine learning model until the initial machine learning model meets the preset standards. End the iterative training of the initial machine learning model to obtain the preset machine learning model, otherwise continue the iterative training after adjusting the model parameters.

[0166] According to one embodiment of the present application, the generating module 300 is specifically used for:

[0167] Determine the dependency relationship between multiple connection traceability graphs based on the entity equivalence principle and the data flow between multiple connection traceability graphs;

[0168] Based on the dependency relationship between the abnormal event and the multiple connection traceability graphs, determine the abnormal connection traceability graph associated with the abnormal event;

[0169] Integrate abnormal connection tracing graphs to generate attack summaries that include attack details and the complete attack process.

[0170] It should be noted that the aforementioned explanation of the embodiment of the intrusion detection and forensic analysis method for server applications is also applicable to the intrusion detection and forensic analysis device for server applications of this embodiment, and will not be repeated here.

[0171] According to the intrusion detection and forensic analysis device for server applications proposed in the embodiment of the present application, by obtaining the connection division information between the user and multiple target server applications in the audit log, multiple connection traceability graphs can be constructed based on the connection division information; by using the preset machine learning model, multiple connection traceability graphs are detected for abnormality, and abnormal events can be determined; abnormal events are displayed as potential attack factors, and an attack summary containing attack details and a complete attack process is generated based on the abnormal events. Therefore, by utilizing the connection-oriented characteristics of the server application and identifying attacks with connections as detection units, the problems of the existing technology such as the difficulty in processing large-scale log data, insufficient detection accuracy leading to alarm fatigue, and difficulty in attack investigation are solved, thereby improving the detection performance.

[0172] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device may include:

[0173] A memory 601 , a processor 602 , and a computer program stored in the memory 601 and executable on the processor 602 .

[0174] When the processor 602 executes the program, the intrusion detection and forensic analysis method for server applications provided in the above embodiment is implemented.

[0175] Furthermore, the electronic device further comprises:

[0176] The communication interface 603 is used for communication between the memory 601 and the processor 602 .

[0177] The memory 601 is used to store computer programs that can be executed on the processor 602 .

[0178] The memory 601 may include a high-speed RAM (Random Access Memory) memory, and may also include a non-volatile memory, such as at least one disk memory.

[0179] If the memory 601, the processor 602 and the communication interface 603 are implemented independently, the communication interface 603, the memory 601 and the processor 602 can be connected to each other through a bus and communicate with each other. The bus can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0180] Optionally, in a specific implementation, if the memory 601, the processor 602 and the communication interface 603 are integrated on a chip, the memory 601, the processor 602 and the communication interface 603 can communicate with each other through an internal interface.

[0181] The processor 602 may be a CPU (Central Processing Unit), or an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiments of the present application.

[0182] An embodiment of the present application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-mentioned intrusion detection and forensic analysis method for server applications.

[0183] An embodiment of the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the above-mentioned intrusion detection and forensic analysis method for server applications.

[0184] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0185] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms are not necessarily directed to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0186] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A method for intrusion detection and forensic analysis of server applications, characterized in that: The following steps are involved: Acquire connection partition information between the user and multiple target server applications in the log, and construct multiple connection traceability graphs based on the connection partition information; Using a preset machine learning model, anomaly detection is performed on the multiple connection traceability graphs to determine abnormal events, wherein the preset machine learning model is trained by a connection traceability graph data set generated by cache log data; The abnormal event is displayed as a potential attack factor, and an attack summary including attack details and a complete attack process is generated based on the abnormal event.

2. The method according to claim 1, characterized in that The constructing a connection traceability graph based on the connection partitioning information includes: Dividing the log based on the connection division information to obtain a plurality of connection units; Based on the multiple connection units, the multiple connection traceability graphs are constructed.

3. The method according to claim 1, characterized in that The using a preset machine learning model to perform anomaly detection on the multiple connection traceability graphs to determine abnormal events includes: Using the encoder in the preset machine learning model, embedding the spatiotemporal information of each event in the plurality of connection traceability graphs into a preset vector representation; Using a decoder in the preset machine learning model, based on the preset vector representation, predict the type of event corresponding to the preset vector representation to obtain a prediction result; An error between the prediction result and an actual event type corresponding to the prediction result is calculated, and the abnormal event is determined based on the error.

4. The method according to claim 3, characterized in that The using the encoder in the preset machine learning model to embed the spatiotemporal information of each event in the plurality of connection traceability graphs into a preset vector representation includes: Based on a preset hierarchical feature hashing strategy, encode entities with similar hierarchical structures in each of the entities to obtain a first encoding result, wherein the first encoding result is a vector representation that satisfies a preset distance relationship in the feature space; Based on a preset one-hot encoding strategy, encode each of the events to obtain a second encoding result, wherein the second encoding result is a vector representation of a corresponding dimension, wherein the corresponding dimension is equal to the total number of types of the corresponding event; Based on the first encoding result and the second encoding result, the encoder in the preset machine learning model is used to embed the spatiotemporal information of each event into the preset vector representation.

5. The method according to claim 1, characterized in that Before using the preset machine learning model to perform anomaly detection on the multiple connection traceability graphs to determine the abnormal event, the method further includes: Acquire the cache log data, and generate the connection tracing graph data set based on the cache log data; Preprocessing the connection traceability graph dataset, and dividing the preprocessed connection traceability graph dataset into a training set and a validation set; The preset neural network is trained using the training set to obtain an initial machine learning model, and the initial machine learning model is verified using the verification set until the initial machine learning model meets the preset criteria, and the iterative training of the initial machine learning model is terminated to obtain the preset machine learning model, otherwise the iterative training continues after adjusting the model parameters.

6. The method according to claim 1, characterized in that The generating of an attack summary including attack details and a complete attack process based on the abnormal event includes: Determine the dependency relationship between the plurality of connection traceability graphs based on the entity equivalence principle and the data flows between the plurality of connection traceability graphs; Determine an abnormal connection tracing graph associated with the abnormal event based on a dependency relationship between the abnormal event and the plurality of connection tracing graphs; The abnormal connection source tracing diagram is integrated to generate the attack summary including the attack details and the complete attack process.

7. An intrusion detection and forensic analysis device for server applications, characterized in that: include: A construction module is used to obtain connection division information between a user and multiple target server applications in the audit log, and to construct multiple connection tracing graphs based on the connection division information; A detection module, used to perform anomaly detection on the plurality of connection traceability graphs and determine abnormal events using a preset machine learning model, wherein the preset machine learning model is trained by a connection traceability graph data set generated by cache log data; The generation module is used to display the abnormal event as a potential attack factor and generate an attack summary including attack details and a complete attack process based on the abnormal event.

8. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the intrusion detection and forensic analysis method for server applications as described in any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the intrusion detection and forensic analysis method for server applications as described in any one of claims 1 to 6.

10. A computer program product, characterized in that It comprises a computer program, which, when executed by a processor, is used to implement the intrusion detection and forensic analysis method for server applications as described in any one of claims 1 to 6.

Images