APT attack path reconstruction method based on time sequence diagram comparison clustering and medium

By constructing a heterogeneous timing graph collection and combining threat intelligence knowledge graphs for graph clustering, the problems of insufficient event correlation and poor adaptability of complex attacks in the existing APT attack path reconstruction method are solved, and efficient and accurate APT attack path reconstruction is achieved.

CN120474829AActive Publication Date: 2025-08-12EVERSEC BEIJING TECH
5 Cites 16 Cited by

Patent Information

Application Number
CN202510942976.9
Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Filing Date
2025-07-09
Publication Date
2025-08-12
Estimated Expiration
2045-07-09

AI Technical Summary

Technical Problem

The existing APT attack path reconstruction method is difficult to effectively express the correlation between events in large-scale, heterogeneous and fragmented security event streams, resulting in the multi-stage attack chain being segmented, lost or mis-stitched. The existing methods are poorly adaptable in complex concurrent attack activities, making it difficult to provide multi-dimensional visual replay methods, affecting response efficiency and accuracy.

Method used

By obtaining the standardized data set of security events, a heterogeneous timing graph collection is constructed and phase embedding annotation is performed, combining the multi-scale graph similarity algorithm of time alignment perception and threat intelligence knowledge graph, a semantic-guided weak supervision graph clustering framework is implemented, an attack path candidate graph is generated and integrity evaluation is performed, and logical conflicts are eliminated.

Benefits of technology

It improves the interpretability of APT traceability, reduces the subjective error of manual analysis, and improves the response efficiency and accuracy of attack path reconstruction.

✦ Generated by Eureka AI based on patent content.
Patent Text Reader

Abstract

The invention discloses an APT attack path reconstruction method based on time sequence diagram comparison clustering and a medium. A security event standardized data set is obtained; mapping each security event into a multi-modal node through a heterogeneous time sequence diagram set construction method, and generating a directed edge to construct and complete a heterogeneous time sequence diagram set; a stage embedding time sequence diagram set is obtained through the joint attack stage set; outputting a time sequence diagram similarity matrix by adopting a multi-scale diagram similarity algorithm of time alignment perception; generating an event semantic sparse matrix based on the threat intelligence knowledge graph; obtaining an image clustering result set; uncertain samples in the graph clustering result set are obtained and processed, and an APT attack path reconstruction result is obtained. The problem that an APT attack path reconstruction method mainly depends on rule matching, single-dimensional feature comparison and manual analysis of security logs or alarm streams is solved, the interpretability of APT traceability is greatly enhanced, and subjective errors of manual research and judgment are reduced.
Need to check novelty before this filing date? Find Prior Art