An attack chain detection method, apparatus, device, medium and product

Abstract

The application provides an attack chain detection method, device, equipment, medium and product. The method comprises the following steps: in response to detecting a target alarm event of a first target object, acquiring first information associated with the target alarm event; extracting a first contamination feature from the first information, and determining second information related to the first contamination feature from a running log of the first target object; generating a first prompt word; sending the first prompt word to a first language model, and receiving first attack chain information returned by the first language model. The method realizes comprehensive and accurate attack chain detection, and improves the attack chain detection capability of a security protection product (such as a CWPP, a HIDS, and a CSPM).

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and particularly relates to an attack chain detection method and device, an electronic device, a computer readable storage medium and a computer program product. BACKGROUND

[0002] With the continuous development of computer technology, security protection products for security detection emerge as the times require. The security protection product can detect computer, host and other entity computing devices or containers and other virtual computing devices, thereby ensuring operation security.

[0003] The security protection product can detect computing devices in multiple aspects. For example, the security protection product can detect attack chains.

[0004] Since the attack chain usually involves multiple stages, multiple tools and multiple targets, the traditional single-point protection method is difficult to cope with the complex attack chain detection, and the security protection product has insufficient detection capability for the attack chain. SUMMARY

[0005] The present application provides an attack chain detection method. The method can realize comprehensive and accurate attack chain detection, and improve the detection capability of the security protection product for the attack chain. The present application also provides a device, an electronic device, a computer readable storage medium and a computer program product corresponding to the above method.

[0006] In a first aspect, the present application provides an attack chain detection method, which comprises:

[0007] In response to detecting a target alarm event of a first target object, acquiring first information associated with the target alarm event;

[0008] Extracting a first taint feature from the first information, and determining second information related to the first taint feature from the running log of the first target object;

[0009] Generating a first prompt word; wherein the first prompt word comprises: the first taint feature, the second information, prompt information for indicating extracting at least one second taint feature based on the second information, and prompt information for indicating forming an attack chain based on the running relationship between each taint feature in the first taint feature and the at least one second taint feature;

[0010] Sending the first prompt word to a first language model, and receiving first attack chain information returned by the first language model.

[0011] In a second aspect, the present application provides an attack chain detection device, which comprises:

[0012] obtain a first information associated with the target alarm event of the first target object in response to detecting the target alarm event of the first target object;

[0013] determine a first contamination feature from the first information, and determine a second information related to the first contamination feature from a running log of the first target object;

[0014] generate a first prompt word; wherein the first prompt word comprises the first contamination feature, the second information, prompt information for indicating extraction of at least one second contamination feature based on the second information, and prompt information for indicating formation of an attack chain based on a running relationship between each contamination feature in the first contamination feature and the at least one second contamination feature;

[0015] detect a first attack chain information returned by the first language model by sending the first prompt word to the first language model.

[0016] In a third aspect, the present application provides an electronic device, which comprises a processor and a memory. The processor and the memory are in communication with each other. The processor is configured to execute instructions stored in the memory, so that the electronic device performs the attack chain detection method in the first aspect or any implementation manner of the first aspect.

[0017] In a fourth aspect, the present application provides a computer readable storage medium, which stores instructions. The instructions instruct an electronic device to perform the attack chain detection method in the first aspect or any implementation manner of the first aspect.

[0018] In a fifth aspect, the present application provides a computer program product comprising instructions, which, when executed on an electronic device, cause the electronic device to perform the attack chain detection method in the first aspect or any implementation manner of the first aspect.

[0019] On the basis of the implementation manners of the above aspects, the present application can be further combined to provide more implementation manners.

[0020] As can be seen from the above technical solutions, the present application has the following advantages:

[0021] The application provides an attack chain detection method, which comprises the following steps: in response to detecting a target alarm event of a first target object, acquiring first information associated with the target alarm event, extracting a first tainted feature from the first information, and determining second information related to the first tainted feature from a running log of the first target object; then, generating a first prompt word, wherein the first prompt word comprises the first tainted feature, the second information, prompt information for indicating extraction of at least one second tainted feature based on the second information, and prompt information for indicating formation of an attack chain based on a running relationship between the first tainted feature and each of the at least one second tainted feature; sending the first prompt word to a first language model; and receiving first attack chain information returned by the first language model.

[0022] In the method, when a target alarm event is detected, an initial tainted feature (i.e., the first tainted feature) in an attack chain involved in the target alarm event is extracted, running information (i.e., the second information) related to the initial tainted feature is determined, the running information is analyzed by means of the natural language processing capability of the language model, more second tainted features related to the initial tainted feature are dynamically extracted, and the attack chain information is restored by integration, so that comprehensive and accurate attack chain detection is realized, the ability of a security protection product for attack chain detection is improved, and the security detection level of the security protection product is improved. BRIEF DESCRIPTION OF DRAWINGS

[0023] In order to more clearly illustrate the technical method of the embodiments of the application, the drawings required to be used in the embodiments will be briefly introduced as follows.

[0024] Figure 1 A flowchart of an attack chain detection method provided by the embodiments of the application is shown in the figure.

[0025] Figure 2 A flowchart of an attack chain detection method provided by the embodiments of the application is shown in the figure.

[0026] Figure 3 A structural diagram of an attack chain detection device provided by the embodiments of the application is shown in the figure.

[0027] Figure 4 A structural diagram of an electronic device provided by the embodiments of the application is shown in the figure. DETAILED DESCRIPTION

[0028] The terms "first" and "second" in the embodiments of the application are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first" and "second" can explicitly or implicitly include one or more of the features.

[0029] Firstly, some technical terms and application scenarios involved in the embodiments of the present application are introduced.

[0030] With the continuous development of computer technology, security protection products for performing security detection and further ensuring the security of entity computing devices such as computers, hosts, and virtual computing devices such as containers have emerged as the times require. The security protection product can perform multi-faceted security detection for various running scenarios, for example, the security protection product can be a cloud workload protection platform (CWPP), which can detect host security and network security. For another example, the security protection product can be a host-based intrusion detection system (HIDS), which can perform security detection on the behavior and state of the computer system. For another example, the security protection product can be a cloud security posture management (CSPM), which can assess and manage cloud security risks, identify configuration errors and security vulnerabilities in the cloud environment.

[0031] In some examples, the security protection product can detect attack chains, for example, the security protection product can detect advanced persistent threat (APT) attacks. In APT attacks, the attacker can usually use complex tools and attack methods to attack, for example, the attacker can develop or use security vulnerabilities that have not been disclosed or patched to attack, in addition, APT attacks are usually long-term and continuous processes, and the attacker can use attack chains to attack one or more computing nodes in multiple stages, for example, APT attacks can be divided into reconnaissance phase, initial attack phase, lateral movement node, persistence node, data transmission phase and maintain access phase.

[0032] In related technologies, the security protection product usually uses a single-point protection method for security detection, which is usually based on static rules or behavior templates and has good detection capability in single-point detection. However, since attack behaviors related to attack chains such as APT attacks involve multiple stages, multiple tools and multiple targets, traditional single-point protection methods are difficult to cope with complex attack chain detection and are easily bypassed by complex attack methods in attack chain attacks. Moreover, the single-point protection method based on static rules or behavior templates is not adaptive enough, resulting in insufficient detection capability of the security protection product for attack chains, often leading to false positives and false negatives, increasing the burden of security operations.

[0033] In view of this, the application provides an attack chain detection method. In response to detecting a target alarm event of a first target object, first information associated with the target alarm event is obtained, a first tainted feature is extracted from the first information, and second information related to the first tainted feature is determined from a running log of the first target object. Then, a first prompt word is generated, wherein the first prompt word includes the first tainted feature, the second information, prompt information indicating extraction of at least one second tainted feature based on the second information, and prompt information indicating formation of an attack chain based on a running relationship between the first tainted feature and each of the at least one second tainted feature. The first prompt word is sent to a first language model, and first attack chain information returned by the first language model is received.

[0034] In the method, when a target alarm event is detected, an initial tainted feature (i.e., the first tainted feature) in an attack chain involved in the target alarm event is extracted, running information (i.e., the second information) related to the initial tainted feature is determined, the running information is analyzed by using the natural language processing capability of the language model, more second tainted features related to the initial tainted feature are dynamically extracted, and the attack chain information is restored by integration, thereby achieving comprehensive and accurate attack chain detection, improving the attack chain detection capability of the security protection product, and further improving the security detection level of the security protection product.

[0035] To facilitate understanding of the technical solutions provided in the embodiments of the application, the following will be described with reference to the accompanying drawings. Referring to Figure 1 The method specifically includes the following steps.

[0036] S101: In response to detecting a target alarm event of a first target object, first information associated with the target alarm event is obtained.

[0037] In the embodiments of the application, the attack chain is detected for security. In the process of performing an attack in the form of an attack chain, a corresponding alarm event can be triggered. Therefore, by detecting a target alarm event, the attack chain that may exist is detected by taking the target alarm event as a detection entrance.

[0038] In some embodiments, the attack chain information can be information used to perform an APT attack. In other words, the security protection product can detect the APT attack by using the attack chain detection method provided in the application.

[0039] The target object can be understood as a computing node for security detection. In some embodiments, the first target object can be a computing device such as a computer or a host. In other embodiments, the first target object can also be a virtual node such as a virtual machine or a container. The embodiments of the application do not limit this.

[0040] The target alarm event can be understood as a pre-configured alarm event. In some possible implementations, the target alarm event can be an alarm event in which a potential threat behavior exists, for example, the target alarm event can be an abnormal traffic event, a specific file creation event, a privileged operation event, and the like.

[0041] The first information associated with the target alarm event can be understood as information associated with the target alarm event, for example, the first information associated with the target alarm event can include an alarm type, alarm data, and the like.

[0042] When the first target object generates the target alarm event, indicating that the first target object can be attacked by an attack behavior in the form of an attack chain, by obtaining the first information associated with the target alarm event, the attack chain is subsequently combed and traced in combination with the first information.

[0043] S102: extracting a first taint feature from the first information, and determining second information related to the first taint feature from a running log of the first target object.

[0044] In combination Figure 2 The flowchart of the attack chain detection method is shown. In the embodiment of the present application, the first taint feature is related to an attack behavior in the form of an attack chain. The taint feature, also known as a taint or a taint keyword, can be understood as a trace left by an attacker in the process of executing an attack in the form of an attack chain, and the taint feature can be used to identify and comb the attack chain. That is, taking the target alarm event as a detection entry, the taint feature is extracted from the first information associated with the target alarm event, and the first taint feature as an initial taint feature is obtained.

[0045] For example, the taint feature can represent an object (such as a computing node), a process, a file, a network request source, a network request target, and the like. For example, when the target alarm event is a command injection event, the first taint feature can be a specific variable or input parameter. When the target alarm event is specific information acquisition, the first taint feature can be a file path.

[0046] The present application does not limit the way of extracting the taint feature from the first information, in some embodiments, the taint feature can be extracted by keyword matching, regular expression matching, and the like.

[0047] In other embodiments, the first taint feature is extracted by means of a first language model. The first language model has natural language processing capability and can understand natural language meaning and process different types of natural language tasks. For example, the first language model can be a deep learning model trained using text data. In other words, by using the natural language processing capability of the first language model, each parameter in the first information is analyzed, and the parameter related to the attack chain is extracted as the first taint feature.

[0048] The first language model performs the first information-based tainted feature extraction in a prompt learning manner. A prompt can be used to guide the language model to generate a specific output in a generative task (for example, a text generation task, a question and answer task, or a dialogue task). By configuring the prompt, the language model can understand the background and requirements of the task, and can process different types of natural language processing tasks without retraining the language model, thereby increasing the scalability and flexibility of the language model.

[0049] In a specific implementation, a second prompt is generated, the second prompt is sent to the first language model, and a first tainted feature returned by the first language model is received.

[0050] In the embodiments of the present application, the second prompt includes the first information and prompt information indicating extraction of the tainted feature from the first information. By configuring the above information in the second prompt, the first language model can determine whether the first information involves a tainted feature of an attack chain based on the prompting capability of the second prompt, extract the first tainted feature from the first information, and find a tainted feature in the attack chain.

[0051] The running log of the first target object can be understood as a log for recording the running status of the first target object. As shown in Figure 2 For example, the running log can include a command log, a network log, a process log, a file log, and other system-level logs.

[0052] Since the running log records the running status of the first target object, the first tainted feature can be traced and followed from the running log of the first target object, and the second information related to the first tainted feature can be determined, so as to subsequently determine the source of the first tainted feature and the propagation path of the first tainted feature. For example, the second information related to the first tainted feature can be an internet protocol (IP) address in the network log, a parent-child relationship in the process log, a read-write behavior in the file log, and the like.

[0053] In a specific implementation, the first language model is used to perform feature analysis on the first tainted feature, obtain a query statement, execute the query statement, and determine the second information related to the first tainted feature.

[0054] The query statement is used to query the second information related to the first contamination feature from the running log of the first target object. For example, the query statement can be a structured query language (SQL) statement. That is, a query statement for querying the second information is generated in combination with the characteristics of the first contamination feature, and the second information is queried from the running log of the first computing device by executing the query statement.

[0055] For example, when the first contamination feature is " / tmp / aaa.sh" and the network log (network_logs) of the first computing device includes the following fields: timestamp, src_ip, dst_ip, dst_port, and url, the query statement for querying the second information related to the first contamination feature from the network log of the first computing device can be:

[0056]

[0057] In some possible implementations, the query statement is generated by means of the first language model. Specifically, a third prompt word is generated, the third prompt word is sent to the first language model, and the query statement returned by the first language model is received.

[0058] The third prompt word can include the first contamination feature, the description information of the running log, and prompt information for indicating generation of a query statement for querying from the running log of the first computing device.

[0059] The description information of the running log can be understood as information for describing the running log from different dimensions. For example, the description information of the running log can include information for describing the content of the running log record, information of each field included in the running log, and the like. By configuring the above information in the third prompt word, the first language model can analyze the first contamination feature and the running log based on the prompting capability of the third prompt word, and generate a second information for extracting from the running log the second information related to the first contamination feature and the attack behavior in the form of an attack chain.

[0060] For example, the third prompt word can be as follows:

[0061] "Task description:

[0062] You are a skilled database query expert, and you need to generate SQL statements for different types of logs based on the provided contamination features. These SQL statements will be used to extract data related to potential threat behaviors.

[0063] Input data:

[0064] • Contamination feature: [first contamination feature]

[0065] • Log type: includes the following:

[0066] Network log: records information related to network communication.

[0067] Process log: records information such as process creation, termination, parent-child relationship, etc.

[0068] File operation log: records file creation, deletion, modification behavior.

[0069] System call log: records system-level operations (such as permission changes, etc.).

[0070] Task requirements:

[0071] 1. Generate SQL statements based on the provided taint features, ensuring logical accuracy and covering upstream and downstream nodes of the attack chain.

[0072] 2. SQL statements need to be generated for each type of log respectively.

[0073] 3. Provide clear comments to describe the purpose and logic of the query.

[0074] S103: Generate a first prompt word.

[0075] S104: Send the first prompt word to the first language model and receive the first attack chain information returned by the first language model.

[0076] Continue as Figure 2 shown, in the embodiments of the present application, the target alarm event of the first target object is taken as the detection entry, the first taint feature is extracted from the first information, and the second information is obtained by querying the running log of the first target object, the other second taint feature is extracted from the second information in combination with the first taint feature, in this way, the first taint feature and the second taint feature are integrated to form an attack chain.

[0077] In specific implementation, the attack chain is integrated by means of the first language model. The first prompt word includes: the first taint feature, the second information, prompt information for indicating extraction of at least one second taint feature based on the second information, and prompt information for indicating formation of an attack chain based on the running relationship between each taint feature in the first taint feature and the at least one second taint feature.

[0078] The running relationship between each taint feature in the first taint feature and the at least one second taint feature can be understood as the data transmission relationship between each taint feature. For example, taint feature A is file A, taint feature B is script B, file A is downloaded from script B, in this case, taint feature A is a downstream taint feature of taint feature B, and in the attack chain, taint feature A is located after taint feature B.

[0079] By configuring the above information in the first prompt word, the first language model can extract at least one second tainted feature from the second information based on the prompting capability of the first prompt word, the second tainted feature being associated with the same attack chain as the first tainted feature. In this way, in combination with the operational relationship between the respective tainted features indicated by the second information, the upstream and downstream relationships between the respective tainted features are determined, and then the first attack chain information including the first tainted feature and the second tainted feature is integrated.

[0080] In this way, by accurately identifying respective tainted features and tracing attack chains, the diversified strategies and complex characteristics of attack behaviors in the form of attack chains can be dynamically adapted, and the security detection capability for attack chains can be improved.

[0081] In some embodiments, as shown in Figure 2 The auxiliary information described in natural language can also be determined from the security detection knowledge base according to the first tainted feature and the second information. The auxiliary information includes at least one tainted feature related to a known attack chain. In this case, the first prompt word can also include the auxiliary information.

[0082] In other words, the first language model can extract a second tainted feature related to the attack chain from the second information in combination with the relevant knowledge of the known attack chain stored in the security detection knowledge base, such as common threat behavior patterns, known tainted features, etc., to improve the accuracy of security detection for attack chains.

[0083] Further, the embodiments of the present application also support users (such as security operation personnel) to dynamically adjust the content in the security detection knowledge base, supplement or optimize the relevant knowledge in the security detection knowledge base, for example, adding the security detection result (such as the first attack chain information) for the attack chain to the security detection knowledge base, and then improving the response capability for similar attack behaviors in the form of attack chains in the future.

[0084] In other embodiments, the first prompt word can also include prompt information for indicating the following content: when a target tainted feature in the at least one second tainted feature is related to a second target object, determining third information related to the target tainted feature from the operation log of the second target object, and re-performing tainted feature extraction based on the second information and the third information.

[0085] Continuing as Figure 2As shown, considering that the attack behavior in the form of attack chain can attack different target objects (such as different computing devices or virtual nodes), therefore, by configuring the above information in the first prompt, when there is a target tainted feature involving other target objects (i.e. second target object) in the second tainted feature extracted from the second information, the first language model can further trace for the second target object, query the third information related to the target tainted feature in the running log of the second target object, re-extract the tainted feature combined with the third information, and re-integrate the attack chain.

[0086] In this way, the behaviors of multiple target objects are integrated to realize comprehensive attack chain tracing and detection, adapt to the cross-host and cross-platform characteristics of attack behavior in the form of attack chain, and form an overall attack chain view.

[0087] For example, the first prompt can be as follows:

[0088] “Task Description:

[0089] You are a network security analysis expert, and you need to continue to extract tainted features based on the extracted tainted features and integrated log information, combined with the existing knowledge base, and form an attack chain. If the tainted feature involves data of other target objects, please trace and analyze the log information further upstream.

[0090] Input information:

[0091] 1. Extracted Tainted Features: [First Tainted Feature]

[0092] 2. Integrated Log Information: [Second Information]

[0093] 3. Knowledge Base Content: [Auxiliary Information]

[0094] Analysis Target:

[0095] 1. Confirm the upstream and downstream relationships of each tainted feature, identify its source and target:

[0096] · Upstream Node: Analyze the host, process, file, or network request source that triggered the current behavior.

[0097] · Downstream Node: Analyze the affected host, process, file, or network request target.

[0098] 2. If the upstream node involves data of other hosts, further trace and find the trigger point further upstream and re-integrate the attack chain.

[0099] 3. Output detailed upstream and downstream relationship analysis results, and potential threat propagation paths.”

[0100] After the first language model returns the first attack chain information, the security protection product can generate a corresponding alarm. Specifically, as shown in Figure 2 , according to the first attack chain information, alarm information is generated. The alarm information includes at least one of the following: the first attack chain information, each tainted feature in the first attack chain information, the risk level corresponding to the first attack chain information, and the disposal suggestion corresponding to the first attack chain information.

[0101] In this way, the security protection product can present the complete attack chain to the user, inform the user of each tainted feature (also referred to as each key node), the propagation path, and the impact target in the attack chain. At the same time, the user can also view the detailed information of each tainted feature in the attack chain, such as commands, network traffic features, and file operation records, through the alarm information, and take alarm disposal in combination with the disposal suggestion, such as isolation, blacklist setting, and vulnerability patching.

[0102] In some embodiments, as shown in Figure 2 , it can also be determined that the first tainted feature in the first attack chain information, and the risk level corresponding to the first attack chain information is increased in response to the first tainted feature in the first attack chain information not being located within the security baseline range.

[0103] The first tainted feature in the first attack chain information can be understood as the most upstream tainted feature in the first attack chain, that is, the source tainted feature. The security baseline range can be understood as the minimum standard for safe operation that is predefined, that is, being located within the security baseline range indicates safe operation, and not being located within the security baseline range indicates unsafe operation.

[0104] Determining whether the source tainted feature is located within the security range, such as whether the service or system where the source tainted feature is located is located within the security range, when the source tainted feature is not located within the security baseline range, it indicates that the source tainted feature may have external exposure or unauthorized access behavior, in which case the alarm risk level is increased so that the user (such as a security operation personnel) can timely dispose of the attack behavior in the form of an attack chain.

[0105] In this method, when a target alarm event is detected, the initial tainted feature (i.e., the first tainted feature) in the attack chain involved in the target alarm event is extracted, the running information (i.e., the second information) related to the initial tainted feature is determined, the running information is analyzed by means of the natural language processing capability of the language model, more second tainted features related to the initial tainted feature are dynamically extracted, and the attack chain information is integrated and restored, thereby achieving comprehensive and accurate attack chain detection, improving the attack chain detection capability of the security protection product, and further improving the security detection level of the security protection product.

[0106] The above is combined with Figure 1 andFigure 2 The attack chain detection method provided by the embodiments of the present application is described in detail, and the device and equipment provided by the embodiments of the present application will be introduced below in combination with the drawings.

[0107] Referring to Figure 3 The structure diagram of the attack chain detection device is shown in the figure, and the device 30 comprises:

[0108] The acquisition module 301 is configured to acquire first information associated with the target alarm event of the first target object in response to detecting the target alarm event of the first target object.

[0109] The determination module 302 is configured to extract a first taint feature from the first information, and determine second information related to the first taint feature from the running log of the first target object.

[0110] The generation module 303 is configured to generate a first prompt word; wherein the first prompt word comprises: the first taint feature, the second information, prompt information for indicating extraction of at least one second taint feature based on the second information, and prompt information for indicating formation of an attack chain based on the running relationship between each taint feature in the first taint feature and the at least one second taint feature.

[0111] The detection module 304 is configured to send the first prompt word to a first language model, and receive first attack chain information returned by the first language model.

[0112] In some possible implementation manners, the determination module 302 is specifically configured to:

[0113] Generate a second prompt word; wherein the second prompt word comprises: the first information and prompt information for indicating extraction of a taint feature from the first information;

[0114] Send the second prompt word to the first language model, and receive the first taint feature returned by the first language model.

[0115] In some possible implementation manners, the determination module 302 is specifically configured to:

[0116] Perform feature analysis on the first taint feature by using the first language model to obtain a query statement; wherein the query statement is used to query the second information related to the first taint feature from the running log of the first target object;

[0117] Execute the query statement to determine the second information related to the first taint feature.

[0118] In some possible implementation manners, the determination module 302 is specifically configured to:

[0119] generate a third prompt word; wherein the third prompt word comprises: the first feature of the stain, the description information of the running log, and prompt information for indicating generation of a query statement for querying from the running log of the first computing device;

[0120] send the third prompt word to the first language model, and receive a query statement returned by the first language model.

[0121] In some possible implementation manners, the determination module 302 is further configured to:

[0122] determine, from the security detection knowledge base, auxiliary information described in a natural language according to the first feature of the stain and the second information; wherein the auxiliary information comprises at least one feature of the stain related to a known attack chain;

[0123] The first prompt word further comprises: the auxiliary information.

[0124] In some possible implementation manners, the first prompt word further comprises prompt information for indicating: when a target feature of the stain in the at least one second feature of the stain is related to a second target object, determining third information related to the target feature of the stain from a running log of the second target object, and re-performing stain feature extraction based on the second information and the third information.

[0125] In some possible implementation manners, the apparatus 30 further comprises an alarm module, and the alarm module is configured to:

[0126] generate alarm information according to the first attack chain information;

[0127] The alarm information comprises at least one of the following: the first attack chain information, each feature of the stain in the first attack chain information, a risk level corresponding to the first attack chain information, and a disposal suggestion corresponding to the first attack chain information.

[0128] In some possible implementation manners, the alarm information comprises the risk level corresponding to the first attack chain information, and the alarm module is further configured to:

[0129] determine a first feature of the stain in the first attack chain information;

[0130] in response to the first feature of the stain in the first attack chain information not being located in a security baseline range, increase the risk level corresponding to the first attack chain information.

[0131] In some possible implementation manners, the first attack chain information is used for performing an advanced persistent threat (APT) attack.

[0132] The attack chain detection apparatus 30 according to embodiments of the present application can correspond to performing the methods described in embodiments of the present application, and the above and other operations and / or functions of the various modules / units of the attack chain detection apparatus 30 are respectively implemented in order to achieve Figure 1 The corresponding flow of each method in the illustrated embodiments, for the sake of brevity, will not be repeated here.

[0133] Embodiments of the present application also provide an electronic device. The electronic device is specifically used to implement the functions of the attack chain detection apparatus 30 in the embodiments as Figure 3 described above.

[0134] Figure 4 A structural schematic diagram of an electronic device 400 is provided, as Figure 4 shown, the electronic device 400 includes a bus 401, a processor 402, a communication interface 403 and a memory 404. The processor 402, the memory 404 and the communication interface 403 communicate through the bus 401.

[0135] The bus 401 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For the sake of convenience, Figure 4 only one thick line is used in the figure, but it does not mean that there is only one bus or only one type of bus.

[0136] The processor 402 can be any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP), etc.

[0137] The communication interface 403 is used for external communication. For example, the communication interface 403 can be used for communication with the terminal.

[0138] The memory 404 can include volatile memory, such as random access memory (RAM) including a cache area for the temporary storage of data. The memory 404 also can include non-volatile memory, such as read only memory (ROM), EPROM, EEPROM, flash memory, or hard disk (HDD), etc.

[0139] The executable code stored in the memory 404 is executed by the processor 402 to perform the aforementioned attack chain detection method.

[0140] Specifically, in the case of the embodiment shown, and Figure 3 In the case of the embodiment shown, and Figure 3 In the case of the embodiment shown, and Figure 3 The software or program code required to perform the functions of the modules / units in the attack chain detection apparatus 30 described in the embodiments can be partially or entirely stored in the memory 404. The processor 402 executes the program code corresponding to each unit stored in the memory 404 to perform the aforementioned attack chain detection method.

[0141] The embodiments of the present application also provide a computer readable storage medium. The computer readable storage medium can be any available medium or data storage device that can be accessed by a computing device and include one or more available media or data storage devices. The available medium can be a magnetic medium (such as a floppy disk, a hard disk, a magnetic tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid state disk), etc. The computer readable storage medium includes instructions that instruct the computing device to perform the attack chain detection method described above and applied to the attack chain detection apparatus 30.

[0142] The embodiments of the present application also provide a computer program product including one or more computer instructions. When the computer instructions are loaded and executed on a computing device, the processes or functions described in the embodiments of the present application are generated in whole or in part.

[0143] The computer instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be transmitted from one website site, computer or data center to another website site, computer or data center through wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) mode.

[0144] The computer program product is executed by a computer, and the computer executes any one of the preceding attack chain detection methods. The computer program product can be a software installation package, and when any one of the preceding attack chain detection methods needs to be used, the computer program product can be downloaded and executed on the computer.

[0145] The flowcharts and block diagrams in the accompanying drawings illustrate possible architectural, functional, and operational architectures of systems, methods, and computer program products according to various embodiments of the present application. In this regard, each block in the flowcharts or block diagrams can represent a module, a segment, or a portion of code that comprises one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in a different order than that noted in the figures. For example, two blocks noted in succession can actually be executed substantially concurrently, or they can sometimes be executed in reverse order, depending on the functionality involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented by a dedicated hardware-based system that performs specified functions or operations, or can be implemented by a combination of dedicated hardware and computer instructions.

[0146] The units involved in the embodiments of the present application can be implemented in a software manner, or can be implemented in a hardware manner. In some cases, the name of the unit / module does not constitute a limitation on the unit itself.

[0147] The functions described above in the embodiments of the present application can be executed at least in part by one or more hardware logic components. For example, non-limiting examples of exemplary types of hardware logic components that can be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system on a chip (SOCs), complex programmable logic devices (CPLDs), and so on.

[0148] In the context of the embodiments of the present application, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include but not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium will include one or more of the following: an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0149] It should be noted that the various embodiments described in the specification are progressive and each embodiment focuses on the differences from other embodiments. The same and similar parts between embodiments can be mutually referred to. For the system or device disclosed by the embodiments, since it corresponds to the method disclosed by the embodiments, the description is relatively simple, and the relevant parts can be referred to the method part.

[0150] It should be understood that in the present application, "at least one" means one or more, and "multiple" means two or more. "And / or" is used to describe the association relationship between the associated objects, which means that there can be three relationships, for example, "A and / or B" can represent three cases: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally represents that the associated objects before and after are in an "or" relationship. "At least one of the following" or similar expressions means any combination of these items, including any combination of single or multiple items. For example, at least one of a, b or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0151] It is also to be noted that, as used in the specification and the appended claims, the singular forms "a," "an" and "the" include plural referents unless otherwise indicated. Furthermore, to the extent that the terms "including," "includes," "having," "has," "with," or "contains" are used in either the detailed description and the claims, such terms are intended to be inclusive in a manner similar to the term "comprising" as an open transition term without precluding any additional or other elements.

[0152] The embodiments disclosed herein can each be implemented as a method, apparatus, or article of manufacture using programming instructions. The embodiments disclosed herein can be implemented using software, firmware, hardware, or a combination thereof. The various elements of the disclosed embodiments, as well as the procedural aspects of the disclosed embodiments, can be implemented using a variety of programming instructions, software, firmware, or other programming instructions. In one embodiment, programming instructions are distributed via a computer medium, such as a compact disc, diskette, tape, file, or other computer medium. In another embodiment, programming instructions are downloaded into a computer from a network connection, such as the Internet, a local area network, a wide area network, or other network connection.

[0153] The above description of disclosed embodiments provides enough information to enable those with ordinary skill in the art to make and use the application. Various modifications to these embodiments will be readily apparent to those with ordinary skill in the art, and the generic principles defined herein can be applied to other embodiments without departing from the spirit or scope of the application. Accordingly, the application is not to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An attack chain detection method, characterized in that, The method includes: In response to detecting a target alarm event of a first target object, first information associated with the target alarm event is obtained; Extract a first taint feature from the first information, and determine second information related to the first taint feature from the runtime log of the first target object; Generate a first prompt word; wherein the first prompt word includes: the first taint feature, the second information, a prompt message for indicating that at least one second taint feature is extracted based on the second information, and a prompt message for indicating that an attack chain is formed based on the operational relationship between each taint feature in the first taint feature and the at least one second taint feature; The first prompt word is sent to the first language model, and the first attack chain information returned by the first language model is received.

2. The method according to claim 1, characterized in that, The step of extracting the first taint feature from the first information includes: Generate a second prompt word; wherein the second prompt word includes: the first information and prompt information for indicating the extraction of blemish features from the first information; The second prompt word is sent to the first language model, and the first taint feature returned by the first language model is received.

3. The method according to claim 1, characterized in that, The step of determining the second information related to the first taint feature from the operation log of the first target object includes: The first language model is used to perform feature analysis on the first taint feature to obtain a query statement; wherein, the query statement is used to query second information related to the first taint feature from the running log of the first target object; Execute the query statement to determine the second information related to the first stain feature.

4. The method according to claim 3, characterized in that, The step of using the first language model to perform feature analysis on the first taint feature to obtain a query statement includes: Generate a third prompt word; wherein the third prompt word includes: the first taint feature, the descriptive information of the operation log, and prompt information for indicating the generation of a query statement for querying from the operation log of the first target object; The third prompt word is sent to the first language model, and the query statement returned by the first language model is received.

5. The method according to claim 1, characterized in that, The method further includes: From the security detection knowledge base, based on the first taint feature and the second information, auxiliary information described in natural language is determined; wherein, the auxiliary information includes at least one taint feature related to a known attack chain; The first prompt word also includes: the auxiliary information.

6. The method according to claim 1, characterized in that, The first prompt word also includes prompt information indicating the following: when the target taint feature in the at least one second taint feature is related to the second target object, determine the third information related to the target taint feature from the running log of the second target object, and, based on the second information and the third information, re-extract the taint feature.

7. The method according to claim 1, characterized in that, The method further includes: Based on the first attack chain information, an alarm message is generated; The alarm information includes at least one of the following: the first attack chain information, each taint feature in the first attack chain information, the risk level corresponding to the first attack chain information, and the handling suggestions corresponding to the first attack chain information.

8. The method according to claim 7, characterized in that, The alarm information includes the risk level corresponding to the first attack chain information, and the method further includes: Identify the first taint feature in the first attack chain information; In response to the first taint feature in the first attack chain information not being within the security baseline range, the risk level corresponding to the first attack chain information is increased.

9. The method according to any one of claims 1 to 8, characterized in that, The first attack chain information is used to execute advanced persistent threat (APT) attacks.

10. An attack chain detection device, characterized in that, The device includes: The acquisition module is used to acquire first information associated with the target alarm event in response to the detection of a target alarm event of a first target object; The determination module is configured to extract a first taint feature from the first information, and to determine second information related to the first taint feature from the running log of the first target object; A generation module is used to generate a first prompt word; wherein the first prompt word includes: a first taint feature, second information, prompt information for indicating that at least one second taint feature is extracted based on the second information, and prompt information for indicating that an attack chain is formed based on the operational relationship between each taint feature in the first taint feature and the at least one second taint feature; The detection module is used to send the first prompt word to the first language model and receive the first attack chain information returned by the first language model.

11. An electronic device, characterized in that, The electronic device includes a processor and a memory; The processor is configured to execute instructions stored in the memory, causing the electronic device to perform the method as described in any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that, Includes instructions that instruct an electronic device to perform the method as described in any one of claims 1 to 9.

13. A computer program product, characterized in that, The computer program product includes computer-readable instructions for implementing the method according to any one of claims 1 to 9.

Images