An APT attack detection method based on a log traceability graph

Abstract

The application discloses an APT attack detection method based on a log traceability graph, and belongs to the technical field of network security. In order to solve the concealment problem of APT attacks at the system entity level in the prior art, the application mainly adopts the combination of a log traceability graph and a text sentiment analysis technology, and effectively enhances the prediction ability and the migratability of an intrusion detection system through means such as traceability graph construction, sentence representation and multi-task pre-training learning.The application can efficiently and accurately detect APT attacks at the system entity level, improve the precision and applicability of the intrusion detection system, adapt to different system environments, and enhance the identification ability of potential threats.

Description

TECHNICAL FIELD

[0001] The application relates to an APT attack detection method based on a log trace graph and belongs to the technical field of network security. BACKGROUND

[0002] Advanced persistent threats (APTs) pose a significant challenge to network security as they can lurk in target networks for months or even years without being detected. APTs generate a large amount of audit logs during their long-lived existence, increasing the complexity of detection. To combat APT attacks, some recent research has proposed methods that use trace graphs, in which nodes represent system entities (such as processes, files, sockets, etc.) and edges represent their interactions. This method converts raw system audit logs into structured graph records, effectively capturing large-scale system audit logs and providing a comprehensive view of system behavior during the APT life cycle.

[0003] Existing trace-based intrusion detection systems (PIDS) are mainly divided into two categories: graph granularity and node granularity. Graph granularity PIDS, such as StreamSpot, UNICORN, and ProvDetector, usually divide graphs into subgraphs, extract subgraph features using various methods, and apply clustering algorithms to detect malicious graphs. However, due to the low-speed attack strategy of APTs and the insensitivity of graph features to low-density threat-related entities, these methods are not effective for APTs with high concealment. To address these issues, node granularity methods, such as THREATRACE, MAGIC, KAIROS, and SIGL, focus on extracting features of individual system entities to identify malicious entities.

[0004] Despite the progress made, current PIDS still faces some key challenges: (1) APTs often exhibit concealment at the system entity level, such as malicious processes that perform normal activities while carrying out malicious operations. This strategy of mixing normal activities with malicious activities is common in APT attacks, but existing methods have difficulty detecting such behavior. (2) Existing methods lack predictive capabilities, which are crucial for proactive defense against future attacks. (3) Existing methods are usually trained on specific systems, limiting their portability in different environments.

[0005] In the field of sentiment analysis, similar challenges have been addressed. Sentiment analysis and intrusion detection have structural similarities (see Figure 1). In sentiment analysis, a reviewer can express different sentiments on different aspects of the same target. Researchers reveal hidden sentiments by shifting the focus of analysis from the broader target or aspect to the target-aspect pair. For intrusion detection, it is difficult to identify malicious entities that participate in normal activities using features of a single system entity (system entity-level concealment). To this end, the detection granularity should be further refined beyond the single system entity level, and the threat detection and prediction capabilities can be enhanced by considering both the subject (process) and the object (process, file, socket) at the same time. SUMMARY

[0006] The purpose of the present application is to solve the problems existing in the prior art and introduce pre-training and sentiment analysis into the field of intrusion detection based on traceability graph. A new APT detection method based on log traceability graph is proposed, which combines log traceability graph and text sentiment analysis technology, and can effectively deal with the concealment of APT attacks at the system entity level.

[0007] To achieve the above purpose, the technical scheme adopted by the present application is as follows:

[0008] An APT attack detection method based on log traceability graph, comprising the following steps:

[0009] 1) Constructing a traceability graph: collecting system audit logs and analyzing, extracting system entities and their interaction relationships, constructing a traceability graph, entities are represented as nodes, and interaction relationships are represented as undirected edges;

[0010] 2) Sentence construction and representation: calculate the closeness matrix between nodes in the traceability graph, extract relevant nodes according to the closeness, construct the sentences corresponding to the subject nodes and the sentences corresponding to the object nodes, and then connect them into subject-object sentence pairs; extract the structural features (Simple-WL), time sequence features (TS-Id), position features (Position) and segment features (Segment) of each node in the subject-object sentence pair, and construct a feature embedding sequence;

[0011] 3) Pre-training: constructing two pre-training tasks of interaction or non-interaction prediction and node type reconstruction, inputting the feature embedding sequence into the BERT model to perform the two pre-training tasks, and predicting the relationship between the subject-object sentence pair and the type of the object node;

[0012] 4) Fine-tuning and detection: based on the pre-trained BERT model, fine-tune using specific labeled log data, and use the fine-tuned BERT model for malicious behavior detection.

[0013] Further, two strategies are used in step 1) to simplify the traceability graph:

[0014] Ignore the directionality of the interaction and convert the graph into an undirected graph;

[0015] Focus on the existence of inter-entity interaction, ignore the interaction type and frequency.

[0016] Further, the affinity matrix of the nodes in the provenance graph is calculated by the PageRank algorithm in step 2).

[0017] Further, the method for extracting relevant nodes and constructing sentences according to the affinity in step 2) is: for each node, a set of high-affinity relevant nodes is extracted according to the affinity ranking; the node is regarded as a word, and the current node and the extracted relevant nodes form a sentence.

[0018] Further, the step of extracting the structural feature of each node in step 2) includes:

[0019] According to the degree of each node, a color is assigned to it;

[0020] Traverse each node in the provenance graph, calculate the color of the neighbor of the current node, and form a set of calculated colors in order; and add the color of the current node itself to the front of the set;

[0021] Map the color set to a structural feature index through a predefined dictionary, thereby obtaining the structural feature of each node.

[0022] Further, in step 3), when performing the interaction or non-interaction prediction task, 50% of the time selects the principal-agent node pair directly connected, and 50% of the time selects the principal-agent node pair not directly connected, to predict whether there is malicious behavior between the principal node and the agent node, to learn the information at the sentence level.

[0023] Further, in step 3), when performing the node type reconstruction task, the structural feature is marked with [MASK], and the type of the agent node is predicted, to learn the information at the node level.

[0024] Further, in step 3), the structural feature is processed as follows:

[0025] 80% of the time, use [MASK] markers;

[0026] 10% of the time, use a random structural feature index;

[0027] 10% of the time, keep the structural feature index unchanged.

[0028] Further, in step 3), the interaction or non-interaction prediction loss function and the node type reconstruction loss function are constructed, and the sum of the two loss functions is taken as the final pre-training loss function, to optimize the model parameters with the goal of minimizing the final pre-training loss;

[0029] The interaction or non-interaction prediction loss function is:

[0030]

[0031] wherein sp represents a subject-object sentence pair; represents a true label of whether there is a direct connection between the subject-object node pair in sp;D p represents a pre-training data set; represents a probability distribution vector of the direct connection label and the non-direct connection label between the subject-object node pair; represents a subject node feature embedding sequence in the sentence corresponding to the subject node, represents an object node feature embedding sequence in the sentence corresponding to the object node, and W1 and b1 represent trainable model parameters;

[0032] The node type reconstruction loss function is:

[0033]

[0034] wherein sp represents a subject-object sentence pair; represents a true node type of the object node v j in sp;D p represents a pre-training data set; represents a probability distribution vector on the node type; represents an object node feature embedding sequence in the sentence corresponding to the object node, and W2 and b2 represent trainable model parameters.

[0035] Further, in step 4), the pre-trained BERT model is fine-tuned, the subject-object sentence pair is input, and whether there is malicious behavior between the subject node and the object node is predicted; a loss function, which is the same as the interaction or non-interaction prediction loss function, is calculated, and the model parameters are optimized to minimize the loss.

[0036] The beneficial effects obtained by the present application are as follows:

[0037] 1. The present application learns from the target aspect to detect the granularity in the sentiment analysis technology, i.e., the subject-object pair, effectively deals with the concealment of APT attacks at the system entity level, and enhances the prediction ability.

[0038] 2. The present application introduces the pre-training and fine-tuning technology in natural language processing, significantly improves the transferability of the intrusion detection system, and makes it adapt to different system environments.

[0039] 3. The application regards the interaction between system entities as similar to the information flow in natural language, applies sentiment analysis technology to analyze the "text" extracted from the provenance graph, infers the "sentiment" tendency of the subject to the object, and identifies potential threats.

[0040] 4. In the pre-training stage of unlabeled data, the application designs two pre-training tasks for the provenance graph, which can capture rich context information at the system entity level and the subject-object pair level, providing a solid foundation for detection.

[0041] 5. The application proposes two new feature label types, Simple-WL and TS-Id, which effectively encode provenance graph information in combination with sentence structure, enriching the representation of text information.

[0042] 6. The application is verified through experiments, and the detection performance is better than existing methods, with significant improvements in overall accuracy, precision, recall, and F1 value, which can effectively counter the concealment of APT at the system entity level and has certain prediction ability.

[0043] 7. The application uses labeled data of a specific system for fine-tuning to generate a personalized detection model, effectively improving the accuracy and applicability of intrusion detection. BRIEF DESCRIPTION OF DRAWINGS

[0044] Figure 1 is a structural comparison chart of text sentiment analysis and intrusion detection.

[0045] Figure 2 is the overall flowchart of the APT attack detection method based on the log provenance graph of the application.

[0046] Figure 3 is the test result chart of the transferability experiment of the application. DETAILED DESCRIPTION

[0047] In order to make the person skilled in the art better understand the technical solutions in the embodiments of the application, and make the purpose, characteristics and advantages of the application more obvious and easy to understand, the technical core in the application will be further described in detail below. It should be understood that the specific embodiments described herein are only used to explain the application and not to limit the application.

[0048] The application embodiment discloses an APT attack detection method based on a log provenance graph, and the overall process is as shown in Figure 2 The specific steps are described as follows:

[0049] 1. Provenance graph construction

[0050] Audit logs collected from various logging infrastructures, such as Windows ETW, Linux Audit, and CamFlow, are analyzed. It extracts system entities and their interactions to construct a system-wide provenance graph, where entities are represented as nodes and interactions are represented as edges. To reduce the computational burden and improve the detection efficiency without significantly affecting the intrusion detection effect, the invention adopts two strategies to simplify the provenance graph:

[0051] (i) Ignoring the directionality of interactions, the graph is converted into an undirected graph;

[0052] (ii) Focusing on the existence of interactions between entities, ignoring the types and frequencies of these interactions.

[0053] 2. Sentence construction and representation

[0054] In order to extract sentences reflecting the current system state of each node, the node is regarded as a word, a set of highly relevant nodes is identified for each node, and they are arranged into a sentence. In order to consider both direct and high-order connections in the graph when extracting relevant nodes for each node, the invention calculates the affinity matrix by the PageRank algorithm, and the formula is:

[0055]

[0056] where the factor α∈[0,1] is usually set to 0.15, I represents the unit matrix, and is the symmetric normalized adjacency matrix of the provenance graph G. Here, A is the adjacency matrix, D is the diagonal matrix, and the diagonal elements D(i,i) = ∑ j A(i,j). The element S(i,j) in the matrix represents the affinity score between nodes v i and v j , and the higher the score, the higher the affinity.

[0057] Based on the affinity matrix S calculated above, a set of highly relevant nodes is extracted with v i as the center node to form a sentence Sentence(v i ) to describe the state of v i . The formal definition of the sentence is as follows:

[0058] Definition: Given a provenance graph G, a set of nodes V and its affinity relationship matrix S, sorting S in descending order (excluding S(i,i)) will produce: Sort i ({S(i,j)|v j ∈V\{V i}}) = {S(i,i1), S(i,i2),..., S(i,in n )}, n = |V|-1. For node vi ∈V, the sentence corresponding to which is defined as:

[0059] The field of sentiment analysis proposes to construct auxiliary sentences with different goals and aspects, thereby transforming the sentiment analysis task into a sentence pair classification task. Similarly, the present application forms a subject-object pair (v and the sentence corresponding to the object node v i , v j ) corresponding to the sentence pair Therefore, this can effectively convert the intrusion detection task into a sentence pair classification task.

[0060] In order to better encode each word in the sentence (i.e., the node in the provenance graph), the present application constructs two novel features: the structural feature Simple-WL and the temporal feature TS-Id. The present application proposes a Simple-WL algorithm to extract the Simple-WL feature of the provenance graph. The algorithm labels the nodes according to their structural roles in the graph, and assigns the same code to nodes with the same topological role. The calculation steps of the algorithm include:

[0061] (1) Input parameters: input the provenance graph PG, containing the node set V and the edge set E. The input color dictionary ColourDict and the SimpleWL dictionary are used to determine the color according to the degree of the node and calculate the Simple-WL index, respectively.

[0062] (2) Node coloring: for each node v i in the graph, calculate its degree D i . Then, by checking whether the degree of the node v i falls within a certain degree interval in the color dictionary ColourDict, assign a color to the node v i . This process iterates through all color indices (from 0 to the maximum color index MAX(ColourIndex)) and assigns a color value to the node.

[0063] (3) Calculate the Simple-WL index: for each node v i , first initialize an empty set S. Then, iterate through all neighbor nodes v i of v j , if the color of v j is not in the set S, add the color of v j to the set S. Next, sort the set S and add the color of v i to the beginning of the set S.

[0064] (4) Mapping to Simple-WL index: Map the set S to the Simple-WL dictionary to get the node v i the corresponding Simple-WL index and return it as output.

[0065] The algorithm can be specifically represented as the following process:

[0066]

[0067] While the log provenance graph enables IDS to correlate system behaviors over a long period of time, they lack the temporal relationships inherent in a time-series IDS. To address this limitation, the present invention designs a feature called TS-Id. Considering the significant difference in system load over different time periods, the number of system entities can vary greatly, which makes it challenging to represent the temporal relationships between system entities based on time alone, so TS-Id is constructed according to the order of creation of system entities (i.e., nodes in the provenance graph). In order to limit the size of the dictionary and observe more log entries when slicing logs, the same TS-Id is assigned to n consecutively created system entities. While increasing n allows more nodes to be observed simultaneously, it reduces the ability to accurately describe temporal relationships.

[0068] The present invention then uses the embedding method of BERT to construct four layers of embedding layers, namely Simple-WL embedding, TS-Id embedding, Position embedding, and Segment embedding. Among them, Position embedding is used to represent the position of each node in the sentence, reflecting the degree of association between the nodes within the sentence and the center node (the first node of the sentence). The purpose of Segment embedding is to distinguish the sentence corresponding to the subject node and the object node in the sentence pair as a marker. Finally, the embedding vector of each node in the sentence is the sum of the four embedding layers, obtaining the sequence

[0069] 3. Pre-training

[0070] In order to learn the information at the node level and the sentence level simultaneously, the present invention adopts the method of multi-task learning and constructs two pre-training tasks: interaction or no interaction prediction and node type reconstruction.

[0071] (1) Interaction or no interaction prediction: Since the task is to predict whether there is malicious behavior between the subject node v i and the object node v j , i.e., to predict the relationship between the two sentences describing the two nodes, an interaction or no interaction pre-training task is designed to learn sentence-level information. In this task, the subject node v i and the object node v jwhether there is an edge between them (i.e., whether there is a direct interaction between the subject-object pair in history). During training, 50% of the time, samples with directly connected subject-object pairs are selected and labeled as “1”, and 50% of the time, samples with not directly connected subject-object pairs are selected and labeled as “0”. The and summed vectors are passed through a fully connected (FC) layer, an activation function, and a binary softmax classifier. More precisely, the probability distribution vector P1 ∈ R 2 over “0 / 1” labels is defined as:

[0072]

[0073] where W1 ∈ R H×2 and b1 ∈ R 2 are trainable model parameters. The negative log-likelihood is used as the loss function, defined as:

[0074]

[0075] where sp denotes a sentence pair, the true label describing whether there is a direct connection between the subject-object pair in sp, D p denotes the pre-training dataset.

[0076] (2) Node type reconstruction: The nodes in the provenance graph (i.e., the system entities in the kernel) have different types, such as processes, files, sockets, etc. To learn the node granularity information, a node type reconstruction task is designed to predict the type of the object node v j (the type of the subject node v i is relatively single). Since the Simple-WL feature may implicitly contain information about the node type, the [MASK] token is used to mask it. In addition, because the [MASK] token will not appear during fine-tuning, this will cause a mismatch between pre-training and fine-tuning, so the present invention uses the following strategy for replacement:

[0077] (i) 80% of the time, the [MASK] token is used;

[0078] (ii) 10% of the time, a random Simple-WL index is used;

[0079] (iii) 10% of the time, the Simple-WL index is kept unchanged.

[0080] The vector is passed through a fully connected (FC) layer, an activation function, and a softmax classifier. More precisely, the probability distribution vector P2 ∈ R |type|It can be represented as follows:

[0081]

[0082] Where W2∈R H×|type| and b2∈R |type| Here are the trainable model parameters, and |type| is the number of node types. The negative log-likelihood is used as the loss function, defined as follows:

[0083]

[0084] Among them, type Represents the object node v in sp j The actual node type.

[0085] In summary, the final pre-training loss function is the sum of the two losses mentioned above, defined as follows:

[0086] L p =L1+L2 Formula (8)

[0087] 4. Fine-tuning and testing

[0088] This invention establishes a highly transferable general model through pre-training. Based on this, the model is tuned using labeled log data from specific terminal systems, resulting in a customized intrusion detection system adapted to that system. Therefore, this method provides more accurate and effective protection for system security. During the fine-tuning and detection phases, the model uses the same input format as during pre-training. For example, in predicting from subject node v... i To the object node v j When malicious behavior is suspected, use Sentence(v) to determine if malicious behavior is suspected. i ) and Sentence(v j Sentence pairs consisting of ) are used as model input. The BERT head used in the fine-tuning and detection stages is the same as that used in the "interactive or non-interactive prediction" pretask, and the loss function is defined as follows:

[0089]

[0090] Where W3∈R H×2 and b3∈R 2 D represents the trainable model parameters. f This indicates a fine-tuned dataset. sp ∈{0,1} means in sp=(Sentence(v i ),Sentence(v j The subject v described in )) i and object v ja true label of whether there is malicious behavior between them. Specifically, "0" indicates that there is no malicious behavior from v i to v j "1" indicates that there is malicious behavior from v i to v j According to the ratio of the number of malignant samples to the number of benign samples in the training data, the training data of each class is assigned to alleviate the problem of data imbalance.

[0091] In addition, the present application proposes two detection modes based on different subject-object pairs detected:

[0092] (i) General mode: This mode aims to detect potential threats between all interacting subject-object pairs within the system.

[0093] (ii) Target protection mode: This mode is specifically designed for systems with parts that should be given priority protection, such as GPS signals in aviation management systems or financial databases in banking systems. It targets potential threats between all active subjects (processes) and highly sensitive objects (e.g., confidential files, high-security level IPs). This mode ensures the security of particularly vulnerable areas within the system.

[0094] Experimental tests:

[0095] The present application was tested on several full-system log data sets during APT attacks, using overall accuracy, precision, recall, and F1 score to evaluate detection performance. The present application showed near-perfect detection performance on all data sets, indicating that it can effectively address APT system entity-level concealment. Table 1 presents the results of the present application method (hereinafter referred to as LOGSAID) compared with the most advanced existing methods, showing that LOGSAID consistently outperforms them in almost all scenarios.

[0096] Table 1: Performance comparison of the present application method and the most advanced existing methods

[0097]

[0098] Figure 3 The results show that fine-tuning a pre-trained model on a specific system requires significantly fewer labeled samples compared to pure supervised learning, indicating that LOGSAID has strong transferability and the ability to reduce dependence on labeled data.

[0099] The above examples only express the embodiments of the present application, the description is more specific, but can not therefore be understood as limiting the scope of the patent of the present application. It should be noted that for ordinary skilled in the art, without departing from the concept of the present application, several modifications and improvements can be made, which all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application should be subject to the appended claims.

Claims

1. A method for detecting APT attack based on log trace graph, characterized in that, The method comprises the following steps: 1) constructing a traceability graph: collecting system audit logs and analyzing, extracting system entities and their interaction relationships, constructing a traceability graph, entities are represented as nodes, and interaction relationships are represented as undirected edges; 2) sentence construction and representation: calculate the closeness matrix between nodes in the traceability graph, extract relevant nodes according to the closeness, construct the subject node corresponding sentence and the object node corresponding sentence, and then connect them into a subject-object sentence pair; Extract the structural features, time sequence features, location features and segment features of each node in the subject-object sentence pair, and construct a feature embedding sequence; The closeness matrix is calculated by the PageRank algorithm, and the calculation formula is as follows: where factor a e [0, 1], I represents a unit matrix, A represents an adjacency matrix; D represents a diagonal matrix, whose diagonal elements D(i, i) = ∑ j A(i, j); the element S(i, j) in the affinity matrix represents the affinity score between nodes v i and v j ; 3) pre-training: constructing two pre-training tasks of interaction or non-interaction prediction and node type reconstruction, inputting the feature embedding sequence into the BERT model to perform the two pre-training tasks, and predicting the relationship between the subject-object sentence pair and the type of the object node; 4) fine-tuning and detection: based on the pre-trained BERT model, fine-tune using specific labeled log data, and use the fine-tuned BERT model for malicious behavior detection.

2. The method of claim 1, wherein, In step 1), two strategies are used to simplify the traceability graph: ignore the directionality of the interaction, and convert the graph into an undirected graph; Focus on the existence of entity interaction, ignore the interaction type and frequency.

3. The method of claim 1, wherein, In step 2), the method of extracting relevant nodes according to the closeness and constructing sentences is: for each node, a group of high-closeness relevant nodes is extracted according to the closeness; The node is regarded as a word, and the current node and the extracted relevant nodes form a sentence.

4. The method of claim 1, wherein, The step of extracting the structural features of each node in step 2) includes: assigning a color to each node according to its degree; Traverse each node in the traceability graph, calculate the color of the neighbor of the current node, and form a set of calculated colors in order; And add the color of the current node itself to the front of the set; Map the color set to a structural feature index through a pre-defined dictionary, so as to obtain the structural feature of each node.

5. The method of claim 1, wherein, In step 3), when performing the interaction or non-interaction prediction task, 50% of the time selects the directly connected subject-object node pair, and 50% of the time selects the not directly connected subject-object node pair, and predicts whether there is malicious behavior between the subject node and the object node, to learn the information at the sentence level.

6. The method of claim 1, wherein, In step 3), when performing the node type reconstruction task, use [MASK] to mark the hidden structure features, and predict the type of the object node to learn the information at the node level.

7. The method of claim 6, wherein, In step 3), the structural features are processed as follows: 80% of the time, use [MASK] to mark; 10% of the time, use a random structure feature index; 10% of the time, keep the structure feature index unchanged.

8. The method of claim 1, wherein, In step 3), construct the interaction or non-interaction prediction loss function and the node type reconstruction loss function, and take the sum of the two loss functions as the final pre-training loss function, and optimize the model parameters to minimize the final pre-training loss; The interaction or non-interaction prediction loss function is: wherein sp represents a subject-object sentence pair; a true label representing whether there is a direct connection between the subject-object node pair in sp; p represents a pre-training data set; a probability distribution vector of the direct connection label and the non-direct connection label between the subject-object node pair; represents a subject node feature embedding sequence in the sentence corresponding to the subject node, represents an object node feature embedding sequence in the sentence corresponding to the object node, and W1 and b1 represent trainable model parameters; The node type reconstruction loss function is: where sp denotes a pair of subject-object sentence; denotes the true node type of the object node v j in sp; p denotes a pre-training dataset; denotes a probability distribution vector over node types; denotes the object node feature embedding sequence in the sentence corresponding to the object node, and W2 and b2 denote trainable model parameters.

9. The method of claim 1 or 8, wherein, In step 4), the pre-trained BERT model is fine-tuned, the subject-object sentence pair is input, and whether there is malicious behavior between the subject node and the object node is predicted; a loss function, which is the same as the interaction or non-interaction prediction loss function, is calculated, and the model parameters are optimized to minimize the loss.

Images