An attack method clustering and attribution method for attack patterns

Abstract

The application provides an attack method clustering and attribution method for attack patterns, and relates to the technical field of network security. The attack method clustering and attribution method comprises the following steps: collecting threat intelligence original data and extracting data based on a large language model to obtain attack information; inputting the attack information into a retrieval enhancement generation framework to generate triplets, fusing the triplets with a network security knowledge graph to obtain TTPs data; clustering the TTPs data based on a Gaussian mixture clustering model, and enhancing the Gaussian mixture clustering model based on the structure entropy of TTP nodes to obtain a soft clustering result; constructing an attack tree based on the soft clustering result, performing weight distribution based on an attention mechanism, and matching the attack tree in the knowledge graph based on a similarity calculation method to obtain an attribution result. The application provides a complete attack behavior attribution implementation framework, combines the advantages of cutting-edge technologies, and can realize efficient, accurate, reliable, scalable and highly interpretable attribution.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to an attack method clustering and attribution method for attack patterns. BACKGROUND

[0002] In the field of network security, with the continuous evolution of existing attack methods, the attack means of attack organizations are becoming more and more complex and difficult to judge, and the traditional detection method and system are difficult to cope with complex attacks such as advanced persistent threats (APTs). However, the attack pattern defined by MITER ATT&CK, that is, Tactics, Techniques, and Procedures (TTPs), is a deep description of attack means, highlighting the behavior style and habit characteristics of attackers. Therefore, how to more efficiently and accurately mine attack activity related information from cyber threat intelligence (CTI) and cluster and attribute attack methods has become one of the core challenges in the current network security field, and efficient use of TTPs has become an important research direction when we formulate security protection strategies.

[0003] In the field of TTPs extraction, existing means are mainly divided into two categories: one is based on rules; and the other is based on deep learning. However, the rule-based method cannot handle variable text patterns, and relies on known attack patterns, rules or templates. Once the attack method changes, there is a high probability of recognition failure; and the deep learning-based extraction method often needs a large amount of labeled data for training. However, the acquisition cost of labeled data is high, and the data in many CTI reports may not have undergone strict standardization or cleaning, resulting in unstable quality of training data and unstable generalization ability of the model. Therefore, it is difficult to obtain a deep learning model that can capture the context relationship and perform well in task execution.

[0004] In addition, the existing main attack behavior attribution methods are based on malware sample attribution method and threat analysis report attribution method. In the malware sample-based attribution method, malware can be modified, shared or sold, which makes it difficult to accurately locate the real source of network attacks, and relying on malware signatures may miss coordinated, multi-faceted attacks involving multiple attack vectors and tools; in the threat analysis report-based attribution method, only the words in the report are used for comparison, which cannot identify features that contribute to attribution classification, so as to understand their impact and build a reliable attribution model.

[0005] Therefore, there is an urgent need to provide a solution to solve the above problems. SUMMARY

[0006] The application aims to provide an attack method clustering and attribution method for attack patterns, improve the ability of the prior art to extract important information in threat intelligence, and improve the accuracy and reliability of attribution.

[0007] The attack method clustering and attribution method for attack patterns provided by the application adopts the following technical scheme:

[0008] Collect threat intelligence raw data and perform normalization processing to obtain experimental data, formulate prompt words for a large language model based on the ontology definition specification of an open source network security knowledge graph, and extract attack information from the experimental data;

[0009] Input the attack information into a retrieval enhancement generation framework to obtain entity attributes with added context information, and generate entity attribute triples connected based on relationships, fuse the triples with a network security knowledge graph to obtain TTPs data;

[0010] Learn deep feature representations of the TTPs data based on an autoencoder, train a Gaussian mixture clustering model based on the deep feature representations, and enhance the Gaussian mixture clustering model based on the structural entropy of TTP nodes to obtain soft clustering results;

[0011] Generate attack vectors based on the soft clustering results based on life cycle phases, add attribute information as child nodes of branch nodes based on the attack vectors as main branch nodes to construct an attack tree, assign weights to nodes in the attack tree based on an attention mechanism to obtain a threat intelligence attack tree, and match the threat intelligence attack tree with attack trees in a knowledge graph based on a similarity calculation method to obtain an attack organization as a root node, thereby obtaining an attribution result.

[0012] Optionally, in the process of collecting threat intelligence raw data and performing normalization processing to obtain experimental data, the process includes: collecting threat intelligence raw data based on a threat intelligence data source, removing irrelevant content in the threat intelligence raw data, including advertisements, repeated information, and garbled characters, and segmenting data with threat intelligence content greater than a first threshold into small semantic units, while normalizing similar semantic expressions, thereby obtaining experimental data; the threat intelligence data source includes threat intelligence reports, security logs, and forum blogs.

[0013] Optionally, in the process of inputting attack information into a retrieval enhancement generation framework to obtain entity attributes with added context information, the process includes: inputting attack information into a retrieval enhancement generation framework, the retrieval enhancement generation framework performing real-time retrieval based on an external knowledge base, and inputting relevant information retrieved as context into a generation model to obtain entity attributes with added context information.

[0014] Optionally, in the process of learning deep feature representation of TTPs data based on the autoencoder, the process comprises: learning TTPs data based on the autoencoder, and capturing the internal structure and distribution of the data in the learning process to obtain a deep feature representation.

[0015] Optionally, in the process of training a Gaussian mixture clustering model based on the deep feature representation, the process comprises: describing 14 cluster types based on 14 Gaussian distributions, constructing a Gaussian mixture clustering model based on the 14 cluster types, and maximizing the likelihood of the deep feature representation by adjusting the parameters of the Gaussian distributions, wherein the 14 cluster types are Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact.

[0016] Optionally, in the process of enhancing the Gaussian mixture clustering model to obtain a soft clustering result based on the structural entropy of the TTP node, the process comprises: calculating the degree distribution of the local k-hop subgraph of the TTP node, calculating the structural entropy of the TTP node based on the degree distribution, normalizing the deep feature representation and the structural entropy, adding a feature dimension to the deep feature representation, and taking the structural entropy value as an additional feature, and ignoring the data of the TTP node when the structural entropy value is greater than a second threshold, thereby improving the robustness of the clustering model.

[0017] Optionally, in the process of calculating the degree distribution of the local k-hop subgraph of the TTP node, the following formula is used for calculation:

[0018]

[0019] wherein, p u is the degree distribution of the local k-hop subgraph of the target node v, d u is the degree of node u, u' is the adjacent node of node u, v is the target node, V k (v) is a set of nodes.

[0020] Optionally, in the process of calculating the structural entropy of the TTP node based on the degree distribution, the following formula is used for calculation:

[0021]

[0022] wherein, H k(v) is the structural entropy of the k-hop subgraph of the target node, p u (v) is the degree distribution of the local k-hop subgraph of the target node v, V k (v) is the structural entropy of the k-hop subgraph of the target node, p

[0023] Optionally, in the process of constructing the attack tree based on the attack vector as the main branch node and adding attribute information as the child node of the branch node, the attribute information includes: malware, vulnerability, tool size, activity duration, and number of campaign initiations.

[0024] Optionally, in the process of matching the threat intelligence attack tree with the attack tree in the knowledge graph based on the similarity calculation method to obtain the attack organization as the root node, the process includes: matching the threat intelligence attack tree with the attack tree in the knowledge graph based on the similarity calculation method, and only when the similarity of the input threat intelligence attack tree and the attack tree in the knowledge graph is greater than a third threshold, the attack organization connected with the attack tree in the knowledge graph is taken as the root node of the threat intelligence attack tree.

[0025] The attack method clustering and attribution method for attack patterns provided by the application have the beneficial effects that:

[0026] 1. The application realizes efficient and accurate extraction of important information in threat intelligence through a large language model, breaking through the limitations of the prior art, such as insufficient flexibility, inability to handle complex text, and low accuracy.

[0027] 2. The application supplements extracted information through a retrieval-enhanced generation framework, solving the problem of scarce usable information in general threat intelligence, and a multi-source information enhancement model understands and analyzes attack behavior, providing more comprehensive data sources for attack behavior attribution.

[0028] 3. The application uses structural entropy to enhance a deep clustering model and classifies TTPs into life cycle stages, constructs effective attack vectors, facilitates hierarchical mining of deep features in attack patterns, and solves the problem of traditional Gaussian mixture models being easily affected by noise values. This innovative clustering scheme solves the problem of complex and low usability of manually constructed clustering features, automatically constructs high-quality data features, and combines statistical theory to construct a reliable and efficient clustering model. The enhancement of structural entropy greatly increases the robustness of the model.

[0029] 4. The attribution strategy of the application constructs attack behavior time series with more extensive associated information and more explicit hierarchical relationships by combining a knowledge graph and an attack tree, and realizes dynamic weight allocation through an attention mechanism, so that the model can focus on the role of key TTPs, thereby improving the accuracy and reliability of attribution. BRIEF DESCRIPTION OF DRAWINGS

[0030] Figure 1 An attack method clustering and attribution method flowchart provided by the present application;

[0031] Figure 2 An attack method clustering and attribution method example diagram provided by the present application;

[0032] Figure 3 A search enhancement generation framework flowchart provided by the present application. DETAILED DESCRIPTION

[0033] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application. Unless otherwise defined, the technical terms or scientific terms used herein should be understood as the common meanings thereof by those of ordinary skill in the art to which the present application belongs. The terms such as “comprise” and the like used herein mean that the elements or objects before the terms encompass the elements or objects listed after the terms and their equivalents, and do not exclude other elements or objects.

[0034] The embodiments of the present application provide an attack method clustering and attribution method for attack patterns, referring to Figure 1 , comprising:

[0035] S1, collecting threat intelligence raw data and performing normalization processing to obtain experimental data, formulating prompt words of a large language model based on the ontology definition specification of an open source network security knowledge graph and extracting experimental data to obtain attack information;

[0036] S2, inputting the attack information into a search enhancement generation framework to obtain entity attributes with added context information, and generating entity attribute triplets based on relationship connections, fusing the triplets with a network security knowledge graph to obtain TTPs data;

[0037] S3, learning deep feature representation of the TTPs data based on a self-encoder, training a Gaussian mixture clustering model based on the deep feature representation, and enhancing the Gaussian mixture clustering model based on the structural entropy of TTP nodes to obtain a soft clustering result;

[0038] S4. generating an attack vector based on the soft clustering result and the life cycle stage, adding attribute information as a child node of a branch node based on the attack vector as a main branch node to build an attack tree, performing weight distribution for nodes in the attack tree based on an attention mechanism to obtain a threat intelligence attack tree, and matching the threat intelligence attack tree with an attack tree in a knowledge graph based on a similarity calculation method to obtain an attack organization as a root node, thereby obtaining an attribution result.

[0039] In some embodiments, in the process of performing step S1, the following steps are included:

[0040] S1.1. Collecting threat intelligence raw data and performing normalization processing to obtain experimental data;

[0041] S1.2. Formulating prompt words for a large language model based on the ontology definition specification of an open source network security knowledge graph and extracting experimental data to obtain attack information.

[0042] Specifically, in the process of performing step S1.1, the following steps are included: collecting threat intelligence raw data based on a threat intelligence data source, removing irrelevant content in the threat intelligence raw data, including advertisements, repeated information, and garbled characters, and dividing data with threat intelligence content greater than a first threshold value into small semantic units, while normalizing similar semantic expressions, thereby obtaining experimental data; the threat intelligence data source includes threat intelligence reports, security logs, and forum blogs.

[0043] Further, in step S1.2, prompt words for a large language model are formulated based on the ontology definition specification of an open source network security knowledge graph, guiding the large model to extract information needed in the threat intelligence data in the graph, especially focusing on the extraction of TTPs.

[0044] In some embodiments, in the process of performing step S2, the following steps are included:

[0045] S2.1. Inputting attack information into a retrieval enhancement generation framework to obtain entity attributes with added context information;

[0046] S2.2. Generating entity attribute triplets based on relationship connections, and fusing the triplets with a network security knowledge graph to obtain TTPs data.

[0047] Specifically, in the process of performing step S2.1, the following steps are included: inputting attack information into a retrieval enhancement generation framework, the retrieval enhancement generation framework performing real-time retrieval based on an external knowledge base, and inputting the retrieved related information as context to a generation model to obtain entity attributes with added context information.

[0048] Further, step S2.2 is performed to generate entity attribute triples based on the relationship connection, and the generated "entity-relation-entity" triples are fused with the network security knowledge graph to obtain TTPs data.

[0049] In some embodiments, in the process of performing step S3, the following steps are included:

[0050] S3.1, learning deep feature representation of the TTPs data based on the autoencoder;

[0051] S3.2, training a Gaussian mixture clustering model based on the deep feature representation;

[0052] S3.3, and based on the structural entropy of the TTP nodes, enhancing the Gaussian mixture clustering model to obtain a soft clustering result.

[0053] Specifically, in the process of performing step S3.1, the following steps are included: learning the TTPs data based on the autoencoder, and capturing the internal structure and distribution of the data in the learning process to obtain deep feature representation.

[0054] Specifically, in the process of performing step S3.2, the following steps are included: 14 Gaussian distributions are used to describe 14 clustering types, each Gaussian distribution represents a clustering center, a Gaussian mixture clustering model is constructed based on the 14 clustering types, and the parameters of the Gaussian distribution are adjusted to maximize the likelihood of the deep feature representation, and the 14 clustering types are Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, LateralMovement, Collection, Command and Control, Exfiltration, and Impact.

[0055] In fact, the reconnaissance and resource development information in the attack preparation stage can be clustered through Reconnaissance and Resource Development, the initial access and execution information in the initial intrusion stage can be clustered through Initial Access and Execution, the information in the access maintenance and privilege escalation stage can be clustered through Persistence, Privilege Escalation and Defense Evasion, the information in the deep exploration and information collection stage can be clustered through Credential Access, Discovery and Lateral Movement, the information in the data collection, command and control stage can be clustered through Collection, Command and Control, and the information in the data exfiltration and impact stage can be clustered through Exfiltration and Impact, based on the 14 clustering types, the complete life cycle of attack behavior can be covered.

[0056] Specifically, in the process of performing step S3.3, the following steps are included: calculating the degree distribution of the local k-hop subgraph of the TTP node, calculating the structure entropy of the TTP node based on the degree distribution, normalizing the deep feature representation and the structure entropy, adding a feature dimension to the deep feature representation, taking the structure entropy value as an additional feature, and ignoring the data of the TTP node when the structure entropy value is greater than a second threshold, so as to improve the robustness of the clustering model.

[0057] Further, in the process of calculating the degree distribution based on the local k-hop subgraph of the TTP node, the following formula is used for calculation:

[0058]

[0059] wherein p u is the degree distribution of the local k-hop subgraph of the target node v, d u is the degree of node u, u' is the adjacent node of node u, v is the target node, V k (v) is a node set.

[0060] Further, in the process of calculating the structure entropy of the TTP node based on the degree distribution, the following formula is used for calculation:

[0061]

[0062] wherein H k is the structure entropy of the k-hop subgraph of the target node, p u is the degree distribution of the local k-hop subgraph of the target node v, V k (v) is a node set, and u is any node in the set.

[0063] In fact, the Gaussian mixture clustering model is sensitive to outliers or noise points, so the structural entropy is used to measure the local connection mode and stability of the TTP node, and the greater the structural entropy value, the more likely it is that the TTP is connected to noise information, which will lead to structural instability, so when the structural entropy value is greater than the second threshold value, the data of the TTP node is ignored, which can improve the robustness of the clustering model.

[0064] In some embodiments, in the process of performing step S4, it includes:

[0065] S4.1, constructing an attack tree;

[0066] S4.2, assigning weights to the nodes in the attack tree based on the attention mechanism to obtain a threat intelligence attack tree;

[0067] S4.3, matching the threat intelligence attack tree with the attack tree in the knowledge graph based on a similarity calculation method to obtain an attack organization as the root node.

[0068] Specifically, in the process of performing step S4.1, it includes generating an attack vector based on the soft clustering result and the life cycle phase, which represents the order of the attacker's actions in the attack process; further, based on the attack vector as the main branch node, adding attribute information as the child nodes of the branch nodes to construct the attack tree.

[0069] Further, in the process of constructing the attack tree based on the attack vector as the main branch node and adding attribute information as the child nodes of the branch nodes, the attribute information includes malware, vulnerability, tool size, activity duration, and number of launched campaigns.

[0070] Specifically, in the process of performing step S4.2, it includes introducing an attention mechanism to give different degrees of attention to different parts of the attack tree. Specifically, under this mechanism, the weight of the main branch is higher than that of the side branch node, because the importance of different stages in the attack process may be different; in addition, the nodes on the main branch are also given different weights according to their role and frequency in the attack process (such as Reconnaissance stage is usually lower than Impact stage), this weight allocation mechanism can more accurately reflect the key of the TTP sequence, and effectively weaken the interference of noise data or secondary information.

[0071] Further, in the process of performing step S4.3, it includes matching the threat intelligence attack tree with the attack tree in the knowledge graph based on a similarity calculation method, and only when the similarity between the input threat intelligence attack tree and the attack tree in the knowledge graph is greater than a third threshold value, the attack organization connected to the attack tree in the knowledge graph is taken as the root node of the threat intelligence attack tree.

[0072] In some embodiments, referring to Figure 2 , comprising:

[0073] Collect threat intelligence and perform data preprocessing, formulate prompt words of large language model based on the ontology definition specification of network security knowledge graph, batch the threat intelligence data into the large language model, generate context content for the threat intelligence data based on retrieval enhancement, extract triplets and entity attributes and fuse with the network security knowledge graph to obtain TTPs data; construct a GMM clustering model based on 14 cluster types of life cycle, input the TTPs data into the GMM clustering model, and enhance the structural stability of the GMM clustering model by extracting k-hop subgraph to calculate the structural entropy of TTP nodes, and output the soft clustering results; construct an attack tree based on the soft clustering results, and match the threat intelligence attack tree with the attack tree in the knowledge graph based on the attention matching mechanism to obtain the attribution results.

[0074] Further, referring to Figure 3 , in the process of generating context content for threat intelligence data based on retrieval enhancement, first input the threat intelligence data text and the prompt for indicating and guiding the model to produce specific output into the large language model LLM, then add context content to the threat intelligence data based on the external knowledge base and return to the large language model, and finally output the entity attribute triplets based on relationship connection.

[0075] Although the embodiments of the present application have been described in detail above, it is obvious to those skilled in the art that various modifications and changes can be made to these embodiments. However, it should be understood that such modifications and changes all fall within the scope and spirit of the present application described in the claims. Moreover, the present application described herein can have other embodiments, and can be implemented or realized in various ways.

Claims

1. A clustering and attribution method for attack techniques targeting attack patterns, characterized in that, Includes the following steps: Collect raw threat intelligence data and standardize it to obtain experimental data. Based on the ontology definition specification of open source network security knowledge graph, formulate prompt words for large language model and extract attack information from experimental data. The attack information is input into the retrieval enhancement generation framework to obtain entity attributes with added context information, and entity attribute triples based on relationship connections are generated. The triples are then fused with the network security knowledge graph to obtain TTPs data. The deep feature representation of TTPs data is learned based on the autoencoder, a Gaussian mixture clustering model is trained based on the deep feature representation, and the Gaussian mixture clustering model is enhanced based on the structural entropy of TTP nodes to obtain soft clustering results. The soft clustering results are used to generate attack vectors based on lifecycle stages. The attack vectors are used as main branches and attribute information is added as child nodes of the branches to construct an attack tree. The nodes in the attack tree are weighted based on an attention mechanism to obtain a threat intelligence attack tree. The threat intelligence attack tree is matched with the attack tree in the knowledge graph based on a similarity calculation method to obtain the attack organization as the root node, thereby obtaining the attribution result. The process of obtaining soft clustering results by enhancing the Gaussian mixture clustering model based on the structural entropy of TTP nodes includes: calculating the degree distribution of the local k-hop subgraph of the TTP node; calculating the structural entropy of the TTP node based on the degree distribution; normalizing the deep feature representation and the structural entropy; adding a feature dimension to the deep feature representation; using the structural entropy value as an additional feature; and ignoring the data of the TTP node when the structural entropy value is greater than a second threshold, thereby improving the robustness of the clustering model.

2. The attack technique clustering and attribution method for attack patterns according to claim 1, characterized in that, The process of collecting raw threat intelligence data and standardizing it to obtain experimental data includes: Raw threat intelligence data is collected based on threat intelligence data sources. Irrelevant content, including advertisements, duplicate information, and garbled characters, is removed from the raw threat intelligence data. Data with threat intelligence content exceeding a first threshold is segmented into small semantic units. At the same time, similar semantic expressions are normalized to obtain experimental data. The threat intelligence data sources include threat intelligence reports, security logs, and forum blogs.

3. The attack technique clustering and attribution method for attack patterns according to claim 1, characterized in that, The process of inputting attack information into the retrieval enhancement generation framework to obtain entity attributes with added contextual information includes: The attack information is input into the retrieval enhancement generation framework, which performs real-time retrieval based on an external knowledge base and inputs the retrieved relevant information as context into the generation model to obtain entity attributes with added context information.

4. The attack technique clustering and attribution method for attack patterns according to claim 1, characterized in that, The process of learning deep feature representations of TTPs data based on autoencoders includes: The system learns TTPs data using an autoencoder and captures the data’s intrinsic structure and distribution during the learning process to obtain deep feature representations.

5. The attack technique clustering and attribution method for attack patterns according to claim 1, characterized in that, The process of training a Gaussian mixture clustering model based on deep feature representation includes: Fourteen clustering types are described based on 14 Gaussian distributions. A Gaussian mixture clustering model is constructed based on these 14 clustering types. The likelihood of deep feature representation is maximized by adjusting the parameters of the Gaussian distributions. The 14 clustering types are Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact.

6. The attack technique clustering and attribution method for attack patterns according to claim 1, characterized in that, The following formula is used to calculate the degree distribution of a local k-hop subgraph based on TTP nodes: ； in, For the target node The degree distribution of the local k-jump subgraph. For nodes The degree, For nodes The adjacent nodes, For the target node, It is a set of nodes.

7. The attack technique clustering and attribution method for attack patterns according to claim 6, characterized in that, In calculating the structural entropy of the TTP node based on the degree distribution, the following formula is used: ； in, Let be the structural entropy of the k-hop subgraph of the target node. For the target node The degree distribution of the local k-jump subgraph. For a set of nodes, Let be any node within the set.

8. The attack technique clustering and attribution method for attack patterns according to claim 1, characterized in that, In the process of constructing an attack tree based on attack vectors as the main branch nodes and adding attribute information as child nodes of the branch nodes, the attribute information includes: malware, vulnerability, tool size, activity duration, and number of campaigns launched.

9. The attack technique clustering and attribution method for attack patterns according to claim 1, characterized in that, The process of matching threat intelligence attack trees with attack trees in a knowledge graph based on similarity calculation methods to obtain the attack organization as the root node includes: The threat intelligence attack tree is matched with the attack tree in the knowledge graph based on the similarity calculation method. If and only if the similarity between the input threat intelligence attack tree and the attack tree in the knowledge graph is greater than the third threshold, the attacking organization connected to the attack tree in the knowledge graph is taken as the root node of the threat intelligence attack tree.

Images