Attack anomaly detection method and device, electronic equipment and storage medium

Abstract

The invention provides an attack anomaly detection method and device, electronic equipment and a storage medium, and belongs to the technical field of network security, the method comprises the following steps: using a preset encoder model to calculate and update an embedded vector of each entity in a system interaction traceability graph in real time; for any audit event, splicing the embedded vectors of the subject and the object to obtain an embedded vector of the audit event, and inputting the embedded vector of the audit event into a preset decoder model to obtain a prediction type of the audit event output by the decoder model; determining a reconstruction error of the audit event based on the prediction type; and if the reconstruction error is greater than a first threshold value, determining that the audit event is an abnormal event, constructing an abnormal aggregation behavior graph based on the abnormal event, and extracting the abnormal aggregation behavior graph to obtain an attack abstract graph. According to the method, the anomaly detection cost can be remarkably reduced, the detection efficiency is improved, the system running for a long time can be monitored in real time, and the system safety is guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an attack anomaly detection method, device, electronic device and storage medium. Background Art

[0002] A Protective Intelligence and Detection System (PIDS) is a system used to protect network systems from complex and advanced threats, especially advanced persistent threats that are difficult to detect with traditional security measures. It is of great significance for protecting the network security of critical infrastructure, enterprises, and institutions.

[0003] Currently, practical PIDS applications typically leverage known or implemented attack tactics, techniques, and procedures (TTPs) to extract complex attack rules across audit events, enabling rapid and accurate identification of advanced persistent threats (APTs). This approach leverages threat intelligence's high-level attack tactics and low-level technical and procedural information, enabling analysts to understand attackers' behavioral intentions at a macro level and capture the full development of events when a system is attacked at a micro level. However, there is a semantic gap between threat intelligence described in text and the nodes in the attribution graph. Extracting complex attack rules based on threat intelligence is time-consuming and labor-intensive. Furthermore, APT attackers often conceal their attack behavior by exploiting zero-day vulnerabilities, adopting new attack tools, or modifying signatures, posing a significant challenge to the response capabilities of PIDSes based on threat intelligence.

[0004] Therefore, there is an urgent need for an attack anomaly detection method to solve the problems of high cost and inability to detect new attack tools in the existing technology. Summary of the Invention

[0005] The present invention provides an attack anomaly detection method, device, electronic device and storage medium to address the defects of the prior art in that attack detection is time-consuming, labor-intensive and incapable of detecting new attack tools.

[0006] The present invention provides an attack anomaly detection method, comprising the following steps: Use the pre-built encoder model to calculate and update the embedding vectors of each entity in the system interaction traceability graph in real time; For any audit event, concatenate the embedding vectors of the subject and the object to obtain the embedding vector of the audit event, input the embedding vector of the audit event into a preset decoder model, and obtain the predicted type of the audit event output by the preset decoder model; determining a reconstruction error of the audit event based on the prediction type; If the reconstruction error is greater than a first threshold, it is determined that the audit event is an abnormal event.

[0007] According to an attack anomaly detection method provided by the present invention, the preset encoder model includes: an entity state update module for, when a new audit event occurs, determining subject message characteristics and object message characteristics based on a historical state vector of the corresponding subject, a historical state vector of the corresponding object, and the audit event, and then updating the subject state vector and the object state vector using a gated recurrent unit based on the subject message characteristics and the object message characteristics; A neighbor state vector extraction module, configured to update the neighbor set of the subject and the neighbor set of the object; A new audit event embedding module is added, which is used to use a graph attention neural network to calculate the embedding vector of the subject at the current moment and the embedding vector of the object at the current moment based on the state vector of the updated neighbor set of the subject and the state vector of the updated neighbor set of the object.

[0008] According to an attack anomaly detection method provided by the present invention, the attack anomaly detection method further includes: Determine the time window length; When a new time window appears, if the suspicious node set of the new time window intersects with the suspicious node set of the historical entity interaction aggregation graph, the traceability graph of the new time window is appended to the historical entity interaction aggregation graph to obtain a new entity interaction aggregation graph, where the suspicious node set is a set of suspicious nodes, and the suspicious nodes include abnormal nodes and rare nodes. The abnormal nodes are subjects and objects corresponding to audit events with reconstruction errors greater than a second threshold, and the rare nodes are entities whose rarity index in benign behaviors is less than a rarity threshold. If the suspicious node set of the newly added time window does not have an intersection with the suspicious node set of any historical entity interaction aggregation graph, a new entity interaction aggregation graph is established using the traceability graph of the newly added time window; A risk score of the new entity interaction aggregate graph is calculated, and if the risk score is greater than a risk threshold, it is determined that the new entity interaction aggregate graph contains advanced persistent threat behavior.

[0009] According to an attack anomaly detection method provided by the present invention, the rarity index of a node is calculated based on the following formula: ; in, is a node The rarity index, is the total number of time windows, Contains nodes The number of time windows.

[0010] According to an attack anomaly detection method provided by the present invention, the risk score is the product of the anomaly scores of each time window in the new entity interaction aggregation graph, the anomaly score of a single time window is the average value of the reconstruction error of the abnormal edges in the time window, and the abnormal edges are edges corresponding to audit events whose reconstruction errors are greater than the second threshold.

[0011] According to an attack anomaly detection method provided by the present invention, the attack anomaly detection method further includes: Adding edges whose reconstruction errors are greater than the second threshold to the abnormal aggregation behavior graph; Initializing each node in the abnormal aggregation behavior graph as an independent community; For each node, the attack summary graph is obtained by moving the node from its current community to the target community, where the target community is the community that maximizes the gain in modularity, where modularity is the ratio of the density of connections within a community to the density of connections between communities.

[0012] The present invention also provides an attack anomaly detection device, comprising the following modules: The encoding module is used to use the pre-built encoder model to calculate and update the embedding vectors of each entity in the system interaction traceability graph in real time; A decoding module is configured to: for any audit event, concatenate the embedding vectors of the subject and the object to obtain the embedding vector of the audit event, input the embedding vector of the audit event into a preset decoder model, and obtain the predicted type of the audit event output by the preset decoder model; an error calculation module, configured to: determine a reconstruction error of the audit event based on the prediction type; The abnormality judgment module is used to: if the reconstruction error is greater than a first threshold, determine that the audit event is an abnormal event.

[0013] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, any of the above-described attack anomaly detection methods is implemented.

[0014] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the attack anomaly detection method described above is implemented.

[0015] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the above-mentioned attack anomaly detection methods.

[0016] The attack anomaly detection method, device, electronic device and storage medium provided by the present invention use a preset encoder model to calculate and update the embedding vectors of each entity in the system interaction traceability diagram in real time; for any audit event, the embedding vectors of the subject and the object are spliced to obtain the embedding vector of the audit event, and then the embedding vector of the audit event is input into the preset decoder model to obtain the predicted type of the audit event output by the preset decoder model; based on the predicted type, the reconstruction error of the audit event is determined; if the reconstruction error is greater than a first threshold, the audit event is determined to be an abnormal event. By calculating the reconstruction error of the audit event, this solution can estimate the degree of deviation from normal behavior, thereby discovering abnormal events in the host and realizing the detection of unknown attack behaviors in the system without relying on any specific attack fingerprint features, thereby significantly reducing the cost of anomaly detection and improving detection efficiency. It can also monitor long-term running systems in real time to ensure system security. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0018] Figure 1 Schematic diagram of the attack anomaly detection method provided by the present invention; Figure 2 It is a structural diagram of the preset encoder model provided by the present invention; Figure 3 1 is a flow chart of the reconstruction error calculation provided by the present invention; Figure 4 It is a structural diagram of the attack anomaly detection device provided by the present invention.

[0019] Figure 5 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0020] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0021] It should be noted that in the description of the embodiments of the present invention, the terms "comprise," "include," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprises a..." does not preclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element. Terms such as "upper" and "lower" indicate positions or location relationships based on those shown in the accompanying drawings and are intended solely for ease of description and simplification of the present invention. They are not intended to indicate or imply that the device or element referred to must have a specific orientation, be constructed, or operate in a specific orientation, and are therefore not to be construed as limiting the present invention. Unless otherwise expressly specified or limited, the terms "mounted," "connected," and "connected" should be broadly construed, for example, to mean a fixed connection, a detachable connection, or an integral connection; a mechanical connection or an electrical connection; a direct connection or an indirect connection through an intermediate medium; or internal communication between two elements. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0022] The terms "first," "second," and the like in this application are used to distinguish similar objects, and are not used to describe a specific order or precedence. It should be understood that such terms are interchangeable where appropriate, so that embodiments of this application can be implemented in an order other than that illustrated or described herein. Furthermore, the terms "first," "second," and the like generally distinguish objects of a class and do not limit the number of objects; for example, the first object can be one or more. Furthermore, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates an "or" relationship between the connected objects.

[0023] The following combination Figure 1-Figure 5 The present invention describes an attack anomaly detection method, device, electronic device, and storage medium provided by embodiments of the present invention.

[0024] Figure 1 FIG. 1 is a flow chart of the attack anomaly detection method provided by the present invention, such as Figure 1 As shown, the method includes the following: S110, using a pre-set encoder model to calculate and update the embedding vector of each entity in the system interaction traceability graph in real time; S120: For any audit event, concatenate the embedding vectors of the subject and the object to obtain the embedding vector of the audit event, input the embedding vector of the audit event into a preset decoder model, and obtain a predicted type of the audit event output by the preset decoder model; S130, determining a reconstruction error of the audit event based on the prediction type; S140: If the reconstruction error is greater than a first threshold, determine that the audit event is an abnormal event.

[0025] It should be noted that the execution subject of the attack anomaly detection method provided in the embodiment of the present application can be a server or computer device, such as a mobile phone, tablet computer, laptop computer, PDA, ultra-mobile personal computer (UMPC), netbook, etc.

[0026] Optionally, according to the type of each entity in the system interaction traceability diagram, each entity is encoded separately to obtain a feature vector of each entity.

[0027] In the specific implementation process, the entity attributes of host operation behaviors have hierarchical semantics. For example, the encoded vectors of two files in the same parent directory (for example, / var / log / wdev and / var / log / xdev) in the feature space will be closer than the vectors of files in different parent directories. How to retain this hierarchical semantic information is very critical for measuring the similarity of operation behaviors.

[0028] The entity attributes in the system interaction traceability diagram are diverse. To obtain consistent representation of heterogeneous attributes, different representation methods are used for different types of attributes in the embodiment of the present invention: (1) For enumerable types, such as edge types, one-hot encoding can be used; (2) For string types containing hierarchical semantic information, such as process names, file paths, socket IP addresses and other attributes, these feature attributes are encoded using hierarchical feature hashing technology.

[0029] Ultimately, the characteristic attributes of each node and edge in the traceability graph are represented as feature vectors that can be used for model learning.

[0030] Hierarchical feature hashing technology can project high-dimensional inputs into a low-dimensional feature space while preserving the hierarchical similarity between the original inputs. At the same time, no pre-training is required, and hashing techniques can be used to directly encode the characteristic attributes of entities that have never been seen. In order to perform hierarchical feature hashing, the attributes of the entity are encoded multiple times at different levels to capture the hierarchical information in the attributes. For example, for a file entity with a path name of / home / admin / clean, three substrings of the path need to be constructed: " / home", " / home / admin", and " / home / admin / clean". Then, each substring is Projected into the feature space. Each The eigenvector of dimension It is calculated as follows: ; in, is a character in the substring, It is a hash function that maps each character to a dimension index in the feature space; is another hash function that hashes a character to Therefore, if the dimension index obtained by the hash function is , The first feature vector Dimensions are set to value. Represents a substring Characteristic vector of entity attributes The eigenvector of is the sum of the eigenvectors of all its substrings.

[0031] It can be understood that, in the initial stage, the state vector of the entity is the feature vector of the entity.

[0032] In S110, system interaction traceability data records audit events related to interactions between different entities in the system kernel layer (such as processes, files, and sockets), describing the overall status of system execution. The system interaction traceability graph is a directed acyclic graph constructed based on this data. Each node represents a system entity, such as a process, file, or socket. Node attributes include the entity's identifier, type, and other related information. Each edge represents an interaction event, such as read, write, create, or delete, and points from a source node (subject) to a target node (object). Edge attributes include timestamps, operation types, and operation results. The system interaction traceability graph can be used to describe the interaction relationships between underlying entities.

[0033] In S120 , an audit event refers to various activities, operations, or abnormal situations recorded during the audit process.

[0034] In S130 , the reconstruction error is the difference between the input data and the reconstructed data (prediction type) when the model encodes the input data into a low-dimensional representation and then decodes it back into a high-dimensional space.

[0035] The attack anomaly detection method provided by the embodiment of the present invention uses a preset encoder model to calculate and update the embedding vectors of each entity in the system interaction traceability graph in real time; for any audit event, the embedding vectors of the subject and the object are spliced to obtain the embedding vector of the audit event, and then the embedding vector of the audit event is input into the preset decoder model to obtain the predicted type of the audit event output by the preset decoder model; based on the predicted type, the reconstruction error of the audit event is determined; if the reconstruction error is greater than a first threshold, the audit event is determined to be an abnormal event. This solution can estimate the degree of deviation from normal behavior by calculating the reconstruction error of the audit event, thereby discovering abnormal events in the host and detecting unknown attack behaviors in the system without relying on any specific attack fingerprint features, thereby significantly reducing the cost of anomaly detection and improving detection efficiency. It can also monitor long-term running systems in real time to ensure system security.

[0036] In an optional embodiment, the preset encoder model includes: The entity state update module 111 is configured to, when a new audit event occurs, determine subject message characteristics and object message characteristics based on the historical state vector of the corresponding subject, the historical state vector of the corresponding object, and the audit event, and then update the subject state vector and the object state vector using a gated recurrent unit based on the subject message characteristics and the object message characteristics; A neighbor state vector extraction module 112, configured to update the neighbor set of the subject and the neighbor set of the object; A new audit event embedding module 113 is added, which is used to use a graph attention neural network to calculate the embedding vector of the subject at the current moment and the embedding vector of the object at the current moment based on the state vector of the updated neighbor set of the subject and the state vector of the updated neighbor set of the object.

[0037] Figure 2 It is a structural diagram of the preset encoder model provided by the present invention, such as Figure 2 As shown, the preset encoder model provided by the present invention is an encoder model based on the Temporal Graph Neural Network (TGN), which includes an entity state update module, a neighbor state vector extraction module, and a new audit event embedding module. Specifically: Entity state update module 111, used to provide the latest state vector for the entity , record entities in the form of compressed vectors The entity’s interaction history with its neighbors is recorded, and the gated recurrent unit GRU is used to continuously iteratively update the entity’s state, thereby recording the entity’s long-term interaction history.

[0038] When New audit events appear all the time After that, the historical state vector of the subject and object and Will Entity message features contained in and Merge and iteratively update the state vector of the entity. Take the update process as an example to introduce the message characteristics of the subject The calculation process is as follows: ; in, is an entity The time of last interaction with other neighbors time interval, New audit events The embedding vector of . It is a learning module composed of multi-layer perceptrons. It performs nonlinear transformation on the input vector and outputs a vector as the message feature. Its dimension is consistent with the entity's state. After the interaction occurs, the subject and object state vectors are updated. The updated state vector of the subject is as follows: .

[0039] Neighbor state vector extraction module 112 is used to continuously update an entity's neighbor set. Given the high complexity of graph traversal, the entity's neighbor set (the set of all directly connected nodes to a node) is continuously updated as new audit events are added, avoiding multiple traversals of the graph structure. Whenever a new audit event occurs, the neighbor sets and neighbor state vectors of both entities are quickly obtained.

[0040] The new audit event embedding module 113 introduces the Graph Attention Network (GAT) as an encoder. For each new audit event, it aggregates the state vectors of the two entity neighbor sets to learn the latest embedding vector of the entity at the current moment. In this way, even if an entity There has been no activity for a long time, but its neighbors are likely to have recently participated in interactive activities. By fusing the state vectors of the neighbors, the model can still Calculate the latest embedding vector to avoid the problem of model rigidity. The embedding vectors of the subject and the object are concatenated to form the embedding vector of an entity interaction. For example, Embedding vector at time The calculation process is as follows: ; in, is an entity exist The set of neighbors between moments, It's the edge The eigenvector of It is a learnable module composed of a graph attention neural network called UniMP (Unified Multi-Task Graph Learning with Memory). It learns the spatial topology and time domain information of the historical graph to generate entity embedding vectors. Through the attention mechanism, it evaluates which neighbors are more important for generating entity embedding vectors during the message transmission process based on the entity feature vectors and interaction characteristics.

[0041] In this embodiment of the present invention, the pre-set encoder model uses a multi-head attention mechanism to improve the learning ability of the encoder. Specifically, the model uses 8 attention heads to learn the spatiotemporal information of the traceability graph, and then splices and fuses the outputs of each attention head to generate the entity At the moment Embedding vector of .

[0042] The attack anomaly detection method provided by the embodiment of the present invention records the long-term interaction history of the entity by iteratively updating the entity's status in real time, providing a reliable data basis for long-term threat detection; by continuously updating the entity's neighbor set, multiple traversals of the graph structure are avoided, the amount of data calculation is significantly reduced, and the efficiency of attack anomaly detection is improved; by updating the entity's latest embedding vector at the current moment in real time, model rigidity is avoided.

[0043] Figure 3 This is a flow chart of the reconstruction error calculation provided by the present invention, such as Figure 3 As shown, further, the subject is inferred through a multilayer perceptron (MLP) and the object The probability and type of events that occur between the two. The embedding vector of the corresponding audit event is obtained by concatenating the embedding vectors of the subject and the object. The decoder will Input to the multi-layer perceptron to calculate the type of audit event .

[0044] During the training process, the optimization goal of the autoencoder in the present invention is to make Compared to the edge types observed in the benign provenance graph The reconstruction error (RE) between is minimized. In this process, the Optimize the parameters of the newly added audit event embedding module, entity state update module, and audit event reconstruction module in the pre-built encoder model to minimize , allowing the decoder to more accurately reconstruct newly added types based on the historical graph. This iterative process yields the temporal evolution of interactions between entities in the provenance graph. During the testing phase, by calculating the reconstruction error of newly added audit events, the degree of deviation from normal behavior can be estimated, thereby identifying abnormal events in the host.

[0045] In an optional embodiment, the attack anomaly detection method further includes: Determine the time window length; When a new time window appears, if the suspicious node set of the new time window intersects with the suspicious node set of the historical entity interaction aggregation graph, the traceability graph of the new time window is appended to the historical entity interaction aggregation graph to obtain a new entity interaction aggregation graph, where the suspicious node set is a set of suspicious nodes, and the suspicious nodes include abnormal nodes and rare nodes. The abnormal nodes are subjects and objects corresponding to audit events with reconstruction errors greater than a second threshold, and the rare nodes are entities whose rarity index in benign behaviors is less than a rarity threshold. If the suspicious node set of the newly added time window does not have an intersection with the suspicious node set of any historical entity interaction aggregation graph, a new entity interaction aggregation graph is established using the traceability graph of the newly added time window; A risk score of the new entity interaction aggregate graph is calculated, and if the risk score is greater than a risk threshold, it is determined that the new entity interaction aggregate graph contains advanced persistent threat behavior.

[0046] In advanced persistent threats, attackers often use multi-step attacks to achieve their objectives. These causally related attacks may be spread over a long period of time. Due to the massive scale of the traceability graph, existing techniques for causally propagating anomalies based on topological connection analysis using methods such as path search or graph traversal are time-consuming and complex.

[0047] In the embodiment of the present invention, a fixed-length time window is set , locate important entities within the time window Through the propagation of abnormal behaviors of important entity sets in multiple time windows over a long period of time, a long-term host entity interaction aggregation graph with potential advanced persistent threats is discovered. Specifically, it includes: S141, suspicious node identification; S142, generating a long-term host entity interaction aggregation graph; S143, abnormal interaction aggregation graph detection.

[0048] In S141, the identification of suspicious nodes is determined based on the abnormality and rarity of the nodes. Specifically: (1) Anomalousness: if the reconstruction error of an edge is greater than the second threshold , then the source entity and destination entity of the edge are considered abnormal. The reconstruction error of all edges in , and for each time window Calculate a reconstruction threshold , under the premise that the reconstruction errors of all edges follow the normal distribution, It is defined as the average value of all reconstruction errors in a time window plus n times the standard deviation. n can be set according to actual usage requirements, for example, n=1.5; (2) Rareness: If the system entity corresponding to a node does not appear frequently or never appears in benign behavior, then the node is rare. Inverse Document Frequency (IDF) is a weight calculation method widely used in the field of information retrieval to measure the rarity of a word in a document collection. In this embodiment of the present invention, each node in the traceability graph is regarded as a word, and IDF is used to calculate the rarity of a node.

[0049] Optionally, for a given node 𝑣, its rarity index ,in, is the total number of time windows, Contains nodes If a node’s IDF score is above the rarity threshold , the model considers the node to be rare. Rarity threshold It is set to the average IDF value of all nodes in the training dataset plus m times the standard deviation, where m can be set according to actual usage requirements, for example, m=1.0.

[0050] It should be noted that, in the specific implementation process, the identification of suspicious nodes can be set according to actual usage requirements. It can be that only nodes with both abnormality and rarity are identified as suspicious nodes, or nodes with either abnormality or rarity are identified as suspicious nodes.

[0051] In S142, when a new time window appears in the dynamically changing traceability graph, the relationship between the traceability graph of the newly added time window and the suspicious nodes in the historical entity interaction aggregation graph is determined, and the abnormal causal relationship is propagated at a specific time window scale to complete the update of the entity interaction aggregation graph. Specifically: For a new time window , if the following conditions are met, ; Then judge The traceability graph of the time window is aggregated through suspicious nodes and existing behaviors Create a causal relationship, The traceability graph will be appended to the existing aggregation graph Among them, Represents all aggregate graphs, Representative aggregation graph All suspicious nodes in express All suspicious nodes within the time window.

[0052] Here, if If there is no causal connection with any existing behavior aggregation graph through the suspicious node, use The traceability graph within creates and initializes a new entity interaction aggregation graph.

[0053] Optionally, in S143, the risk score is the product of the anomaly scores of each time window in the new entity interaction aggregation graph, and the anomaly score of a single time window is the average of the reconstruction errors of the abnormal edges in the time window, and the abnormal edges are edges corresponding to audit events whose reconstruction errors are greater than the second threshold. Specifically: An aggregate graph The risk score is the risk of all time windows included in the graph The product of the anomaly scores of : ; Among them, a single time window The anomaly score is The reconstruction error is higher than the reconstruction threshold When a new time window is added to the aggregated behavior graph, the detection model dynamically updates the risk score of the aggregated graph. Whenever the risk score of the aggregated graph changes, the model compares the updated anomaly score with the risk threshold. to determine if there is an advanced persistent threat in the cohort.

[0054] Optionally, after model training, use a validation dataset containing only benign behaviors to set ,set up is the maximum risk score among all aggregated graphs in the validation dataset. If a cohort has an anomaly score greater than , the aggregated behavior graph (and all behaviors in the graph) will be detected as anomalies by the model and considered to be advanced persistent threat behaviors.

[0055] The attack anomaly detection method provided by the embodiment of the present invention discovers a long-term host entity interaction aggregation graph with potential advanced persistent threats through the propagation of abnormal behaviors of important entity sets in multiple time windows over a long period of time, thereby timely discovering potential long-term targeted network attacks in the system; the reconstruction error generated by graph representation learning is directly used to quantify the suspicious degree of nodes and accurately identify suspicious nodes.

[0056] In an optional embodiment, the attack anomaly detection method further includes: Adding edges whose reconstruction errors are greater than the second threshold to the abnormal aggregation behavior graph; Initializing each node in the abnormal aggregation behavior graph as an independent community; For each node, the attack summary graph is obtained by moving the node from its current community to the target community, where the target community is the community that maximizes the gain in modularity, where modularity is the ratio of the density of connections within a community to the density of connections between communities.

[0057] It is understandable that abnormal aggregation graphs contain thousands of nodes and edges, and benign behaviors and attack behaviors are intertwined. Due to the large scale and high complexity of these abnormal aggregation graphs, direct analysis will reduce processing efficiency and analysis accuracy. Therefore, when given an abnormal aggregation graph , merge the same type of edges from the same source and destination nodes, compressing the graph without changing its entity relationships scale.

[0058] It should be noted that placing the traceability graph compression process after anomaly event detection simplifies the attack graph while ensuring that the contextual information lost in the compression process does not affect the anomaly detection results.

[0059] In an embodiment of the present invention, in order to eliminate normal interaction processes and provide a panoramic overview of attacks with the same attack intent, an attack summary graph extraction model based on the clustering algorithm Louvain is designed based on the compressed abnormal aggregation graph. First, the entity interaction process with the same intent is cohesive and usually forms a dense community. Second, abnormal entity interaction processes have a high reconstruction error. Therefore, in the community discovery algorithm, while retaining the entity interaction relationship, the reconstruction error is used as the weight of the edge, aiming to divide behaviors with high abnormality and close interaction relationships into the same community. Specifically: Any one of Greater than the reconstruction threshold edge Join , a weighted graph is constructed for all abnormal aggregate behavior graphs ,Right now: ; The Louvain algorithm will Each node in is initialized as an independent community. , the algorithm will Move from their current neighborhood to one of its neighboring neighborhoods and eventually Join the community that maximizes modularity. Modularity is the ratio of the density of connections within a community to the density of connections between communities, and is used to measure the quality of community division.

[0060] In this embodiment of the present invention, attack summary graphs are composed of demarcated communities. These graphs concisely describe long-term attack behaviors. System administrators can quickly understand the attacker's entire attack process from the attack summary graph without having to trace back or forward through the entire traceability graph.

[0061] The following describes an attack anomaly detection device provided in an embodiment of the present application. The attack anomaly detection device described below and the attack anomaly detection method described above can refer to each other.

[0062] Figure 4 Schematic diagram of the attack anomaly detection device provided by the present invention. Figure 4 As shown, the attack anomaly detection device may include but is not limited to; The encoding module 410 is used to calculate and update the embedding vector of each entity in the system interaction traceability graph in real time using a preset encoder model; The decoding module 420 is configured to: for any audit event, concatenate the embedding vectors of the subject and the object to obtain the embedding vector of the audit event, input the embedding vector of the audit event into a preset decoder model, and obtain the predicted type of the audit event output by the preset decoder model; An error calculation module 430 is configured to: determine a reconstruction error of the audit event based on the prediction type; The abnormality judgment module 440 is used to: determine that the audit event is an abnormal event if the reconstruction error is greater than a first threshold.

[0063] It should be noted that the attack anomaly detection device provided in the embodiment of the present invention can execute the attack anomaly detection method described in any of the above embodiments during specific operation, which will not be described in detail in this embodiment.

[0064] Figure 5 An example of a physical structure diagram of an electronic device is shown below. Figure 5 As shown, the electronic device may include: a processor 510, a communications interface 520, a memory 530, and a communication bus 540, wherein the processor 510, the communications interface 520, and the memory 530 communicate with each other via the communication bus 540. The processor 510 may call the logic instructions in the memory 530 to execute the attack anomaly detection method, which includes: using a preset encoder model to calculate and update the embedding vector of each entity in the system interaction traceability graph in real time; For any audit event, concatenate the embedding vectors of the subject and the object to obtain the embedding vector of the audit event, input the embedding vector of the audit event into a preset decoder model, and obtain the predicted type of the audit event output by the preset decoder model; determining a reconstruction error of the audit event based on the prediction type; If the reconstruction error is greater than a first threshold, it is determined that the audit event is an abnormal event.

[0065] Furthermore, the logic instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a mobile hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0066] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can perform the attack anomaly detection method provided by the above methods, which includes: using a preset encoder model to calculate and update the embedding vector of each entity in the system interaction traceability graph in real time; For any audit event, concatenate the embedding vectors of the subject and the object to obtain the embedding vector of the audit event, input the embedding vector of the audit event into a preset decoder model, and obtain the predicted type of the audit event output by the preset decoder model; determining a reconstruction error of the audit event based on the prediction type; If the reconstruction error is greater than a first threshold, it is determined that the audit event is an abnormal event.

[0067] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the attack anomaly detection method provided by the above methods, the method comprising: using a preset encoder model to calculate and update the embedding vector of each entity in the system interaction traceability graph in real time; For any audit event, concatenate the embedding vectors of the subject and the object to obtain the embedding vector of the audit event, input the embedding vector of the audit event into a preset decoder model, and obtain the predicted type of the audit event output by the preset decoder model; determining a reconstruction error of the audit event based on the prediction type; If the reconstruction error is greater than a first threshold, it is determined that the audit event is an abnormal event.

[0068] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0069] Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0070] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for detecting an attack anomaly, characterized in that: include: Use the pre-built encoder model to calculate and update the embedding vectors of each entity in the system interaction traceability graph in real time; For any audit event, concatenate the embedding vectors of the subject and the object to obtain the embedding vector of the audit event, input the embedding vector of the audit event into a preset decoder model, and obtain the predicted type of the audit event output by the preset decoder model; determining a reconstruction error of the audit event based on the prediction type; If the reconstruction error is greater than a first threshold, it is determined that the audit event is an abnormal event.

2. The attack anomaly detection method according to claim 1, characterized in that: The pre-set encoder model includes: an entity state update module for, when a new audit event occurs, determining subject message characteristics and object message characteristics based on a historical state vector of the corresponding subject, a historical state vector of the corresponding object, and the audit event, and then updating the subject state vector and the object state vector using a gated recurrent unit based on the subject message characteristics and the object message characteristics; A neighbor state vector extraction module, configured to update the neighbor set of the subject and the neighbor set of the object; A new audit event embedding module is added, which is used to use a graph attention neural network to calculate the embedding vector of the subject at the current moment and the embedding vector of the object at the current moment based on the state vector of the updated neighbor set of the subject and the state vector of the updated neighbor set of the object.

3. The attack anomaly detection method according to claim 1, characterized in that: The attack anomaly detection method further includes: Determine the time window length; When a new time window appears, if the suspicious node set of the new time window intersects with the suspicious node set of the historical entity interaction aggregation graph, the traceability graph of the new time window is appended to the historical entity interaction aggregation graph to obtain a new entity interaction aggregation graph, where the suspicious node set is a set of suspicious nodes, and the suspicious nodes include abnormal nodes and rare nodes. The abnormal nodes are subjects and objects corresponding to audit events with reconstruction errors greater than a second threshold, and the rare nodes are entities whose rarity index in benign behaviors is less than a rarity threshold. If the suspicious node set of the newly added time window does not have an intersection with the suspicious node set of any historical entity interaction aggregation graph, a new entity interaction aggregation graph is established using the traceability graph of the newly added time window; A risk score of the new entity interaction aggregate graph is calculated, and if the risk score is greater than a risk threshold, it is determined that the new entity interaction aggregate graph contains advanced persistent threat behavior.

4. The attack anomaly detection method according to claim 3, characterized in that: The node rarity index is calculated based on the following formula: ； in, is a node The rarity index, is the total number of time windows, Contains nodes The number of time windows.

5. The attack anomaly detection method according to claim 3, characterized in that: The risk score is the product of the anomaly scores of each time window in the new entity interaction aggregation graph, and the anomaly score of a single time window is the average value of the reconstruction errors of the abnormal edges in the time window, and the abnormal edges are edges corresponding to audit events whose reconstruction errors are greater than the second threshold.

6. The attack anomaly detection method according to any one of claims 3 to 5, characterized in that: The attack anomaly detection method further includes: Adding edges whose reconstruction errors are greater than the second threshold to the abnormal aggregation behavior graph; Initializing each node in the abnormal aggregation behavior graph as an independent community; For each node, the attack summary graph is obtained by moving the node from its current community to the target community, where the target community is the community that maximizes the gain in modularity, where modularity is the ratio of the density of connections within a community to the density of connections between communities.

7. An attack anomaly detection device, characterized in that: include: The encoding module is used to use the pre-built encoder model to calculate and update the embedding vectors of each entity in the system interaction traceability graph in real time; A decoding module is configured to: for any audit event, concatenate the embedding vectors of the subject and the object to obtain the embedding vector of the audit event, input the embedding vector of the audit event into a preset decoder model, and obtain the predicted type of the audit event output by the preset decoder model; an error calculation module, configured to: determine a reconstruction error of the audit event based on the prediction type; The abnormality judgment module is used to: if the reconstruction error is greater than a first threshold, determine that the audit event is an abnormal event.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the attack anomaly detection method according to any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the attack anomaly detection method according to any one of claims 1 to 6 is implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the attack anomaly detection method according to any one of claims 1 to 6 is implemented.

Images