APT attack detection system and method for graph matching threat intelligence

Abstract

The invention discloses an APT attack detection system for graph matching threat intelligence. The APT attack detection system comprises a cloud data layer, a management decision layer and a terminal equipment layer, the detection method comprises the following steps: step 1, static graph matching similarity calculation based on a graph neural network; step 2, dynamic abnormal flow detection; step 3, trust evaluation; the method has the characteristics that the APT attack is detected by fusing graph matching and threat intelligence, and the cross-domain abnormal traffic detection efficiency of the industrial internet is improved.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and in particular relates to an APT attack detection system and method based on graph matching threat intelligence. Background Art

[0002] With the rapid development of information technology, the Industrial Internet has become a critical infrastructure for the deep integration of modern industrial production and information technology. However, while driving the rapid development of the digital economy, the Industrial Internet also faces increasingly severe cybersecurity threats, particularly APT attacks. APT attacks are complex, advanced, highly covert, and persistent cyberattacks. Attackers typically utilize various tactics, such as social engineering, zero-day vulnerabilities, supply chain vulnerabilities, and watering hole attacks, to remain lurking in target networks for extended periods, gradually infiltrating and stealing sensitive information. Traditional network security protection technologies, such as intrusion detection systems and firewalls, rely primarily on feature matching and rule-based configuration, making them difficult to address the complexity and variability of APT attacks. While some existing detection methods have achieved some success, they are often only able to detect individual stages or specific attacks when faced with the multi-stage infiltration behavior of APT attacks, failing to identify the threat of the underlying attack chain. This leaves some nodes within the system at risk of compromise.

[0003] Research and analysis of extensive domestic and international literature reveals that existing methods often focus on detecting a single network environment, making it difficult to cover the complex multi-network scenarios of the Industrial Internet and prone to missing key links in the attack chain. Furthermore, traditional detection technologies inefficiently utilize threat intelligence, failing to fully exploit attack patterns and behavioral characteristics, resulting in insufficient detection accuracy. Existing methods often rely on perimeter protection, making it difficult to address the lateral penetration of complex threats such as APT attacks from the IT domain into the OT domain. Furthermore, traditional methods fail to adequately weight network traffic characteristics, making it difficult to accurately capture the hidden nature and dynamic patterns of attack behavior.

[0004] Existing technologies face some technical challenges when using graph matching threat intelligence to detect APT attacks:

[0005] 1) Most existing detection models can only cover attack detection of a single device or a single network. It is difficult to conduct comprehensive and systematic monitoring of multiple network environments within the Industrial Internet. This can easily lead to the omission of some links in the attack chain and the inability to accurately identify APT attacks across multiple stages and nodes.

[0006] 2) Some existing APT attack detection models have deficiencies in their use of threat intelligence. They fail to fully tap into the rich information contained in threat intelligence, and are unable to deeply understand known attack patterns and attacker behavioral characteristics during detection. This inefficient use of threat intelligence limits the detection models' ability to accurately identify and promptly respond to APT attacks, making it difficult to meet the detection needs of complex network security environments.

[0007] 3) Traditional network traffic data processing methods generally lack sufficient consideration of feature weights, failing to fully identify and differentiate the importance of different features in detecting APT attacks. Furthermore, when processing network traffic data with long-term dependencies, these methods often struggle to consistently and effectively utilize early-stage information, making it difficult to accurately capture the hidden nature and dynamic patterns of attack behavior. Summary of the Invention

[0008] In order to overcome the shortcomings of the above-mentioned prior art, the purpose of the present invention is to provide an APT attack detection system and method based on graph matching threat intelligence. The present invention constructs an attack behavior graph through graph matching technology, combines deep neural networks to extract deep features of network traffic, and accurately identifies the multi-stage penetration behavior of APT attacks. At the same time, a trust evaluation mechanism is introduced, combined with the initial trust value of graph matching and dynamic abnormal traffic detection, to evaluate the trust level of equipment in real time and limit the permissions of abnormal nodes, effectively enhance the ability to identify APT attacks, prevent the lateral movement of compromised equipment, introduce trust threshold values and dynamic recovery mechanisms, optimize equipment access permission management, and improve the overall security and adaptability of the system. It has the characteristics of integrating graph matching and threat intelligence to detect APT attacks, improve the efficiency of cross-domain abnormal traffic detection in the industrial Internet, use GCN and NTN to mine APT attack patterns, dynamically trust evaluation to block the lateral movement of abnormal equipment, cloud storage terminal trust value to ensure data fault tolerance, and BiLSTM-Attention to optimize traffic feature weights.

[0009] To achieve the above-mentioned purpose, the technical solution adopted by the present invention is: an APT attack detection system based on graph matching threat intelligence, comprising: a cloud data layer, a management decision layer, and a terminal device layer;

[0010] The cloud data layer is primarily responsible for data storage and processing, generating relevant maps through threat processing, saving user or device authentication information, and providing stable and standardized data support for management decision-making; it also receives budget assessment results from management decision-making.

[0011] The management decision layer is the computing center of the detection system. It calculates the trust value of the terminal device through the data of the cloud data layer, combined with security policies and preset detection methods. The management decision layer uses graph neural networks to build a graph matching algorithm to match the internal network topology with the attack pattern in the threat intelligence, and performs a static evaluation of the initial trust value based on the similarity. It combines the deep neural network algorithm to detect anomalies in the traffic between the gateways of the industrial OT area and the IT area, realizes dynamic trust evaluation of the terminal device, and controls the request permissions of the terminal device. In order to prevent the lateral movement of the compromised terminal device, a zero-trust controller is introduced, in which the policy engine determines the access rights, the policy manager manages the communication path and generates the authentication token, and the policy execution point is responsible for the activation, monitoring and termination of the connection. The three components jointly ensure the secure implementation of the zero-trust architecture, realize the control of the terminal layer traffic and the storage of the corresponding trust values of the cloud data layer devices.

[0012] The terminal device layer includes industrial Internet terminals. The industrial Internet is divided into information technology domain and operation technology domain. In the information technology domain, industrial Internet terminals are used to manage and optimize the enterprise's information technology systems, mainly including key components of manufacturing execution, supply chain management, and product life cycle management. In the industrial OT domain, industrial Internet terminals connect and control various monitoring and sensing equipment. To prevent the loss of terminal devices, the terminal device layer accepts access control from the management decision-making layer and provides log resource access information to the cloud data layer.

[0013] A method for detecting APT attacks based on graph matching threat intelligence includes the following steps:

[0014] Step 1: Static graph matching similarity calculation based on graph neural network

[0015] Data processing: Using Neo4j, a graph database in the cloud data layer, attack behavior graphs with attack behavior characteristics are selected from the threat intelligence database. Graph embeddings are generated based on node information and passed to the management decision layer for similarity matching with suspicious subgraphs extracted from terminal device logs. Based on IOCs, suspicious subgraphs are selected from the terminal device log database using Cyber statements and the generated graph embeddings are passed to the management decision layer. At the management decision layer, similarity calculations are performed between the graph embeddings of the attack behavior graph and the graph embeddings of the suspicious subgraphs in the logs using a neural tensor network.

[0016] Step 2: Dynamic abnormal traffic detection

[0017] After using graph matching methods to perform an initial trust assessment, traffic anomaly detection is performed on intranet and extranet devices according to the zero-trust principle. A BiLSTM-Attention traffic detection model is deployed between the IT and OT domains to perform dynamic anomaly traffic detection under the control of the management decision-making layer.

[0018] Step 3: Trust Assessment

[0019] A comprehensive trust assessment strategy is used to detect APT threats and control access rights of industrial Internet terminals. A graph matching algorithm is used to calculate the initial trust value and evaluate device relevance and credibility. At the same time, the BiLSTM-Attention model is used to monitor network traffic in real time, and a time decay factor is introduced to limit invalid requests to conduct dynamic trust assessment. The trust assessment scores are stored in the cloud data layer to provide a data basis for the management decision-making layer.

[0020] In the aforementioned data processing, the threat intelligence in the threat intelligence database and the device log data collected by the device log database are heterogeneous. To align their data representation methods, the threat intelligence and device log data are stored in the form of triples, namely subject, relationship, and object. The subject and object represent entities, which can be IP addresses, process IDs, and file paths, and the relationship describes the relationship between entities, including read, write, and connect operations. The graph database Neo4j is used to solve the problem of similarity matching of heterogeneous data. The threat intelligence and device log data in the cloud data layer graph database use a unified Cyber syntax to extract attack behavior graphs and suspicious subgraphs.

[0021] The specific steps for generating graph embedding are as follows:

[0022] When comparing the similarity between the attack behavior graph and the suspicious subgraphs in the logs, the graph similarity calculation model first uses a convolutional neural network, a graph embedding algorithm, to convert the abstract node graph structure into a tensor format. It then uses a neural tensor network to capture the complex interactions between entities and relationships to achieve graph similarity calculation;

[0023] GCN extracts node features by performing convolution operations in the feature space of the graph's Laplacian matrix. It then propagates node features to its neighboring nodes through the adjacency matrix, ensuring that each node's feature embedding not only includes its own features but also incorporates information from neighboring nodes. Using multi-layer graph convolution operations, the graph similarity calculation model learns low-dimensional embedding representations of nodes. The low-dimensional embeddings of attack behavior graphs and suspicious subgraphs in logs can capture both the graph's structural information and the semantic information of nodes.

[0024] The graph G = (V, E) is represented as the adjacency matrix A and the node feature matrix X, where V is the node set and E is the edge set. When GCN receives the graph G, it normalizes the adjacency matrix A to obtain a symmetric normalized adjacency matrix Where D is the diagonal matrix of node degrees and I is the identity matrix; using the formula Update the graph convolution layer to get the embedded representation of the node, where H (l) represents the node embedding representation matrix of the lth layer, represents the activation function applied to the normalized adjacency matrix, W (l) Represents the weight matrix of the lth layer. In the graph similarity calculation model, the embeddings of all nodes are aggregated to generate the embedded representation of the graph, which is passed into the NTN network for graph similarity comparison.

[0025] The specific steps for comparing graph similarity are as follows:

[0026] After the graph neural network embeds each graph, it obtains the graph-level embedding vector; NTN captures the global structural information of the graph through the embedding vector; NTN uses the formula For a set of graph embedding vectors h i ,h j Perform similarity comparison, where h i is the embedding representation of the i-th graph, h j is the j-th graph embedding representation, f3 is the activation function, T represents transposition, W3 [1:K] is a K×d×d three-dimensional weight tensor, d is the embedding dimension, V[h i ;h j ] will h i and h j Spliced into a vector, and linearly transformed using the weight matrix V, b3 represents a bias term; for two graphs G i and G j , respectively extract its node embedding matrix U i and U j , use the activation function σ to calculate the similarity matrix between nodes to calculate the similarity of local node information; finally, the model combines the results of graph embedding and node pair comparison, and uses the formula Sim(G1,G2)=σ(W4[h1;h2;s]+b4) to calculate the similarity score of the two graphs, where σ is the activation function, which introduces a nonlinear factor into the similarity calculation, W4 is the weight matrix, s is the aggregation result of node pair similarity, and b4 is a bias vector used to adjust the output of the model.

[0027] The BiLSTM-Attention traffic detection model includes bidirectional temporal feature extraction and attention mechanism;

[0028] Bidirectional time series feature extraction: APT attack threat tool traffic features have obvious time series characteristics. BiLSTM simultaneously learns the features of traffic data from both forward and reverse directions, leveraging the correlation between previous and subsequent data to more comprehensively understand the context of traffic. BiLSTM also captures the relationships between distant time steps in network traffic.

[0029] BiLSTM uses its internal gating mechanism to control the flow of information, solve the long-distance dependency problem, and avoid the gradient disappearance of the input data x t Through the hidden state h in the layer t , cell state c t And sigmoid activation function for output; the calculation process of reverse LSTM is the same as that of forward LSTM, but the input sequence is reversed; finally, BiLSTM merges the output of forward and reverse LSTM at each time step to obtain bidirectional time series features in is the output of the forward LSTM hidden state, is the output of the backward LSTM hidden state;

[0030] The attention mechanism automatically identifies and focuses on the most critical features for APT detection, enabling the BiLSTM-Attention traffic detection model to identify rare attack entities and context-related entities; the attention mechanism assigns weights to each element in the sequence, enabling the BiLSTM-Attention traffic detection model to focus on information that is more important to the task. When the sequence vector set H = [h1,h2,…h T ] When passing through the Attention layer, the attention mechanism performs a nonlinear transformation of the hidden state of the sequence vector set and uses α=softmax(w T HW) to get the attention weight α, where softmax is the probability distribution function, w T is the transpose of the weight vector, H is the vector set, W is the weight matrix product, and after the weighted formula r=Hα T , the sequence vector,r,is finally represented as vector h through the tanh activation function * =tanh(r), and the weighted sequence vector is used for subsequent classification or other tasks.

[0031] The comprehensive trust evaluation strategy is implemented as follows:

[0032] Step 1: Use a graph matching algorithm to analyze the associations between devices in the terminal device layer, calculate the initial trust value of each device in the terminal device layer, and set dynamic thresholds based on the initial trust value. Medium-trust devices will be marked and have their resource access restricted, while low-trust devices will require re-verification.

[0033] Step 2: Introduce a time decay factor so that as the device operating time in the terminal device layer gradually increases, the trust value of its cloud data layer gradually decreases. Introduce the decay rate and time interval decay rate calculation to accelerate the re-authentication process of low-trust devices and improve the security cycle;

[0034] Step 3: Establish a device-trust value mapping table in the cloud to store and update the trust value of each device in real time. Use a data synchronization mechanism to ensure that the local trust value of the device is always consistent with the trust value of the cloud data layer, thus blocking abnormal behavior in real time.

[0035] Step 4: Monitor network traffic in real time, promptly initiate a traceability mechanism for abnormal traffic, identify the device involved in abnormal behavior, and apply a mutation attenuation factor to quickly reduce its trust value;

[0036] Step 5: For devices with low trust values, a dynamic recovery mechanism is set up. If the device demonstrates good trustworthiness in subsequent behavior, the trust value can be gradually restored through re-verification through the verification mechanism.

[0037] Step 6: Feedback the trust value adjustment status to the system administrator in real time so that the trust evaluation strategy can be optimized based on the feedback information to improve the overall security and adaptability of the system.

[0038] Compared with the prior art, the present invention has the following beneficial effects:

[0039] This paper introduces an APT attack detection method that combines graph matching technology with deep neural networks. In macro-level attack detection, graph matching technology can construct an attack behavior graph by modeling and analyzing network entities (such as devices, users, and processes) and their relationships. This graph can then be matched against known threat intelligence graphs to identify potential APT attack behaviors. Simultaneously, for single-point micro-level detection, deep neural networks, particularly architectures with time series processing capabilities (such as BiLSTM), can perform deep feature extraction on network traffic data, capturing the hidden characteristics and dynamic behaviors of attacks. Combining these two methods not only fully utilizes the rich information contained in threat intelligence, but also overcomes the limitations of traditional detection methods when dealing with complex attack patterns. This provides stronger security for critical information infrastructure such as the Industrial Internet, enabling accurate detection and effective defense against APT attacks.

[0040] In this paper, after graph neural network matching of threat intelligence, a deep neural network algorithm is integrated to analyze traffic characteristics, achieving accurate detection of abnormal behavior. By integrating multi-source information, the comprehensiveness and accuracy of detection results are effectively improved, providing strong support for addressing the complexity and stealth of APT attacks.

[0041] This paper designs a graph matching-driven APT attack detection model, which uses a graph convolutional network (GCN) to embed graph nodes, encodes node features and structural information into vectors, and uses a neural tensor network (NTN) to interact the graph-level embeddings of two graphs, capture the similarities between graphs, and discover potential APT attack patterns, overcoming the limitations of traditional detection methods that rely solely on a single data source or feature matching.

[0042] This paper introduces a multidimensional feature extraction method based on BiLSTM-Attention deep neural network to perform deep feature extraction on network traffic data. It dynamically adjusts feature weights through the Attention mechanism and analyzes the connections in the spatial dimension and the dependencies in the temporal dimension from the terminal traffic sequence characteristics.

[0043] The present invention adopts a fusion method of graph matching and abnormal traffic detection to comprehensively identify potential threats, optimize device access permission management, and improve the security protection level of the industrial Internet.

[0044] This invention leverages a trust assessment mechanism to combine heterogeneous data detection: structure graphs and network traffic. Using graph matching technology, network entities are assigned initial trust values. Dynamic trust assessment is performed through abnormal traffic detection, thereby limiting the resource access rights of abnormal nodes and enhancing the ability to identify APT attacks.

[0045] This paper adopts the attention mechanism, which can dynamically assign weights to each element in the sequence, allowing the model to focus more on the parts that are more important to the task, thereby improving the performance and interpretability of the model; in tasks such as APT attack detection, this mechanism can help the model better identify key features in abnormal traffic.

[0046] The present invention adopts an APT attack detection method based on graph matching threat intelligence to prevent diversified and continuous attacks.

[0047] In the cross-domain abnormal traffic detection of the industrial Internet, a new collaborative paradigm is provided, which effectively improves the efficiency of cross-domain industrial Internet security terminal identification.

[0048] The present invention can fully mine the rich information contained in threat intelligence, and use technologies such as GCN and tensor neural network NTN to discover potential APT attack patterns, thereby improving the detection model's ability to identify and respond to APT attacks.

[0049] The present invention introduces a trust assessment mechanism, combines the initial trust value of graph matching with dynamic abnormal traffic detection, evaluates the device trust level in real time and limits the permissions of abnormal nodes, effectively enhances the ability to identify APT attacks, prevents the lateral movement of compromised devices, and improves system security.

[0050] The present invention stores the terminal trust level in the cloud, provides a secure storage mechanism, realizes the separation of terminal trust value and terminal device storage, and improves the fault tolerance of data.

[0051] This paper uses the BiLSTM-Attention network to dynamically adjust feature weights through the Attention mechanism, analyzes the spatial connections and temporal dependencies of traffic features, solves the problem of insufficient consideration of feature weights in traditional methods, and accurately captures the concealment and dynamic changes of attack behaviors.

[0052] The APT attack detection solution designed in this invention is innovative and practical, suitable for comprehensive monitoring of multi-network environments of the Industrial Internet, and is conducive to large-scale threat behavior detection within the Industrial Internet. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 This is a schematic diagram of the system of the present invention.

[0054] Figure 2 Schematic diagram of behavioral pattern matching.

[0055] Figure 3 This is a flowchart of graph similarity calculation according to the present invention.

[0056] Figure 4 Schematic diagram of abnormal flow detection according to the present invention.

[0057] Figure 5 This is a flow chart of the trust evaluation strategy of the present invention. DETAILED DESCRIPTION

[0058] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0059] See also Figure 1 , an APT attack detection system based on graph matching threat intelligence, the present invention relies on a hierarchical system architecture to achieve APT attack detection based on graph matching threat intelligence, Figure 1 The multi-layer architecture on which the detection method is based introduces the concept of zero trust and is divided into the cloud data layer, management decision layer, and terminal device layer according to the functions of different components.

[0060] The cloud data layer is primarily responsible for data storage and processing, generating relevant maps through threat processing, saving user or device authentication information, and providing stable and standardized data support for the decision-making of the management below. At the same time, this layer also receives the results of the management's budget assessment, such as the user's initial trust value, the device's management permissions, etc. The cloud layer ensures the security and reliability of the system through real-time data updates, thereby controlling access rights by evaluating the trust level of users or devices, and providing a safe and reliable data storage and processing platform for the entire architecture system.

[0061] The management decision layer is the computing center of the detection system. It calculates the trust value of the terminal device through the data of the cloud data layer, combined with security policies and preset detection methods; the management decision layer uses graph neural networks to build a graph matching algorithm to match the internal network topology with the attack pattern in the threat intelligence, and performs a static evaluation of the initial trust value based on the similarity; the deep neural network algorithm is combined to detect anomalies in the traffic between the gateways of the industrial OT area and the IT area to achieve dynamic trust evaluation of the terminal device and control the request permissions of the terminal device; in order to prevent the lateral movement of the compromised terminal device, a zero-trust controller is introduced, in which the policy engine (PE) determines access rights, the policy manager (PA) manages the communication path and generates authentication tokens, and the policy execution point (PEP) is responsible for the activation, monitoring and termination of the connection. The three components work together to ensure the secure implementation of the zero-trust architecture, realize the control of terminal layer traffic and the storage of corresponding trust values of cloud layer devices;

[0062] The terminal device layer primarily includes Industrial Internet terminals (IIT). The Industrial Internet is divided into the Information Technology (IT) and Operational Technology (OT) domains. Within the IT domain, IIT is primarily responsible for managing and optimizing the company's information technology systems, including key components such as Manufacturing Execution System (MES), Supply Chain Management (SCM), and Product Lifecycle Management (PLM). Within the Industrial OT domain, IIT focuses on connecting and controlling various monitoring and sensing devices, such as Programmable Logic Controllers (PLCs), Supervisory Control and Data Acquisition (SCADA), and Fieldbus Control Systems (FCS). To prevent terminal device compromise, this layer must accept access control from the management decision-making layer and provide resource access information, such as logs, to the cloud data layer.

[0063] See also Figure 2 After converting the terminal device log data into a behavior graph, the IOC information of the threat intelligence is used to select the suspicious subgraph in the log behavior graph. Then, the suspicious subgraph is matched with the attack behavior graph extracted by the threat intelligence for similarity. Based on the matching similarity score, the node terminal device is given an initial trust value.

[0064] A method for detecting APT attacks based on graph matching threat intelligence includes the following steps:

[0065] Step 1: Static graph matching similarity calculation based on graph neural network

[0066] See also Figure 3 ,Data processing, using the graph database Neo4j of the cloud data layer, selects attack behavior graphs with attack behavior characteristics from the threat intelligence database, generates graph embedding based on node information, and transmits the graph embedding vector to the management decision layer for graph similarity calculation (matching) with the suspicious subgraph in the log; In the terminal device log database, based on IOC, the Cyber statement is used to select suspicious subgraphs and the generated graph embedding is transmitted to the management decision layer. The graph embedding of the attack behavior graph and the graph embedding of the suspicious subgraph in the log are calculated in the management decision layer through the neural tensor network for similarity;

[0067] Step 2: Dynamic abnormal traffic detection

[0068] After using graph matching methods to perform an initial trust assessment, traffic anomalies on both intranet and extranet devices are continuously detected according to the zero-trust principle. Complex APT attacks often penetrate the IT domain into the OT domain, exploiting the limitations of perimeter protection to cause severe damage to critical infrastructure. A BiLSTM-Attention traffic detection model is deployed between the IT and OT domains to perform dynamic anomaly detection under the control of management decision-makers.

[0069] Step 3: Trust Assessment

[0070] A comprehensive trust assessment strategy is used to detect APT threats and control access rights of industrial Internet terminals. A graph matching algorithm is used to calculate the initial trust value and evaluate device relevance and credibility. At the same time, the BiLSTM-Attention model is used to monitor network traffic in real time, and a time decay factor is introduced to limit invalid requests to conduct dynamic trust assessment. The trust assessment scores are stored in the cloud data layer to provide a data basis for the management decision-making layer.

[0071] See also Figure 4 The BiLSTM-Attention traffic detection model is deployed between the industrial OT and IT domains. Input traffic passes through a two-layer LSTM to extract temporal features before entering the Attention layer. The attention mechanism assigns weights to these features, further extracting important features and thus detecting abnormal traffic. After detecting abnormal traffic, a dynamic trust assessment mechanism and Zero Trust Terminal (ZTC) are used to identify the terminal devices involved in the abnormal traffic. The trust value of these terminal devices is then suddenly reduced, restricting their resource access rights and promptly blocking any threatening behavior.

[0072] In the aforementioned data processing, the threat intelligence in the threat intelligence database and the device log data collected by the device log database are heterogeneous. To align their data representation methods, the threat intelligence and device log data are stored in the form of triples, namely subject, relationship, and object. The subject and object represent entities, which can be IP addresses, process IDs, and file paths, and the relationship describes the relationship between entities, including read, write, and connect operations. The graph database Neo4j is used to solve the problem of similarity matching of heterogeneous data. The threat intelligence and device log data in the cloud data layer graph database use a unified Cyber syntax to extract attack behavior graphs and suspicious subgraphs.

[0073] The specific steps for generating graph embedding are as follows:

[0074] When comparing the similarity between the attack behavior graph and the suspicious subgraphs in the logs, the graph similarity calculation model first uses the graph embedding algorithm, a convolutional neural network (GCN), to convert the abstract node graph structure into a tensor format. It then uses the neural tensor network (NTN) to capture the complex interactions between entities and relationships, thus achieving graph similarity calculation.

[0075] GCN extracts node features by performing convolution operations in the feature space of the graph's Laplacian matrix, and propagates node feature information to its neighboring nodes through the adjacency matrix. This ensures that the embedding of each node feature not only contains its own features but also incorporates information from neighboring nodes. By using multi-layer graph convolution operations, the graph similarity calculation model learns a low-dimensional embedding representation of the nodes. The embedding of attack behavior graphs and suspicious subgraphs in logs can capture the structural information of the graph and the semantic information of the nodes.

[0076] The graph G = (V, E) is represented as the adjacency matrix A and the node feature matrix X, where V is the node set and E is the edge set. When GCN receives the graph G, it normalizes the adjacency matrix A to obtain a symmetric normalized adjacency matrix Where D is the diagonal matrix of node degrees, I is the identity matrix; using the formula Update the graph convolution layer to get the embedded representation of the node, where H (l) represents the node embedding representation matrix of the lth layer, represents the activation function applied to the normalized adjacency matrix, W (l) Represents the weight matrix of the lth layer. In the graph similarity calculation model, the embeddings of all nodes are aggregated to generate the embedded representation of the graph, which is passed into the NTN network for graph similarity comparison.

[0077] The neural tensor network (NN) is a neural network model used to compare graph similarity, especially in graph embedding and similarity measurement. After the graph neural network embeds each graph, it obtains the graph-level embedding vector. NTN captures the global structural information of the graph through the embedding vector. NTN uses the formula For a set of graph embedding vectors H i ,h j Perform similarity comparison, where h i is the i-th graph embedding representation, f3 is the activation function, T represents transposition, W3 [1:K] is a K×d×d three-dimensional weight tensor, d is the embedding dimension, V[h i ;h j ] will h i and h j Spliced into a vector, and linearly transformed using the weight matrix V,, b3 represents a bias term; for two graphs G i and G j , respectively extract its node embedding matrix U i and U j , by calculating the similarity matrix between nodes To calculate the similarity of local node information. Finally, the model combines the results of graph embedding and node pair comparison to calculate the similarity score of the two graphs using the formula Sim(G1,G2)=σ(W4[h1;h2;s]+b4), where σ is the activation function that introduces nonlinear factors to the similarity calculation, W4 is the weight matrix, s is the aggregated result of node pair similarity, and b4 is a bias vector used to adjust the model output.

[0078] The BiLSTM-Attention traffic detection model includes bidirectional temporal feature extraction and attention mechanism;

[0079] Bidirectional time series feature extraction: Network traffic data, especially traffic characteristics of APT threat tools, have obvious time series characteristics. BiLSTM simultaneously learns the characteristics of traffic data from both forward and reverse directions, effectively utilizing the correlation between previous and subsequent data to more comprehensively understand the context of traffic. BiLSTM captures the relationship between distant time steps in network traffic.

[0080] BiLSTM uses its internal gating mechanism to control the flow of information, solve the long-distance dependency problem, and avoid the gradient disappearance of the input data x t Through the hidden state h in the layer t , cell state c tAnd sigmoid activation function for output; the calculation process of reverse LSTM is the same as that of forward LSTM, but the input sequence is reversed; finally, BiLSTM merges the output of forward and reverse LSTM at each time step to obtain bidirectional time series features in is the output of the forward LSTM hidden state, is the output of the backward LSTM hidden state;

[0081] The BiLSTM (Bi-directional Long Short-Term Memory) is an improved recurrent neural network (RNN) architecture for processing sequence data. It combines two directional LSTMs: forward LSTM and backward LSTM to better capture bidirectional dependencies in the sequence.

[0082] LSTM (Long Short-Term Memory) is a special recurrent neural network (RNN) architecture designed to process long-term dependencies in sequential data. LSTM addresses the vanishing and exploding gradient problems of traditional RNNs by introducing gating mechanisms (such as input, forget, and output gates).

[0083] The attention mechanism mentioned above automatically identifies and focuses on the most critical features for APT detection, enabling the model to more effectively identify rare attack entities and context-related entities; the attention mechanism assigns weights to each element in the sequence, allowing the BiLSTM-Attention traffic detection model to focus on information that is more important to the task. When the sequence vector h processed by BiLSTM is T The set H=[h1,h2,…h T ] When passing through the Attention layer, the attention mechanism performs a nonlinear transformation of the hidden state of the sequence vector set and uses α=softmax(w T HW) to get the attention weight α, where softmax is the probability distribution function, w T is the transpose of the weight vector, H is the vector set, W is the weight matrix product, and after the weighted formula r=Hα T , the sequence vector,r,is finally represented as vector h through the tanh activation function * =tanh(r), this step uses the weighted sequence vector for subsequent classification or other tasks.

[0084] In this way, the attention mechanism dynamically assigns weights to each element in the sequence, allowing the model to focus more on the parts that are more important to the task, thereby improving the performance and interpretability of the model; in tasks such as APT attack detection, this mechanism can help the model better identify key features in abnormal traffic.

[0085] See also Figure 5 The implementation steps of the comprehensive trust evaluation strategy are as follows:

[0086] Step 1: Use a graph matching algorithm to analyze the associations between devices in the terminal device layer, calculate the initial trust value of each device in the terminal device layer, and set dynamic thresholds based on the initial trust value. Medium-trust devices will be marked and have their resource access restricted, while low-trust devices will require re-verification.

[0087] Step 2: Introduce a time decay factor so that as the device operating time in the terminal device layer gradually increases, the trust value of its cloud data layer gradually decreases. Introduce the decay rate and time interval decay rate calculation to accelerate the re-authentication process of low-trust devices and improve the security cycle;

[0088] Step 3: Set up a device-trust value mapping table in the cloud to store and update the trust value of each device in real time. Use a data synchronization mechanism to ensure that the trust value of the device is consistent with that of the cloud.

[0089] Block abnormal behavior in real time;

[0090] Step 4: Monitor network traffic in real time, promptly initiate the tracing mechanism for abnormal traffic, identify the abnormal behavior of the device involved, and apply the mutation attenuation factor to quickly reduce its trust value.

[0091] Step 5: For devices with low trust values, a dynamic recovery mechanism is set up. If the device demonstrates good trustworthiness in subsequent behavior, re-verification through the verification mechanism can gradually restore the trust value;

[0092] Step 6: Feedback the trust value adjustment status to the system administrator in real time so that the trust evaluation strategy can be optimized based on the feedback information to improve the overall security and adaptability of the system.

[0093] List of abbreviations and definitions

[0094] IT: Information, Technology, Information technology: involves technologies such as information collection, storage, transmission, processing and utilization, such as computer technology, network technology, etc.

[0095] OT: Operational,Technology, Operational Technology: Technology used to monitor, control and manage equipment and processes in industrial environments, such as industrial automation systems, control systems, etc.

[0096] IIT: Industrial, Internet, Terminal, Industrial Internet Terminal: A device terminal connected to the Industrial Internet, used for data collection, transmission, control and other functions.

[0097] MES: Manufacturing, Execution, System, Manufacturing Execution System: A system used to monitor and manage the production process in real time, including production scheduling, quality control, equipment management, etc.

[0098] SCM: Supply, Chain, Management, Supply Chain Management: involves the planning, organization, coordination and control of each link in the supply chain to improve the efficiency and effectiveness of the supply chain.

[0099] PLM: Product, Lifecycle, Management, Product Lifecycle Management: It is a systematic approach to comprehensively manage the entire life cycle of a product from concept design, research and development, production, sales to scrapping.

[0100] PLC: Programmable, Logic, Controller, a programmable logic controller is a digital computer used in industrial environments for automated control.

[0101] FCS: Fieldbus, Control, System, Fieldbus control system: A control system based on fieldbus technology, used to connect and control field equipment, and realize communication and collaborative work between devices.

[0102] NTN: Tensor,Neural,Network, Tensor neural network: a neural network architecture that uses tensors (multidimensional arrays) for data representation and processing.

[0103] GCN: Graph,Convolutional,Networks, Graph Convolutional Network: A neural network used to process graph structured data, which extracts and updates features of nodes in the graph through convolution operations.

[0104] ZTC: Zero,Trust,Client,Zero Trust Client: Client device or software based on the zero trust security model, emphasizing strict authentication and authorization for each access request.

[0105] SCADA: Supervisory, Control, And, Data, Acquisition, Supervisory Control and Data Acquisition System: A system used for industrial process monitoring and data acquisition, collecting data through sensors and controllers, and performing remote monitoring and control.

Claims

1. A graph matching threat intelligence APT attack detection system, characterized by: Includes: cloud data layer, management decision layer, and terminal device layer; The cloud data layer is primarily responsible for data storage and processing, generating relevant maps through threat processing, saving user or device authentication information, and providing stable and standardized data support for management decision-making; it also receives budget assessment results from management decision-making. The management decision layer is the computing center of the detection system. It calculates the trust value of the terminal device through the data of the cloud data layer, combined with security policies and preset detection methods. The management decision layer uses graph neural networks to build a graph matching algorithm to match the internal network topology with the attack pattern in the threat intelligence, and performs a static evaluation of the initial trust value based on the similarity. It combines the deep neural network algorithm to detect anomalies in the traffic between the gateways of the industrial OT area and the IT area, realizes dynamic trust evaluation of the terminal device, and controls the request permissions of the terminal device. In order to prevent the lateral movement of the compromised terminal device, a zero-trust controller is introduced, in which the policy engine determines the access rights, the policy manager manages the communication path and generates the authentication token, and the policy execution point is responsible for the activation, monitoring and termination of the connection. The three components jointly ensure the secure implementation of the zero-trust architecture, realize the control of the terminal layer traffic and the storage of the corresponding trust values of the cloud data layer devices. The terminal device layer includes industrial Internet terminals. The industrial Internet is divided into information technology domain and operation technology domain. In the information technology domain, industrial Internet terminals are used to manage and optimize the enterprise's information technology systems, mainly including key components of manufacturing execution, supply chain management, and product life cycle management. In the industrial OT domain, industrial Internet terminals connect and control various monitoring and sensing equipment. To prevent the loss of terminal devices, the terminal device layer accepts access control from the management decision-making layer and provides log resource access information to the cloud data layer.

2. A graph matching threat intelligence APT attack detection method, characterized in that: The following steps are involved: Step 1: Static graph matching similarity calculation based on graph neural network Data processing: Using Neo4j, a graph database in the cloud data layer, we select attack behavior graphs with attack behavior characteristics from the threat intelligence database, generate graph embeddings based on node information, and pass the graph embedding vectors to the management decision layer for similarity matching with suspicious subgraphs extracted from terminal device logs. Based on the IOCs, cyber statements are used to select suspicious subgraphs from the terminal device log database and the generated graph embedding is transmitted to the management decision layer. The graph embedding of the attack behavior graph and the graph embedding of the suspicious subgraph in the log are similarly calculated at the management decision layer through a neural tensor network. Step 2: Dynamic abnormal traffic detection After using graph matching methods to perform an initial trust assessment, traffic anomaly detection is performed on intranet and extranet devices according to the zero-trust principle. A BiLSTM-Attention traffic detection model is deployed between the IT and OT domains to perform dynamic anomaly traffic detection under the control of the management decision-making layer. Step 3: Trust Assessment A comprehensive trust assessment strategy is used to detect APT threats and control access rights of industrial Internet terminals. A graph matching algorithm is used to calculate the initial trust value and evaluate device relevance and credibility. At the same time, the BiLSTM-Attention model is used to monitor network traffic in real time, and a time decay factor is introduced to limit invalid requests to conduct dynamic trust assessment. The trust assessment scores are stored in the cloud data layer to provide a data basis for the management decision-making layer.

3. The APT attack detection method based on graph matching threat intelligence according to claim 1, characterized in that: In the aforementioned data processing, the threat intelligence in the threat intelligence database and the device log data collected by the device log database are heterogeneous. To align their data representation methods, the threat intelligence and device log data are stored in the form of triples, namely subject, relationship, and object. The subject and object represent entities, which can be IP addresses, process IDs, and file paths, and the relationship describes the relationship between entities, including read, write, and connect operations. The graph database Neo4j is used to solve the problem of similarity matching of heterogeneous data. The threat intelligence and device log data in the cloud data layer graph database use a unified Cyber syntax to extract attack behavior graphs and suspicious subgraphs. The specific steps for generating graph embedding are as follows: When comparing the similarity between the attack behavior graph and the suspicious subgraphs in the logs, the graph similarity calculation model first uses a convolutional neural network, a graph embedding algorithm, to convert the abstract node graph structure into a tensor format. It then uses a neural tensor network to capture the complex interactions between entities and relationships to achieve graph similarity calculation; GCN extracts node features by performing convolution operations in the feature space of the graph's Laplacian matrix. It then propagates node features to its neighboring nodes through the adjacency matrix, ensuring that each node's feature embedding not only includes its own features but also incorporates information from neighboring nodes. Using multi-layer graph convolution operations, the graph similarity calculation model learns low-dimensional embedding representations of nodes. The low-dimensional embeddings of attack behavior graphs and suspicious subgraphs in logs can capture both the graph's structural information and the semantic information of nodes. The graph G = (V, E) is represented as the adjacency matrix A and the node feature matrix X, where V is the node set and E is the edge set. When GCN receives the graph G, it normalizes the adjacency matrix A to obtain a symmetric normalized adjacency matrix Where D is the diagonal matrix of node degrees and I is the identity matrix; Using the formula Update the graph convolution layer to get the embedded representation of the node, where H (l) represents the node embedding representation matrix of the lth layer, represents the activation function applied to the normalized adjacency matrix, W (l) Represents the weight matrix of the lth layer. In the graph similarity calculation model, the embeddings of all nodes are aggregated to generate the embedded representation of the graph, which is passed into the NTN network for graph similarity comparison.

4. The APT attack detection method based on graph matching threat intelligence according to claim 1, characterized in that: The specific steps for comparing graph similarity are as follows: After the graph neural network embeds each graph, it obtains the graph-level embedding vector; NTN captures the global structural information of the graph through the embedding vector; NTN uses the formula For a set of graph embedding vectors h i ,h j Perform similarity comparison, where h i is the embedding representation of the i-th graph, h j is the j-th graph embedding representation, f3 is the activation function, T represents the transposition, is a K×d×d three-dimensional weight tensor, d is the embedding dimension, V[h i ;h j ] will h i and h j Spliced into a vector, and linearly transformed using the weight matrix V,, b3 represents a bias term; for two graphs G i and G j , respectively extract its node embedding matrix U i and U j , use the activation function σ to calculate the similarity matrix between nodes to calculate the similarity of local node information; finally, the model combines the results of graph embedding and node pair comparison, and uses the formula Sim(G1,G2)=σ(W4[h1;h2;s]+b4) to calculate the similarity score of the two graphs, where σ is the activation function, which introduces a nonlinear factor into the similarity calculation, W4 is the weight matrix, s is the aggregation result of node pair similarity, and b4 is a bias vector used to adjust the output of the model.

5. The APT attack detection method based on graph matching threat intelligence according to claim 1, characterized in that: The BiLSTM-Attention traffic detection model includes bidirectional temporal feature extraction and attention mechanism; Bidirectional time series feature extraction: APT attack threat tool traffic features have obvious time series characteristics. BiLSTM simultaneously learns the features of traffic data from both forward and reverse directions, leveraging the correlation between previous and subsequent data to more comprehensively understand the context of traffic. BiLSTM also captures the relationships between distant time steps in network traffic. BiLSTM uses its internal gating mechanism to control the flow of information, solve the long-distance dependency problem, and avoid the gradient disappearance of the input data x t Through the hidden state h in the layer t , cell state c t And sigmoid activation function for output; the calculation process of reverse LSTM is the same as that of forward LSTM, but the input sequence is reversed; Finally, BiLSTM merges the outputs of the forward and backward LSTM at each time step to obtain bidirectional time series features in is the output of the forward LSTM hidden state, is the output of the backward LSTM hidden state; The attention mechanism automatically identifies and focuses on the most critical features for APT detection, enabling the BiLSTM-Attention traffic detection model to identify rare attack entities and context-related entities; The attention mechanism assigns weights to each element in the sequence, so that the BiLSTM-Attention traffic detection model focuses on the information that is more important to the task. When the sequence vector set H = [h1,h2,…h T ] When passing through the Attention layer, the attention mechanism performs a nonlinear transformation of the hidden state of the sequence vector set and uses α=softmax(w T HW) to get the attention weight α, where softmax is the probability distribution function, w T is the transpose of the weight vector, H is the vector set, W is the weight matrix product, and after the weighted formula r=Hα T , the sequence vector,r,is finally represented as vector h through the tanh activation function * =tanh(r), and the weighted sequence vector is used for subsequent classification or other tasks.

6. The APT attack detection method based on graph matching threat intelligence according to claim 1, characterized in that: The implementation steps of the comprehensive trust evaluation strategy are as follows: Step 1: Use a graph matching algorithm to analyze the associations between devices in the terminal device layer, calculate the initial trust value of each device in the terminal device layer, and set dynamic thresholds based on the initial trust value. Medium-trust devices will be marked and have their resource access restricted, while low-trust devices will require re-verification. Step 2: Introduce a time decay factor so that as the device operating time in the terminal device layer gradually increases, the trust value of its cloud data layer gradually decreases. Introduce the decay rate and time interval decay rate calculation to accelerate the re-authentication process of low-trust devices and improve the security cycle; Step 3: Establish a device-trust value mapping table in the cloud to store and update the trust value of each device in real time. Use a data synchronization mechanism to ensure that the trust value of the device and the cloud data layer is consistent, thus blocking abnormal behavior in real time. Step 4: Monitor network traffic in real time, promptly initiate a traceability mechanism for abnormal traffic, identify the device involved in abnormal behavior, and apply a mutation attenuation factor to quickly reduce its trust value; Step 5: For devices with low trust values, a dynamic recovery mechanism is set up. If the device demonstrates good trustworthiness in subsequent behavior, the trust value can be gradually restored through re-verification through the verification mechanism. Step 6: Feedback the trust value adjustment status to the system administrator in real time so that the trust evaluation strategy can be optimized based on the feedback information to improve the overall security and adaptability of the system.

Images