A method for reconstructing APT attack chains based on knowledge graph and graph neural network

Abstract

The present invention discloses an APT attack chain reconstruction method based on knowledge graph and graph neural network, which belongs to the field of network security technology. This application introduces a large language model to perform advanced analysis of multi-source heterogeneous attack clues, combines the time-enhanced knowledge graph representation with the deep learning ability of graph convolutional attention network, and promotes the efficient completion and dynamic reconstruction of the attack chain. It solves the problem that the existing technology has obvious limitations in attack chain completion and inference due to problems such as data sparsity, relationship complexity and time series characteristics, and the traditional method lacks the deep learning ability of implicit relationships in the attack chain, resulting in insufficient inference ability for unknown attack behaviors.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and specifically relates to an APT attack chain reconstruction method based on knowledge graph and graph neural network. Background Art

[0002] In recent years, APT attacks, due to their complexity, stealth, and high risk, have become a major challenge in global cybersecurity. APT attacks often involve multiple stages, such as initial access, vulnerability exploitation, lateral movement, and data theft, and involve a large number of discrete attack clues, such as alert logs, threat intelligence, and IOCs. However, because attack clues are dispersed and heterogeneous, traditional analysis methods struggle to effectively correlate these clues and reconstruct the complete attack chain.

[0003] Existing technologies have attempted to use knowledge graphs for attack behavior modeling. However, due to data sparsity, relationship complexity, and temporal characteristics, these methods have significant limitations in completing and inferring attack chains. Furthermore, traditional methods lack the ability to deeply learn the implicit relationships within attack chains, resulting in insufficient ability to infer unknown attack behaviors. These limitations render current security defense systems vulnerable to new or evolving APT attacks. Summary of the Invention

[0004] In order to solve the problems raised in the above background technology, the present invention provides an APT attack chain reconstruction method based on knowledge graph and graph neural network, so as to solve the problem that the existing technology has obvious limitations in attack chain completion and inference due to problems such as data sparsity, relationship complexity and time series characteristics, and the traditional method lacks the deep learning ability of implicit relationships in the attack chain, resulting in insufficient inference ability of unknown attack behaviors.

[0005] To achieve the above object, the present invention provides the following technical solutions:

[0006] A method for reconstructing an APT attack chain based on knowledge graph and graph neural network, including the following steps:

[0007] S1: APT-related data collection and analysis: Collect multi-source heterogeneous data related to APTs, including alarm logs, threat intelligence reports, and IOCs, and extract key data including entity information, time-series event processes, and relationships between entities. Based on this key data, the complete structure of each APT attack chain is clarified.

[0008] S2: Construction of the APT attack chain knowledge graph: Through the APT attack chain, we build an APT attack chain knowledge graph with time series characteristics. Through a fine-grained time node splitting strategy, we model the behavior of each entity in the knowledge graph in different time periods separately to capture the temporal evolution characteristics. At the same time, we introduce multi-hop relationships on the basis of the knowledge graph to generate high-order dependency subgraphs, improving the knowledge graph's ability to describe complex APT attack chains.

[0009] S3: Graph Convolutional Attention Network Model Training: Using the graph convolutional attention network model, we conduct deep learning on the knowledge graph of the APT attack chain, generating high-dimensional vector representations of nodes and edges to capture the dependencies in the APT attack chain. Then, we use dynamic subgraph generation and context encoding techniques to further model the complex interactions between nodes and capture the timing characteristics of the APT attack chain. Finally, we design an APT attack chain learning task based on temporal masks, enabling the model to learn and predict APT attack chains in the node or relationship mask state.

[0010] S4: APT attack chain reconstruction and dynamic inference; The model that completes the learning task can dynamically reconstruct the APT attack chain, connect all known entities and relationships, and build a complete attack sequence. For the missing parts of the APT attack chain, it uses high-confidence relationship predictions to complete them, and uses time series sorting modeling to ensure that the attack behaviors are arranged in the order in which they actually occurred, thereby accurately inferring the attacker's next move.

[0011] Preferably, in S1, for structured data and unstructured data in multi-source heterogeneous data, a method of parsing fields and relationships based on preset rules and a method of automatic parsing using a large language model are respectively adopted to extract key information including entity information, temporal event processes and relationships between entities, and the extracted entities and relationships are deduplicated, normalized and semantically unified to remove duplicate entities and relationships. In combination with the threat intelligence standard MITRE ATT&CK, the entities and relationships are classified and labeled to generate basic data with unified standards.

[0012] Preferably, in S1, clarifying the complete structure of each APT attack chain includes the following steps: first, performing time series analysis based on the temporal event process, sorting events by timestamps, identifying the starting point, stage, and end point of each event, then associating the entities and relationships in the event, and dividing independent APT attack chains, and then according to the threat intelligence standard MITRE ATT&CK, performing phased annotation on each APT attack chain, dividing it into various stages, and at the same time, annotating the entities and relationships involved in each stage in detail, and outputting the time series and phased annotation results of the APT attack chain for each attack.

[0013] Preferably, S2 is specifically, based on the data of the APT attack chain, the entity type and its attributes are converted into nodes in the knowledge graph, and according to the results of the communication analysis and tool method analysis, the relationship between entities is defined as the edge connecting the nodes, and time attributes are embedded in the nodes and edges to support temporal reasoning. At the same time, through the time-fine-grained node splitting strategy, the behavior of the same entity in different time periods is modeled separately to capture the time evolution characteristics, and a multi-hop relationship including "tool-target-attack organization" is introduced to build a high-order dependency subgraph, thereby improving the knowledge graph's ability to describe complex APT chains.

[0014] Preferably, in S3, the calculation method for the high-dimensional vector representation of a node is as follows:

[0015] For the node to be processed, a subgraph gc containing the node and its multi-hop neighbors is generated as the context, and the graph embedding method is used to capture the global topological information of the node. The network structure characteristics of the node are captured through the global topological information, and each node is initialized into a low-dimensional vector form. , encode the attribute features of the node including IP address, geographic location, and threat intelligence label, and use the embedding lookup table to generate a vector representation as For nodes with text descriptions, a large language model is used to generate high-dimensional semantic vectors Then, through the linear transformation dimensionality reduction and splicing method, the high-dimensional vector of the node is finally represented as:

[0016] ;

[0017] in, Represents a vector concatenation operation.

[0018] Preferably, in S3, the method for expressing the high-dimensional vector of the relationship is to express the relationship between nodes as a feature matrix including the relationship type and time attribute, which specifically includes the following steps:

[0019] Relationship type embedding: First, according to the relationship type, the relationship type embedding is expressed as , The generation methods include random initialization, using TransE, and DistMult pre-trained knowledge graph models to generate;

[0020] Edge attribute embedding: In addition to the relationship type, each edge also contains additional attribute information of embedded time and intensity. The additional edge attribute embedding is expressed as ;

[0021] Construction of relationship feature matrix; for edge feature representation r ij Embedded by relationship type and edge attribute embedding Stitched together:

[0022] ;

[0023] The relational feature matrix R of the entire knowledge graph can be expressed as:

[0024] ;

[0025] Where E is the edge set of the graph.

[0026] Preferably, in S3, the dynamic subgraph generation and context encoding mechanism is specifically as follows:

[0027] Dynamic subgraph generation: Generate dynamic subgraphs with multi-hop dependencies by performing random walks based on node and edge timestamps;

[0028] Context encoding mechanism: After the dynamic subgraph is generated, the local structure and timing characteristics in the dynamic subgraph are contextually encoded, and the local structural features and timing information of the nodes are extracted using a time-aware graph convolutional network, and the local structural features of the nodes and their behavior patterns that change over time are extracted.

[0029] Preferably, the APT attack chain learning task based on temporal masking is specifically expressed as follows: for each subgraph gc, a node or relationship is randomly selected for masking operation, and then the model is trained to predict the masked nodes or relationships based on the information of the remaining nodes. Based on the masking processing of some nodes and edges, a supervised learning task is constructed, and the prediction results of the masked nodes and edges are optimized using the cross entropy loss function. The optimizer is used to adjust the model parameters, and the learning rate scheduling mechanism is combined to improve the training convergence speed.

[0030] Compared with the prior art, the present invention has the following beneficial effects:

[0031] This application introduces a large language model to perform advanced analysis of multi-source heterogeneous attack clues, combines the time-enhanced knowledge graph representation with the deep learning capabilities of the graph convolutional attention network, and promotes the efficient completion and dynamic reconstruction of the attack chain. It solves the problem that the existing technology has obvious limitations in attack chain completion and inference due to problems such as data sparsity, relationship complexity and time series characteristics, and the traditional method lacks the deep learning ability of the implicit relationship in the attack chain, resulting in insufficient inference ability of unknown attack behaviors. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 Schematic diagram for constructing the knowledge graph for this application;

[0033] Figure 2 Schematic diagram of the graph convolutional attention network model training for this application. DETAILED DESCRIPTION

[0034] To facilitate those skilled in the art to understand the technical content of the present invention, the present invention is further described in detail below with reference to the accompanying drawings and specific examples. It should be understood that the specific examples described herein are only used to explain the present invention and are not intended to limit the present invention.

[0035] Example 1:

[0036] A method for reconstructing APT attack chains based on knowledge graph and graph neural network, such as Figure 1 、 Figure 2 As shown, the following steps are included:

[0037] S1: APT attack chain data collection and cleaning and entity relationship extraction;

[0038] Multiple APT attack chain data are collected from multi-source heterogeneous data, which contains other irrelevant attack noise, including but not limited to alarm logs, threat intelligence reports, IOCs, etc., to form raw data that can describe the complete attack chain. The raw data is then cleaned and key information such as entity information, temporal event processes, and relationships between entities are extracted from structured data. Unstructured data is automatically parsed using a large language model to identify and extract key entities to extract entity nodes and their relationships in the attack chain. Entity types include but are not limited to: attackers, victims, tools, technologies, IP addresses, domain names, URLs, IOCs, file hashes, timestamps, etc.; relationship types include but are not limited to: communication relationships, attack paths, dependencies, etc. In addition, the extracted entities and relationships are deduplicated, normalized, and semantically unified to remove duplicate entities and relationships. Combined with the threat intelligence standard MITRE ATT&CK, the entities and relationships are classified and labeled to generate basic data with unified standards.

[0039] Based on standard basic data, we conduct in-depth analysis and separation of mixed multiple attack data to clarify the complete structure of each attack chain. First, we conduct time series analysis, sort events based on timestamps, and identify the starting point, stage, and end point of each attack. Secondly, we associate entities and relationships through communication modes, attack tools, usage patterns, etc., and divide independent attack chains. Furthermore, according to MITRE ATT&CK, we perform phased annotation on each attack chain, dividing it into reconnaissance and tracking, weapon construction, payload delivery, vulnerability exploitation, installation and implantation, command execution, data exfiltration, etc. At the same time, we annotate the entities and relationships involved in each stage in detail. The output results include the time series and phased annotation of the attack chain of each attack, providing accurate input for knowledge graph construction.

[0040] S2: Construction of APT attack chain knowledge graph;

[0041] Entity types and their attributes are converted into nodes in the knowledge graph. Based on the results of communication analysis and tool and technique analysis, relationship types such as "tool used," "attack target," and "communication association" between entities are defined as edges connecting nodes. Time attributes are embedded in nodes and relationships to support temporal reasoning. At the same time, a fine-grained time-based node splitting strategy is used to model the behavior of the same entity in different time periods separately to capture temporal evolution characteristics. Multi-hop relationships such as "tool-target-attack organization" are introduced to build high-order dependency subgraphs, improving the knowledge graph's ability to describe complex APT chains. The knowledge graph is stored in a graph database, and visualization capabilities are provided to support attack chain reconstruction and analysis.

[0042] S3: Attack chain deduction learning based on graph neural networks; using the graph convolutional attention network (GCAN) to conduct deep learning on the knowledge graph of the APT attack chain, generate high-dimensional vector representations of nodes and edges, fully integrate the graph structure features and node semantic features, and capture the complex dependencies and temporal characteristics in the APT attack chain. At the same time, the application of dynamic subgraph generation and context encoding technology further enhances the model's understanding of the stage-by-stage evolution characteristics of the APT attack chain. By designing an APT attack chain learning task based on temporal masks, the model can learn and predict attack chains in the node or relationship mask state. This includes but is not limited to completing missing attack steps, inferring unknown attack stages, etc. S3 specifically includes the following steps:

[0043] S3.1: Node and relationship feature representation; for each node, a variety of embedding methods are used to generate its feature vector. Specifically, the graph embedding method is used to capture the global topological information of the node, and each node is initialized to a low-dimensional vector form; for the attribute features of the node, attribute embedding is generated by embedding the lookup table; for nodes with rich text descriptions, a fine-tuned large language model is used to generate a high-dimensional semantic vector. Finally, after dimensionality reduction through linear transformation, the structural embedding, attribute embedding, and semantic embedding are spliced ​​into the final representation of the node. For the feature representation of the edge, different relationship types generate relationship type embeddings, and at the same time, the attributes of the edge such as timestamp, duration, and communication frequency are normalized to generate edge attribute embeddings. Finally, the two are spliced ​​together to form the final feature representation of the edge, and a feature matrix containing relationship types and time attributes is constructed.

[0044] S3.2: Dynamic subgraph generation: Based on the temporal attributes of nodes and edges in the knowledge graph, a time window is used to filter out neighboring nodes related to the current node to ensure temporal consistency. Starting from the current node, a random walk algorithm is then used to generate a multi-hop dependency subgraph, prioritizing temporally close nodes to reflect the temporal characteristics of the attack chain. Finally, based on the sampling results, a dynamic subgraph is generated containing the current node and its multi-hop neighbors. The local structure and temporal characteristics of the subgraph are encoded, and a time-aware graph convolutional network is used to extract the local structural features and temporal information of the nodes. The extracted local structural features of the nodes and their temporal behavior patterns are used as input to the subsequent graph convolutional attention network.

[0045] S3.3: Application of Graph Convolutional Attention Network; Based on dynamic subgraph generation, the Graph Convolutional Attention Network (GCAN) is used to further model the complex interactive relationships between nodes and capture the temporal characteristics in the APT attack chain. The core of GCAN lies in the design of multi-head attention mechanism and temporal enhanced attention. The multi-head attention mechanism calculates the importance scores of neighboring nodes relative to the current node and assigns a weighted sum to each node as a new feature representation, allowing the model to simultaneously learn the relationship between nodes from multiple perspectives and improve the ability to capture fine-grained patterns. Temporal enhanced attention introduces time difference embedding, that is, the time span of the relationship between nodes, to adjust the attention score, so that the model pays more attention to those relationships with significant time interval changes.

[0046] S3.4: Mask prediction task: For each dynamically generated subgraph, a node or relationship is randomly selected for masking. The model is then trained to predict the masked node or relationship based on the information from the remaining nodes. The predictions are optimized using a cross-entropy loss function, and an optimizer is used to adjust model parameters. A learning rate scheduling mechanism is also used to improve training convergence. Furthermore, a supervised learning task is constructed based on masking of some nodes and edges, enabling the model to learn high-order relationships along paths of arbitrary length between nodes, thereby enabling the completion of missing attack steps and the ability to infer unknown attack stages.

[0047] S4: Based on the learned node representations and relationship features, the model can reconstruct and infer attack chains. Based on the known entity nodes and the relationships between them, a series of steps from the attack source to the final target are generated. The possible attack paths are calculated using the similarity of node representations to form a preliminary attack chain:

[0048] ;

[0049] Among them, {v1, v2…v n} represents the entity nodes in the attack chain, such as attackers, tools, IP addresses or other indicators; {r1, r2…} represents the relationship connecting these entities, including communication associations, attack paths or dependencies, etc.

[0050] Valid paths are screened based on timing constraints, and high-confidence relationship prediction results are used to fill in missing nodes or relationships in the attack chain to achieve attack chain prediction and reconstruction.

[0051] In this embodiment, the present application introduces a large language model to perform advanced analysis of multi-source heterogeneous attack clues, combines the time-enhanced knowledge graph representation with the deep learning capabilities of the graph convolutional attention network, and promotes the efficient completion and dynamic reconstruction of the attack chain. It solves the problem that the existing technology has obvious limitations in attack chain completion and inference due to problems such as data sparsity, relationship complexity and time series characteristics, and the traditional method lacks the deep learning ability of implicit relationships in the attack chain, resulting in insufficient inference ability for unknown attack behaviors.

Claims

1. A method for reconstructing APT attack chains based on knowledge graph and graph neural network, characterized in that: The following steps are involved: S1: APT-related data collection and analysis: Collect multi-source heterogeneous data related to APTs, including alarm logs, threat intelligence reports, and IOCs, and extract key data including entity information, time-series event processes, and relationships between entities. Based on this key data, the complete structure of each APT attack chain is clarified. Specifically, for structured data and unstructured data in multi-source heterogeneous data, we use a method of parsing fields and relationships based on preset rules and a method of automatic parsing using a large language model to extract key information including entity information, temporal event processes, and relationships between entities. We then perform deduplication, normalization, and semantic unification on the extracted entities and relationships, remove duplicate entities and relationships, and classify and annotate entities and relationships in combination with the threat intelligence standard MITRE ATT&CK to generate basic data with unified standards. The complete structure of each APT attack chain is clarified in the following steps: First, a time series analysis is performed based on the temporal event process, events are sorted by timestamps, and the starting point, stage, and end point of each event are identified. Entities and relationships in the events are then associated, and independent APT attack chains are divided. Then, each APT attack chain is annotated in stages according to the threat intelligence standard MITRE ATT&CK, dividing it into various stages. At the same time, the entities and relationships involved in each stage are annotated in detail, and the time series and stage-by-stage annotation results of the APT attack chain for each attack are output. S2: Construction of the APT attack chain knowledge graph: Through the APT attack chain, we build an APT attack chain knowledge graph with time series characteristics. Through a fine-grained time node splitting strategy, we model the behavior of each entity in the knowledge graph in different time periods separately to capture the temporal evolution characteristics. At the same time, we introduce multi-hop relationships on the basis of the knowledge graph to generate high-order dependency subgraphs, improving the knowledge graph's ability to describe complex APT attack chains. S3: Graph Convolutional Attention Network Model Training: Using the graph convolutional attention network model, we conduct deep learning on the knowledge graph of the APT attack chain, generating high-dimensional vector representations of nodes and edges to capture the dependencies in the APT attack chain. Then, we use dynamic subgraph generation and context encoding techniques to further model the complex interactions between nodes and capture the timing characteristics of the APT attack chain. Finally, we design an APT attack chain learning task based on temporal masks, enabling the model to learn and predict APT attack chains in the node or relationship mask state. S4: APT attack chain reconstruction and dynamic inference; The model that completes the learning task can dynamically reconstruct the APT attack chain, connect all known entities and relationships, and build a complete attack sequence. For the missing parts of the APT attack chain, it uses high-confidence relationship predictions to complete them, and uses time series sorting modeling to ensure that the attack behaviors are arranged in the order in which they actually occurred, thereby accurately inferring the attacker's next move.

2. The APT attack chain reconstruction method based on knowledge graph and graph neural network according to claim 1 is characterized in that: Specifically, S2 converts entity types and their attributes into nodes in the knowledge graph based on the data of the APT attack chain. According to the results of communication analysis and tool method analysis, the relationship between entities is defined as the edge connecting the nodes, and time attributes are embedded in the nodes and edges to support temporal reasoning. At the same time, through the time-grained node splitting strategy, the behavior of the same entity in different time periods is modeled separately to capture the time evolution characteristics. Multi-hop relationships including "tool-target-attack organization" are introduced to build a high-order dependency subgraph, thereby improving the knowledge graph's ability to describe complex APT chains.

3. The APT attack chain reconstruction method based on knowledge graph and graph neural network according to claim 2 is characterized in that: In S3, the calculation method for the high-dimensional vector representation of a node is as follows: For the node to be processed, a subgraph gc containing the node and its multi-hop neighbors is generated as the context, and the graph embedding method is used to capture the global topological information of the node. The network structure characteristics of the node are captured through the global topological information, and each node is initialized into a low-dimensional vector form. , encode the attribute features of the node including IP address, geographic location, and threat intelligence label, and use the embedding lookup table to generate a vector representation as For nodes with text descriptions, a large language model is used to generate high-dimensional semantic vectors Then, through the linear transformation dimensionality reduction and splicing method, the high-dimensional vector of the node is finally represented as: ； in, Represents a vector concatenation operation.

4. The APT attack chain reconstruction method based on knowledge graph and graph neural network according to claim 3 is characterized in that: In S3, the high-dimensional vector representation of relationships is to represent the relationships between nodes as a feature matrix containing the relationship type and time attributes. Specifically, the following steps are included: Relationship type embedding: First, according to the relationship type, the relationship type embedding is expressed as , The generation methods include random initialization, using TransE, and DistMult pre-trained knowledge graph models to generate; Edge attribute embedding: In addition to the relationship type, each edge also contains additional attribute information of embedded time and intensity. The additional edge attribute embedding is expressed as ; Construction of relationship feature matrix; for edge feature representation r ij Embedded by relationship type and edge attribute embedding Stitched together: ； The relational feature matrix R of the entire knowledge graph can be expressed as: ； Where E is the edge set of the graph.

5. The APT attack chain reconstruction method based on knowledge graph and graph neural network according to claim 4 is characterized in that: In S3, the dynamic subgraph generation and context encoding mechanism is as follows: Dynamic subgraph generation: Generate dynamic subgraphs with multi-hop dependencies by performing random walks based on node and edge timestamps; Context encoding mechanism: After the dynamic subgraph is generated, the local structure and timing characteristics in the dynamic subgraph are contextually encoded, and the local structural features and timing information of the nodes are extracted using a time-aware graph convolutional network, and the local structural features of the nodes and their behavior patterns that change over time are extracted.

6. The APT attack chain reconstruction method based on knowledge graph and graph neural network according to claim 5 is characterized in that: The APT attack chain learning task based on temporal masking is specifically expressed as follows: for each subgraph gc, a node or relationship is randomly selected for masking operation, and then the model is trained to predict the masked nodes or relationships based on the information of the remaining nodes. Based on the masking of some nodes and edges, a supervised learning task is constructed, and the prediction results of masked nodes and edges are optimized using the cross-entropy loss function. The optimizer is used to adjust the model parameters, and the learning rate scheduling mechanism is combined to improve the training convergence speed.

Images