A source tracing model for EDR and its behavior chain preservation mechanism

Abstract

The application discloses a kind of EDR-oriented traceability model and the method of its behavior chain preservation mechanism.The method realizes the traceability analysis of network attack behavior by data collection, threat detection, forensic analysis, archival storage and attack traceability etc. function module, and stores the behavior chain as electronic evidence for storage.Specific steps include: collecting system log, operation log, memory image etc. data from terminal equipment by EDR system and GRR tool;Real-time behavior analysis is carried out using the threat detection algorithm built-in EDR and MITRE ATT&CK framework, potential threats are found and response is triggered;Reconstruct attack behavior chain by combining third-party forensic tool to analyze memory image and file data;Through the hybrid mechanism of decentralized storage (IPFS) and local storage, and blockchain technology, the integrity and non-tamperability of data are ensured;Finally, the correlation between behavior chains is analyzed using attack traceability module, and a complete attack traceability graph is constructed.The method effectively improves the accuracy of attack behavior traceability and the security of data storage, reduces the risk of data loss and tampering in traditional traceability method, and provides strong support for subsequent network security incident investigation and legal evidence.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a source tracing model for EDR (Endpoint Detection and Response) and its behavior chain preservation mechanism. Background Technology

[0002] With the rapid development of information technology, cybersecurity has become a key focus across various industries. Faced with increasingly complex and covert cyberattacks, traditional security technologies (such as firewalls, intrusion detection systems (IDS), and virus scanning tools) are gradually revealing their shortcomings and proving ineffective in responding to modern, ever-changing security threats. Therefore, Endpoint Detection and Response (EDR) technology, due to its advantages in threat detection and attribution analysis, is gradually becoming an important component of modern defense systems. EDR technology monitors endpoint behavior to detect and respond to potential threats in real time, while providing crucial information for subsequent attack investigations. Furthermore, forensic analysis and data attribution have become important aspects of security incident response, helping security personnel to deeply understand the process and impact of attack behaviors and develop targeted defense strategies.

[0003] However, most existing EDR technologies focus only on threat detection and real-time response, offering relatively weak support for detailed forensic analysis and attack attribution after an attack. Furthermore, most existing EDR technologies rely solely on local storage and lack cross-system, cross-time data retrieval and storage mechanisms, making it difficult to conduct efficient and in-depth analysis and investigation after an attack. In preserving forensic evidence, traditional centralized storage methods are susceptible to single points of failure and face the risk of malicious data tampering. While decentralized storage technologies (such as IPFS) offer the advantages of distributed storage, ensuring the authenticity and immutability of stored data still requires effective verification mechanisms in practical applications. Blockchain technology, with its immutable data characteristics, offers a possible solution for data integrity, but directly storing large-scale data on the blockchain leads to high storage costs and low operational efficiency. Moreover, existing technologies typically hash and encrypt data uniformly, which simplifies the data structure but also introduces problems. For example, accessing a portion of data requires decrypting the entire data packet, reducing query efficiency and increasing operational complexity. Furthermore, the unified hash calculation method means that even small changes in the data packet can alter the overall hash value, increasing the difficulty of verifying some data. Simultaneously, if the encryption key is leaked, all data will be exposed simultaneously, making fine-grained access control difficult to achieve. Summary of the Invention

[0004] This invention provides a source tracing model for Electronic Data Retrieval (EDR) and a method for preserving its behavioral chain. It aims to achieve source tracing and analysis of malicious attacks on terminal devices through multi-level and multi-dimensional technical means, and to preserve the chain of attack behavior as electronic forensic evidence. This method, through five main modules—data collection, threat detection, forensic analysis, behavioral chain storage, and attack source tracing—effectively improves the accuracy of attack detection and the precision of attack source tracing, and has significant application value, particularly in supporting legal evidence collection and long-term preservation of electronic evidence.

[0005] Step 1: Data Collection

[0006] This method utilizes a data collection module, employing the Audibeat log collection tool and the GRR forensics tool to acquire critical data from various terminal devices. Audibeat collects system logs, operation logs, network traffic data, and file activity logs from these devices to help identify potential threat clues. This data is then transmitted to the threat detection module for real-time analysis. Simultaneously, the GRR tool remotely collects memory images, file data, registry information, and endpoint data, providing in-depth forensics support. When the EDR system detects a potential threat, GRR transmits the data in real-time to external forensics tools (such as Volatility and Autopsy) to ensure comprehensive data acquisition and analysis from multiple perspectives, thereby providing strong evidence for subsequent attack attribution and legal evidence collection.

[0007] Step 2: Threat Detection

[0008] The threat detection module first preprocesses the collected log data, including formatting, removing irrelevant information, and standardization. Next, the EDR system's built-in threat detection algorithm performs real-time behavioral analysis, using the MITRE ATT&CK framework for threat identification to capture abnormal behavioral patterns, such as malware propagation, ransomware activity, and internal network penetration. Once a potential threat is detected, the system automatically triggers a response mechanism, executing alerts, isolating devices, or taking other protective measures based on the severity of the threat. Furthermore, the system generates detailed threat analysis reports for the security team to analyze and address, thereby improving the timeliness and accuracy of threat response.

[0009] Step 3: Evidence Collection and Analysis

[0010] In the forensic analysis module, after the threat detection module detects anomalies, the system integrates with third-party forensic tools (such as Volatility, Autopsy, and GRR) to deeply analyze memory images and file data. The GRR tool remotely acquires data from the target terminal device and transmits it to the third-party forensic tools, which are used to analyze memory images, hard drive data, and network activity. In this way, the forensic analysis module can reconstruct the attack chain, accurately reconstructing the attacker's intrusion path and attack methods. Combining the tactics and techniques in the MITRE ATT&CK framework, the system can effectively extract source data related to attacker behavior, providing a foundation for attack attribution and legal evidence collection.

[0011] Step 4: Archiving and Storage

[0012] The archiving and storage module employs a multi-level storage mechanism to ensure the long-term preservation and integrity of behavioral chain data. Each behavioral chain consists of multiple behavioral nodes, and the data of each node is encrypted using AES and stored in the decentralized storage system (IPFS), while simultaneously calculating the data's hash value. The generated identifier (cid) and hash value are associated with the behavioral chain data, ensuring data immutability. Furthermore, the behavioral chain itself also calculates its hash value and encrypts it before storing it in IPFS, generating a global identifier (CID). To ensure data security, the system also incorporates a local storage system for backup and verifies data integrity through blockchain storage. When data in IPFS is tampered with or lost, the system can recover the data from local storage and verify its integrity through the blockchain, thereby ensuring the validity and reliability of electronic evidence.

[0013] The system also incorporates a multi-level hashing mechanism. In addition to storing the CID of the behavior chain, it calculates independent hash values ​​unrelated to the CID. These independent hash values ​​allow the system to verify data integrity even when the CID is invalid. This mechanism enhances the system's resistance to data tampering and provides robust technical protection against changes to IPFS or blockchains.

[0014] Step 5: Attack attribution

[0015] In the attack attribution module, the system utilizes archived behavioral chain data and source data to comprehensively analyze the correlations between attack behaviors through attribution algorithms and construct an attack attribution graph. First, the system verifies the integrity of the archived data based on the CID and independent hash values ​​stored on the blockchain. Then, it employs feature matching, time series analysis, and graph analysis techniques to extract key attack-related data, such as access sources, operational characteristics, and network traffic patterns, constructing a correlation matrix for the behavioral chains. Using graph embedding technology and machine learning algorithms, the system can discover potential correlations between attack behaviors and further uncover the attacker's action paths.

[0016] Furthermore, the system employs clustering and anomaly detection methods to group attack chains based on behavioral characteristics and identify behavioral patterns similar to known attack features. Through automated clustering analysis, the system can quickly locate typical attack types or novel attack behaviors, thereby improving the efficiency and accuracy of attribution. Finally, all attribution results are presented through visualization tools, generating an attack attribution map that provides security teams with information such as attack paths, methods, and target systems, supporting subsequent response and legal evidence collection efforts.

[0017] Compared with the prior art, the beneficial effects of the present invention are:

[0018] This invention integrates the EDR system with third-party forensic tools (such as GRR, Volatility, and Autopsy), which improves the comprehensiveness and depth of forensic data and reduces the limitations of a single tool in fully covering various attack behaviors.

[0019] By adopting a hybrid storage mechanism that combines decentralized storage (IPFS) and local storage, the reliability of data storage is improved, the immutability of evidence is ensured, and the risk of evidence loss or tampering that may occur with traditional centralized storage is reduced.

[0020] This study introduces graph analysis methods and machine learning techniques for attack attribution, employing graph embedding, clustering, and anomaly detection algorithms to improve the accuracy and automation of attack behavior analysis, reducing manual analysis and missed detections inherent in traditional attribution methods. Through graph analysis and machine learning, the system can automatically discover potential connections within attack chains, quickly identify complex attack paths, and enhance attribution efficiency and emergency response capabilities.

[0021] A multi-level hash verification mechanism has been introduced to improve the verification capability of data integrity and reduce the verification risks associated with a single hash mechanism. By performing independent hash calculations on the behavioral chain and source data, the system can more effectively detect whether the data has been tampered with and provide additional verification methods to ensure data integrity even if the CID fails. Attached Figure Description

[0022] Figure 1 EDR source tracing model diagram

[0023] Figure 2 Archiving and storage flowchart

[0024] Figure 3 A chain diagram of attack behavior and its node data structure. Detailed Implementation

[0025] The present invention will now be described in detail with reference to the accompanying drawings. It should be noted that the described embodiments are for illustrative purposes only and are not intended to limit the scope of the invention.

[0026] This invention provides a traceability model for EDR and a method for preserving its behavioral chain. The flowchart of this method is as follows: Figure 1 As shown, it includes the following steps:

[0027] Step 1: The data collection module first collects data from different terminal devices using Audibeat log collection (or the data collection function built into the EDR system) and the GRR forensics tool. Audibeat collects log data from the terminal devices, including system logs, operation logs, network traffic data, and file activity logs. This data can be transmitted to the threat detection module for further analysis. Simultaneously, the GRR tool collects deep forensic data from the terminal devices, such as system memory images, file data, registry information, and endpoint data. When the EDR system detects a potential threat, the GRR tool collects this data in real time and transmits it to external forensics tools, such as Volatility and Autopsy, for in-depth analysis. Specifically, the GRR tool remotely acquires data from the target device and transmits it to integrated third-party forensics tools, which further parse the memory images and file data to help reconstruct the attack chain. In this way, the combination of the GRR tool and external forensics tools ensures comprehensive acquisition and in-depth analysis of key evidence from the terminal devices when an attack occurs, providing strong support for subsequent tracing and forensics work.

[0028] Step 2: In the threat detection module, log data from the data collection module is first preprocessed, including data formatting, filtering irrelevant information, and information standardization. The processed data is then subjected to real-time behavioral analysis using the threat detection algorithms built into the EDR system to identify potential security threats. Specifically, the system combines various tactics and techniques from the MITRE ATT&CK framework, employing pattern matching algorithms, behavioral analysis algorithms (such as machine learning-based anomaly detection algorithms), and statistical analysis methods to detect abnormal behavioral patterns, such as malware self-replication, ransomware encryption, and suspicious activities involving internal network penetration. For each detected threat, the system takes appropriate response measures based on its severity and category: for lower-level threats, the system may only trigger an alert; for medium- to high-level threats, it may immediately isolate infected devices or implement protective measures such as network isolation, antivirus scanning, and access blocking. Furthermore, the EDR system automatically integrates with the security response platform to generate detailed threat analysis reports, helping security teams to deeply analyze and handle threats, further improving the accuracy and timeliness of threat response. This process relies on advanced behavioral analysis and adaptive response strategies to ensure that the system can detect and respond to various potential attacks in a timely and accurate manner, minimizing security risks.

[0029] Step 3: In the forensic analysis module, after the threat detection module detects abnormal activity and triggers a response, the module integrates with third-party forensic tools (such as Volatility, Autopsy, and GRR). Specifically, the GRR tool is responsible for obtaining deep forensic data from affected end devices, including memory images, file data, registry information, and endpoint data. The collected raw data is then transferred to the third-party forensic tools for further analysis. Volatility is primarily used for parsing memory images, helping to extract key information such as process information, network connections, and module loading. Autopsy is used to analyze data traces in hard drives and file systems, tracking attacker file operations and data flow. The combination of the EDR system with these tools ensures efficient management and in-depth analysis of large-scale data, enabling accurate reconstruction of attack behavior chains. Through these integrations, the forensic analysis module can not only extract important source data from massive amounts of data but also reconstruct the attacker's intrusion path and attack methods based on the strategies and techniques in the MITRE ATT&CK framework, providing strong support for subsequent attack tracing and legal evidence collection.

[0030] Step 4: The archiving and storage module is responsible for the long-term preservation of behavioral chain data and source data. Its flowchart is as follows: Figure 3Each action chain consists of multiple action nodes. The source data block of each action node is encrypted (AES) and stored in the decentralized storage system IPFS to obtain an identifier (cid). The hash of the source data block is also calculated. The generated identifier and hash value are added to the action chain data, thus establishing the association between the action chain data and the source data. Its data structure is as follows: Figure 2 Each node contains a timestamp, the name of the behavior node, the hash value of the associated source data, and an identifier (cid) for the source data storage location. Furthermore, the behavior chain itself calculates a hash value and encrypts it in IPFS to generate a global identifier (CID) for the behavior chain. Finally, the hash values ​​of the behavior chain data and their corresponding CIDs are stored on the blockchain, ensuring data integrity and unforgeability.

[0031] To enhance data reliability and robustness, the system further introduces a hybrid storage mechanism combining decentralized storage (IPFS) and local storage. When source data is encrypted and stored in IPFS, the system synchronously backs up the data and its calculated hash value to the local storage system. The local storage system can be a secure database or file system specifically designed to store copies of the behavioral chain data. Furthermore, the system periodically triggers a consistency check task, comparing the hash values ​​of the data in local storage with those in IPFS to ensure consistency. If data in IPFS is tampered with or lost, the system can quickly recover the data from local storage and verify its integrity using the original CID stored in the blockchain. In this way, even if data on IPFS becomes invalid, the system can still guarantee the validity and reliability of evidence during the electronic forensics process.

[0032] To further enhance data integrity verification, the system also employs a multi-level hashing mechanism. Before storing the CID of the behavior chain on the blockchain, the system additionally calculates and stores a set of independent hash values ​​unrelated to the CID (such as the original hash value of the behavior chain data). These independent hash values ​​are generated based on the original data and are primarily used to provide additional verification methods in case the CID is invalid or tampered with. While the CID is used for fast data retrieval, the independent hash values ​​directly verify data integrity. Even if data in IPFS is tampered with, causing the CID to become invalid, the system can still verify whether the data restored from the backup is consistent with the original data using the original hash value. This mechanism not only enhances the resistance to data tampering but also provides strong technical protection against possible changes to or attacks on the IPFS mechanism.

[0033] During a query, the system prioritizes locating and retrieving data from IPFS using the CID in the blockchain. If the retrieved data has been tampered with or the CID cannot be effectively matched, the system automatically switches to local storage, retrieves backup data for the query, and simultaneously verifies the integrity of the backup data using the original hash value stored in the blockchain. If the verification passes, the system re-uploads the recovered data to IPFS to generate a new CID and associates the newly generated CID with the original hash value in the blockchain, forming a new and valid chain of evidence. The entire query and recovery process is traceable through detailed logging and auditing mechanisms, further enhancing the system's credibility.

[0034] By combining encrypted storage of behavioral chain data and source data, local backup mechanisms, multi-level hash verification mechanisms, and blockchain storage, the system not only ensures the integrity and immutability of evidence during storage and retrieval, but also provides functions to cope with data tampering, loss, and system changes. This design provides comprehensive protection for evidence preservation and auditing, while achieving efficient cross-system queries and robust data verification capabilities.

[0035] Step 5: In the attribution module, the system utilizes previously archived behavioral chains and source data, combined with attribution algorithms, to comprehensively analyze the correlations between different attack behaviors, ultimately constructing a complete attack attribution graph. First, the system verifies the archived behavioral chains and source data based on the CID and independent hash values ​​stored in the blockchain, ensuring the integrity and credibility of the forensic data. Subsequently, through techniques such as feature matching and time series analysis, key attack-related data is extracted from the behavioral chains, such as access sources, operational characteristics, network traffic patterns, and timestamps. The system uses this data to construct an association matrix, identifying potential correlations between different behavioral chains, and reveals these correlations through graph analysis techniques. By constructing a graph model of attack behaviors, each behavior node represents an attack event or behavior (e.g., malicious file download, privilege escalation operation), and the edges between nodes represent causal relationships or time series dependencies between different attack behaviors. To further explore the correlations between behaviors, the system introduces graph embedding technology, mapping the nodes and edges in the graph to a low-dimensional vector space. This allows us to discover potential attack paths and hidden attack patterns by calculating the similarity between nodes. For example, by embedding nodes, we can detect whether attackers reuse the same malicious tools or use similar attack methods in different attack chains, which helps improve the accuracy of tracing and reduce the false negative rate.

[0036] Furthermore, to enhance the automation and accuracy of attack attribution, the system also employs machine learning algorithms, particularly clustering algorithms and anomaly detection methods. Through clustering algorithms, the system can automatically group attack behaviors and identify behavioral chains similar to known attack patterns, thereby quickly locating typical attack types or new types of attacks. During clustering, the machine learning model automatically categorizes similar behaviors based on the characteristics of behavioral nodes (such as file hashes, network traffic patterns, process behavior, etc.), helping security teams quickly identify potential attack paths. In addition, anomaly detection algorithms analyze historical behavioral data to identify emerging attack characteristics that significantly differ from conventional patterns. Through these methods, the system can continuously optimize the accuracy and timeliness of attack attribution, helping security teams more quickly and accurately locate attack sources and attacker movement trajectories.

[0037] Finally, all the attribution results are presented through visualization tools to generate an attack attribution graph. This graph not only shows the attacker's intrusion path but also includes detailed information on each behavioral node, correlation analysis results, and key contextual information (such as the characteristics of the attack tools and the identification of the attack targets). This graph analysis method combines graph embedding technology with machine learning, significantly improving the data analysis capabilities in the attack attribution process. It enables the system to accurately reconstruct the attack process even in complex, multi-stage attacks, providing precise evidentiary support for subsequent responses and legal forensics.

[0038] Example: Source tracing model and behavior chain preservation mechanism for EDR

[0039] Suppose a complex internal network attack occurred within an organization's network environment. Attackers exploited a vulnerability to compromise an employee's computer, further expanding the attack's scope and stealing sensitive data. The attack proceeded through multiple phases, including initial access, privilege escalation, data collection, and information leakage. The organization deployed the EDR-oriented attribution model and its behavior chain preservation mechanism as described in this invention. The following is a detailed implementation process of how the system works to resolve this attack incident.

[0040] Step 1: Data Collection

[0041] In the initial stages of the attack, the organization's EDR system used the Audibeat log collection tool to collect various log data from employee terminals in real time, including system logs, network traffic, and operation logs. Additionally, the GRR forensics tool, triggered by the EDR system, began collecting deep forensic data from the terminal, including memory images, registry information, and all file activity records. Leveraging its remote forensics capabilities, the GRR tool automatically transferred this data to integrated external forensics tools (such as Volatility and Autopsy). Volatility analyzed the memory image data, recovering the process tree and network connection information, providing further evidence; Autopsy analyzed the file system, tracing malicious operations performed by the attacker within the file system.

[0042] Step 2: Threat Detection

[0043] After collecting a large amount of log data, the threat detection module preprocesses the data, formatting it and filtering out irrelevant information. Then, the system uses its built-in threat detection algorithm in conjunction with the MITRE ATT&CK framework to perform real-time behavioral analysis. Through behavioral analysis algorithms (such as machine learning-based anomaly detection algorithms), the system can quickly detect attacker behavior patterns, such as malware self-replication, privilege escalation, and data encryption. Upon detecting anomalies, the system automatically triggers alerts, isolates affected endpoint devices, and initiates protective measures, such as blocking attackers' external communications, performing antivirus scans, and blocking suspicious processes.

[0044] Step 3: Evidence Collection and Analysis

[0045] After the threat detection module triggers an alert and executes response measures, the forensic analysis module immediately begins its work. The system integrates with third-party forensic tools (such as Volatility and Autopsy) to acquire deep forensic data from the attacked endpoint devices. Memory images and file data collected by the GRR tool are sent to these tools for detailed analysis. For example, Volatility parses the memory image to recover the attacker's processes and network connection information, while Autopsy analyzes data traces in the file system to help trace the attacker's file operations. The EDR system further combines this forensic data with known attack tactics and techniques according to the MITRE ATT&CK framework to accurately reconstruct the attack behavior chain, revealing the attacker's intrusion path and attack methods.

[0046] Step 4: Behavior Chain Storage and Archiving

[0047] The system extracts the behavioral chain data and source data and stores them in the decentralized storage system IPFS using encrypted storage. Each behavioral node's source data block is stored using AES encryption, and a unique identifier (CID) and hash value are generated for it. This is then added to the behavioral chain data, creating a tight link between the behavioral chain data and the source data, ensuring data integrity and immutability. Furthermore, to enhance data reliability, the system periodically backs up the data and hash values ​​from IPFS to the local storage system and stores the behavioral chain's hash value and CID on the blockchain, ensuring data integrity and audit traceability.

[0048] Step 5: Attack attribution and graph analysis

[0049] With the archiving and storage of behavioral chain data, the system enters the attack attribution phase. Based on the archived behavioral chains and source data, the system first uses attribution algorithms to comprehensively analyze the data. Through feature matching and time series analysis, the system extracts key attack-related data, including access sources, operational characteristics, network traffic patterns, and timestamps. To reveal the potential connections between different behavioral chains, the system employs graph analysis technology. By constructing a graph model of attack behaviors, each behavioral node represents a specific attack activity, and the edges between nodes represent causal relationships or time dependencies between attack behaviors. Furthermore, the system uses graph embedding technology to map the nodes and edges in the graph to a low-dimensional vector space, utilizing the similarity between nodes to discover potential relationships in attack paths. Graph embedding not only helps identify similar malicious tools used by attackers in multiple chains but also reveals hidden attack paths, improving the accuracy and efficiency of attribution.

[0050] Furthermore, the system combines clustering algorithms and anomaly detection methods to automatically group and classify behavioral chains. Through clustering, the system can quickly identify behavioral chains similar to known attack patterns, helping security teams rapidly locate attack sources and analyze attack methods. Anomaly detection can discover emerging attack behaviors that do not conform to conventional patterns, further improving the accuracy of attribution.

[0051] Finally, the system generated an attack origin graph using visualization tools, intuitively displaying the attacker's intrusion path, attack methods, and the relationship between the target system. The attack origin graph not only presents detailed information for each behavioral node but also provides in-depth attack path analysis through graph embedding and clustering algorithms.

[0052] Through this embodiment, the system successfully detected and responded to an intranet attack, reconstructed the complete attack behavior chain, and ensured the integrity, immutability, and efficient tracing capabilities of the forensic data through graph analysis, machine learning, and decentralized storage technologies, providing strong support for the investigation and response to cybersecurity incidents.

Claims

1. An EDR-oriented traceability model and its behavior chain preservation mechanism method, characterized in that: The mechanism realizes the traceability analysis of attack behaviors through functional modules such as a data collection module, a threat detection module, a forensic analysis module, an archiving and storage module, and an attack traceability module, and stores the behavior chain as electronic evidence for forensic evidence, and the specific steps are as follows: Step 1: Data collection, using Audibeat log collection tools or EDR system built-in collection functions, and GRR forensic tools to collect data from different terminal devices, including but not limited to system logs, operation logs, network traffic data, file activity logs, memory images, file data, registry information and endpoint data; Step 2: Threat detection, pre-processing the collected data, filtering irrelevant information and formatting, then using the threat detection algorithm built-in EDR system and MITRE ATT&CK framework to perform real-time behavior analysis on the data, detect abnormal behavior patterns, and trigger a preset response mechanism when potential threats are found, including alert, isolation of infected devices or other protection operations; Step 3: Forensic analysis, through integration with third-party forensic tools, deeply analyze the collected memory image and file data, combined with the behavior analysis data provided by the threat detection module, to reconstruct the complete process of attack behavior; Step 4: Archiving and storage, the process includes the following sub-steps: First step: Calculate the hash value hash1, hash2… of each behavior node in the behavior chain data, store it in the decentralized storage system IPFS through encryption, and generate an identifier cid, at the same time, synchronize the source data, cid and related hash value to the local storage system; Second step: Add the generated identifier and hash value to the behavior chain data to ensure the association between the behavior chain data and the source data; Third step: Calculate the hash value HASH of the entire behavior chain data, and store it in the IPFS through encryption, generate the global identifier CID of the behavior chain; At the same time, synchronize the data, CID and HASH to the local storage system; Fourth step: Store the hash value HASH of the behavior chain data and its corresponding CID on the blockchain to ensure the integrity and non-falsifiability of the data; Step 5: Attack traceability, using the previously archived behavior chain and source data, combined with the traceability algorithm, comprehensively analyze the correlation between different attack behaviors, and finally build a complete attack traceability graph.

2. The EDR-oriented provenance model and its behavior chain preservation mechanism method according to claim 1, characterized in that, The source data includes log data, network traffic, memory image and other information collected from terminal devices, and the behavior chain data is built based on the source data according to the technical model framework in MITRE ATT&CK framework, which contains multiple behavior nodes, each node represents an operation of the attacker, such as privilege escalation, internal penetration or malware propagation, etc. By analyzing the association of these nodes, the attack path can be reconstructed, and evidence can be provided for electronic forensics.

3. The EDR-oriented provenance model and its behavior chain preservation mechanism method according to claim 1, characterized in that, The data collection in step 1 includes collecting log data on the terminal device using the Audibeat tool and transmitting the log data to the threat detection module for analysis, while collecting deep forensic data including system memory image, file data, registry information and endpoint data, etc. through the GRR tool.

4. The EDR-oriented provenance model and its behavior chain preservation mechanism method according to claim 1, wherein, The threat detection process in step 2 includes the following three sub-steps: First step: pre-processing the collected log data, including data formatting, removing irrelevant information and information standardization; Second step: real-time behavior analysis of the pre-processed data through the threat detection algorithm built-in EDR system, to identify potential security threats; Third step: based on the MITRE ATT&CK framework, further analyze the results to determine abnormal behavior and trigger the corresponding response mechanism.

5. The EDR-oriented provenance model and its behavior chain preservation mechanism method according to claim 1, characterized in that, In the forensic analysis in step 3, when the threat detection module finds abnormalities, it combines third-party tools to deeply analyze memory images and file data, including but not limited to Volatility, Autopsy and GRR, to reconstruct the attack behavior chain and ensure comprehensive attack behavior tracing.

6. The EDR-oriented provenance model and its behavioral chain preservation mechanism method according to claim 1, in step 4, the hybrid storage mechanism of decentralized storage and local storage, characterized in that, After the system synchronously backs up data, identifiers and their hash values to the local storage system, if the data in IPFS is tampered with or lost, the system can recover the data from the local storage and verify the integrity of the data through the hash value stored in the blockchain, to ensure the effectiveness and reliability of the data.

7. The EDR-oriented provenance model and its behavior chain preservation mechanism method according to claim 1, in step 4, multi-level hash mechanism, characterized in that, Before storing the CID of the behavior chain into the blockchain, the system also calculates and stores independent hash values unrelated to the CID, which are hash values generated based on the original content of the behavior chain data. These independent hash values are generated based on the original data and are mainly used to provide additional verification means when the CID is invalid or tampered with. CID is used for quick data retrieval, while independent hash values can directly verify data integrity. Even if the data in IPFS is tampered with, causing the CID to be invalid, the system can still verify whether the data recovered from the backup is consistent with the original data through the original hash value.

8. The EDR-oriented provenance model and its behavior chain preservation mechanism method according to claim 1, wherein, The attack tracing in step 5 includes the following sub-steps: First step: based on the CID and independent hash value stored in the blockchain, verify the archived behavior chain and source data to ensure the integrity and credibility of the forensic data; Second step: through feature matching, time series analysis and other technologies, extract key data related to attacks, such as access source, operation characteristics, network traffic pattern and timestamp, etc.; Third step: by constructing a correlation matrix, identify potential correlations between different behavior chains, and use graph analysis techniques to mine attack paths, including graph embedding or graph-based machine learning methods; Fourth step: through pattern recognition and behavior feature similarity, use clustering and classification techniques to group behavior chain data, and identify behavior chains matching known attack features; Fifth step: combine static analysis and dynamic analysis methods to deeply analyze the operation records and file information in the source data, and extract context information of attack behavior, such as intrusion tool features and abnormal network requests, etc. Step 6: Based on the correlation analysis results, automatically generate an attack tracing diagram to show the relationship between the attacker's intrusion path, attack means and target system or data, and assist the security team in attack incident investigation and emergency response.

9. The EDR-oriented provenance model and its behavior chain preservation mechanism method according to claim 8, the sub-step first step, characterized in that, The specific tampered content can be located. First, the behavior chain data is extracted from the IPFS according to the CID, decrypted and the hash value is calculated, and compared with the independent hash value stored on the blockchain. If the hash values are consistent, it means that the data has not been tampered with. If the hash values are inconsistent, further verify the hash value of the source data. If the hash value of the source data is consistent, it means that the source data has not been tampered with, and the behavior chain information may have been tampered with. If the hash value of the source data is also inconsistent, the specific behavior node and its source data where the tampering occurs can be accurately located, so that the specific location and content of the tampering can be determined.

Images