Hidden attack tracing method based on dynamic and static behavior mapping and graph neural network

Abstract

The invention discloses a hidden attack tracing method based on dynamic and static behavior mapping and a graph neural network. The method comprises the following steps: acquiring an APT organization PE file sample containing a shell and obfuscated code in a computer system, and preprocessing the sample; constructing a control flow graph for the preprocessed sample, extracting a high-frequency sub-graph mode as a code gene, and constructing a tissue fingerprint in combination with other features; processing sample static code features and mapping the sample static code features to a unified semantic space, monitoring sample operation dynamic behaviors to construct a dynamic feature matrix containing time sequence information, using an attention mechanism to enhance semantics, adjusting feature weights, and fusing the two features to generate a comprehensive feature vector; a graph attention network node type is defined, a weighted edge is established according to feature association, a node importance score is calculated by using a self-attention mechanism, and APT organization traceability is performed based on the network. According to the method, the F1 value of attack traceability can be improved to 91.2% and is improved by 12.3% compared with a traditional method, novel shell adding and confusion technologies are effectively dealt with, and key technical support is provided for network security defense.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular to a covert attack tracing method based on dynamic and static behavior mapping and graph neural network. Background Art

[0002] APT attacks are highly concealed, long-term, and highly targeted. Their malware usually uses anti-detection techniques such as packing, obfuscation, and dynamic code generation to evade detection. Traditional attack tracing methods rely on feature matching or behavioral rules, which are difficult to deal with the complex deformation of highly concealed attacks.

[0003] The deficiencies of existing technologies are mainly reflected in the following aspects: it is difficult for existing technologies to effectively restore the real code logic of packed samples, resulting in failure of feature extraction; traditional sandbox monitoring only captures surface API calls and cannot deeply analyze timing dependencies and context associations; simple splicing of static and dynamic features cannot achieve semantic-level fusion, affecting the model's discrimination ability; traditional graph neural networks cannot effectively model the complex relationships between heterogeneous nodes, and the traceability accuracy is limited.

[0004] The current mainstream attack source tracing technologies are mainly divided into the following three categories: (1) Static feature analysis: extract the string, instruction sequence, control flow graph (CFG) and other features of the malicious code through disassembly, and classify them in combination with rule matching or machine learning models. For example, the disassembly tool based on IDAPro and the CAPA rule library can identify some known attack patterns, but the ability to parse the packed and obfuscated code is limited.

[0005] (2) Dynamic behavior monitoring: Run samples in a sandbox environment, record behaviors such as API calls and file operations, and build a behavior feature matrix. Sandbox tools such as Cuckoo and CAPE can generate behavior reports, but they rely on fixed time window analysis and are difficult to capture long-term latent complex behavior chains.

[0006] (3) Application of graph neural networks: Model the attack entities (such as IP, domain name, file hash) as graph structures, and learn node associations through algorithms such as GCN and GAT. For example, some scholars have proposed a GCN-based attack graph model, but it only focuses on the co-occurrence relationship between IP and files, ignoring the code semantics and timing characteristics.

[0007] Although the above existing technologies have improved the attack source tracing capability to a certain extent, they still have the following fundamental defects: First, the ability to resist packing and obfuscation is weak. The success rate of existing depacketizing tools (such as UPX) for new packing technologies (such as VMProtect) is less than 60%, resulting in disassembly failure; obfuscated code destroys the structural features of static analysis through control flow flattening, instruction replacement and other technologies, and the subgraph recognition accuracy of the traditional LDA model drops below 50%.

[0008] Secondly, dynamic behavior analysis is one-sided. For example, sandbox monitoring relies on a fixed time window (such as the default 60 seconds), which cannot capture long-term behavior patterns across processes and sessions; and traditional LSTM models only focus on API call sequences, ignoring deep context information such as call parameters and memory operations. Summary of the invention

[0009] The present invention aims to solve the problem of accurate tracing of highly concealed APT attacks. Aiming at the shortcomings of the existing technology in shell obfuscated code parsing, dynamic behavior analysis and feature fusion, an attack tracing method based on multimodal feature semantic enhancement and graph neural network is provided.

[0010] Based on the first main aspect of the present invention, a covert attack tracing method based on dynamic and static behavior mapping and graph neural network is provided, comprising the following steps: S1, obtaining PE file samples containing packed and obfuscated codes from the APT organization in the computer system and performing sample preprocessing; S2, for the preprocessed samples, construct the control flow graph of their program execution, extract high-frequency subgraph patterns from the control flow graph as code genes, and construct an organizational fingerprint that can characterize the characteristics of the APT organization based on the extracted code genes and other features of the samples; S3 processes the static code features of the sample and converts them into a unified semantic space through mapping technology. At the same time, it monitors the dynamic behavior of the sample in real time and builds a dynamic feature matrix containing timing information. It uses the attention mechanism to semantically enhance the static and dynamic features, dynamically adjusts the weight of each feature, and then fuses the two to generate a comprehensive feature vector. S4, defines the node types of the graph attention network, constructs weighted edges in the graph according to the correlation between features, uses the self-attention mechanism to calculate the importance scores between nodes, and conducts traceability analysis on APT organizations based on the constructed graph attention network.

[0011] As a further preferred embodiment, the method further comprises the following steps: S5, selects the loss function and combines it with the regularization term to optimize the model parameters; adopts a parallel computing strategy and uses resources including server clusters to perform distributed training on the model; during the training process, continuously adjusts the model's hyperparameters to improve the model's performance and accuracy.

[0012] As a further preferred solution, the sample preprocessing in step S1 includes: restoring the semantic logic of the obfuscated code by disassembly technology, and matching the assembly code with the technical and tactical entries in the CAPA rule base; The integrity of the unpacked sample is verified, and the hash value comparison is used to ensure that the file content before and after unpacking is consistent.

[0013] As a further preferred solution, in step S2, the Angr tool is used to generate an inter-process control flow graph ICFG to capture the cross-function call relationship of the malware; and, through the improved LDA model, high-frequency subgraphs are extracted from the ICFG as the code genes of the APT organization; and, the sample is run in the CAPE sandbox, the runtime API sequence and timestamp are captured through the Hook mechanism, a dynamic behavior chain is generated, the API co-occurrence frequency is counted based on the time window, and a dynamic feature matrix is ​​constructed.

[0014] As a further preferred solution, step S3 includes the following sub-steps: S31, multimodal semantic enhancement: For static code features, the Attack2Vec algorithm is used to map API functions and ATT&CK techniques and tactics into dense vectors through XOR operations; For the control flow graph features, the Node2Vec algorithm is used to perform a second-order random walk on the ICFG subgraph generated by Angr, retaining the structural semantic information of the subgraph and generating a 256-dimensional vector; For dynamic behavior features, the API call sequence monitored by the sandbox is encoded through the BiLSTM model to capture the long-term and short-term dependencies within a certain time window.

[0015] S32, feature fusion and aggregation: after normalizing the static feature vector and the dynamic feature vector, a fusion vector is generated through a cascade operation; The channel attention mechanism is used to weight the fusion vector, and the importance weight of each feature dimension is dynamically calculated through global average pooling and fully connected layers.

[0016] As a further preferred solution, in step S4, in terms of graph structure definition, the node types in the graph are determined, including APT organizations, ATT&CK techniques and tactics, code genes, and AP functions; when constructing edges, the weights of the edges are determined based on co-occurrence frequency, control flow calls, and timing dependencies; In the construction and application of the graph attention network, a multi-head self-attention mechanism is adopted; after being processed by the multi-head self-attention mechanism, the nodes are classified through the Softmax layer; the Softmax layer predicts the APT organization label corresponding to each node and outputs the probability distribution of the node belonging to each APT organization; by analyzing the probability distribution, the APT organization can be traced and the possible source of the attack can be determined.

[0017] As a further preferred solution, the multi-head self-attention mechanism formula is as follows: ; in, For Node For Node The attention weight is expressed as right The semantic contribution of For Node The set of neighbor nodes of For the activation function, introduce nonlinearity and alleviate the gradient vanishing problem; It is a vector concatenation operation, which concatenates the transformed features of two nodes; is the attention mechanism parameter vector, which is used to calculate the importance scores between nodes; W represents the trainable weight matrix, which is used to linearly transform node features; Respectively represent nodes and The input feature vector, h k represents the original feature vector of node k, the neighbor of node i. In the summation process of the denominator, h k Traverse all neighbor nodes to calculate the normalization factor of the attention weight.

[0018] As a further preferred solution, in step S5, the loss function is: ; in, is the true label of the sample; is the predicted probability distribution of the model for the sample; is the L2 regularization coefficient, which is used to control the strength of the regularization term to prevent overfitting; are all trainable parameters in the model, Based on the second main aspect of the present invention, there is provided an electronic device, comprising: at least one processor; a memory communicatively connected to the at least one processor; the memory storing a computer program which, when executed by the at least one processor, enables the at least one processor to implement the aforementioned covert attack tracing method based on dynamic and static behavior mapping and graph neural network.

[0019] Based on the third main aspect of the present invention, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed, the covert attack tracing method based on dynamic and static behavior mapping and graph neural network as described above is implemented.

[0020] Advantages and beneficial effects of the present invention: Compared with the prior art, the present invention uses an automated unpacking tool and an improved LDA model to effectively analyze malicious samples with a packing rate ≥30% and an obfuscated code ratio ≥50%, extract high-frequency subgraphs as code genes, and improve the robustness of feature extraction.

[0021] Moreover, the present invention combines sandbox monitoring with the BiLSTM model to capture the timing dependencies of API calls and construct a dynamic behavior matrix containing a 50ms time window, thereby solving the one-sided problem that traditional methods only rely on surface behavioral characteristics.

[0022] This paper adopts multimodal embedding technologies such as Attack2Vec and Node2Vec to map static code features and dynamic behavior features into a unified semantic space, and dynamically adjusts feature weights through a channel attention mechanism to enhance the model's ability to discriminate complex attack patterns.

[0023] The present invention constructs a heterogeneous graph neural network that includes APT organizations, techniques and tactics, code genes, and API functions, and uses a multi-head self-attention mechanism to learn the deep associations between nodes, breaking through the limitations of traditional GCN models in heterogeneous node modeling and achieving accurate reasoning of attack paths.

[0024] Through the above technical scheme, the present invention can improve the F1 value of attack tracing to 91.2%, which is 12.3% higher than the traditional method, effectively deal with new shell and obfuscation technologies, and provide key technical support for network security defense. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 The overall framework of the APT attack tracing and reasoning solution based on semantic behavior enhancement and code genes in one embodiment of the present invention is shown.

[0026] Figure 2 A dynamic and static feature extraction and code gene recognition module in one embodiment of the present invention is shown.

[0027] Figure 3 A semantic behavior enhancement and representation module in one embodiment of the present invention is shown.

[0028] Figure 4 An APT attack tracing module in one embodiment of the present invention is shown.

[0029] Figure 5 Shows Figure 4 Schematic diagram of the attention network in Figure 2.

[0030] Figure 6 The static feature characterization is performed by the CAPA tool in one embodiment of the present invention.

[0031] Figure 7 It is shown that dynamic feature characterization is implemented by Cuckoo and CAPE sandbox in one embodiment of the present invention.

[0032] Figure 8 A dynamic and static feature alignment framework in one embodiment of the present invention is shown.

[0033] Fig. 9 The static code gene and ATT&CK mapping in one embodiment of the present invention is shown.

[0034] Fig.10 The diagram shows the mapping of key code snippets and semantic behaviors in one embodiment of the present invention.

[0035] Fig.11 The figure shows the association between dynamic code genes and timing dependencies in one embodiment of the present invention.

[0036] Fig.12 An example of implementing dynamic and static feature alignment in an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0037] The preferred embodiments of the present invention will be described in detail below so that the purpose, features and advantages of the present invention can be more clearly understood. It should be understood that the following embodiments are not intended to limit the scope of the present invention, but are only intended to illustrate the essential spirit of the technical solution of the present invention.

[0038] In the following description, certain specific details are set forth for the purpose of illustrating various disclosed embodiments to provide a thorough understanding of the various disclosed embodiments. However, those skilled in the relevant art will recognize that the embodiments may be practiced without one or more of these specific details. In other cases, well-known techniques associated with the present application may not be shown or described in detail to avoid unnecessarily obscuring the description of the embodiments.

[0039] References throughout the specification to "one embodiment" or "an embodiment" indicate that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Thus, the appearances of "in one embodiment" or "in an embodiment" in various places throughout the specification are not necessarily all referring to the same embodiment. Furthermore, the particular features, structures, or characteristics may be combined in any manner in one or more embodiments.

[0040] The following terms cover the core technical components of malware analysis, feature extraction, semantic enhancement, and tracing model in the present invention.

[0041] APT: (Advanced Persistent Threat) refers to a long-term, covert network attack launched against a specific target. This paper focuses on the tracing and technical and tactical analysis of APT attacks.

[0042] GAN: (Graph Attention Network) is a graph neural network based on the attention mechanism, which achieves feature aggregation by calculating the importance scores between nodes. In this invention, GAN is used for the traceability classification of APT organizations, for example, through the multi-head self-attention mechanism to mine the correlation between ATT&CK tactics and code genes.

[0043] Attention Weight: (Attention Weight) represents the importance score of the relationship between nodes in the Graph Attention Network (GAN). In this invention, it is used to weight the aggregation of key features (such as the association between APT organizations and ATT&CK techniques and tactics).

[0044] GCN model: (Graph Convolutional Network) is a deep learning model based on graph structure, which learns graph representation by aggregating neighborhood node information. In this paper, it is used for comparative experiments to verify the superiority of Graph Attention Network (GAN).

[0045] BiLSTM (Bidirectional Long Short-Term Memory) is a recurrent neural network that can simultaneously capture the dependencies between time series data. In this paper, BiLSTM is used to encode dynamic API sequences (such as RegOpenKey → RegSetValue) to enhance the temporal semantic modeling capability.

[0046] LDA (Latent Dirichlet Allocation) is an unsupervised machine learning algorithm mainly used for text topic modeling. In this paper, the improved LDA model is used to mine potential organizational topic information from the code genes of APT malware, and the specific characteristics of the APT family are identified by analyzing the behavioral characteristics and code patterns of the malware, thereby improving the accuracy of attack tracing.

[0047] Attack2Vec: (Attack-to-Vector, attack behavior vectorization algorithm) is a custom feature embedding method that solves the semantic gap between dynamic and static features by mapping static API functions and ATT&CK techniques and tactics into low-dimensional dense vectors. For example, kernel32.GetSystemInfo is combined with the tactic "information discovery" to generate a vector representation with semantic consistency.

[0048] The Node2Vec algorithm (Node-to-Vector, node vectorization algorithm) is a graph embedding technology based on random walks, which is used to convert graph structures (such as control flow graph nodes) into low-dimensional vectors. In this invention, the algorithm is applied to the embedding learning of inter-procedural control flow graphs (ICFGs), retaining the semantic information of code genes, such as cross-function call relations (such as Call instruction jumps).

[0049] ICFG2Vec: (Inter-procedural Control-Flow Graph to Vector) is a graph embedding method that converts ICFG (inter-procedural control-flow graph) into a low-dimensional vector, preserving the cross-function call relationship. It is used for the semantic representation of code genes in this invention.

[0050] APISeq2Vec: (API Sequence to Vector) encodes dynamic API call sequences into vectors through sequence models (such as BiLSTM) to capture temporal dependencies. This method is used for semantic enhancement of dynamic behavior features.

[0051] Angr: (the name comes from "Analysis Engine", binary analysis framework) is an open source tool used for reverse engineering and vulnerability analysis. In this invention, it is used to generate ICFG (inter-procedural control flow graph) of malware and extract code genes.

[0052] ICFG: (Inter-procedural Control-Flow Graph) is a control flow graph that describes the inter-function call relationship of a program. The nodes are basic blocks or functions, and the edges represent control flow jumps. In the present invention, it is used to identify the characteristic subgraph of the APT family.

[0053] PE file: (Portable Executable) is the standard format of executable files in Windows operating system (such as .exe, .dll). The malware samples processed in this invention are all in PE format.

[0054] Unipack: (Automated depacketization tool) is used to remove the malware's packing protection (such as UPX, VMProtect) and restore the original code logic. It is used for sample preprocessing in this invention.

[0055] VMProtect: (Virtual Machine Protect) is a commercial-grade code obfuscation tool that increases the difficulty of reverse engineering by virtualizing instructions. The samples processed in this invention include the confrontation scenario of VMProtect packing.

[0056] UPX: (Ultimate Packer for eXecutables, executable file compression tool) is an open source shelling tool used to compress PE files. In the present invention, the UPX shelled sample is unpacked by the Unipack tool.

[0057] CAPA rule base: (Capability Pattern Analysis Rules) is a static analysis rule base open sourced by FireEye, which is used to identify the ATT&CK technical and tactical features of malware (such as persistence and privilege escalation). This invention is used to extract static behavior features, and the CAPA tool is used to characterize static features, such as Figure 6 shown.

[0058] ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a cybersecurity threat behavior classification system proposed by MITRE, which decomposes attack behaviors into tactics (goals) and techniques (means). This paper uses this framework to semantically map static features, such as associating the API function advapi32.StartService with the tactic "Persistence" (Persistence) and the technical number T1053 (planned task), to achieve the transformation from low-level behavior to high-level attack mode.

[0059] ICFG: (Inter-procedural Control-Flow Graph) is a control flow graph that describes the inter-function call relationship of a program. Nodes represent basic blocks or functions, and edges represent control flow jumps. After generating ICFG using the Angr tool, the present invention extracts high-frequency subgraphs (such as CreateFile → WriteFile → StartService) from it as the code gene of the APT organization.

[0060] CAPE sandbox: (Configurable Analysis Platform for Exploratory research) is an open source malware dynamic analysis tool that is used to capture API calls, file operations, registry modifications, and other behaviors during sample runtime. By customizing Hook rules, the sandbox can enhance the monitoring capabilities of complex malicious code and provide support for dynamic feature extraction. The operation logic of dynamic feature characterization implemented through Cuckoo and CAPE sandbox is as follows: Figure 7 shown.

[0061] Hook mechanism: (Hook technology) is a system-level interception technology that intercepts specific events (such as API calls, process creation) by inserting code. In this invention, the Hook mechanism is used to capture the dynamic behavior of malware in real time, such as monitoring the calls of key API functions (such as CreateFile, RegSetValue) to generate a high-fidelity dynamic behavior chain.

[0062] API: (Application Programming Interface) is a set of functions provided by an operating system or library. In this invention, the focus is on monitoring sensitive APIs (such as ShellExecute, VirtualAllocEx) called by malware, and combined with dynamic behavior analysis, an attack behavior feature library is constructed.

[0063] RegOpenKey: (Registry Open Key, registry key opening function) is a Windows API function used to open a specific key in the system registry. In the present invention, the modification behavior of malware to the registry (such as persistent attacks) is monitored.

[0064] RegSetValue: (Registry Set Value) is a Windows API function used to set the value of a registry key. The present invention is used to detect malware modifying the registry to achieve self-startup or configuration storage.

[0065] ShellExecute: (Shell Execute, execute external program function) is a Windows API function used to start external applications or open files. In the present invention, it is used to capture the behavior of malware executing malicious payloads (such as downloaders, ransomware).

[0066] Example 1: APT attack tracing method based on code gene and dynamic and static semantic enhancement The overall framework of the APT attack tracing and reasoning solution based on semantic behavior enhancement and code gene in this invention is as follows: Figure 1 An example of implementing dynamic and static feature alignment is shown in Fig.12 shown.

[0067] Step 1: APT malware sample collection and preprocessing 1. Sample collection: a) Obtain PE file samples of APT organizations from public APT analysis reports (such as FireEye, Qi'anxin) and partner manufacturers, covering 10 major APT families (such as OceanLotus, DarkHotel).

[0068] b) The selected samples must meet the following requirements: the proportion of packed code ≥ 30% and the proportion of obfuscated code ≥ 50% to ensure the representativeness of the data.

[0069] 2. Sample pretreatment: a) Automated unpacking: Use the Unipack tool combined with custom scripts to batch process common packed samples such as UPX and VMProtect.

[0070] b) Disassembly and semantic restoration: Use IDA Pro to generate assembly code, match ATT&CK techniques and tactics (such as T1053 corresponding to "planned tasks") through the CAPA rule library, and restore the semantic logic of the obfuscated code.

[0071] Step 2: Extraction of coding genes and construction of tissue fingerprints 1. Static code gene extraction: a) Control flow graph generation: Use the Angr tool to generate an inter-procedural control flow graph (ICFG) to capture the cross-function call relationship of the malware. The following is an example: ⅰNode: Basic Block Side 2: Control flow jump (Call / Jump instruction) b) Key subgraph identification: Through the improved LDA model, high-frequency subgraphs (such as CreateFile →WriteFile → StartService) are extracted from ICFG as the code genes of the APT organization.

[0072] 2. Dynamic behavior feature extraction: a) Sandbox monitoring: Run the sample in the CAPE sandbox, capture the runtime API sequence and timestamp through the Hook mechanism, and generate a dynamic behavior chain (such as RegOpenKey → RegSetValue → ShellExecute).

[0073] b) Timing dependency analysis: Count the co-occurrence frequency of APIs based on the time window (50ms by default) and build a dynamic feature matrix.

[0074] The dynamic and static feature extraction and code gene recognition module of the present invention is as follows Figure 2 The dynamic code gene is associated with the timing dependency as shown in Fig.11 shown.

[0075] Step 3: Semantic enhancement and fusion of dynamic and static features 1. Semantic enhancement algorithm: a) Attack2Vec: Maps static API functions (such as advapi32.StartService) and ATT&CK techniques and tactics (such as Persistence) into dense vectors. The formula is as follows: ; Parameter Description: : The output static feature vector represents the joint semantics of API functions and techniques and tactics.

[0076] : A natural language processing model that maps discrete symbols into dense vectors.

[0077] : Vector concatenation operation, combining the API function and the symbolic representation of techniques and tactics into a single input.

[0078] : API functions called in the malware (such as advapi32.StartService), extracted through static analysis.

[0079] : Technical and tactical labels in the ATT&CK framework (such as Persistence), which are associated with API functions.

[0080] b)ICFG2Vec: Convert ICFG subgraphs into vectors through graph embedding algorithms (such as Node2Vec), preserving control flow semantics.

[0081] c)APISeq2Vec: Uses BiLSTM model to encode dynamic API sequences and capture long-term and short-term dependencies.

[0082] 2. Feature Fusion: a) Alignment and splicing: Align the dimensions of the static vector vstaticvstatic and the dynamic vector vdynamicvdynamic and concatenate them to generate a fused vector: ; Parameter Description: : The fused joint feature vector is input into the graph attention network.

[0083] : Cascade operation, concatenating static and dynamic vectors into a unified representation.

[0084] : Static feature vector (from Attack2Vec and ICFG2Vec).

[0085] : Dynamic feature vector (from API sequence encoded by APISeq2Vec).

[0086] b) Semantic aggregation: weighted fusion of key features through attention mechanism.

[0087] The semantic behavior enhancement and characterization module of the present invention is as follows Figure 3 The dynamic and static feature alignment framework is shown in Figure 8 The static code gene and ATT&CK mapping are shown as follows. Fig. 9 The key code snippets and semantic behavior mapping are shown in Fig.10 shown.

[0088] Step 4: Graph Attention Network Construction and APT Organization Tracing 1. Graph structure definition: a) Nodes: APT organizations, ATT&CK techniques and tactics, code genes (ICFG subgraphs), API functions.

[0089] b) Edges: Build weighted edges based on co-occurrence frequency, control flow calls, and timing dependencies (e.g., weight = 0.9 for organization A → T1053).

[0090] 2. Graph Attention Network (GAN): a) Multi-head self-attention: Calculate the importance score between nodes. The formula is as follows: ;

[0091] Parameter Description: :node For Node The attention weight is expressed as right semantic contribution.

[0092] :node The set of neighbor nodes.

[0093] : Activation function, which introduces nonlinearity and alleviates the gradient vanishing problem.

[0094] : Vector concatenation operation, concatenating the transformed features of two nodes.

[0095] : Attention mechanism parameter vector, used to calculate the importance scores between nodes.

[0096] W: Trainable weight matrix used to linearly transform node features.

[0097] :node and Input feature vectors (such as embeddings of APT organizations, API functions, or code genes); h k : The original feature vector of node k, the neighbor of node i.

[0098] b) Node classification: Predict the APT organization label through the Softmax layer and output the probability distribution ; The APT attack tracing module of the present invention is as follows Figure 4 As shown in Figure 2, the graph attention network is Figure 5 shown.

[0099] Step 5: Model training and optimization 1. Loss function: cross entropy loss combined with L2 regularization: ; Parameter Description: : The true label of the sample (such as the category of the APT organization).

[0100] : The model's predicted probability distribution for the sample.

[0101] : L2 regularization coefficient, controls the strength of the regularization term to prevent overfitting.

[0102] : All trainable parameters in the model (such as weight matrix W, attention parameters ).

[0103] : The L2 norm of the parameter, used to constrain the parameter size.

[0104] 2. Hyperparameters: learning rate 0.001, batch size 64, number of attention heads 4, training epochs 100.

[0105] Example 2: Code gene robustness verification In order to verify the adaptability of the present invention to anti-packaging, obfuscation and other anti-techniques, the following experiment is designed: 1. Adversarial sample generation: 30% of adversarial samples are inserted into the test set, including: a) Code obfuscation: randomizing control flow through Ollvm.

[0106] b) Dynamic behavior interference: inserting redundant API calls (such as Sleep(100)).

[0107] 2. Experimental results: a) Code gene stability: The improved LDA model can still extract valid subgraphs in the obfuscated samples (accuracy ≥ 85%).

[0108] b) Tracing accuracy: The F1 value of the GAN model reaches 91.2%, which is 12.3% higher than the traditional GCN model.

[0109] Example 3: Comparative experiment with traditional methods The performance comparison between the proposed method and the baseline model on a dataset of 6,620 samples is shown in Table 1: Table 1: Performance comparison results of the proposed method and the baseline model ; Key conclusions: Code gene extraction improves traceability accuracy by 27.7% (compared with rule matching).

[0110] GAN's multi-head attention mechanism significantly outperforms ordinary graph convolutional networks (F1 value +7.7%).

[0111] The matters not described in detail in the present invention are all known technologies to those skilled in the art.

[0112] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A covert attack tracing method based on dynamic and static behavior mapping and graph neural network, characterized in that: The steps include: S1, obtaining PE file samples containing packed and obfuscated codes from the APT organization in the computer system and performing sample preprocessing; S2, for the preprocessed samples, construct the control flow graph of their program execution, extract high-frequency subgraph patterns from the control flow graph as code genes, and construct an organizational fingerprint that can characterize the characteristics of the APT organization based on the extracted code genes and other features of the samples; S3 processes the static code features of the sample and converts them into a unified semantic space through mapping technology. At the same time, it monitors the dynamic behavior of the sample in real time and builds a dynamic feature matrix containing timing information. It uses the attention mechanism to semantically enhance the static and dynamic features, dynamically adjusts the weight of each feature, and then fuses the two to generate a comprehensive feature vector. S4, defines the node types of the graph attention network, constructs weighted edges in the graph according to the correlation between features, uses the self-attention mechanism to calculate the importance scores between nodes, and conducts traceability analysis on APT organizations based on the constructed graph attention network.

2. The covert attack tracing method based on dynamic and static behavior mapping and graph neural network according to claim 1 is characterized in that: The following steps are also included: S5, selects the loss function and combines it with the regularization term to optimize the model parameters; adopts a parallel computing strategy and uses resources including server clusters to perform distributed training on the model; during the training process, continuously adjusts the model's hyperparameters to improve the model's performance and accuracy.

3. The covert attack tracing method based on dynamic and static behavior mapping and graph neural network according to claim 1 or 2 is characterized in that: The sample preprocessing described in step S1 includes: restoring the semantic logic of the obfuscated code through disassembly technology, and matching the assembly code with the technical and tactical entries in the CAPA rule base; The integrity of the unpacked sample is verified, and the hash value comparison is used to ensure that the file content before and after unpacking is consistent.

4. The covert attack tracing method based on dynamic and static behavior mapping and graph neural network according to claim 1 or 2 is characterized in that: In step S2, the inter-procedural control flow graph ICFG is generated using the Angr tool to capture the cross-function call relationship of the malware; Moreover, through the improved LDA model, high-frequency subgraphs are extracted from ICFG as the code genes of APT organizations; In addition, the sample is run in the CAPE sandbox, and the runtime API sequence and timestamp are captured through the Hook mechanism to generate a dynamic behavior chain. The API co-occurrence frequency is counted based on the time window to build a dynamic feature matrix.

5. The covert attack tracing method based on dynamic and static behavior mapping and graph neural network according to claim 1 or 2 is characterized in that: Step S3 includes the following sub-steps: S31, multimodal semantic enhancement: For static code features, the Attack2Vec algorithm is used to map API functions and ATT&CK techniques and tactics into dense vectors through XOR operations; For the control flow graph features, the Node2Vec algorithm is used to perform a second-order random walk on the ICFG subgraph generated by Angr, retaining the structural semantic information of the subgraph and generating a 256-dimensional vector; For dynamic behavior features, the API call sequence monitored by the sandbox is encoded through the BiLSTM model to capture the long-term and short-term dependencies within a certain time window; S32, feature fusion and aggregation: after normalizing the static feature vector and the dynamic feature vector, a fusion vector is generated through a cascade operation; The channel attention mechanism is used to weight the fusion vector, and the importance weight of each feature dimension is dynamically calculated through global average pooling and fully connected layers.

6. The covert attack tracing method based on dynamic and static behavior mapping and graph neural network according to claim 1 or 2 is characterized in that: In step S4, in terms of graph structure definition, the node types in the graph are determined, including APT organizations, ATT&CK techniques and tactics, code genes, and AP functions; when constructing edges, the weights of the edges are determined based on co-occurrence frequency, control flow calls, and timing dependencies; In the construction and application of the graph attention network, a multi-head self-attention mechanism is adopted; after being processed by the multi-head self-attention mechanism, the nodes are classified through the Softmax layer; the Softmax layer predicts the APT organization label corresponding to each node and outputs the probability distribution of the node belonging to each APT organization; by analyzing the probability distribution, the APT organization can be traced and the possible source of the attack can be determined.

7. The covert attack tracing method based on dynamic and static behavior mapping and graph neural network according to claim 6 is characterized in that: The multi-head self-attention mechanism formula is as follows: ； in, For Node For Node The attention weight is expressed as right The semantic contribution of For Node The set of neighbor nodes of For the activation function, introduce nonlinearity and alleviate the gradient vanishing problem; It is a vector concatenation operation, which concatenates the transformed features of two nodes; is the attention mechanism parameter vector, which is used to calculate the importance scores between nodes; W represents the trainable weight matrix, which is used to linearly transform node features; Respectively represent nodes and The input feature vector, h k Represents the original feature vector of node k, the neighbor of node i.

8. The covert attack tracing method based on dynamic and static behavior mapping and graph neural network according to claim 2 is characterized in that: In step S5, the loss function is: ； in, is the true label of the sample; is the predicted probability distribution of the model for the sample; is the L2 regularization coefficient, which is used to control the strength of the regularization term to prevent overfitting; All trainable parameters in the model, including weight matrix W, attention parameters ; is the L2 norm of the parameter, which is used to constrain the parameter size.

9. An electronic device, characterized in that: include: at least one processor; a memory communicatively coupled to the at least one processor; The memory stores a computer program, which, when executed by the at least one processor, enables the at least one processor to implement the covert attack tracing method based on dynamic and static behavior mapping and graph neural network as described in any one of claims 1-8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed, a covert attack tracing method based on dynamic and static behavior mapping and graph neural network is implemented as described in any one of claims 1-8.

Images