Multi-source combined collaborative attack detection and traceability method based on behavior abnormality

Abstract

The invention discloses a multi-source combined collaborative attack detection and traceability method based on behavior abnormity. The method comprises the following steps: S1, acquiring an abnormal score and an abnormal node; s2, evaluating a threat score; s3, determining whether the abnormal node is a high-risk node or not according to the threat score, and obtaining a related path threat; s4, according to the path threat value or a predefined attack behavior template sequence, determining whether the attack behavior is an attack behavior, and obtaining an initial attack behavior graph and an initial modularity; s5, performing community division, and calculating a first modularity and a second modularity; s6, moving the high-risk node according to the first modularity and the second modularity to obtain an updated attack behavior graph and an updated modularity; s7, obtaining a target attack behavior graph according to the update modularity and the initial modularity, so as to trace the source of the attack behavior; otherwise, returning to S5. According to the method, detection of attack behaviors and multi-dimensional evaluation of node threats are realized, and the constructed attack behavior graph suffers less interference.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a multi-source combined collaborative attack detection and tracing method based on behavioral anomalies. Background Art

[0002] In the field of network security, with the expansion of system scale and the evolution of attack methods, attack behaviors have shown characteristics such as complexity, dynamism and multi-stage coordination. In order to identify and respond to potential threats, attack detection and attack tracing technologies have become key supporting means.

[0003] In terms of attack detection, the current mainstream technologies include detection methods based on rule matching, anomaly detection methods based on machine learning, and behavior analysis methods based on graph structure modeling. The rule matching method relies on predefined attack features and can quickly identify typical known attack patterns. The machine learning method learns and classifies system behaviors through model training and can identify abnormal behaviors with statistical differences. When dealing with complex scenarios with dynamic evolution, some methods introduce time series analysis or feature fusion mechanisms to enhance the model's adaptability to the changing process of attack behaviors. The detection method based on graph structure constructs a behavior graph to characterize and analyze the structural relationships and interaction paths between system entities. It is suitable for modeling attack features such as multi-entity collaboration and chain propagation, and has strong structural expression capabilities.

[0004] In terms of attack tracing, existing technologies mainly include attack path restoration based on graph structure, event tracing methods based on log analysis, and causal tracing methods based on dependency relationships. Among them, the graph structure method represents the causal relationship between attack behaviors by constructing an attack behavior graph, which is suitable for path-level attack chain restoration and behavior association mining. The log analysis method extracts and sorts the abnormal behaviors recorded in the system operation log to achieve the reorganization and tracking of attack events. The dependency tracing method uses the dependency relationships such as calling, transferring, and sharing between components or tasks in the system to reconstruct the propagation path of the attack process within the system, thereby discovering the source and key nodes of the attack.

[0005] Multi-source collaborative combined attack is a type of complex attack behavior implemented in stages through the cooperation of multiple attack source points in time and space. Such attacks usually use an asynchronous execution method, and multiple attack modules are used to initiate a linkage penetration from different levels and multiple key nodes of the system respectively, aiming to avoid traditional detection means and cause system-level damage or control. Compared with the traditional attack mode, the attack path of multi-source collaborative combined attack is often segmented into multiple low-frequency behavior segments, distributed in different time periods and system modules, with high concealment. Moreover, there is a dynamic evolution relationship between attack behaviors, and the propagation path shows phased jumps and role conversions, making it difficult to conduct a complete modeling and identification through a static graph or a single data source. In addition, its attack intention is usually embedded in the normal business process in a chained interaction manner, with strong behavior camouflage and cross-domain linkage.

[0006] However, the existing detection and tracing technologies have significant shortcomings in dealing with such attacks, which are manifested as follows: First, the existing detection strategies are difficult to perceive the attack path linkage and behavior correlation across modules and stages, affecting the complete identification and dynamic response of complex attack chains; Second, the attack behavior graph structure has a high redundancy degree and complex path dependencies, lacking effective structure compression and attribution aggregation mechanisms, resulting in large tracing calculation overhead, poor real-time performance, and weak interpretability. Summary of the Invention

[0007] In order to solve the above problems existing in the prior art, the present invention provides a method for detecting and tracing multi-source combined collaborative attacks based on behavior anomalies.

[0008] The technical problems to be solved by the present invention are realized through the following technical solutions:

[0009] In a first aspect, the present invention provides a method for detecting and tracing multi-source combined collaborative attacks based on behavior anomalies, the method comprising:

[0010] S1. Obtain the anomaly score of the detected abnormal behavior and the corresponding abnormal node; wherein, the abnormal behavior includes abnormal state graphs at multiple different times;

[0011] S2. Evaluate the threat score of the abnormal node according to the anomaly score;

[0012] S3. When the threat score of the abnormal node is higher than the warning threshold, determine the abnormal node as a high-risk node, and obtain the path threat of the relevant path of the high-risk node;

[0013] S4. When the threat value of the path threat is higher than the threat threshold, or when the similarity score between the feature sequences of each node or edge in the relevant paths of the high-risk nodes and the predefined attack behavior template sequence is greater than the similarity threshold, determine that the path threat is an attack behavior, and obtain the initial attack behavior graph and the initial modularity of the initial attack behavior graph based on the path threat and the relevant high-risk nodes;

[0014] S5. Perform community division on the attack behavior graph, and calculate the first modularity of each high-risk node in the current community where it is located and the second modularity of each high-risk node in the attack behavior graph in the community where each neighbor node is located; wherein, the attack behavior graph is obtained based on the initial attack behavior graph;

[0015] S6. Move each high-risk node in the attack behavior graph according to the first modularity and the second modularity, and merge the high-risk nodes in the same community after moving into super nodes to obtain the updated attack behavior graph and the updated modularity of the updated attack behavior graph;

[0016] S7. When the difference between the updated modularity and the initial modularity is less than the difference threshold, obtain the target attack behavior graph for tracing the attack behavior; otherwise, return to S5.

[0017] Optionally, before the S1, the method further includes:

[0018] Construct a system state graph;

[0019] Generate a prediction vector for the newly generated edge in the system state graph according to the graph attention embedding model;

[0020] Update the corresponding source node and target node according to the newly generated edge through a gated recurrent unit to obtain the updated source node and the updated target node;

[0021] Construct a decoder according to the prediction vector, the updated source node and the updated target node; the decoder is used to predict the relationship vector between the updated source node and the updated target node;

[0022] Train the decoder to obtain the trained decoder;

[0023] Obtain the predicted relationship vectors of each source node and target node in the system state graph according to the trained decoder;

[0024] Obtain the value of cross entropy according to the predicted relationship vector and the true label; wherein, the true label represents the true relationship type between each source node and target node in the system state graph;

[0025] When the value of the cross-entropy is greater than or equal to the reconstruction threshold, it is determined that the predicted relationship vector is an abnormal behavior;

[0026] When the value of the cross-entropy is less than the reconstruction threshold, it is determined that the predicted relationship vector is a normal behavior.

[0027] Optionally, the threat score is calculated according to the following formula:

[0028] T(v1) = [event_probability / (1 + γ·duration)] × (1 + log(out_degree + 1));

[0029] where T(v1) represents the threat score of the abnormal node v1, event_probability represents the occurrence frequency of the abnormal node v1, γ represents the penalty factor, duration represents the abnormal duration of the abnormal node v1, and out_degree represents the importance of the abnormal node v1.

[0030] Optionally, the threat value of the path threat is calculated according to the following formula:

[0031] Ψ = ∏(node_threat × distance_decay);

[0032] where Ψ represents the threat value of the path threat, node_threat represents the local threat scores of all nodes in the relevant path of the high-risk node, and distance_decay represents the position weights of all nodes in the relevant path of the high-risk node in the relevant path.

[0033] Optionally, the similarity score is calculated according to the following formula:

[0034] similarity = 1 - DTW(path_features, attack_template) / max_length;

[0035] where similarity represents the similarity score, path_features represents the feature sequences of each node or edge in the relevant path of the high-risk node, max_length attack_template represents the predefined attack behavior template sequence, DTW(path_features, attack_template) represents the minimum matching distance between the path feature sequence and the attack template calculated according to the dynamic time warping algorithm, and represents the sequence length for normalization processing.

[0036] Optionally, before S5, the method further includes:

[0037] When the number of events of a high-risk node in the initial attack behavior graph within a preset time window exceeds a quantity threshold, marking the high-risk node as a hot process node;

[0038] Extracting all nodes directly interacting with the hot process node in the initial attack behavior graph and corresponding relevant paths to obtain the attack behavior graph.

[0039] Optionally, before S5, the method further includes:

[0040] Merging parallel edges of the same operation type between each high-risk node in the initial attack behavior graph into a single edge and retaining relevant data information to obtain the attack behavior graph.

[0041] Optionally, the moving of each high-risk node in the attack behavior graph according to the first modularity and the second modularity includes:

[0042] When the first modularity of the high-risk node is greater than the second modularity, retaining the high-risk node in the current community where it is located;

[0043] When the first modularity of the high-risk node is less than or equal to the second modularity, moving the high-risk node to the community where the corresponding neighbor node is located.

[0044] The technical solutions provided by the embodiments of the present invention may include the following beneficial effects:

[0045] In the above technical solution, the present invention introduces a gated recurrent unit to dynamically update nodes, establishes a calculation mechanism for the anomaly score of the time-series state graph, realizes real-time monitoring and dynamic evolution analysis of the system's abnormal state, and realizes real-time monitoring and dynamic evolution analysis of attack behaviors; based on multi-dimensional anomaly features, combined with a dynamic anomaly scoring network and threat path extension technology, realizes multi-dimensional evaluation of node threat levels, and solves the problem that the existing technology usually analyzes single attack behaviors in isolation when detecting multi-source collaborative combined attacks and ignores the non-linear correlation characteristics between attack modules. By introducing a hot process mechanism and redundant event aggregation, the key attack paths are retained, solving the challenge that existing traceability technologies often face explosive growth of computing resources due to complex path dependence relationships when dealing with large-scale attack behavior graphs, significantly simplifying the topological structure of the attack behavior graph and reducing the interference of irrelevant nodes.

[0046] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Description of the Drawings

[0047] Figure 1It is a flowchart of a multi-source combined collaborative attack detection and tracing method based on behavior anomalies provided by an embodiment of the present invention. Detailed implementation manners

[0048] To facilitate the understanding of the solution of the present invention, the relevant situations of the prior art and the inventive concept of the present invention will be briefly described first.

[0049] Although various existing attack detection and tracing methods have introduced technical means such as system tracing graphs and graph neural networks, which have improved the ability to identify abnormal behaviors and trace attack paths to a certain extent, there are still the following key deficiencies when dealing with complex advanced threats such as multi-source combined collaborative attacks:

[0050] (1) The single-dimensional discretized behavior monitoring mode restricts the upper limit of the complex attack detection and tracing ability. Currently, most system behavior detection methods use static graphs or fixed-time windows to construct behavior models, and it is difficult for the models to cover the continuous changes of node states and structural attributes in the time dimension. System behaviors have significant stages and temporal correlations during operation. Attack behaviors are often accompanied by multi-stage evolution, role switching, and event chain triggering. The time dependence and chain propagation characteristics of abnormal behaviors are difficult to be accurately captured in the current modeling framework. This modeling limitation is manifested as weak ability to identify key nodes and key behavior segments and delayed response to abnormal states in the detection stage; in the tracing stage, it is manifested as limited ability to construct attack path linkages. Especially in the scenario of multi-module collaborative attacks, the chain behavior structure is interspersed in the normal process, and there are implicit information flows and causal dependencies between paths. Existing methods are difficult to perform path-level reasoning and dynamic propagation chain identification based on the global context, affecting the detection coverage rate and complete expression ability of complex attack behaviors.

[0051] (2) The rarity of anomalies and the scale redundancy of behavior graphs restrict the lower limit of multi-source attack tracing ability. In the multi-source attack scenario, due to the sparse distribution of abnormal events and the interspersion of attack behaviors among a large number of normal behaviors, the generated attack behavior graphs often contain a large number of non-critical nodes and low-correlation edges. The structure of the attack behavior graph shows high redundancy and high complexity characteristics, lacking a structure compression and clustering mechanism, resulting in increased difficulty in path reconstruction and information screening. High-value behavior units and marginal events are not distinguished in the graph, and problems such as path inflation and node deviation are likely to occur during the attribution analysis process, affecting the positioning accuracy of the attack chain and the accuracy of attribution judgment, and restricting the real-time response and discrimination ability of the system in complex tracing tasks.

[0052] Figure 1 It is a flowchart of a multi-source combined collaborative attack detection and tracing method based on behavior anomalies provided by an embodiment of the present invention. As Figure 1 shown, the method may include the following steps:

[0053] S1. Obtain the anomaly score of the detected abnormal behavior and the corresponding abnormal node; wherein, the abnormal behavior includes abnormal state diagrams at multiple different times.

[0054] It can be understood that the present invention assigns a lower anomaly score to behaviors with a high similarity to known normal system behaviors, while assigning a higher anomaly score to relationships that significantly deviate from known normal system behaviors.

[0055] Optionally, before S1, the method further includes:

[0056] Construct a system state diagram;

[0057] Generate a prediction vector for the newly generated edges in the system state diagram according to the graph attention embedding model;

[0058] Update the corresponding source node and target node according to the newly generated edges through a gated recurrent unit to obtain the updated source node and the updated target node;

[0059] Construct a decoder according to the prediction vector, the updated source node, and the updated target node; the decoder is used to predict the relationship vector between the updated source node and the updated target node;

[0060] Train the decoder to obtain a trained decoder;

[0061] Obtain the predicted relationship vectors of each source node and target node in the system state diagram according to the trained decoder;

[0062] Obtain the value of the cross-entropy according to the predicted relationship vector and the true label; wherein, the true label represents the true relationship type between each source node and target node in the system state diagram;

[0063] When the value of the cross-entropy is greater than or equal to the reconstruction threshold, determine that the predicted relationship vector is an abnormal behavior;

[0064] When the value of the cross-entropy is less than the reconstruction threshold, determine that the predicted relationship vector is a normal behavior.

[0065] In terms of the characterization of node behavior features, the present invention classifies the nodes in the system into three types and defines nine types of relationships, accurately describing the behavior information of nodes in an event. Specifically, each event in the system is defined as a directed relationship. Each event is represented in the form of a quadruple (Sub, Obj, Rel, Attribute), where Sub represents the event subject node, Obj represents the node being operated on, Rel represents the interaction relationship between the subject node and the node being operated on, and Attribute reflects the detailed attributes of the node being operated on. This characterization method not only captures the behavioral semantics of events but also retains fine-grained temporal and spatial association information, helping to comprehensively depict the interaction process between nodes. The specific classification and definition of node types and relationships between nodes in event interactions are shown in Table 1.

[0066] Table 1

[0067]

[0068] Using the quadruple (v src , v des , Nv src , Nv des ) to describe the neighborhood structure features of system nodes. Among them, v src and v des respectively represent the source node and the target node of the relationship; Nv src and Nv des represent the sets of neighborhood relationships of the source node and the target node. The set of neighborhood relationships of the nodes in the present invention is defined as all relationships within one hop of a certain node at a certain moment (i.e., the set of nodes and edges directly connected to a certain node). This structure completely includes the attributes of the node itself and the relationships of adjacent nodes. In this way, the local structural characteristics of the node are effectively combined with its own attributes, and the context relationship of the node in the system state graph is completely depicted.

[0069] Using the graph attention embedding model of the graph neural network to encode the local graph structure at time t - 1, generating a prediction vector z for the new edge e t (i.e., the relationship between the source node and the target node):

[0070] z = GNN(s t , e t );

[0071] When a new node is introduced into the graph, due to the lack of historical information, its state is initialized as a zero feature vector. When a new relationship appears in the graph, the neighborhood feature vectors of the source node and the target node of the relationship are also updated accordingly. Therefore, the graph structure state s t not only includes the relationship e tThe eigenvectors of the source node and the target node, and also include the state information of the sampled nodes in its neighborhood nodes.

[0072] The prediction vector is concatenated by the eigenvectors of the source node and the target node, and the encoding of its neighborhood event types. In this way, the structural information and dynamic changes of the time series graph can be effectively embedded into the edge vector, providing a complete feature representation for subsequent time series graph analysis tasks.

[0073] The present invention uses a graph attention embedding layer to learn the complete features of nodes. This layer combines a message passing and a time encoding mechanism to enhance the ability to model time series information. The graph attention embedding layer consists of two Transformer convolutional layers, and each convolutional layer uses a multi-head self-attention mechanism to process the relationship features between nodes. The feature of each relationship is composed of a message feature and a time feature. This mechanism further strengthens the representation learning of the time series state graph structure, and provides a more accurate representation of the system state graph through the joint encoding of relative time and relationship message features.

[0074] To achieve system state update, the present invention updates the states of the source node and the target node through a gated recurrent unit. Realize the real-time update of node states. Specifically, the node state update formula is as follows:

[0075] s t (v n ) = GRU( s t-(v n ), e t );

[0076] Where, s t (v n ) represents the node state of node v n at time t, s t- (v n ) represents the node state of node v n at time t- before update, and e t represents the newly emerged relationship at time t, v n represents the source node or the target node. Specifically, the information of the new relationship e t is propagated to the latest state s n (v t ) through the state update process. Therefore, for the new relationships that appear after time t, as long as these relationships are within the neighborhood range of e n , then the eigenvector of e t contains the information of these new relationships. t

[0077] To avoid the relationship e t at the current time tLeaking the real information to the prediction model requires ensuring that the input to the decoder does not contain any information at time t, so that the prediction result of the model only depends on the state at time t-. To achieve this goal, the present invention adopts a mechanism that simultaneously updates the nodes and obtains the prediction vectors. When the calculation speeds are not synchronized, the calculation results of the update and prediction are directly passed to the cross-entropy loss function, ensuring that the final calculation is only performed when the calculation results of both modules are complete. This design can enhance the effectiveness of the model in extracting relationship features.

[0078] In the decoding stage, a multi-layer perceptron is used to learn the relationship type predicting the connection between the source node and the target node from the prediction vector z generated by the encoder. Specifically, the decoder outputs a predicted relationship vector P(e t ), and this predicted relationship vector represents the probability distribution of the relationship e t belonging to nine possible relationship types. The probability of each edge type reflects the matching degree of the relationship e t with the known normal behavior pattern, and the present invention selects the behavior pattern with the highest probability as the prediction result.

[0079] First, the feature vectors of the source node and the target node are respectively transformed through two independent linear layers:

[0080] h n = Linear(z n );

[0081] where z n represents the feature vector of the source node or the target node. Then, the two transformed node representation vectors are concatenated and further processed through a series of linear layers, activation functions, and Dropout operations:

[0082] h = concat(h src , h dst );

[0083] where h src represents the feature vector of the source node transformed by the linear layer, and h dst represents the feature vector of the target node transformed by the linear layer. The dimension of the input features is expanded through linear transformation, then the nonlinear characteristics are introduced through the activation function, and then the Dropout operation is applied to prevent overfitting. The output of each layer will gradually reduce the dimension, and the finally output vector P(e t ) represents the probability distribution of the nine possible relationship types of the relationship e t .

[0084] During the training phase, this method uses optimization algorithms such as gradient descent to adjust the model parameters, making the prediction results gradually approach the true distribution, thereby effectively reducing the reconstruction error between the minimized prediction probability and the actual edge type, and using the cross-entropy loss function to optimize the detection model. The training dataset only selects benign data, and reducing the reconstruction error is beneficial to improving the recognition accuracy of the model for benign behaviors. The cross-entropy loss function optimizes the decoder parameters by measuring the difference between the predicted probability distribution and the true label, minimizing the prediction error. Specifically, the calculation formula of the cross-entropy loss function is as follows:

[0085] RE = CrossEntropy(P(e t ), L(e t ));

[0086] Among them, L(et) represents the actual edge type label, usually represented in the form of a one-hot vector, with the corresponding true relationship type position value being 1 and the rest being 0, ensuring that the decoder can accurately predict the relationship type of relationship e t and CrossEntropy represents the cross-entropy function.

[0087] During the testing phase, the decoder calculates the predicted relationship vector based on information such as the structure and time of the edge. If the calculated cross-entropy is less than the reconstruction threshold, it is determined to be a normal behavior; otherwise, it is determined to be an abnormal behavior.

[0088] The calculation of the anomaly score for abnormal behaviors also depends on the reconstruction error. The anomaly score at time t is determined by the product of the anomaly scores greater than the reconstruction error within the graph. If starting from time t, the anomaly score of a certain temporal state graph is always greater than the anomaly threshold, the temporal state graph starting from time t will be added to the anomaly queue until the anomaly score of the temporal state graph is less than the anomaly threshold, the state disappears, or it no longer changes.

[0089] S2. Evaluate the threat score of the abnormal node according to the anomaly score.

[0090] Optionally, based on the anomaly score, combined with the anomaly duration, occurrence probability, and node importance, evaluate the threat level of the node. Considering comprehensively the anomaly degree of the node's own behavior characteristics and the influence of its adjacent nodes, through multi-dimensional feature fusion calculation, a comprehensive threat assessment model is constructed.

[0091] The threat score is calculated according to the following formula:

[0092] T(v1) = [event_probability / (1 + γ·duration)] × (1 + log(out_degree + 1));

[0093] Among them, T(v1) represents the threat score of the abnormal node v1, event_probability represents the occurrence frequency of the abnormal node v1, γ represents the penalty factor, duration represents the abnormal duration of the abnormal node v1, and out_degree represents the importance of the abnormal node v1.

[0094] S3. When the threat score of the abnormal node is higher than the warning threshold, determine the abnormal node as a high-risk node, and obtain the path threat of the relevant path of the high-risk node.

[0095] Optionally, the threat value of the path threat is calculated according to the following formula:

[0096] Ψ = ∏(node_threat × distance_decay);

[0097] Among them, Ψ represents the threat value of the path threat, node_threat represents the local threat scores of all nodes in the relevant path of the high-risk node, distance_decay represents the position weights of all nodes in the relevant path of the high-risk node in the relevant path, and the threat score weights are dynamically adjusted in combination with real-time behavior data to ensure the adaptability of the detection algorithm to different attack modes.

[0098] S4. When the threat value of the path threat is higher than the threat threshold, or when the similarity score between the feature sequences of each node or edge in the relevant path of the high-risk node and the predefined attack behavior template sequence is greater than the similarity threshold, determine the path threat as an attack behavior, and obtain the initial attack behavior graph and the initial modularity of the initial attack behavior graph according to the path threat and the relevant high-risk node.

[0099] Optionally, the similarity score is calculated according to the following formula:

[0100] similarity = 1 - DTW(path_features, attack_template) / max_length;

[0101] Among them, represents the similarity score, path_features represents the feature sequences of each node or edge in the relevant path of the high-risk node, attack_template represents the predefined attack behavior template sequence, DTW(path_features, attack_template) represents the minimum matching distance between the path feature sequence and the attack template calculated according to the dynamic time warping algorithm, and similarity max_length represents the sequence length for normalization processing.

[0102] Optionally, before S5, the method further includes:

[0103] When the number of events of high-risk nodes in the initial attack behavior graph exceeds the quantity threshold within a preset time window, mark the high-risk nodes as hot process nodes;

[0104] Extract all nodes directly interacting with the hot process nodes in the initial attack behavior graph and the corresponding relevant paths to obtain the attack behavior graph.

[0105] It can be understood that the present invention solves the problem that the attack behavior graph contains a large amount of redundant information through the hot process mechanism. The core function of this mechanism is to effectively reduce the interference of irrelevant information, thereby avoiding the problem of explosion of computational complexity caused by excessive dependence relationships during the traceability analysis process. A hot process is defined as a process node that has high-frequency interactions with a large number of system objects (such as files, network connections, registry, etc.) within a short period of time.

[0106] Optionally, before S5, the method further includes:

[0107] Merge the parallel edges of the same operation type between each high-risk node in the initial attack behavior graph into a single edge, and retain the relevant data information to obtain the attack behavior graph.

[0108] It can be understood that in the attack behavior graph, there are usually a large number of parallel edges between process nodes and file or network nodes, and these edges represent read / write operations repeatedly triggered within a short period of time. The present invention proposes a graph reduction algorithm based on redundant event aggregation to merge parallel edges of the same operation type into a single edge while retaining the relevant data information (such as the number of operations, timestamp, etc.).

[0109] S5. Perform community partitioning on the attack behavior graph, and calculate the first modularity of each high-risk node in the current community where it is located in the attack behavior graph and the second modularity of each high-risk node in the attack behavior graph in the community where each neighbor node is located; wherein, the attack behavior graph is obtained according to the initial attack behavior graph.

[0110] It can be understood that each node in the attack behavior graph is initialized as an independent community to form an initial community partitioning structure; at this time, the modularity is in an initial state, and then for each high-risk node, calculate the first modularity in the current community where it is located and the second modularity after moving it to the community where its neighbor node is located one by one.

[0111] S6. Move each high-risk node in the attack behavior graph according to the first modularity and the second modularity, and merge the high-risk nodes in the same community after moving into a super node to obtain the updated attack behavior graph and the updated modularity of the updated attack behavior graph.

[0112] Optionally, moving each high-risk node in the attack behavior graph according to the first modularity and the second modularity includes:

[0113] When the first modularity of a high-risk node is greater than the second modularity, the high-risk node is retained in the current community where it is located;

[0114] When the first modularity of a high-risk node is less than or equal to the second modularity, the high-risk node is moved to the community where its corresponding neighbor node is located.

[0115] It can be understood that by comparing the modularities of high-risk nodes in different communities, a community that can increase the modularity is selected as the target community for movement, and the high-risk node is moved to this target community. After the local movement of high-risk nodes is completed, the high-risk nodes belonging to the same community are merged into a super node, and the graph structure is updated. After merging, the original internal edges of this target community are not retained one by one, but are inherited as a self-loop edge as a whole, and its weight is equal to the sum of the weights of all internal edges, which is used to represent the internal connectivity of this super node itself. At the same time, the connecting edges between the target community and other communities are also aggregated into ordinary edges between super nodes, and the weight is equal to the sum of all cross-community edges.

[0116] S7. When the difference between the updated modularity and the initial modularity is less than the difference threshold, a target attack behavior graph is obtained to trace the attack behavior; otherwise, return to S5.

[0117] It can be understood that the local movement of high-risk nodes and the merging steps are repeated to continuously optimize the modularity. When the community membership of high-risk nodes no longer changes, or the overall modularity reaches a local optimum, or the change in modularity is less than the threshold, or the maximum number of iterations is reached, the algorithm terminates.

[0118] The present invention introduces a gated recurrent unit to dynamically update nodes, establishes a calculation mechanism for the anomaly score of the time-series state graph, realizes real-time monitoring and dynamic evolution analysis of the system's abnormal state, and realizes real-time monitoring and dynamic evolution analysis of attack behaviors; based on multi-dimensional anomaly features, combined with a dynamic anomaly scoring network and threat path extension technology, it realizes multi-dimensional evaluation of node threat levels, and solves the problem that the existing technology usually analyzes single attack behaviors in isolation when detecting multi-source collaborative combined attacks, ignoring the non-linear correlation characteristics between attack modules. By introducing a hot process mechanism and redundant event aggregation, the retention of the attack critical path is realized, and the problem that the existing traceability technology often faces the challenge of explosive growth of computing resources due to the complex path dependence relationship when dealing with large-scale attack behavior graphs is solved, significantly simplifying the topological structure of the attack behavior graph and reducing the interference of irrelevant nodes.

[0119] In the description of this specification, the descriptions with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples", etc., mean that the specific features or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features or characteristics described can be combined in a suitable manner in any one or more embodiments or examples. In addition, those skilled in the art can combine and combine the different embodiments or examples described in this specification.

[0120] Although the present invention has been described herein in connection with various embodiments, however, in the process of implementing the claimed invention, those skilled in the art can understand and achieve other variations of the disclosed embodiments by viewing the accompanying drawings and the disclosure. In the description of the present invention, the term "including" does not exclude other components or steps, the word "a" or "an" does not exclude a plurality of cases, and the meaning of "plurality" is two or more, unless otherwise specifically defined. In addition, certain measures are described in different embodiments, but this does not mean that these measures cannot be combined to produce good results.

[0121] The above content is a further detailed description of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is only limited to these descriptions. For those of ordinary skill in the technical field to which the present invention pertains, without departing from the concept of the present invention, several simple deductions or substitutions can be made, and all should be regarded as belonging to the protection scope of the present invention.

Claims

1. A multi-source combined collaborative attack detection and tracing method based on abnormal behavior, characterized in that The method includes: S1. Obtain the anomaly score of the detected abnormal behavior and the corresponding abnormal node; wherein, the abnormal behavior includes abnormal state graphs at multiple different times; S2. Evaluate the threat score of the abnormal node according to the anomaly score; S3. When the threat score of the abnormal node is higher than the warning threshold, determine the abnormal node as a high-risk node, and obtain the path threat of the relevant path of the high-risk node; S4. When the threat value of the path threat is higher than the threat threshold, or when the similarity score between the feature sequences of each node or edge in the relevant path of the high-risk node and the predefined attack behavior template sequence is greater than the similarity threshold, determine the path threat as an attack behavior, and obtain the initial attack behavior graph and the initial modularity of the initial attack behavior graph according to the path threat and the relevant high-risk node; S5. Perform community division on the attack behavior graph, calculate the first modularity of each high-risk node in the current community where it is located in the attack behavior graph and the second modularity of each high-risk node in the attack behavior graph in the community where each neighbor node is located; wherein, the attack behavior graph is obtained according to the initial attack behavior graph; S6. Move each high-risk node in the attack behavior graph according to the first modularity and the second modularity, and merge the high-risk nodes in the same community after moving into a super node to obtain the updated attack behavior graph and the updated modularity of the updated attack behavior graph; S7. When the difference between the updated modularity and the initial modularity is less than the difference threshold, obtain the target attack behavior graph for tracing the attack behavior; otherwise, return to S5.

2. The multi-source combined collaborative attack detection and tracing method based on abnormal behavior according to claim 1, wherein Before the S1, the method further includes: Construct a system state graph; Generate a prediction vector of the newly generated edge in the system state graph according to the graph attention embedding model; Update the corresponding source node and target node according to the newly generated edge through a gated recurrent unit to obtain the updated source node and the updated target node; Construct a decoder according to the prediction vector, the updated source node and the updated target node; the decoder is used to predict the relationship vector between the updated source node and the updated target node; Train the decoder to obtain the trained decoder; Obtain the predicted relationship vectors of each source node and target node in the system state graph according to the trained decoder; Obtain the value of the cross entropy according to the predicted relationship vector and the true label; wherein, the true label represents the true relationship type between each source node and target node in the system state graph; When the value of the cross entropy is greater than or equal to the reconstruction threshold, determine that the predicted relationship vector is an abnormal behavior; When the value of the cross entropy is less than the reconstruction threshold, determine that the predicted relationship vector is a normal behavior.

3. The multi-source combined collaborative attack detection and tracing method based on abnormal behavior according to claim 1, wherein, The threat score is calculated according to the following formula: T(v1) = [event_probability / (1 + γ·duration)] × (1 + log(out_degree + 1)); Among them, T(v1) represents the threat score of the abnormal node v1, event_probability represents the occurrence frequency of the abnormal node v1, γ represents the penalty factor, duration represents the abnormal duration of the abnormal node v1, and out_degree represents the importance of the abnormal node v1.

4. The multi-source combined collaborative attack detection and traceability method based on abnormal behavior according to claim 1, characterized in that, The threat value of the path threat is calculated according to the following formula: Ψ = ∏(node_threat × distance_decay); Among them, Ψ represents the threat value of the path threat, node_threat represents the local threat scores of all nodes in the relevant path of the high-risk node, and distance_decay represents the position weights of all nodes in the relevant path of the high-risk node in the relevant path.

5. The multi-source combined collaborative attack detection and traceability method based on abnormal behavior according to claim 1, characterized in that The similarity score is calculated according to the following formula: similarity = 1 - DTW(path_features, attack_template) / max_length; Among them, similarity represents the similarity score, path_features represents the feature sequence of each node or edge in the relevant path of the high-risk node, attack_template represents the predefined attack behavior template sequence, DTW(path_features, attack_template) represents the minimum matching distance between the path feature sequence and the attack template calculated according to the dynamic time warping algorithm, and max_length represents the sequence length used for normalization processing.

6. The method for detecting and tracing multi-source combined collaborative attacks based on behavioral anomalies according to claim 1, wherein Before S5, the method further includes: When the number of events of the high-risk node in the initial attack behavior graph within a preset time window exceeds the quantity threshold, mark the high-risk node as a hot process node; Extract all nodes directly interacting with the hot process node in the initial attack behavior graph and the corresponding relevant paths to obtain the attack behavior graph.

7. The multi-source combined collaborative attack detection and traceability method based on abnormal behavior according to claim 1, wherein Before S5, the method further includes: Merge the parallel edges of the same operation type between each high-risk node in the initial attack behavior graph into a single edge and retain the relevant data information to obtain the attack behavior graph.

8. The method for detecting and tracing multi-source combined collaborative attacks based on abnormal behavior according to claim 1, wherein The moving of each high-risk node in the attack behavior graph according to the first modularity and the second modularity includes: When the first modularity of the high-risk node is greater than the second modularity, retain the high-risk node in the current community where it is located; When the first modularity of the high-risk node is less than or equal to the second modularity, move the high-risk node to the community where the corresponding neighbor node is located.

Images