Multi-source combined coordinated attack detection and tracing method based on behavioral anomalies

Abstract

The present invention discloses a multi-source combined collaborative attack detection and tracing method based on behavioral anomalies, comprising the following steps: S1, obtaining anomaly scores and abnormal nodes; S2, assessing threat scores; S3, determining whether the abnormal node is a high-risk node based on the threat score, and obtaining related path threats; S4, determining whether it is an attack behavior based on the path threat value or a predefined attack behavior template sequence, and obtaining an initial attack behavior graph and initial modularity; S5, performing community division and calculating a first modularity and a second modularity; S6, moving high-risk nodes based on the first and second modularities, obtaining an updated attack behavior graph and an updated modularity; S7, obtaining a target attack behavior graph based on the updated modularity and the initial modularity to trace the attack behavior; otherwise, returning to S5. The present invention achieves attack behavior detection and multi-dimensional assessment of node threats, and the constructed attack behavior graph is less susceptible to interference.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and in particular relates to a multi-source combined collaborative attack detection and tracing method based on behavioral anomalies. Background Art

[0002] In the field of cybersecurity, as systems scale and attack methods evolve, attacks are becoming more complex, dynamic, and multi-stage. To identify and respond to potential threats, attack detection and tracing technologies have become key support.

[0003] In terms of attack detection, current mainstream technologies include rule-matching-based detection methods, machine learning-based anomaly detection methods, and behavioral analysis methods based on graph structure modeling. Rule-matching methods rely on predefined attack signatures and can quickly identify typical known attack patterns. Machine learning methods learn and classify system behaviors through model training, identifying statistically significant anomalous behaviors. When dealing with complex, dynamically evolving scenarios, some methods incorporate time series analysis or feature fusion mechanisms to enhance the model's adaptability to changing attack behaviors. Graph-based detection methods construct behavioral graphs to depict and analyze the structural relationships and interaction paths between system entities. These methods are suitable for modeling attack characteristics such as multi-entity collaboration and chain propagation, and possess strong structural expression capabilities.

[0004] In terms of attack tracing, existing technologies primarily include graph-based attack path restoration, log analysis-based event tracing, and dependency-based causal tracing. Graph-based methods construct attack behavior graphs to represent the causal relationships between attack behaviors, making them suitable for path-level attack chain restoration and behavioral correlation mining. Log analysis methods extract and sort abnormal behaviors recorded in system operation logs to reconstruct and track attack events. Dependency tracing methods leverage dependency relationships between components or tasks in the system, such as calls, transfers, and sharing, to reconstruct the propagation path of the attack process within the system, thereby identifying the attack source and key nodes.

[0005] Multi-source coordinated attacks are complex attacks carried out in phases, coordinated across time and space by multiple attack sources. These attacks typically execute asynchronously, leveraging multiple attack modules to launch coordinated penetration attacks from different levels and key nodes of the system, aiming to evade traditional detection and cause system-level damage or control. Compared to traditional attack patterns, the attack paths of multi-source coordinated attacks are often segmented into multiple low-frequency behavior segments, distributed across different time periods and system modules. This makes them highly concealed, and the dynamic evolution of attack behaviors, with propagation paths exhibiting phased transitions and role reversals, makes them difficult to fully model and identify using static graphs or single data sources. Furthermore, their attack intent is often embedded within normal business processes through chained interactions, demonstrating strong behavioral disguise and cross-domain linkage.

[0006] However, existing detection and tracing technologies have significant shortcomings when dealing with such attacks. First, existing detection strategies have difficulty perceiving the linkage and behavioral correlation of attack paths across modules and stages, affecting the complete identification and dynamic response of complex attack chains. Second, the attack behavior graph has high structural redundancy and complex path dependencies, and lacks effective structural compression and attribution aggregation mechanisms, resulting in high tracing computational overhead, poor real-time performance, and weak interpretability. Summary of the Invention

[0007] In order to solve the above problems existing in the prior art, the present invention provides a multi-source combined collaborative attack detection and tracing method based on behavioral anomalies.

[0008] The technical problem to be solved by the present invention is achieved through the following technical solutions:

[0009] In a first aspect, the present invention provides a method for detecting and tracing a multi-source combined collaborative attack based on behavioral anomalies, the method comprising:

[0010] S1. Obtain an abnormal score and corresponding abnormal node of the detected abnormal behavior; wherein the abnormal behavior includes abnormal state diagrams at multiple different moments;

[0011] S2. Evaluate the threat score of the abnormal node according to the abnormal score;

[0012] S3. When the threat score of the abnormal node is higher than the warning threshold, determine the abnormal node as a high-risk node, and obtain the path threat of the relevant path of the high-risk node;

[0013] S4. When the threat value of the path threat is higher than a threat threshold, or when the similarity score between the feature sequence of each node or edge in the relevant path of the high-risk node and a predefined attack behavior template sequence is greater than a similarity threshold, the path threat is determined to be an attack behavior, and an initial attack behavior graph and an initial modularity of the initial attack behavior graph are obtained based on the path threat and the relevant high-risk nodes.

[0014] S5. Divide the attack behavior graph into communities, and calculate the first modularity of each high-risk node in the attack behavior graph in the current community and the second modularity of each high-risk node in the attack behavior graph in the community where each neighboring node is located; wherein the attack behavior graph is obtained based on the initial attack behavior graph;

[0015] S6. Move each high-risk node in the attack behavior graph according to the first modularity and the second modularity, and merge the high-risk nodes in the same community after the movement into a super node, to obtain an updated attack behavior graph and an updated modularity of the updated attack behavior graph;

[0016] S7. When the difference between the updated modularity and the initial modularity is less than the difference threshold, a target attack behavior graph is obtained to trace the attack behavior; otherwise, return to S5.

[0017] Optionally, before S1, the method further includes:

[0018] Build system state diagram;

[0019] generating prediction vectors for newly generated edges in the system state graph according to a graph attention embedding model;

[0020] Update the corresponding source node and target node through the gated recurrent unit according to the newly generated edge to obtain the updated source node and the updated target node;

[0021] Constructing a decoder according to the prediction vector, the updated source node and the updated target node; the decoder is used to predict the relationship vector between the updated source node and the updated target node;

[0022] Training the decoder to obtain the trained decoder;

[0023] Obtaining prediction relationship vectors of each source node and target node in the system state diagram according to the trained decoder;

[0024] Obtain a cross entropy value based on the predicted relationship vector and the true label; wherein the true label represents the true relationship type between each source node and target node in the system state diagram;

[0025] When the value of the cross entropy is greater than or equal to a reconstruction threshold, the predicted relationship vector is determined to be abnormal behavior;

[0026] When the value of the cross entropy is less than the reconstruction threshold, the predicted relationship vector is determined to be normal behavior.

[0027] Optionally, the threat score is calculated according to the following formula:

[0028] T(v1)=[event_probability / (1+γ·duration)]×(1+log(out_degree+1));

[0029] Where T(v1) represents the threat score of the abnormal node v1, event_probability represents the occurrence frequency of the abnormal node v1, γ represents the penalty factor, duration represents the abnormal duration of the abnormal node v1, and out_degree represents the importance of the abnormal node v1.

[0030] Optionally, the threat value of the path threat is calculated according to the following formula:

[0031] Ψ=∏(node_threat×distance_decay);

[0032] Wherein, Ψ represents the threat value of the path threat, node_threat represents the local threat score of all nodes in the relevant path of the high-risk node, and distance_decay represents the position weight of all nodes in the relevant path of the high-risk node.

[0033] Optionally, the similarity score is calculated according to the following formula:

[0034] similarity=1-DTW(path_features,attack_template) / max_length;

[0035] Among them, similarity represents the similarity score, path_features represents the feature sequence of each node or edge in the relevant path of the high-risk node, max_length attack_template represents the predefined attack behavior template sequence, DTW(path_features,attack_template) represents the minimum matching distance between the path feature sequence and the attack template calculated according to the dynamic time warping algorithm, and represents the sequence length used for normalization processing.

[0036] Optionally, before S5, the method further includes:

[0037] When the number of events of a high-risk node in the initial attack behavior graph exceeds a threshold within a preset time window, marking the high-risk node as a hot process node;

[0038] All nodes that directly interact with the hot process node in the initial attack behavior graph and corresponding related paths are extracted to obtain the attack behavior graph.

[0039] Optionally, before S5, the method further includes:

[0040] The parallel edges of the same operation type between the high-risk nodes in the initial attack behavior graph are merged into a single edge, and the relevant data information is retained to obtain the attack behavior graph.

[0041] Optionally, the moving each high-risk node in the attack behavior graph according to the first modularity and the second modularity includes:

[0042] When the first modularity of the high-risk node is greater than the second modularity, retaining the high-risk node in the current community;

[0043] When the first modularity of the high-risk node is less than or equal to the second modularity, the high-risk node is moved to the community where the corresponding neighboring node is located.

[0044] The technical solutions provided by the embodiments of the present invention may have the following beneficial effects:

[0045] In the above technical solution, the present invention introduces a gated loop unit to dynamically update nodes, establishes a time-series state graph anomaly score calculation mechanism, realizes real-time monitoring and dynamic evolution analysis of system anomaly states, and realizes real-time monitoring and dynamic evolution analysis of attack behaviors; based on multi-dimensional anomaly features, combined with dynamic anomaly scoring network and threat path expansion technology, realizes multi-dimensional evaluation of node threat degree, solves the problem that the existing technology for detecting multi-source collaborative combined attacks usually analyzes a single attack behavior in isolation and ignores the nonlinear correlation characteristics between attack modules. By introducing a hot process mechanism and redundant event aggregation, the key attack path is retained, solving the challenge of explosive growth of computing resources faced by existing tracing technology when processing large-scale attack behavior graphs due to complex path dependencies, significantly simplifying the topological structure of the attack behavior graph and reducing the interference of irrelevant nodes.

[0046] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1This is a flowchart of a multi-source combined collaborative attack detection and tracing method based on behavioral anomalies provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0048] In order to facilitate the understanding of the present invention, the related art and the inventive concept of the present invention are briefly described first.

[0049] Although various existing attack detection and tracing methods have introduced technical means such as system traceability graphs and graph neural networks, which have improved the ability to identify abnormal behavior and trace attack paths to a certain extent, they still have the following key shortcomings when dealing with complex and advanced threats such as multi-source combined coordinated attacks:

[0050] (1) The single-dimensional discretized behavior monitoring model restricts the upper limit of complex attack detection and tracing capabilities. Current system behavior detection methods mostly use static graphs or fixed time windows to construct behavior models. The models are difficult to cover the continuous changes of node states and structural attributes in the time dimension. System behavior has significant stage and time sequence correlations during operation. Attack behavior is often accompanied by multi-stage evolution, role switching and event chain triggering. The time dependence and chain propagation characteristics of abnormal behavior are difficult to be accurately captured in the current modeling framework. This modeling limitation manifests itself in the detection stage as weak recognition capabilities of key nodes and key behavior fragments, and delayed response to abnormal states; in the tracing stage, it manifests itself as limited attack path linkage construction capabilities. Especially in multi-module collaborative attack scenarios, chain behavior structures are interspersed in normal processes, and there are implicit information flows and causal dependencies between paths. Existing methods find it difficult to achieve path-level reasoning and dynamic propagation chain identification based on global context, affecting the detection coverage and complete expression capabilities of complex attack behaviors.

[0051] (2) The scarcity of anomalies and the scale redundancy of behavior graphs restrict the lower limit of multi-source attack tracing capabilities. In multi-source attack scenarios, due to the sparse distribution of abnormal events and the interspersed attack behaviors among large-scale normal behaviors, the attack behavior graphs generated by the system often contain a large number of non-critical nodes and low-correlation edges. The attack behavior graph structure exhibits high redundancy and high complexity, and lacks structural compression and clustering mechanisms, which increases the difficulty of path reconstruction and information screening. The graph does not distinguish between high-value behavior units and marginal events. During the attribution analysis process, problems such as path expansion and node offset are prone to occur, affecting the accuracy of attack chain positioning and attribution judgment, and restricting the system's real-time response and judgment capabilities in complex tracing tasks.

[0052] Figure 1 This is a flowchart of a multi-source combined collaborative attack detection and tracing method based on behavioral anomalies provided by an embodiment of the present invention. Figure 1 As shown, the method may include the following steps:

[0053] S1. Obtain anomaly scores and corresponding abnormal nodes of detected abnormal behaviors; wherein the abnormal behaviors include abnormal state diagrams at multiple different moments.

[0054] It is understandable that the present invention assigns lower anomaly scores to behaviors that are highly similar to known normal system behaviors, and assigns higher anomaly scores to relationships that significantly deviate from known normal system behaviors.

[0055] Optionally, before S1, the method further includes:

[0056] Build system state diagram;

[0057] Generate prediction vectors for newly generated edges in the system state graph based on the graph attention embedding model;

[0058] According to the newly generated edge, the corresponding source node and target node are updated through the gated recurrent unit to obtain the updated source node and the updated target node;

[0059] Constructing a decoder based on the prediction vector, the updated source node, and the updated target node; the decoder is used to predict the relationship vector between the updated source node and the updated target node;

[0060] Train the decoder to obtain a trained decoder;

[0061] Obtain the predicted relationship vectors of each source node and target node in the system state diagram based on the trained decoder;

[0062] The cross entropy value is obtained based on the predicted relationship vector and the true label; wherein the true label represents the true relationship type between each source node and target node in the system state diagram;

[0063] When the cross entropy value is greater than or equal to the reconstruction threshold, the predicted relationship vector is judged to be abnormal behavior;

[0064] When the cross entropy value is less than the reconstruction threshold, the predicted relationship vector is judged to be normal behavior.

[0065] In terms of characterizing node behavior characteristics, the present invention divides the nodes in the system into three types and defines nine types of relationships to accurately describe the behavioral information of nodes in events. Specifically, each event in the system is defined as a directional relationship. Each event is represented in the form of a quadruple (Sub, Obj, Rel, Attribute), where Sub represents the event subject node, Obj represents the operated node, Rel represents the interaction relationship between the subject node and the operated node, and Attribute reflects the detailed attributes of the operated node. This representation method not only captures the behavioral semantics of the event, but also retains fine-grained temporal and spatial correlation information, which helps to comprehensively characterize the interaction process between nodes. The specific classification and definition of node types and relationships between nodes in event interactions are shown in Table 1.

[0066] Table 1

[0067]

[0068] Using the quadruple (v src ,v des ,Nv src ,Nv des ) describes the neighborhood structure characteristics of the system nodes. src and v des Represents the source node and target node of the relationship respectively; Nv src and Nv des Represents the neighborhood relationship set of the source node and the target node. The neighborhood relationship set of the node of the present invention is defined as all the relationships within a one-hop range of a node (i.e., the set of nodes and edges within the directly connected range of a node) at a certain moment. This structure fully includes the properties of the node itself and the relationship with the adjacent nodes. In this way, the local structural characteristics of the node and its own properties are effectively combined to fully characterize the contextual relationship of the node in the system state diagram.

[0069] The graph attention embedding model of the graph neural network is used to encode the local graph structure at time t-1 and generate a new edge e t (i.e. the relationship between the source node and the target node) prediction vector z:

[0070] z=GNN(s t ,e t );

[0071] When a new node is introduced into the graph, its state is initialized to an all-zero feature vector due to its lack of historical information. When a new relationship appears in the graph, the neighborhood feature vectors of the source and target nodes of the relationship are also updated. Therefore, the graph structure state s t Not only does it include the relationship tThe feature vectors of the source and target nodes also include the status information of the sampled nodes in their neighborhood nodes.

[0072] The prediction vector is constructed by concatenating the feature vectors of the source and target nodes, along with the encoding of the event types in their neighborhood. This effectively embeds the structural information and dynamic changes of the time series graph into the edge vector, providing a complete feature representation for subsequent time series graph analysis tasks.

[0073] This paper uses a graph attention embedding layer to learn complete node features. This layer combines message passing and temporal encoding mechanisms to enhance the modeling of temporal information. The graph attention embedding layer consists of two Transformer convolutional layers, each of which uses a multi-head self-attention mechanism to process the relationship features between nodes. The features of each relationship are composed of message features and temporal features. This mechanism further enhances the representation learning of temporal state graph structures, providing a more accurate representation of the system state graph by jointly encoding relative time and relational message features.

[0074] In order to achieve system status update, the present invention updates the status of the source node and the target node through a gated recurrent unit. This enables real-time update of node status. Specifically, the node status update formula is as follows:

[0075] s t (v n )=GRU( s t-(v n ),e t );

[0076] Among them, s t (v n ) represents node v n The node state at time t, s t- (v n ) represents node v n The node state at time t- before the update, and e t represents the new relationship at time t, v n represents the source node or the target node. Specifically, the new relation e t The information is propagated to v through the state update process n Latest status t (v n ). Therefore, new relations that appear after time t, as long as these relations are located in e t In the neighborhood of t The feature vector of contains the information of these new relationships.

[0077] To avoid the relationship e at the current time t tTo prevent the true information from leaking to the prediction model, it is necessary to ensure that the decoder input does not contain any information at time t, so that the model's prediction results depend solely on the state at time t. To achieve this goal, the present invention adopts a mechanism that simultaneously updates nodes and obtains prediction vectors. When the calculation speeds are out of sync, the update and prediction results are directly passed to the cross-entropy loss function, ensuring that the final calculation is performed only when the calculation results of both modules are complete. This design can enhance the model's effectiveness in extracting relational features.

[0078] In the decoding stage, a multi-layer perceptron is used to learn to predict the type of relationship between the source node and the target node from the prediction vector z generated by the encoder. Specifically, the decoder outputs a predicted relationship vector P(e t ), the predicted relationship vector represents the relationship e t The probability distribution of belonging to nine possible relationship types. The probability of each edge type reflects the relationship e t Based on the matching degree with known normal behavior patterns, the present invention selects the behavior pattern with the highest probability as the prediction result.

[0079] First, the feature vectors of the source node and the target node are transformed by two independent linear layers:

[0080] h n =Linear(z n );

[0081] Among them, z n Represents the feature vector of the source node or the feature vector of the target node. Then, the two transformed node representation vectors are concatenated and further processed through a series of linear layers, activation functions and Dropout operations:

[0082] h=concat(h src ,h dst );

[0083] Among them, h src represents the feature vector of the source node transformed by the linear layer, h dst The feature vector of the target node transformed by the linear layer is expanded by the linear transformation, and then the nonlinear characteristics are introduced by the activation function, and then the Dropout operation is applied to prevent overfitting. The output of each layer will gradually reduce the dimension, and the final output vector P(e t ) represents the relationship e t The probability distribution of the nine possible relationship types.

[0084] During the training phase, this method uses optimization algorithms such as gradient descent to adjust model parameters so that the prediction results gradually approach the true distribution, thereby effectively reducing the reconstruction error. The reconstruction error between the predicted probability and the actual edge type is minimized and the detection model is optimized using the cross-entropy loss function. The training data set uses benign data. Reducing the reconstruction error helps improve the model's recognition accuracy for benign behavior. The cross-entropy loss function measures the difference between the predicted probability distribution and the true label, and then optimizes the decoder parameters to minimize the prediction error. Specifically, the calculation formula of the cross-entropy loss function is as follows:

[0085] RE=CrossEntropy(P(e t ),L(e t ));

[0086] Among them, L(et) represents the actual edge type label, which is usually expressed in the form of a one-hot vector. The corresponding true relationship type position value is 1, and the rest of the positions are 0, ensuring that the decoder can accurately predict the relationship e t The relationship type, CrossEntropy represents the cross entropy function.

[0087] During the testing phase, the decoder calculates the predicted relationship vector based on information such as edge structure and time. If the calculated cross entropy is less than the reconstruction threshold, it is considered normal behavior; otherwise, it is considered abnormal behavior.

[0088] The calculation of anomaly scores for abnormal behavior also depends on the reconstruction error. The anomaly score at time t is determined by multiplying the anomaly scores within the graph by the reconstruction error. If the anomaly score of a time series state graph remains above the anomaly threshold starting at time t, the graph will be added to the anomaly queue until its anomaly score falls below the anomaly threshold, the state disappears, or no longer changes.

[0089] S2. Evaluate the threat score of the abnormal node based on the anomaly score.

[0090] Optionally, the threat level of a node can be assessed based on the anomaly score, combined with the anomaly duration, probability of occurrence, and node importance. A comprehensive threat assessment model is constructed by comprehensively considering the degree of anomaly in the node's own behavioral characteristics and the impact of neighboring nodes through multi-dimensional feature fusion calculations.

[0091] The threat score is calculated using the following formula:

[0092] T(v1)=[event_probability / (1+γ·duration)]×(1+log(out_degree+1));

[0093] Where T(v1) represents the threat score of the abnormal node v1, event_probability represents the occurrence frequency of the abnormal node v1, γ represents the penalty factor, duration represents the abnormal duration of the abnormal node v1, and out_degree represents the importance of the abnormal node v1.

[0094] S3. When the threat score of the abnormal node is higher than the warning threshold, the abnormal node is determined to be a high-risk node, and the path threat of the relevant path of the high-risk node is obtained.

[0095] Optionally, the threat value of the path threat is calculated according to the following formula:

[0096] Ψ=∏(node_threat×distance_decay);

[0097] Among them, Ψ represents the threat value of the path threat, node_threat represents the local threat score of all nodes in the relevant path of the high-risk node, and distance_decay represents the position weight of all nodes in the relevant path of the high-risk node. The threat score weight is dynamically adjusted in combination with real-time behavior data to ensure the adaptability of the detection algorithm to different attack modes.

[0098] S4. When the threat value of the path threat is higher than the threat threshold, or when the similarity score between the feature sequence of each node or edge in the relevant path of the high-risk node and the predefined attack behavior template sequence is greater than the similarity threshold, the path threat is determined to be an attack behavior, and the initial attack behavior graph and the initial modularity of the initial attack behavior graph are obtained based on the path threat and the relevant high-risk nodes.

[0099] Optionally, the similarity score is calculated according to the following formula:

[0100] similarity=1-DTW(path_features,attack_template) / max_length;

[0101] Among them, represents the similarity score, path_features represents the feature sequence of each node or edge in the relevant path of the high-risk node, attack_template represents the predefined attack behavior template sequence, DTW(path_features,attack_template) represents the minimum matching distance between the path feature sequence and the attack template calculated by the dynamic time warping algorithm, and similarity max_length represents the sequence length used for normalization processing.

[0102] Optionally, before S5, the method further includes:

[0103] When the number of events of a high-risk node in the initial attack behavior graph exceeds a threshold within a preset time window, the high-risk node is marked as a hot process node;

[0104] All nodes that directly interact with the hot process nodes in the initial attack behavior graph and the corresponding related paths are extracted to obtain the attack behavior graph.

[0105] As can be understood, the present invention addresses the issue of attack behavior graphs containing a large amount of redundant information through the hot process mechanism. The core function of this mechanism is to effectively reduce the interference of irrelevant information, thereby avoiding the computational complexity explosion caused by excessive dependencies during the traceability analysis process. A hot process is defined as a process node that frequently interacts with a large number of system objects (such as files, network connections, and registry keys) in a short period of time.

[0106] Optionally, before S5, the method further includes:

[0107] The parallel edges of the same operation type between each high-risk node in the initial attack behavior graph are merged into a single edge, and the relevant data information is retained to obtain the attack behavior graph.

[0108] It's understandable that in attack behavior graphs, there are often numerous parallel edges between process nodes and file or network nodes. These edges represent read / write operations that are triggered repeatedly within a short period of time. This paper proposes a graph reduction algorithm based on redundant event aggregation, merging parallel edges of the same operation type into a single edge while preserving relevant data information (such as operation counts and timestamps).

[0109] S5. Divide the attack behavior graph into communities, calculate the first modularity of each high-risk node in the attack behavior graph in the current community, and calculate the second modularity of each high-risk node in the attack behavior graph in the community where each neighboring node is located; wherein the attack behavior graph is obtained based on the initial attack behavior graph.

[0110] It can be understood that each node in the attack behavior graph is initialized as an independent community to form an initial community division structure; at this time, the modularity is in the initial state, and then for each high-risk node, the first modularity in the current community and the second modularity after moving it to the community where its neighbor node is located are calculated one by one.

[0111] S6. Move each high-risk node in the attack behavior graph according to the first modularity and the second modularity, and merge the high-risk nodes in the same community after the movement into super nodes to obtain an updated attack behavior graph and an updated modularity of the updated attack behavior graph.

[0112] Optionally, moving each high-risk node in the attack behavior graph according to the first modularity and the second modularity includes:

[0113] When the first modularity of a high-risk node is greater than the second modularity, the high-risk node is retained in the current community;

[0114] When the first modularity of a high-risk node is less than or equal to the second modularity, the high-risk node is moved to the community where the corresponding neighbor node is located.

[0115] It can be understood that by comparing the modularity of high-risk nodes in different communities, the community that can increase modularity is selected as the destination community for movement, and the high-risk node is moved to this destination community. After the local movement of the high-risk node is completed, the high-risk nodes belonging to the same community are merged into a supernode, and the graph structure is updated. After the merger, the original internal edges of the destination community are not retained one by one, but are inherited as a self-loop edge with a weight equal to the sum of the weights of all internal edges, which is used to represent the internal connectivity of the supernode itself. At the same time, the connecting edges between the destination community and other communities are also aggregated into ordinary edges between supernodes, with a weight equal to the sum of all cross-community edges.

[0116] S7. When the difference between the updated modularity and the initial modularity is less than the difference threshold, a target attack behavior graph is obtained to trace the attack behavior; otherwise, return to S5.

[0117] It is understandable that the modularity is continuously optimized by repeating the steps of locally moving high-risk nodes and merging them. The algorithm terminates when the community affiliation of high-risk nodes no longer changes, when the overall modularity reaches a local optimum, when the change in modularity is less than a threshold, or when the maximum number of iterations is reached.

[0118] The present invention introduces a gated loop unit to dynamically update nodes, establishes a time-series state graph anomaly score calculation mechanism, realizes real-time monitoring and dynamic evolution analysis of system anomaly states, and realizes real-time monitoring and dynamic evolution analysis of attack behaviors; based on multi-dimensional anomaly characteristics, combined with a dynamic anomaly scoring network and threat path expansion technology, realizes multi-dimensional evaluation of node threat levels, and solves the problem that the existing technology for detecting multi-source collaborative combined attacks usually analyzes a single attack behavior in isolation and ignores the nonlinear correlation characteristics between attack modules. By introducing a hot process mechanism and redundant event aggregation, the critical attack path is retained, solving the challenge of explosive growth of computing resources faced by existing tracing technology when processing large-scale attack behavior graphs due to complex path dependencies, significantly simplifying the topological structure of the attack behavior graph and reducing interference from irrelevant nodes.

[0119] In the description of this specification, the reference terms "one embodiment," "some embodiments," "example," "specific example," or "some examples" mean that the specific features or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features or characteristics described can be combined in any suitable manner in any one or more embodiments or examples. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification.

[0120] Although the present invention is described herein in conjunction with various embodiments, in the process of implementing the claimed invention, those skilled in the art can understand and implement other variations of the disclosed embodiments by viewing the drawings and the disclosed content. In the description of the present invention, the word "comprising" does not exclude other components or steps, "one" or "a" does not exclude multiple situations, and "multiple" means two or more, unless otherwise clearly and specifically defined. In addition, certain measures are recorded in different embodiments, but this does not mean that these measures cannot be combined to produce good results.

[0121] The above is a further detailed description of the present invention in conjunction with specific preferred embodiments, and the specific implementation of the present invention should not be considered to be limited to these descriptions. For those skilled in the art of the present invention, without departing from the concept of the present invention, several simple deductions or substitutions can be made, which should be considered to fall within the scope of protection of the present invention.

Claims

1. A multi-source combined collaborative attack detection and tracing method based on behavioral anomalies, characterized by: The method comprises: S1. Obtain an abnormal score and corresponding abnormal node of the detected abnormal behavior; wherein the abnormal behavior includes abnormal state diagrams at multiple different moments; S2. Evaluate the threat score of the abnormal node according to the abnormal score; S3. When the threat score of the abnormal node is higher than the warning threshold, determine the abnormal node as a high-risk node, and obtain the path threat of the relevant path of the high-risk node; S4. When the threat value of the path threat is higher than a threat threshold, or when the similarity score between the feature sequence of each node or edge in the relevant path of the high-risk node and a predefined attack behavior template sequence is greater than a similarity threshold, the path threat is determined to be an attack behavior, and an initial attack behavior graph and an initial modularity of the initial attack behavior graph are obtained based on the path threat and the relevant high-risk nodes. S5. Divide the attack behavior graph into communities, and calculate the first modularity of each high-risk node in the attack behavior graph in the current community and the second modularity of each high-risk node in the attack behavior graph in the community where each neighboring node is located; wherein the attack behavior graph is obtained based on the initial attack behavior graph; S6. Move each high-risk node in the attack behavior graph according to the first modularity and the second modularity, and merge the high-risk nodes in the same community after the movement into a super node, to obtain an updated attack behavior graph and an updated modularity of the updated attack behavior graph; S7. When the difference between the updated modularity and the initial modularity is less than the difference threshold, a target attack behavior graph is obtained to trace the attack behavior; otherwise, return to S5.

2. The multi-source combined collaborative attack detection and tracing method based on behavioral anomalies according to claim 1 is characterized in that: Before S1, the method further includes: Build system state diagram; generating prediction vectors for newly generated edges in the system state graph according to a graph attention embedding model; Update the corresponding source node and target node through the gated recurrent unit according to the newly generated edge to obtain the updated source node and the updated target node; Constructing a decoder according to the prediction vector, the updated source node and the updated target node; the decoder is used to predict the relationship vector between the updated source node and the updated target node; Training the decoder to obtain the trained decoder; Obtaining prediction relationship vectors of each source node and target node in the system state diagram according to the trained decoder; Obtain a cross entropy value based on the predicted relationship vector and the true label; wherein the true label represents the true relationship type between each source node and target node in the system state diagram; When the value of the cross entropy is greater than or equal to a reconstruction threshold, the predicted relationship vector is determined to be abnormal behavior; When the value of the cross entropy is less than the reconstruction threshold, the predicted relationship vector is determined to be normal behavior.

3. The multi-source combined collaborative attack detection and tracing method based on behavioral anomalies according to claim 1 is characterized in that: The threat score is calculated according to the following formula: T(v1)=[event_probability / (1+γ·duration)]×(1+log(out_degree+1)); Where T(v1) represents the threat score of the abnormal node v1, event_probability represents the occurrence frequency of the abnormal node v1, γ represents the penalty factor, duration represents the abnormal duration of the abnormal node v1, and out_degree represents the importance of the abnormal node v1.

4. The multi-source combined collaborative attack detection and tracing method based on behavioral anomalies according to claim 1 is characterized in that: The threat value of the path threat is calculated according to the following formula: Ψ=∏(node_threat×distance_decay); Wherein, Ψ represents the threat value of the path threat, node_threat represents the local threat score of all nodes in the relevant path of the high-risk node, and distance_decay represents the position weight of all nodes in the relevant path of the high-risk node.

5. The multi-source combined collaborative attack detection and tracing method based on behavioral anomalies according to claim 1 is characterized in that: The similarity score is calculated according to the following formula: similarity=1-DTW(path_features,attack_template) / max_length; Among them, similarity represents the similarity score, path_features represents the feature sequence of each node or edge in the relevant path of the high-risk node, attack_template represents the predefined attack behavior template sequence, DTW(path_features,attack_template) represents the minimum matching distance between the path feature sequence and the attack template calculated according to the dynamic time warping algorithm, and max_length represents the sequence length used for normalization processing.

6. The multi-source combined collaborative attack detection and tracing method based on behavioral anomalies according to claim 1 is characterized in that: Before S5, the method further includes: When the number of events of a high-risk node in the initial attack behavior graph exceeds a threshold within a preset time window, marking the high-risk node as a hot process node; All nodes that directly interact with the hot process node in the initial attack behavior graph and corresponding related paths are extracted to obtain the attack behavior graph.

7. The multi-source combined collaborative attack detection and tracing method based on behavioral anomalies according to claim 1 is characterized in that: Before S5, the method further includes: The parallel edges of the same operation type between the high-risk nodes in the initial attack behavior graph are merged into a single edge, and the relevant data information is retained to obtain the attack behavior graph.

8. The multi-source combined collaborative attack detection and tracing method based on behavioral anomalies according to claim 1 is characterized in that: The moving each high-risk node in the attack behavior graph according to the first modularity and the second modularity includes: When the first modularity of the high-risk node is greater than the second modularity, retaining the high-risk node in the current community; When the first modularity of the high-risk node is less than or equal to the second modularity, the high-risk node is moved to the community where the corresponding neighboring node is located.

Images