Server application oriented intrusion detection and forensic analysis method and apparatus

Abstract

The application relates to the technical field of Internet security, in particular to a server application-oriented intrusion detection and evidence analysis method and device. The method comprises the following steps: acquiring connection division information between a user and a plurality of target server applications in a log, and constructing a plurality of connection tracing graphs based on the connection division information; performing abnormality detection on the plurality of connection tracing graphs by using a preset machine learning model to determine an abnormal event, wherein the preset machine learning model is obtained by training connection tracing graph data sets generated by cache log data; and displaying the abnormal event as a potential attack factor, and generating an attack summary containing attack details and a complete attack process based on the abnormal event. Thus, by using the connection-oriented characteristics of the server application, the attack is identified by taking the connection as a detection unit, the problems that the existing technology is difficult to process large-scale log data, the detection accuracy is insufficient, the alarm fatigue is caused, and the attack investigation is difficult are solved, and the detection performance is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet security, and in particular relates to a server application-oriented intrusion detection and forensic analysis method and device. BACKGROUND

[0002] Servers are the basic components of information storage and services. With the explosive growth of Internet services, the security risks they face continue to increase, affecting the normal operation of organizations and user trust. Trace graphs are introduced as analysis tools and widely used in intrusion detection fields, which can help security experts identify intrusion behavior in time and take defensive measures, thereby reducing the risk of data leakage and system hacking.

[0003] However, existing threat discovery still faces many challenges, including the pressure of large-scale log data processing, insufficient detection accuracy leading to alarm fatigue, and attack investigation difficulties, which affect the effect of timely response and defense, and need to be solved urgently. SUMMARY

[0004] The present application provides a server application-oriented intrusion detection and forensic analysis method and device to solve the problems of difficulty in large-scale log data processing, insufficient detection accuracy leading to alarm fatigue, and attack investigation difficulty in the prior art, thereby improving detection performance.

[0005] To achieve the above-mentioned purpose, the first aspect of the present application provides a server application-oriented intrusion detection and forensic analysis method, comprising the following steps:

[0006] Obtain connection division information between users and multiple target server application programs in logs, and construct multiple connection trace graphs based on the connection division information;

[0007] Use a preset machine learning model to perform anomaly detection on the multiple connection trace graphs to determine abnormal events, wherein the preset machine learning model is trained by a connection trace graph dataset generated by cache log data;

[0008] Display the abnormal events as potential attack factors, and generate an attack summary containing attack details and complete attack processes based on the abnormal events.

[0009] According to an embodiment of the present application, the connection trace graph is constructed based on the connection division information, which comprises:

[0010] Divide the logs based on the connection division information to obtain multiple connection units;

[0011] Based on the multiple connection units, the multiple connection trace graphs are constructed.

[0012] According to an embodiment of the present application, the abnormal event is determined by using the preset machine learning model to perform anomaly detection on the plurality of connection trace graphs, comprising:

[0013] The spatio-temporal information of each event in the plurality of connection trace graphs is embedded into a preset vector representation by using an encoder in the preset machine learning model.

[0014] The type of the event corresponding to the preset vector representation is predicted based on the preset vector representation by using a decoder in the preset machine learning model, to obtain a prediction result.

[0015] An error between the prediction result and an actual event type corresponding to the prediction result is calculated, and the abnormal event is determined based on the error.

[0016] According to an embodiment of the present application, the spatio-temporal information of each event in the plurality of connection trace graphs is embedded into a preset vector representation by using an encoder in the preset machine learning model, comprising:

[0017] The entities with similar hierarchical structures in the each entity are encoded based on a preset hierarchical feature hashing strategy, to obtain a first encoding result, wherein the first encoding result is a vector representation in a feature space satisfying a preset distance relationship.

[0018] The each event is encoded based on a preset one-hot encoding strategy, to obtain a second encoding result, wherein the second encoding result is a vector representation of a corresponding dimension, wherein the corresponding dimension is equal to a total number of types of corresponding events.

[0019] The spatio-temporal information of the each event is embedded into the preset vector representation by using the encoder in the preset machine learning model based on the first encoding result and the second encoding result.

[0020] According to an embodiment of the present application, before the abnormal event is determined by using the preset machine learning model to perform anomaly detection on the plurality of connection trace graphs, further comprising:

[0021] The cache log data is obtained, and the connection trace graph data set is generated based on the cache log data.

[0022] The connection trace graph data set is preprocessed, and the preprocessed connection trace graph data set is divided into a training set and a validation set.

[0023] The initial machine learning model is iteratively trained until the initial machine learning model meets a preset standard, and the preset machine learning model is obtained.

[0024] According to an embodiment of the present application, the attack summary containing attack details and a complete attack process is generated based on the abnormal event, including:

[0025] Based on the entity equivalence principle and the data flow between the multiple connection tracing graphs, a dependency relationship between the multiple connection tracing graphs is determined.

[0026] Based on the dependency relationship between the abnormal event and the multiple connection tracing graphs, an abnormal connection tracing graph associated with the abnormal event is determined.

[0027] The abnormal connection tracing graph is integrated to generate the attack summary containing attack details and a complete attack process.

[0028] According to the server application-oriented intrusion detection and forensic analysis method proposed in the embodiments of the present application, by obtaining connection division information between users and multiple target server applications in audit logs, multiple connection tracing graphs can be constructed based on the connection division information. By utilizing a preset machine learning model, abnormal events can be determined by performing abnormal detection on the multiple connection tracing graphs. The abnormal events are displayed as potential attack factors, and an attack summary containing attack details and a complete attack process is generated based on the abnormal events. Thus, by utilizing the connection-oriented characteristics of server applications, attacks are identified by taking connections as detection units, and the problems of difficulty in processing large-scale log data, insufficient detection accuracy leading to alarm fatigue, and difficulty in attack investigation in the prior art are solved, thereby improving detection performance.

[0029] To achieve the above-mentioned purpose, the second aspect of the present application proposes a server application-oriented intrusion detection and forensic analysis device, comprising:

[0030] The construction module is configured to obtain connection division information between users and multiple target server applications in logs, and construct multiple connection tracing graphs based on the connection division information.

[0031] The detection module is configured to utilize a preset machine learning model to perform abnormal detection on the multiple connection tracing graphs and determine abnormal events, wherein the preset machine learning model is trained by connection tracing graph data sets generated by buffered log data.

[0032] The generating module is configured to display the abnormal event as a potential attack factor, and generate an attack summary including attack details and a complete attack process based on the abnormal event.

[0033] According to an embodiment of the present application, the constructing module is specifically configured to:

[0034] divide the log based on the connection division information to obtain a plurality of connection units;

[0035] construct the plurality of connection trace graphs based on the plurality of connection units.

[0036] According to an embodiment of the present application, the detecting module comprises:

[0037] The encoding unit is configured to embed spatiotemporal information of each event in the plurality of connection trace graphs into a preset vector representation by using an encoder in the preset machine learning model.

[0038] The prediction unit is configured to predict a type of an event corresponding to the preset vector representation based on the preset vector representation by using a decoder in the preset machine learning model to obtain a prediction result.

[0039] The computing unit is configured to calculate an error between the prediction result and an actual event type corresponding to the prediction result, and determine the abnormal event based on the error.

[0040] According to an embodiment of the present application, the encoding unit is specifically configured to:

[0041] encode entities with similar hierarchical structures in the each entity based on a preset hierarchical feature hashing strategy to obtain a first encoding result, wherein the first encoding result is a vector representation in a feature space satisfying a preset distance relationship;

[0042] encode the each event based on a preset one-hot encoding strategy to obtain a second encoding result, wherein the second encoding result is a vector representation of a corresponding dimension, and the corresponding dimension is equal to a total number of types of corresponding events;

[0043] embed spatiotemporal information of the each event into the preset vector representation by using an encoder in the preset machine learning model based on the first encoding result and the second encoding result.

[0044] According to an embodiment of the present application, before the detecting module is configured to perform anomaly detection on the plurality of connection trace graphs by using the preset machine learning model to determine the abnormal event, the detecting module is further configured to:

[0045] obtaining the cache log data, and generating the connection trace graph dataset based on the cache log data;

[0046] preprocessing the connection trace graph dataset, and dividing the preprocessed connection trace graph dataset into a training set and a validation set;

[0047] training a preset neural network using the training set to obtain an initial machine learning model, and verifying the initial machine learning model using the validation set until the initial machine learning model meets a preset standard, ending the iterative training of the initial machine learning model to obtain the preset machine learning model, or otherwise adjusting model parameters and continuing the iterative training.

[0048] According to an embodiment of the present application, the generating module is specifically configured to:

[0049] determining a dependency relationship between the multiple connection trace graphs based on an entity equivalence principle and data flow between the multiple connection trace graphs;

[0050] determining an abnormal connection trace graph associated with the abnormal event based on the abnormal event and the dependency relationship between the multiple connection trace graphs;

[0051] integrating the abnormal connection trace graph to generate an attack summary containing attack details and a complete attack process.

[0052] According to the server application-oriented intrusion detection and forensic analysis apparatus provided by the embodiments of the present application, by obtaining connection division information between a user and multiple target server application programs in audit logs, multiple connection trace graphs can be constructed based on the connection division information. By utilizing a preset machine learning model, abnormal detection can be performed on the multiple connection trace graphs, and an abnormal event can be determined. The abnormal event is displayed as a potential attack factor, and an attack summary containing attack details and a complete attack process is generated based on the abnormal event. Thus, by utilizing the connection-oriented characteristics of server application programs, attacks are identified by taking connections as detection units, and the problems of difficulty in processing large-scale log data, insufficient detection accuracy leading to alarm fatigue, and difficulty in attack investigation in the prior art are solved, thereby improving detection performance.

[0053] To achieve the above object, a third aspect of the embodiments of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor executes the program to implement the server application-oriented intrusion detection and forensic analysis method as described in the above embodiments.

[0054] To achieve the above object, the fourth aspect of the present application provides a computer readable storage medium, which stores a computer program. The computer program is executed by a processor to implement the server application-oriented intrusion detection and forensic analysis method.

[0055] To achieve the above object, the fifth aspect of the present application provides a computer program product, which comprises a computer program. The computer program is executed by a processor to implement the server application-oriented intrusion detection and forensic analysis method.

[0056] Additional aspects and advantages of the present application will be made apparent by the following description and the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0057] The above and / or additional aspects and advantages of the present application will become apparent and be readily appreciated from the following description, including the accompanying drawings.

[0058] Figure 1 A flow chart of a server application-oriented intrusion detection and forensic analysis method according to an embodiment of the present application;

[0059] FIG. 2(a) is a schematic diagram of a partition method for a case that one worker process processes two connections (connection 1 and connection 2) in sequence based on audit logs according to an embodiment of the present application;

[0060] FIG. 2(b) is a schematic diagram of a partition method for a case that one worker process processes two connections (connection 1 and connection 2) in interleaving based on audit logs according to an embodiment of the present application;

[0061] Figure 3 A schematic diagram of a connection trace graph according to an embodiment of the present application;

[0062] Figure 4 A schematic diagram of an algorithm overview of an attack investigation according to an embodiment of the present application;

[0063] Figure 5 A block schematic diagram of a server application-oriented intrusion detection and forensic analysis apparatus according to an embodiment of the present application;

[0064] Figure 6 A schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0065] Embodiments of the present application are described below in detail, examples of which are shown in the accompanying drawings, wherein the same or similar notations represent the same or similar elements or elements having the same or similar functions throughout. The embodiments described below by reference to the drawings are exemplary and are intended to explain the present application, and cannot be understood as limiting the present application.

[0066] A server application-oriented intrusion detection and forensic analysis method and device are described below with reference to the accompanying drawings according to embodiments of the present application.

[0067] Figure 1 A flowchart of a server application-oriented intrusion detection and forensic analysis method according to an embodiment of the present application.

[0068] It can be understood that embodiments of the present application are based on an observation that a server program usually needs to handle requirements from multiple users at the same time. Each user establishes a separate connection with the server, and various operations are performed in this connection. This design ensures that the activities of different users do not interfere with each other, and each user operates in his own "small world". The behavior of most users is normal, but some users may have malicious behavior, and their behavior patterns will be significantly different from those of ordinary users. This difference can better monitor and review the activities of the server. It is inspired by this that embodiments of the present application propose a server application-oriented intrusion detection and forensic analysis method, which divides the logs received by the server according to each connection, regards all events occurring in a connection as a whole unit (i.e., a connection trace graph mentioned below), and detects these units respectively to discover possible malicious behavior or anomalies.

[0069] The server application-oriented intrusion detection and forensic analysis method will be described in detail below.

[0070] As shown in an example, Figure 1 The server application-oriented intrusion detection and forensic analysis method includes the following steps:

[0071] In step S101, connection division information between users and multiple target server application programs in the logs is obtained, and multiple connection trace graphs are constructed based on the connection division information.

[0072] Among them, the server application program refers to a software program that provides services in a network, such as a website server, a file storage service, etc. The trace graph is a graphical representation method for tracking and recording the flow of data in the network, which is helpful for analyzing and detecting network attacks.

[0073] Specifically, users establish connections with multiple target server programs, which operate independently during their lifetimes and interact with the server as needed. These server programs employ efficient techniques such as multi-threading or asynchronous processing to manage these simultaneous connections effectively when handling concurrent connections. During processing, the server program follows a series of established procedures, including request parsing, data validation, business logic processing, and response generation, to ensure that each connection's request is handled correctly and efficiently. By obtaining relevant information from the logs, one can gain a detailed understanding of the connection between users and multiple target server applications (i.e., connection partitioning information). Based on the connection partitioning information, multiple connection provenance graphs can be constructed, which can detail the establishment and interaction process of each connection.

[0074] Next, how the embodiments of the present application construct multiple connection provenance graphs will be described in detail.

[0075] As a possible implementation, in some embodiments, constructing a connection provenance graph based on connection partitioning information includes: dividing the logs based on the connection partitioning information to obtain multiple connection units; and constructing multiple connection provenance graphs based on the multiple connection units.

[0076] Wherein, the connection partitioning information (CPI) specifically refers to a partition boundary (referred to as boundary), which is usually a system call that marks the beginning or end of a server program's processing of a user connection. Once the boundary is determined, each log event can be assigned to its corresponding connection, thus completing log partitioning and obtaining multiple connection units. The connection provenance graph (CPG) is a provenance graph that records the complete behavior of a user connection in detail, including all related entities (processes, files, or sockets) and events between entities, and plays a crucial role in anomaly detection and attack investigation. To obtain the connection provenance graph, one can obtain the complete event set of each user connection based on the connection unit, and further convert the event set corresponding to each connection into a connection provenance graph.

[0077] Specifically, (1) select a log partitioning scheme according to the server application. The embodiments of the present application can provide four optional log partitioning schemes, which are a partitioning scheme based on application program logs, a partitioning scheme based on audit logs, a partitioning scheme based on plugins, and a partitioning scheme based on source code modification.

[0078] (1) Application log based partitioning: Each worker process or thread (referred to as worker process hereinafter) of a server application processes connections sequentially, i.e., it completes the current connection before processing the next one. In the application log, events from different worker processes can be distinguished by process identifier (PID) or thread identifier (TID). For a single worker process, the start and end of each connection processing is marked by explicit system calls (e.g., accept and close), and by taking them as boundaries, events within the boundaries can be grouped into a connection unit. If the application log is available, the timestamp, client IP address, PID or TID, etc. provided by it can help identify the boundaries.

[0079] (2) Audit log based partitioning: Each worker process of a server application processes connections sequentially, i.e., it completes the current connection before processing the next one. In the audit log, events from different worker processes can be distinguished by process identifier or thread identifier. For a single worker process, the start and end of each connection processing is marked by explicit system calls (e.g., accept and close), and by taking them as boundaries, events within the boundaries can be grouped into a connection unit. When the application does not print application log, or the application log cannot provide timestamp, client IP, PID or TID, etc., the boundaries can be identified by traversing the audit log.

[0080] For example, as shown in FIG. 2(a), a worker process based on the audit log processes two connections (connection 1 and connection 2) sequentially. To perform connection partitioning, the information of the two connections can be extracted first, and the boundaries can be obtained using the information. For connection 1, its start and end boundaries can be found around time 1 and time 3, which are the accept event and close event matching its IP address and PID information. In the audit log, the accept event at t = 1 and the close event at t = 4 are matched, and then the events between the two boundaries are marked as belonging to connection 1. Using the same method, the boundaries of connection 2 can be determined and its events are marked.

[0081] (3) Plugin-based partitioning scheme: suitable for server applications that adopt an I / O (Input / Output) multiplexing execution model, in which a single worker process interleaves the processing of multiple different connections based on operating system mechanisms (e.g., select, poll, or epoll). If the application provides non-intrusive mechanisms (e.g., hooks, modules, or code replacement), such mechanisms can be exploited to insert code without changing the application source code. In this application scenario, a hook function will be responsible for intercepting the creation and execution of all connections. Specifically, there can be two specific locations for code insertion: 1) when a connection is established, a unique identifier (ID) can be assigned to it; 2) before and after each processing logic is executed, additional system call code can be added to generate a boundary containing the connection ID in the audit log, thus explicitly specifying the unit to which the processing logic belongs.

[0082] (4) Source code modification-based partitioning scheme: also suitable for server applications that adopt an I / O multiplexing execution model, in which a single worker process interleaves the processing of multiple different connections based on operating system mechanisms (e.g., select, poll, or epoll). When the application does not provide non-intrusive mechanisms, modifications can be made directly at specified locations in the application source code to implement event recording functions.

[0083] For example, as shown in FIG. 2(b), a worker process interleaves the processing of two connections (connection 1 and connection 2). This scheme pre-inserts additional start and end partition boundaries (i.e., StartDelimiter and EndDelimiter) before and after the processing logic (i.e., Handler), which can identify the connection unit corresponding to each processing logic.

[0084] Table 1 shows four connection partitioning methods suitable for mainstream server applications based on the research of embodiments of the present application. The following will describe in detail how each partitioning method is used in combination with specific server applications (e.g., Apache (an open-source web server software), PHP-FPM (PHP Fast CGI Process Manager), Fast API (Fast Application Programming Interface), and Nginx (a proxy server)).

[0085]

[0086] VSFTPD (Very Secure FTP Daemon), ProFTPD (Professional FTP Daemon), PostgreSQL (Postgres Structured Query Language), asyncio, Django, Express.js, libuv, JavaScript, and HAProxy.

[0087] (2) According to the selected log partitioning scheme, the application program can be modified and deployed to facilitate the collection of logs. Specifically, when the selected log partitioning scheme is the application log-based partitioning scheme, the configuration of the application log format needs to be completed (for example, defining the format, fields, and output method of the log, etc.); when the selected log partitioning scheme is the plug-in or source code modification-based partitioning scheme, specific boundary printing code needs to be inserted into the source code of the application program. Finally, the kernel audit log is collected using the operating system service (such as Linux Auditd).

[0088] (3) The logs of the server application are partitioned by identifying the boundaries in the logs, and a connection tracing graph is constructed, including the following steps:

[0089] Step (1): The server application program is divided into units, and the connection units of the server application program logs are marked.

[0090] Specifically, ① For the application log based partitioning scheme, the timestamp, client IP, PID or TID, etc. can be extracted from the application log (e.g. web log), and based on the information, the start and end partition boundaries (e.g. accept and close system calls) can be searched in the audit log. After the search is completed, the events of the start and end partition boundaries are marked as a connection unit. ② For the audit log based partitioning scheme, the audit log can also be traversed and the start and end partition boundaries (e.g. accept and close system calls) can be identified. After the search is completed, the events of the start and end partition boundaries are marked as a connection unit. ③ For the plug-in based partitioning scheme and the source code modification based partitioning scheme, the start and end partition boundaries inserted in the audit log can be identified, and the connection ID corresponding to the boundaries can be identified, and the processing logic between the two partition boundaries is marked as the connection unit corresponding to the ID.

[0091] Step (2): Based on the connection unit, the complete event set of each user connection is obtained. Since the connection unit may not be able to fully capture all relevant events of the connection, for example, in the FTP server such as VSFTPD, the main process is responsible for accepting connections, and a sub-process is generated to process each connection respectively, and the unit division often focuses on the events of the main process, and thus the events generated by the sub-processes may be missed. In order to solve this problem, the application follows the path of the process control flow, and the events generated by the sub-processes processing the connection are included in the event set corresponding to the connection. Thus it is ensured that the event set can accurately reflect all events related to each connection.

[0092] Step (3): The event set corresponding to each connection is converted into a connection provenance graph (CPG). Each connection provenance graph is a directed time sequence graph , which is used to describe all system activities generated by the user connection. Among them, is a set of nodes, which is composed of multiple entities, including three types: process, file and socket. Each type of node has different attributes: the attribute of the process node is the execution path, the attribute of the file node is the file path, and the attribute of the socket node is the IP address and port. is a set of ordered events (edges) between these entities during the connection process. Each event can be expressed as a four-tuple , which includes the source node , the target node , the event type and the timestamp . In the embodiment of the application, includes 97 event types, such as read, recvfrom, clone, etc.

[0093] In step S102, the preset machine learning model is used to perform anomaly detection on the plurality of connection provenance graphs to determine abnormal events, wherein the preset machine learning model is trained by the connection provenance graph data set generated by the cache log data.

[0094] That is, the preset machine learning model is used to perform anomaly detection analysis on the plurality of connection provenance graphs when the connection provenance graphs are input into the model, so as to accurately identify abnormal events therein, wherein the preset machine learning model is trained by the connection provenance graph data set generated by the cache log data, and the specific training process will be described in detail below.

[0095] Next, how to use the preset machine learning model to perform anomaly detection on the plurality of connection provenance graphs to determine abnormal events will be described in detail.

[0096] As a possible implementation manner, in some embodiments, the preset machine learning model is used to perform anomaly detection on the plurality of connection provenance graphs to determine abnormal events, including: using an encoder in the preset machine learning model to embed the spatiotemporal information of each event in the plurality of connection provenance graphs into a preset vector representation; using a decoder in the preset machine learning model to predict the type of the event corresponding to the preset vector representation based on the preset vector representation to obtain a prediction result; calculating the error between the prediction result and the actual event type corresponding to the prediction result, and determining abnormal events based on the error.

[0097] The preset machine learning model is GraphMixer-MLP (Multi Layer Perceptron), which is composed of two parts: GraphMixer and MLP. GraphMixer is the encoder part of the model, which encodes the event information (including spatial and temporal information) in the time series graph (i.e., connection provenance graph CPG) into an internal representation. MLP is the decoder part of the model, which can use the vector representation generated by GraphMixer to predict the type of the event.

[0098] That is, first, the encoder in the preset machine learning model can embed the spatiotemporal information of a given event (i.e., an edge in the connection provenance graph) in the connection provenance graph into a vector representation (i.e., a preset vector representation) to create a vector for the event. Second, the decoder in the preset machine learning model is used to predict the type of the event based on the preset vector representation corresponding to the event. Finally, the error between the predicted type of the event and the actual type of the event is calculated to identify abnormalities.

[0099] Next, how to embed the spatio-temporal information of each event in the plurality of connection tracing graphs into a preset vector representation using an encoder in the preset machine learning model is described in detail.

[0100] As a possible implementation, in some embodiments, embedding the spatio-temporal information of each event in the plurality of connection tracing graphs into a preset vector representation using an encoder in the preset machine learning model comprises: based on a preset hierarchical feature hashing strategy, encoding entities with similar hierarchical structures in each entity to obtain a first encoding result, wherein the first encoding result is a vector representation in a feature space that satisfies a preset distance relationship; based on a preset one-hot encoding strategy, encoding each event to obtain a second encoding result, wherein the second encoding result is a vector representation of a corresponding dimension, wherein the corresponding dimension is equal to the total number of types of corresponding events; based on the first encoding result and the second encoding result, embedding the spatio-temporal information of each event into a preset vector representation using an encoder in the preset machine learning model.

[0101] The preset hierarchical feature hashing strategy is an encoding technique that can map strings with similar structures to points in a feature space that are close in distance, helping the model to identify and distinguish different entities or events. The preset one-hot encoding strategy is a technique for converting categorical variables into a format that can be understood by a machine learning model. In one-hot encoding, each category is converted into a vector with a length equal to the total number of categories, with only one dimension being 1 and the rest being 0.

[0102] Specifically, given that the connection source graph is a temporally directed graph, the entities (i.e., nodes) and events (i.e., edges) can be encoded first. Entities include three categories: files, sockets, and executable files, with corresponding attributes of file path, IP address and port number, and executable file path, respectively. Encoding entities essentially encodes these attributes. For entity attributes presented as strings, a pre-defined hierarchical feature hashing strategy can be used to embed them into a fixed-length vector space, obtaining the first encoding result. This method ensures that attributes with similar hierarchical structures (e.g., similar directory paths, similar IP addresses, etc.) are encoded as vectors with similar distances in the feature space. For example, / data / html / index.html and / data / html / about.html will generate similar vector representations, while the vector representation of / etc / passwd will be far apart. Similarly, the vector representations of IP addresses 192.168.0.1 and 192.168.0.2 are close, while their vector representations are quite different from that of 127.0.0.1. This helps the model effectively detect anomalous behavior when attackers attempt to access uncommon directories. It is worth noting that this embodiment does not use entity type attributes in this process, which simplifies the prediction process of event types between entities. Entities The coding features are .

[0103] For event attributes, a preset one-hot encoding strategy can be used to map their type to a... In a dimensional vector space ( The total number of representative types is used to obtain the second encoding result. In this vector, each dimension corresponds to a specific type. For example, if the third dimension represents the read type, then encoding an event of type read will generate a vector of length [length missing]. d A vector is defined with its third dimension set to 1 and all other dimensions set to 0. In this embodiment, the event is... e The feature label after encoding is: .

[0104] Finally, by combining the first and second encoding results, and utilizing the encoder function in the pre-defined machine learning model, the spatiotemporal information of each event is further embedded into a pre-defined vector representation space. Through this series of encoding processes, the spatiotemporal information of the event can be effectively transformed into a structured vector representation, thereby facilitating further analysis and processing.

[0105] In step S103, abnormal events are displayed as potential attack factors, and an attack summary containing attack details and a complete attack process is generated based on the abnormal events.

[0106] That is, after identifying the abnormal event, the connection trace graph containing too many abnormal events can be reported, and the abnormal event can be highlighted, and then all connection trace graphs having a dependency relationship with the abnormal event are iteratively identified from the connection trace graph containing the abnormal event, and finally these connection trace graphs are integrated into a complete attack summary, and the attack summary is presented for security experts to deeply analyze the attack details and the complete attack process.

[0107] Among them, for the step of displaying the abnormal event as a potential attack factor, similar to other methods, the present application is based on a basic understanding that an attack event will cause more significant prediction errors. According to this, the present application determines whether an event is abnormal by checking the following two standards: (1) The prediction error of the event must exceed the preset threshold ; (2) The source node and the destination node of the event must not be located in the whitelist. As for the setting of the threshold , it is calculated on the basis of the validation data set containing only benign connection trace graphs. Specifically, for each connection trace graph, the top m% of events with the highest prediction error can be filtered out, and the top n% of events can be further selected from them. Then, the mean and the standard deviation of these errors are calculated, and the threshold is set to =mean+3*std. In addition, when the number of abnormal events in the connection trace graph exceeds the predetermined threshold T k , the connection trace graph is automatically determined to be abnormal, and the corresponding alarm mechanism is triggered.

[0108] How to generate an attack summary containing attack details and complete attack process based on abnormal events will be described in detail below.

[0109] As a possible implementation, in some embodiments, generating an attack summary containing attack details and complete attack process based on abnormal events includes: determining the dependency relationship between multiple connection trace graphs based on the entity equivalence principle and the data flow between the multiple connection trace graphs; determining abnormal connection trace graphs associated with the abnormal event based on the dependency relationship between the abnormal event and the multiple connection trace graphs; and integrating the abnormal connection trace graphs to generate an attack summary containing attack details and complete attack process.

[0110] That is, in order to effectively identify and respond to abnormal events, a method based on the principle of entity equivalence is proposed, which can accurately determine the dependency between multiple connection trace graphs by analyzing the data flow between them. By deeply analyzing the dependency between these graphs, the data flow patterns in the network can be better understood, providing strong support for subsequent anomaly detection and incident response. Further, based on the dependency between abnormal events and multiple connection trace graphs, abnormal connection trace graphs associated with a specific abnormal event can be determined. These abnormal connection trace graphs usually contain data flow paths directly related to abnormal events. Finally, by integrating these abnormal connection trace graphs, an attack summary containing attack details and complete attack process can be generated, which describes each step of the attack in detail.

[0111] Specifically, when an abnormal connection trace graph is detected, an attack factor can be automatically generated to explain the triggered alarm. The attack factor is generated by excluding regular benign events (e.g., log recording events) that are not directly related to attack behavior. Specifically, if a file node v meets the following two criteria, it can be removed from consideration:

[0112] (1) Its frequency exceeds a pre-set threshold T f . The calculation is based on the following formula:

[0113]

[0114] Where, is the number of benign connection trace graphs containing node v , and CPG represents the total number of benign connection trace graphs.

[0115] (2) The prediction error of all interaction events related to node v is lower than the threshold T e . In the embodiments of the present application, T e can be set equal to the mean value mean of all interaction event prediction errors.

[0116] This screening mechanism aims to retain only the most characteristic events as attack indicators, making it easier for analysts to quickly grasp the core information of the alarm. In addition, an optional function is provided to merge events from the same source and destination nodes to further refine the attack indicators.

[0117] Further, in some embodiments, before the abnormal event is determined by performing the abnormality detection on the plurality of connection trace graphs using the preset machine learning model, the method further comprises: obtaining cache log data, generating a connection trace graph dataset based on the cache log data; preprocessing the connection trace graph dataset, and dividing the preprocessed connection trace graph dataset into a training set and a validation set; training a preset neural network using the training set to obtain an initial machine learning model, and verifying the initial machine learning model using the validation set until the initial machine learning model meets a preset standard, ending the iterative training of the initial machine learning model to obtain the preset machine learning model, or adjusting the model parameters and continuing the iterative training.

[0118] That is, by obtaining cache log data, a connection trace graph dataset can be generated based on the cache log data. These data contain detailed information of network connections in the past period of time, which helps better understand the normal patterns of network behavior. Then, the connection trace graph dataset is preprocessed. The purpose of preprocessing is to clean and standardize the data to ensure data quality. This may include removing noise, filling missing values, converting data formats, etc. The preprocessed data will be more suitable for training machine learning models. Next, the preprocessed connection trace graph dataset is divided into a training set and a validation set. The training set is used to train the machine learning model, while the validation set is used to evaluate the performance of the model. In this way, the model parameters can be continuously adjusted during model training to improve the accuracy and generalization ability of the model. The preset neural network is trained using the training set to obtain an initial machine learning model. During training, the weights and biases of the neural network are continuously adjusted to minimize prediction errors. Through multiple iterations, the model gradually learns the rules and patterns in the data. During training, the initial machine learning model also needs to be verified using the validation set. By evaluating the model's performance on the validation set, we can understand the model's generalization ability, i.e., the model's performance on unseen data. If the model meets the preset standard, such as achieving a certain accuracy or error rate, the iterative training of the initial machine learning model can be ended to obtain the final preset machine learning model. If the initial machine learning model fails to meet the preset standard, the model parameters need to be adjusted and the iterative training continues. This may include adjusting the learning rate, changing the network structure, increasing or decreasing the number of layers, etc. Through continuous optimization and adjustment, a high-performance machine learning model is finally obtained, which is used to perform abnormality detection on the plurality of connection trace graphs to effectively identify abnormal events.

[0119] Specifically, in the embodiments of the present application, the preset machine learning model is GraphMixer-MLP, wherein GraphMixer is an encoder, and the encoder is used to encode the connection trace graph of any event in the connection trace graph ​(For event timestamps), GraphMixer can aggregate events. In time The spatiotemporal information of its surrounding domain includes its one-hop neighbors and the relationships between these neighbors and events. Historical interaction information, and embed this information into the representation. In the middle. Subsequently, the MLP, as a decoder, can utilize this representation. To predict events The probability distribution of the type.

[0120] The following will first explain how to obtain it. .

[0121] Representation derived from the event source node and the representation of the destination node The combination methods are as follows: Specifically, By node In time Spatial characteristics of the place and interaction features composition.

[0122] Spatial features Describes the nodes In time Neighbor information at the location. This is achieved by obtaining node information. Within the time range All one-hop neighbors containing interactive events Aggregate its original features and combine them with the entity By adding the original features, we can obtain :

[0123]

[0124] Interactive features Describes the nodes In time Time-series event information. Retrieved by time. Previously with nodes The latest related One event (excluding) For each event ,use To encode the time of its occurrence With current time The time interval between them, and its relationship to the original characteristics of the event. splicing:

[0125]

[0126] Stack them up to get And perform zero-padding to make its length . Then, interactive features are generated using MLP-mixer. :

[0127]

[0128]

[0129] Finally, and By piecing them together, you can get... :

[0130]

[0131] The decoding method is described below.

[0132] Based on the MLP component of a pre-defined machine learning model, Given the input, it can output a value of length . The probability distribution vector. Each element in this vector corresponds to an event type, representing the event. This is the probability of that type. It is calculated by... original features The cross-entropy between the prediction result and the prediction result can be used to determine the prediction error and serve as the loss value.

[0133]

[0134] The design presented in this application offers the following significant advantages. First, it captures the interaction relationships between entities (derived from spatial features) and integrates structural information into the model accordingly. Second, by sampling the most recent interactions, the design effectively incorporates temporal information (from nodes and interaction events), enabling the learning of the dynamic sequences of system entities and events, thereby enhancing the model's effectiveness. Finally, it achieves event-level prediction, providing a finer granularity for anomaly detection.

[0135] For example, during the training process of the model, taking the first... i One event For example, it will happen The previous partial link trace graph (containing only the first to the () i -1) events are input into the encoder of a pre-defined machine learning model, and the encoder outputs... The source and target nodes are spatiotemporally represented, and then the representations of these two nodes are concatenated and input into the decoder of a pre-defined machine learning model to predict. The type of prediction error is then used to update the preset machine learning model. This process is repeated iteratively to complete the training of the preset machine learning model.

[0136] To facilitate a better understanding of the intrusion detection and forensic analysis method for server applications proposed in the embodiments of this application, further explanation is provided below with reference to examples.

[0137] Suppose that Tom's server is running two long-running server programs: Nginx and PHP-FPM. For example... Figure 3 As shown, the method proposed in this application can divide its events into connection source graphs (1) to (10) according to the connections, and check them one by one. In each connection source graph, a preset machine learning model can be used to predict the type of each event in chronological order, and anomalies can be detected based on the prediction error. For example, when checking the connection source graph (8), the events will be predicted in sequence. arrive It correctly predicted the event. and The type, but for events that deviate from benign behavior patterns. - A significant prediction error occurred, therefore, the connection source graph (8) was marked as an anomaly. Subsequently, these anomalous events (edges) were highlighted as attack factors, and the attack investigation continued, tracing other connections related to the attack factors through information flow dependencies. For example, the connection source graph (8) contains write operations to the file wqnf.txt (i.e., events). The connection trace graph (10) then reads this file (i.e., the events). This demonstrates the dependencies in the data flow. Therefore, the connection source graph (10) is incorporated into the attack story. Similarly, the process can also incorporate connection source graphs (1), (2), and (6). Ultimately, a complete attack chain is obtained, including the Trojan image upload and the download of confidential files, while events unrelated to the attack factors (e.g., ...) are excluded from the attack digest. , ).

[0138] Understandably, a complete attack process includes both anomalous behavior and the preparation work required to execute that behavior. It's highly likely that anomalous behavior resides in anomaly connection source graphs, while preparation work is scattered throughout benign connection source graphs. Although these benign connections lack anomalous actions, they are equally important for forensic analysis, helping security experts to deduce the attack chain and identify the attacker. Therefore, reconstructing the complete attack story requires starting with the anomalous connection source graph and iteratively identifying all related connection source graphs (both benign and anomalous) with dependencies, thereby revealing the entire set of connection source graphs relevant to the attack.

[0139] like Figure 4 The algorithm shown outlines an attack investigation process according to an embodiment of this application. Before the attack investigation, given that the data flow of all connection source graphs is known, the entity objects interacting in these connection source graphs and the interaction times (e.g., Figure 4 The first row). Then, starting from the anomalous connection origination graph, identify other connection origination graphs with data flow dependencies (such as the first row). Figure 4 (lines 3-19), and update the search entry (e.g. Figure 4 Line 20). In this process, to prevent the introduction of irrelevant linking graphs due to common dependencies such as logs and library files, embodiments of this application may also allow security experts to control the frequency of co-occurring file or socket entities (e.g., Figure 4 (Lines 8-9). The search will continue until no new connection source graph is found or the maximum number of iterations is reached (e.g., lines 8-9). Figure 4 (Lines 3 and 18). Finally, all identified connection source graphs are integrated into a comprehensive source graph to represent the complete attack story.

[0140] To achieve the above process, this application embodiment can collect audit logs by employing the Linux auditing system Auditd (an auditing daemon in the Linux operating system responsible for recording various security-related events on the system, such as file access, system calls, user login and logout). In addition, a dedicated Linux kernel module has been developed to supplement additional information that Auditd may fail to capture, such as thread ID, local IP address, and local port number.

[0141] The embodiments of the present application can implement the above process by about 8000 lines of Python code. For the log-based method, a double-pointer-based stream processing framework is designed, which can accurately map the extracted connection division information to the audit log and mark events accordingly. For the code insertion-based method, a series of special parsers are developed, which can accurately divide events by reading the partition boundaries in each application audit log. It is worth noting that unoccupied system call numbers are used in all inserted partition boundaries to ensure unambiguity in data flow. The connection trace graph generation module is unified. The connection trace graph anomaly detection module is implemented based on PyG (PyTorch Geometric, a library for Graph Neural Network (GNN)), and its source code is derived from the open source project of GraphMixer. In addition, the time sampler in the TGL framework is also used, and the connection trace graph data is stored in the Neo4j database (a graph database). This design enables security experts to conveniently browse and analyze the results during attack investigation.

[0142] The server application-oriented intrusion detection and forensic analysis method proposed in the embodiments of the present application has been evaluated in performance on 9 server scenario datasets. These datasets cover widely used server applications and frameworks, and their scenarios are derived from previous research results and known security vulnerabilities. By comparing and analyzing with ProvDetector and KAIROS, the most advanced intrusion detection systems in the industry, the experimental results show that the present application can effectively detect malicious connections (with an average accuracy of 0.95 and a recall rate of 1.00), and can provide accurate attack factors (with an F1 score of 0.906), and its performance indicators are better than ProvDetector and KAIROS. In addition, the method of the present application also has the ability to reconstruct the complete attack process, which can provide strong support for security experts in attack tracing work.

[0143] According to the server application-oriented intrusion detection and forensic analysis method proposed in the embodiments of the present application, by obtaining the connection division information between the user and the plurality of target server application programs in the audit log, a plurality of connection trace graphs can be constructed based on the connection division information. By utilizing a preset machine learning model, the plurality of connection trace graphs are subjected to anomaly detection, and an abnormal event can be determined. The abnormal event is displayed as a potential attack factor, and an attack summary containing attack details and a complete attack process is generated based on the abnormal event. Thus, by utilizing the connection-oriented characteristics of server application programs and taking connection as the detection unit to identify attacks, the problems of difficulty in processing large-scale log data, insufficient detection accuracy leading to alarm fatigue, and difficulty in attack investigation in the prior art are solved, thereby improving the detection performance.

[0144] With reference to the accompanying drawings, the server application-oriented intrusion detection and forensic analysis apparatus according to an embodiment of the present application is described.

[0145] Figure 5 FIG. 1 is a block diagram of a server application-oriented intrusion detection and forensic analysis apparatus according to an embodiment of the present application.

[0146] As shown in FIG. 1, the server application-oriented intrusion detection and forensic analysis apparatus includes: Figure 5

[0147] The construction module 100 is configured to obtain connection division information between a user and a plurality of target server applications in a log, and construct a plurality of connection trace graphs based on the connection division information.

[0148] The detection module 200 is configured to perform anomaly detection on the plurality of connection trace graphs by using a preset machine learning model, and determine an abnormal event, wherein the preset machine learning model is trained by a connection trace graph dataset generated by cache log data.

[0149] The generation module 300 is configured to display the abnormal event as a potential attack factor, and generate an attack summary containing attack details and a complete attack process based on the abnormal event.

[0150] According to an embodiment of the present application, the construction module 100 is specifically configured to:

[0151] divide the log based on the connection division information to obtain a plurality of connection units;

[0152] construct a plurality of connection trace graphs based on the plurality of connection units.

[0153] According to an embodiment of the present application, the detection module 200 includes:

[0154] The encoding unit is configured to embed spatiotemporal information of each event in the plurality of connection trace graphs into a preset vector representation by using an encoder in the preset machine learning model.

[0155] The prediction unit is configured to predict a type of the event corresponding to the preset vector representation based on the preset vector representation by using a decoder in the preset machine learning model, to obtain a prediction result.

[0156] The calculation unit is configured to calculate an error between the prediction result and an actual event type corresponding to the prediction result, and determine an abnormal event based on the error.

[0157] According to an embodiment of the present application, the encoding unit is specifically configured to:

[0158] ​Based on the preset hierarchical feature hashing strategy, each entity with a similar hierarchical structure in the entity is encoded to obtain a first encoding result, wherein the first encoding result is a vector representation in a feature space that satisfies a preset distance relationship.

[0159] Based on the preset one-hot encoding strategy, each event is encoded to obtain a second encoding result, wherein the second encoding result is a vector representation of the corresponding dimension, wherein the corresponding dimension is equal to the total number of types of the corresponding event.

[0160] Based on the first encoding result and the second encoding result, the encoder in the preset machine learning model is used to embed the spatio-temporal information of each event into a preset vector representation.

[0161] According to an embodiment of the present application, before using the preset machine learning model to perform anomaly detection on the plurality of connection tracing graphs and determine the abnormal event, the detection module 200 is further configured to:

[0162] Obtain cache log data, and generate connection tracing graph data sets based on the cache log data;

[0163] Preprocess the connection tracing graph data sets, and divide the preprocessed connection tracing graph data sets into a training set and a validation set;

[0164] Train the preset neural network using the training set to obtain an initial machine learning model, and verify the initial machine learning model using the validation set until the initial machine learning model meets a preset standard, end the iterative training of the initial machine learning model to obtain the preset machine learning model, otherwise continue the iterative training after adjusting the model parameters.

[0165] According to an embodiment of the present application, the generation module 300 is specifically configured to:

[0166] Determine the dependency relationship between the plurality of connection tracing graphs based on the entity equivalence principle and the data flow between the plurality of connection tracing graphs;

[0167] Determine the abnormal connection tracing graph associated with the abnormal event based on the abnormal event and the dependency relationship between the plurality of connection tracing graphs;

[0168] Integrate the abnormal connection tracing graph to generate an attack summary containing attack details and a complete attack process.

[0169] It should be noted that the foregoing explanation and description of the intrusion detection and forensic analysis method for the server application program embodiment also applies to the intrusion detection and forensic analysis device for the server application program of this embodiment, which will not be described here.

[0170] The server application-oriented intrusion detection and forensic analysis device provided by the embodiments of the present application can obtain connection division information between a user and a plurality of target server applications in an audit log, can construct a plurality of connection tracing graphs based on the connection division information, can determine an abnormal event by performing abnormality detection on the plurality of connection tracing graphs by using a preset machine learning model, can display the abnormal event as a potential attack factor, and can generate an attack summary containing attack details and a complete attack process based on the abnormal event. Thus, by using the connection-oriented characteristics of the server application, the attack is identified by taking the connection as a detection unit, and the problems of difficulty in processing large-scale log data, alarm fatigue caused by insufficient detection accuracy, and difficulty in attack investigation in the prior art are solved, thereby improving the detection performance.

[0171] Figure 6 The electronic device provided by the embodiments of the present application is shown in the structural schematic diagram. The electronic device can include:

[0172] The memory 601, the processor 602, and the computer program stored in the memory 601 and executable on the processor 602.

[0173] The processor 602 implements the server application-oriented intrusion detection and forensic analysis method provided in the above embodiments when executing the program.

[0174] Further, the electronic device further includes:

[0175] The communication interface 603 is used for communication between the memory 601 and the processor 602.

[0176] The memory 601 is used to store the computer program executable on the processor 602.

[0177] The memory 601 can include a high-speed RAM (Random Access Memory, random access memory) memory, and can also include a non-volatile memory, such as at least one disk memory.

[0178] If the memory 601, the processor 602 and the communication interface 603 are implemented independently, the communication interface 603, the memory 601 and the processor 602 can be connected with each other through a bus and complete communication between each other. The bus can be an ISA (Industry Standard Architecture, Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect, Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture, Extended Industry Standard Architecture) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, Figure 6 Only one thick line is used in the figure, but it does not mean that there is only one bus or only one type of bus.

[0179] Optionally, in a specific implementation, if the memory 601, the processor 602 and the communication interface 603 are integrated on a chip, the memory 601, the processor 602 and the communication interface 603 can complete communication between each other through an internal interface.

[0180] The processor 602 can be a CPU (Central Processing Unit, Central Processing Unit) or an ASIC (Application Specific Integrated Circuit, Application Specific Integrated Circuit) or an integrated circuit configured to implement one or more embodiments of the application.

[0181] The embodiments of the application also provide a computer readable storage medium, which stores a computer program, and the program is executed by a processor to implement the server application-oriented intrusion detection and forensic analysis method.

[0182] The embodiments of the application also provide a computer program product, which includes a computer program, and the computer program is executed by a processor to implement the server application-oriented intrusion detection and forensic analysis method.

[0183] In addition, the terms "first", "second" are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include at least one of the features. In the description of the application, the meaning of "a plurality of" is at least two, for example, two, three, etc., unless otherwise specifically limited.

[0184] In the description of the specification, the description using the terms "one embodiment", "some embodiments", "an example", "a specific example", or "some examples" etc. means that the particular feature, structure, material or characteristic being described is included in at least one embodiment or example of the present application. The illustrative appearances of the above-mentioned terms in various places in the specification are not necessarily referred to the same embodiment or example. Moreover, the particular features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples. Furthermore, the description herein of certain examples does not necessarily exclude these features, structures, materials, or characteristics from being used in other examples. Neither, should the following claims that include minimum features explain only some embodiments or examples of the present application. Other embodiments and examples of the present application that are not expressly described herein can also be possible in the scope of the present application.

[0185] Although the embodiments of the present application have been shown and described above, it is understood that the above-described embodiments are exemplary, and should not be construed as limiting the present application, and those ordinarily skilled in the art can make changes, modifications, replacements and variations to the above-described embodiments within the scope of the present application.

Claims

1. A method for intrusion detection and forensic analysis of server applications, characterized in that, Includes the following steps: Obtain connection segmentation information between the user and multiple target server applications from the logs, and construct multiple connection tracing graphs based on the connection segmentation information; Anomaly detection is performed on the multiple connection origination graphs using a preset machine learning model to identify abnormal events. The preset machine learning model is trained on a connection origination graph dataset generated from cached log data. The anomalous events are displayed as potential attack factors, and an attack summary containing attack details and a complete attack process is generated based on the anomalous events. The step of using a preset machine learning model to perform anomaly detection on the multiple connection source graphs and determine abnormal events includes: using the encoder in the preset machine learning model to embed the spatiotemporal information of each event in the multiple connection source graphs into a preset vector representation; using the decoder in the preset machine learning model to predict the type of the event corresponding to the preset vector representation based on the preset vector representation to obtain a prediction result; calculating the error between the prediction result and the actual event type corresponding to the prediction result; and determining the abnormal event based on the error. The step of embedding the spatiotemporal information of each event in the multiple connection tracing graphs into a preset vector representation using the encoder in the preset machine learning model includes: encoding entities with similar hierarchical structures in each entity based on a preset hierarchical feature hashing strategy to obtain a first encoding result, wherein the first encoding result is a vector representation in the feature space that satisfies a preset distance relationship; encoding each event based on a preset one-hot encoding strategy to obtain a second encoding result, wherein the second encoding result is a vector representation of a corresponding dimension, wherein the corresponding dimension is equal to the total number of types of the corresponding event; and embedding the spatiotemporal information of each event into the preset vector representation using the encoder in the preset machine learning model based on the first encoding result and the second encoding result.

2. The method according to claim 1, characterized in that, The construction of the connection origin graph based on the connection partitioning information includes: The log is divided based on the connection partitioning information to obtain multiple connection units; Based on the multiple connection units, the multiple connection traceability graphs are constructed.

3. The method according to claim 1, characterized in that, Before using the preset machine learning model to perform anomaly detection on the multiple connection tracing graphs and determine the abnormal event, the method further includes: Obtain the cached log data, and generate the connection tracing graph dataset based on the cached log data; The connection origination graph dataset is preprocessed, and the preprocessed connection origination graph dataset is divided into a training set and a validation set; The initial machine learning model is obtained by training the preset neural network using the training set, and the initial machine learning model is verified using the validation set until the initial machine learning model meets the preset standard. Then, the iterative training of the initial machine learning model ends and the preset machine learning model is obtained. Otherwise, the model parameters are adjusted and iterative training continues.

4. The method according to claim 1, characterized in that, The generation of an attack summary based on the abnormal event, which includes attack details and a complete attack process, includes: Based on the principle of entity equivalence and the data flow between the multiple connection source graphs, the dependencies between the multiple connection source graphs are determined. Based on the dependencies between the abnormal events and the multiple connection source graphs, an abnormal connection source graph associated with the abnormal events is determined. By integrating the abnormal connection tracing graph, an attack summary containing attack details and the complete attack process is generated.

5. An intrusion detection and forensic analysis device for server applications, characterized in that, include: The module is used to obtain connection segmentation information between users and multiple target server applications in the audit logs, and to construct multiple connection tracing graphs based on the connection segmentation information; The detection module is used to perform anomaly detection on the multiple connection origination graphs using a preset machine learning model to determine abnormal events, wherein the preset machine learning model is trained from the connection origination graph dataset generated from cached log data. The generation module is used to display the abnormal events as potential attack factors and generate an attack summary containing attack details and a complete attack process based on the abnormal events. The detection module includes: an encoding unit, used to embed the spatiotemporal information of each event in the plurality of connection traceability graphs into a preset vector representation using an encoder in the preset machine learning model; a prediction unit, used to predict the type of the event corresponding to the preset vector representation based on the preset vector representation using a decoder in the preset machine learning model, and obtain a prediction result; and a calculation unit, used to calculate the error between the prediction result and the actual event type corresponding to the prediction result, and determine the abnormal event based on the error. The encoding unit is specifically used for: encoding entities with similar hierarchical structures in each entity based on a preset hierarchical feature hashing strategy to obtain a first encoding result, wherein the first encoding result is a vector representation in the feature space that satisfies a preset distance relationship; encoding each event based on a preset one-hot encoding strategy to obtain a second encoding result, wherein the second encoding result is a vector representation of the corresponding dimension, wherein the corresponding dimension is equal to the total number of types of the corresponding event; and embedding the spatiotemporal information of each event into the preset vector representation using the encoder in the preset machine learning model based on the first encoding result and the second encoding result.

6. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, the processor executing the program to implement the intrusion detection and forensic analysis method for server applications as described in any one of claims 1-4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, The program is executed by the processor to implement the intrusion detection and forensic analysis method for server applications as described in any one of claims 1-4.

8. A computer program product, characterized in that, It includes a computer program, which, when executed by a processor, is used to implement the intrusion detection and forensic analysis method for server applications as described in any one of claims 1-4.

Images