Apt attack path reconstruction method based on timing chart comparison clustering and medium

Abstract

The application discloses an APT attack path reconstruction method and medium based on a timing diagram comparison cluster. A security event standardized data set is acquired; each security event is mapped into a multi-modal node and a directed edge is generated by a heterogeneous timing diagram set construction method, so that a heterogeneous timing diagram set is constructed; a stage embedding timing diagram set is obtained through a joint attack stage set; a multi-scale graph similarity algorithm with time alignment perception is adopted to output a timing diagram similarity matrix; an event semantic sparse matrix is generated based on a threat intelligence knowledge graph; a graph clustering result set is obtained; uncertain samples in the graph clustering result set are acquired and processed to obtain an APT attack path reconstruction result. The APT attack path reconstruction method mainly depends on rule matching of security logs or alarm streams, single-dimensional feature comparison and manual analysis, the problem is solved, the explainability of APT tracing is greatly enhanced, and subjective errors of manual research and judgment are reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of network security data processing, and in particular to an APT attack path reconstruction method and medium based on time sequence graph comparison and clustering. Background Art

[0002] As cybersecurity threats become increasingly complex, advanced persistent threats (APTs) have become a key challenge. APT (Advanced Persistent Threat) attacks are typically stealthy, persistent, involve complex penetration paths, and exhibit distinct phased behavior. Attackers often achieve their targets through multi-stage, multi-hop lateral movement. Current methods for reconstructing APT attack paths primarily rely on rule matching, single-dimensional feature comparison, and manual analysis of security logs or alert streams.

[0003] In the process of realizing the present invention, the inventors found that the existing technology has the following defects: First, faced with large-scale, heterogeneous and fragmented security event streams, the existing solutions have obvious deficiencies in the normalized expression of security events and the modeling of correlations between events. Traditional time series tables or relational structures are difficult to simultaneously describe the topological dependencies and fine-grained temporal relationships between events, resulting in the multi-stage attack chain being split, lost or mis-splicing. During the attacker's lateral movement and persistence stage, event fragments are easily misjudged as irrelevant behaviors, and the tracing results are seriously incomplete.

[0004] Secondly, the existing rule-based or threshold-based similarity judgment methods have poor adaptability to complex concurrent attack activities. APT organizations often use multi-vector and multi-entry parallel infiltration. A single rule or threshold is often unable to accurately distinguish multiple attack paths, and is prone to cross-chain event confusion and misclassification of attack fragments, resulting in deviations in analysis conclusions and affecting response efficiency and accuracy.

[0005] Finally, existing technologies also have obvious shortcomings in the structured expression and interactive analysis capabilities of attack path results. Most traceability systems can only output linear event flows or static graphs, making it difficult to provide security analysts with multi-dimensional and multi-granular visual review methods. This limits the efficient tracing of event causality and stage flow, thereby affecting decision-making and emergency response. Summary of the Invention

[0006] The present invention provides an APT attack path reconstruction method and medium based on time sequence diagram comparison and clustering, so as to effectively enhance the interpretability of APT tracing and reduce the subjective errors of manual analysis and judgment.

[0007] According to one aspect of the present invention, a method for reconstructing an APT attack path based on time sequence graph comparison and clustering is provided, which includes:

[0008] Obtaining a standardized security event data set; wherein the standardized security event data set includes at least one security event;

[0009] By using a preset heterogeneous time sequence graph set construction method, each of the security events is mapped into a multimodal node and a directed edge is generated to complete the construction of the heterogeneous time sequence graph set;

[0010] Through the pre-set joint attack phase set, each multimodal node is annotated with phase embedding based on the heterogeneous timing graph set to obtain the phase embedding timing graph set;

[0011] A time-alignment-aware multi-scale graph similarity algorithm is used to perform pairwise comparisons on the set of stage-embedded timing graphs and output a timing graph similarity matrix.

[0012] Based on the threat intelligence knowledge graph, the semantic similarity of each security event in the security event standardized data set is calculated to generate an event semantic sparse matrix;

[0013] Taking the time sequence graph similarity matrix as input, under the constraint of the event semantic sparse matrix, a semantic-guided weakly supervised graph clustering framework method is executed, and cluster analysis is performed on the heterogeneous time sequence graph set through density reachability rule and hierarchical merging strategy to obtain a graph clustering result set;

[0014] Acquire uncertain samples from the graph clustering result set and perform iterative clustering optimization using a pseudo-label self-enhancement mechanism to generate a time-series graph enhanced clustering result. Furthermore, within each cluster of the time-series graph enhanced clustering result, perform multi-window aligned path sorting and splicing based on topological dependencies and time order to form a set of attack path candidate graphs arranged continuously by stage.

[0015] The candidate attack path graphs are evaluated for integrity and checked for consistency, and logically conflicting segments are removed to obtain the APT attack path reconstruction results.

[0016] According to another aspect of the present invention, a device for reconstructing an APT attack path based on time sequence diagram comparison and clustering is provided, which includes:

[0017] A security event standardized data set acquisition module, configured to acquire a security event standardized data set; wherein the security event standardized data set includes at least one security event;

[0018] A heterogeneous timing graph set construction module is used to map each of the security events into a multimodal node and generate directed edges to complete the construction of the heterogeneous timing graph set through a preset heterogeneous timing graph set construction method;

[0019] A phase-embedded timing diagram set determination module is used to perform phase-embedded annotation on each multimodal node based on a pre-set joint attack phase set and a heterogeneous timing diagram set to obtain a phase-embedded timing diagram set;

[0020] The timing graph similarity matrix output module is used to use the time alignment-aware multi-scale graph similarity algorithm to perform pairwise comparisons on the set of stage-embedded timing graphs and output the timing graph similarity matrix;

[0021] An event semantic sparse matrix generation module is used to calculate the semantic similarity of each security event in the security event standardized data set based on the threat intelligence knowledge graph to generate an event semantic sparse matrix;

[0022] A graph clustering result set determination module is configured to take the time sequence graph similarity matrix as input, execute a semantically guided weakly supervised graph clustering framework method under the constraint of the event semantic sparse matrix, and perform cluster analysis on the heterogeneous time sequence graph set through density reachability rules and hierarchical merging strategies to obtain a graph clustering result set;

[0023] The attack path candidate graph set formation module is used to obtain uncertain samples from the graph clustering result set and use a pseudo-label self-enhancement mechanism to perform iterative clustering optimization to generate a time-series graph enhanced clustering result. In addition, within each cluster of the time-series graph enhanced clustering result, multi-window aligned path sorting and splicing are performed based on topological dependencies and time sequence to form a set of attack path candidate graphs arranged continuously by stage.

[0024] The APT attack path reconstruction result determination module is used to perform integrity assessment and consistency verification on the attack path candidate graphs, remove logically conflicting fragments, and obtain the APT attack path reconstruction result.

[0025] According to another aspect of the present invention, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method for reconstructing an APT attack path based on timing graph comparison and clustering as described in any embodiment of the present invention is implemented.

[0026] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the APT attack path reconstruction method based on timing diagram comparison clustering according to any embodiment of the present invention when executed.

[0027] The technical solution of the embodiment of the present invention is to obtain a standardized data set of security events; map each of the security events into a multimodal node through a pre-set heterogeneous timing graph set construction method, and generate directed edges to complete the construction of a heterogeneous timing graph set; perform phase embedding annotation on each multimodal node based on the heterogeneous timing graph set through a pre-set joint attack phase set to obtain a phase embedded timing graph set; use a time alignment-aware multi-scale graph similarity algorithm to perform pairwise comparison on the phase embedded timing graph set and output a timing graph similarity matrix; calculate the semantic similarity of each security event in the standardized data set of security events based on a threat intelligence knowledge graph to generate an event semantic sparse matrix; use the timing graph similarity matrix as Input, under the constraints of the event semantic sparse matrix, execute the semantic-guided weakly supervised graph clustering framework method, and cluster analysis is performed on the heterogeneous time series graph set through density reachability rules and hierarchical merging strategy to obtain a graph clustering result set; obtain uncertain samples in the graph clustering result set, and use the pseudo-label self-enhancement mechanism to iteratively optimize clustering to generate enhanced clustering results of the time series graph, and within each cluster of the enhanced clustering results of the time series graph, perform multi-window aligned path sorting and splicing based on topological dependencies and time sequence to form a set of attack path candidate graphs arranged continuously by stage; perform integrity assessment and consistency verification on the attack path candidate graphs, remove logically conflicting fragments, and obtain the APT attack path reconstruction result. This solves the problem that the APT attack path reconstruction method mainly relies on rule matching, single-dimensional feature comparison and manual analysis of security logs or alarm streams, greatly enhances the interpretability of APT traceability, reduces the subjective errors of manual judgment, and improves the response efficiency and accuracy of APT attack path reconstruction.

[0028] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0030] Figure 1 This is a flow chart of an APT attack path reconstruction method based on time sequence diagram comparison and clustering according to the first embodiment of the present invention;

[0031] Figure 2This is a detailed flow chart of an APT attack path reconstruction method based on time sequence diagram comparison and clustering according to the second embodiment of the present invention;

[0032] Figure 3 2 is a schematic structural diagram of an APT attack path reconstruction device based on time sequence diagram comparison and clustering according to a third embodiment of the present invention;

[0033] Figure 4 It is a structural diagram of an electronic device provided according to the fourth embodiment of the present invention. DETAILED DESCRIPTION

[0034] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0035] It should be noted that the terms "target", "current", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0036] Example 1

[0037] Figure 1 A flowchart of an APT attack path reconstruction method based on timing graph comparison and clustering is provided for the first embodiment of the present invention. This embodiment is applicable to the situation where an APT attack path is reconstructed in network security. The method can be executed by an APT attack path reconstruction device based on timing graph comparison and clustering. The APT attack path reconstruction device based on timing graph comparison and clustering can be implemented in the form of hardware and / or software.

[0038] Correspondingly, such as Figure 1 As shown, the method includes:

[0039] S110. Obtain a standardized security event data set.

[0040] The security event standardized data set includes at least one security event.

[0041] Optionally, obtaining a standardized data set of security events includes: constructing an original security event data set, wherein the original security event data set includes at least one type of original security event data; inputting each type of original security event data into a preset field mapping function, and performing field standardization processing to generate an intermediate set of security events after field mapping; performing time alignment processing on the intermediate set of security events after field mapping through a preset time reference to obtain a standardized data set of security events after time alignment; obtaining and sorting the timestamps corresponding to each security event in the standardized data set of security events in ascending order of time to obtain a standardized data set of security events.

[0042] In this embodiment, the original security event data set includes at least one type of security event original data, and each security event original data may include the timestamp of the security event, the host identifier to which the security event belongs, the security event source type label, the security event content information, and the original confidence level score of the security event, etc.

[0043] Specifically, raw security event data can be collected from host logs, network traffic, intrusion detection system alarms, and sandbox analysis reports.

[0044] S120 . Map each of the security events into a multimodal node and generate directed edges through a preset heterogeneous timing graph set construction method to complete the construction of the heterogeneous timing graph set.

[0045] Optionally, the method for constructing a heterogeneous timing diagram set is used to map each of the security events into a multimodal node and generate directed edges to complete the construction of the heterogeneous timing diagram set, including: mapping each of the security events into a multimodal node through the pre-set heterogeneous timing diagram set construction method, and obtaining a multimodal node set; wherein the attributes of each of the multimodal nodes include: event type label, host identifier, event source device role, account authority level, and event confidence score; according to each of the security events, identifying event pairs with temporal sequence logic and semantic association, and generating directed edges based on each of the event pairs, and obtaining a directed edge set; wherein each directed edge is composed of an event association type label, a context label, and a time weight; integrating the multimodal node set and the directed edge set to construct a heterogeneous timing diagram set; wherein each heterogeneous timing diagram in the heterogeneous timing diagram set is composed of a group of multimodal nodes and a group of directed edges that satisfy the temporal sequence logic.

[0046] Among them, the attributes of a multimodal node may include attributes such as event type label, host identifier, event source device role, account authority level, and event confidence score.

[0047] Specifically, the event type label is used to indicate the behavior category to which the security event belongs; the host identifier is used to uniquely mark the device where the security event occurred; the event source device role is used to describe the functional positioning of the host in the network environment; the account permission level is used to indicate the permission level of the account involved in the event; the event confidence score is a normalized value used to reflect the importance or credibility of the security event.

[0048] In this embodiment, the event correlation type tag is used to describe the logical dependencies between events, specifically including causal relationships, communication session relationships, or resource derivation relationships. The context tag is used to identify the attack semantic context corresponding to the event pair in the attack path. The time weight is used to characterize the time interval difference between events and is defined as the unified timestamp of the ending event minus the unified timestamp of the starting event.

[0049] Specifically, all directed edges contained in the heterogeneous timing graph corresponding to the heterogeneous timing graph set must satisfy the following constraints: the start node and the end node of the directed edge both belong to the node set of the current heterogeneous timing graph, and the event time order must satisfy that the unified timestamp of the end node is later than the unified timestamp of the start node.

[0050] S130 , using a preset joint attack phase set, and based on a heterogeneous timing graph set, performing phase embedding annotation on each multimodal node to obtain a phase embedding timing graph set.

[0051] Optionally, the joint attack stage set includes: initial penetration stage, authority escalation stage, lateral movement stage, persistence stage and data exfiltration stage; the pre-set joint attack stage set is used to perform stage embedding annotation on multimodal nodes based on a heterogeneous timing diagram set to obtain a stage embedded timing diagram set, including: according to the joint attack stage set, each multimodal node is assigned to any target attack stage in the joint attack stage set through a stage mapping function; wherein the stage mapping function takes the attributes of the multimodal node and the acquired context information as input, and outputs the attack stage label to which each multimodal node belongs; for each multimodal node, a stage embedding vector is constructed; the stage embedding vector is appended as an attribute of each multimodal node to obtain a multimodal stage embedding node set containing the stage embedding vector; and a stage embedded timing diagram set is constructed with the multimodal stage embedding node set and the directed edge set as components.

[0052] In this embodiment, each element of the stage embedding vector is a binary value. If the graph node belongs to a certain stage (any of the initial penetration stage, privilege escalation stage, lateral movement stage, persistence stage, and data exfiltration stage), the element corresponding to the stage is 1, otherwise it is 0.

[0053] Each node in the multimodal phase-embedded node set includes its original attributes and a phase-embedded vector. While the phase-embedded vector is appended to the node set, the time weight of each edge in the directed edge set remains unchanged. The time weight is the unified timestamp of the ending node minus the unified timestamp of the starting node.

[0054] In addition, each stage-embedded timing graph in the stage-embedded timing graph set consists of a subset of the node set and a subset of the directed edge set, and all edges must satisfy the time order constraint that the unified timestamp of the end node is greater than the unified timestamp of the start node.

[0055] S140: Using a time alignment-aware multi-scale graph similarity algorithm, perform pairwise comparisons on the set of stage-embedded timing graphs, and output a timing graph similarity matrix.

[0056] S150. Based on the threat intelligence knowledge graph, calculate the semantic similarity of each security event in the security event standardized data set to generate an event semantic sparse matrix.

[0057] Optionally, the method calculates the semantic similarity of each security event in the security event standardized data set based on the threat intelligence knowledge graph and generates an event semantic sparse matrix, including: constructing a threat intelligence knowledge graph; wherein the threat intelligence knowledge graph includes an entity set and an entity relationship set, establishing a threat intelligence knowledge graph through a structured threat intelligence source, and converting each entity and each entity relationship into a vector embedding representation; extracting event semantic feature representations for the standardized data of each security event in the security event standardized data set; calculating the security event semantic similarity between the standardized data of any two security events in the security event standardized data set based on the semantic feature representations of each event; setting a semantic similarity sparse threshold, when the security event semantic similarity is less than the semantic similarity sparse threshold, setting its corresponding element in the event semantic sparse matrix to 0, and when the security event semantic similarity is not less than the semantic similarity sparse threshold, the corresponding element in the event semantic sparse matrix is ​​the semantic similarity between the two security event standardized data, and generating an event semantic sparse matrix.

[0058] The entity set includes multiple threat intelligence entities such as attack behavior, attack tool, attack target, and attack feature. The entity relationship set includes semantic relationships between use, belonging, influence, and derived entities.

[0059] In this embodiment, the event semantic feature is represented as an entity embedding vector of the event content information on the threat intelligence knowledge graph, and each standardized data of a security event corresponds to a unique event semantic feature representation.

[0060] Specifically, the semantic similarity of security events is the normalized cosine similarity between the semantic features of the two corresponding security events. Generally speaking, the value range of the semantic similarity of security events is from -1 to 1. The closer the value is to 1, the closer the semantics of the two security events are.

[0061] In detail, the event semantic sparse matrix is ​​a real number matrix with N rows and N columns, where N is the number of security events in the security event standardized dataset.

[0062] S160. Taking the time sequence graph similarity matrix as input, under the constraint of the event semantic sparse matrix, execute the semantic-guided weakly supervised graph clustering framework method, and perform cluster analysis on the heterogeneous time sequence graph set through density reachability rules and hierarchical merging strategy to obtain a graph clustering result set.

[0063] Optionally, the method takes the timing graph similarity matrix as input, executes the semantic-guided weakly supervised graph clustering framework method under the constraint of the event semantic sparse matrix, and performs cluster analysis on the heterogeneous timing graph set through density reachability rule and hierarchical merging strategy to obtain a graph clustering result set, including: taking the timing graph similarity matrix as input, and introducing the event semantic sparse matrix as semantic guidance constraint, constructing a timing graph semantic adjacency graph, wherein the nodes in the timing graph semantic adjacency graph are multimodal stage embedding nodes of all stage-embedded timing graphs in the stage-embedded timing graph set, and the edges in the timing graph semantic adjacency graph are only included when they meet the pre-defined conditions. The method is established when the two conditions are met at the same time; wherein, the first condition is that the corresponding element in the similarity matrix of the time sequence graph is greater than or equal to the similarity threshold, and the second condition is that between the standardized data of security events corresponding to the two stage embedded time sequence graphs, there is at least one pair of events whose security event semantic similarity in the event semantic sparse matrix is ​​greater than or equal to the semantic similarity threshold; in the semantic adjacency graph of the time sequence graph, the weakly supervised graph clustering framework method is executed, the minimum number of adjacent nodes of the density core and the search radius parameter are set, and each stage in the node set in the semantic adjacency graph of the time sequence graph is embedded in the time sequence graph according to the adjacent stages within the search radius parameter. The classification is performed based on whether the number of embedded time sequence graphs is greater than or equal to the minimum number of density core neighbors to obtain an initial graph clustering result set; wherein, the initial graph clustering result set is divided into core stage embedded time sequence graphs, boundary stage embedded time sequence graphs and noise stage embedded time sequence graphs; each cluster in the initial graph clustering result set is composed of at least one stage embedded time sequence graph, and each stage embedded time sequence graph is assigned to any one of the core cluster clusters, boundary cluster clusters or noise cluster clusters; based on the initial graph clustering result set, a hierarchical merging strategy is executed to aggregate each initial cluster according to the average similarity between clusters. When the average similarity between any two clusters is greater than or equal to the cluster merging similarity threshold, the two clusters are merged to obtain a new cluster. The aggregation process is repeated until the average similarity between all clusters is less than the cluster merging similarity threshold, and the current graph clustering result set is obtained. The hierarchical merging strategy is iteratively executed until the average similarity between any two clusters is less than the graph cluster merging similarity threshold, and the graph clustering result set is obtained. Each cluster in the graph clustering result set consists of at least one stage embedded in a time sequence graph, representing a cluster of APT attack path fragments.

[0064] In this embodiment, the time sequence graph semantic adjacency graph can be constructed as ,in, is the set of nodes in the semantic adjacency graph of the temporal graph, is the edge set in the semantic adjacency graph of the temporal graph.

[0065] Specifically, the edges in the semantic adjacency graph of the timing graph are established only when two preset conditions are met at the same time; the first condition is that the corresponding elements in the timing graph similarity matrix are greater than or equal to the similarity threshold, and the second condition is that between the standardized data of security events corresponding to the two stage embedded timing graphs, there is at least one pair of events whose security event semantic similarity in the event semantic sparse matrix is ​​greater than or equal to the semantic similarity threshold.

[0066] It can be expressed by the expression: ,in, is the graph similarity value between the m-th stage embedding timing diagram and the n-th stage embedding timing diagram; m and n represent the index numbers of the two stage embedding timing diagrams to be compared respectively; is the i-th security event node; is the jth security event node; For security incidents and security incidents The semantic similarity of security events between them, i and j represent the index numbers of security event nodes respectively;

[0067] Specifically, the density core minimum number of neighbors MinPts is used to limit the search radius parameter The threshold of the number of adjacent phase embedding time graphs within a phase embedding time graph that is considered as the density core. Used to limit the similarity neighborhood range between stage embedding timing graphs.

[0068] Among them, the core phase embedding timing diagram is in the search radius parameter A phase embedding timing graph is one whose number of adjacent phase embedding timing graphs within the scope is greater than or equal to the minimum density core adjacency number, MinPts. A boundary phase embedding timing graph is one that is connected to a core phase embedding timing graph but whose number of adjacent phase embedding timing graphs is less than the minimum density core adjacency number, MinPts. A noise phase embedding timing graph is one that is neither a core phase embedding timing graph nor a boundary phase embedding timing graph.

[0069] S170. Acquire uncertain samples from the graph clustering result set, and use a pseudo-label self-enhancement mechanism to perform iterative clustering optimization to generate a time-series graph enhanced clustering result. In addition, within each cluster of the time-series graph enhanced clustering result, perform multi-window aligned path sorting and splicing based on topological dependencies and time sequence to form a set of attack path candidate graphs arranged continuously by stage.

[0070] Optionally, the uncertain samples in the graph clustering result set are obtained, and a pseudo-label self-enhancement mechanism is used to perform iterative clustering optimization to generate a time-series graph enhanced clustering result, and in each cluster cluster of the time-series graph enhanced clustering result, multi-window aligned path sorting and splicing are performed according to topological dependency and time sequence to form an attack path candidate graph arranged continuously by stage, including: identifying cluster clusters containing boundary stage embedded time-series graphs and noise stage embedded time-series graphs and isolated graph samples for the graph clustering result set, and calculating the pseudo-label similarity distribution between the uncertain stage embedded time-series graph and each cluster cluster based on the stage embedded time-series graph assigned to each core cluster cluster; using the pseudo-label self-enhancement mechanism, all uncertain stage embedded time-series graphs that meet the pseudo-label assignment conditions are reallocated to the target cluster cluster according to the principle of maximizing the mean pseudo-label similarity, thereby forming a new enhanced graph clustering result set, and repeating the process of calculating the pseudo-label assignment and graph cluster update until the enhanced graph clustering result set is consistent with the previous one. The difference ratio of a round of clustering result sets is less than the cluster boundary convergence threshold, and an enhanced graph clustering result set is obtained; for the enhanced graph clustering result set, the node set and edge set of all stage embedded time sequence graphs in each cluster cluster are extracted, and the node set and the edge set are integrated to construct an attack path fusion graph containing the structural information of all stage embedded time sequence graphs of each cluster cluster; all nodes of the attack path fusion graph are jointly sorted according to the unified timestamp and stage embedding vector of each node; wherein, the joint sorting rule arranges the nodes according to the attack stage order represented by the stage embedding vector; the node sequence after the joint sorting is sequentially composed into path segments, and the path is spliced ​​by executing multi-window alignment paths in time sequence to obtain a set of attack path candidate graphs that are continuously arranged by stage and have complete time sequence; wherein, the attack path candidate graph set includes at least one attack path candidate graph, and each attack path candidate graph represents an APT attack path.

[0071] The node set of the attack path fusion graph is the union of the node sets of all phases embedded in the time sequence graph within the cluster, and the edge set of the attack path fusion graph is the union of the edge sets of all phases embedded in the time sequence graph within the cluster.

[0072] Specifically, the joint sorting rule arranges nodes in the order of the attack phases represented by the phase embedding vectors, and can arrange them in ascending order according to the unified timestamp within the same attack phase.

[0073] Among them, multi-window alignment can be a sliding time window mechanism. Specifically, the node sequence after joint sorting is sequentially organized into path segments, and the paths are spliced ​​through the sliding time window mechanism. The window width parameter of the sliding time window mechanism limits the unified timestamp interval of two adjacent nodes. Only when the unified timestamp interval of two adjacent nodes is less than or equal to the time window width parameter, the two nodes will be spliced ​​into the same continuous attack path segment, and finally a set of attack path candidate graphs that are continuously arranged in stages and have complete temporal sequence are obtained. Each attack path candidate graph represents an APT attack path, which meets the requirements of topological coherence and temporal causal consistency, and thus a set of attack path candidate graphs that are continuously arranged in stages and have complete temporal sequence are obtained.

[0074] S180: Perform integrity assessment and consistency check on the candidate attack path graphs, remove logically conflicting segments, and obtain the APT attack path reconstruction result.

[0075] The technical solution of the embodiment of the present invention is to obtain a standardized data set of security events; map each of the security events into a multimodal node through a pre-set heterogeneous timing graph set construction method, and generate directed edges to complete the construction of a heterogeneous timing graph set; perform phase embedding annotation on each multimodal node based on the heterogeneous timing graph set through a pre-set joint attack phase set to obtain a phase embedded timing graph set; use a time alignment-aware multi-scale graph similarity algorithm to perform pairwise comparison on the phase embedded timing graph set and output a timing graph similarity matrix; calculate the semantic similarity of each security event in the standardized data set of security events based on a threat intelligence knowledge graph to generate an event semantic sparse matrix; use the timing graph similarity matrix as Input, under the constraints of the event semantic sparse matrix, execute the semantic-guided weakly supervised graph clustering framework method, and cluster analysis is performed on the heterogeneous time series graph set through density reachability rules and hierarchical merging strategy to obtain a graph clustering result set; obtain uncertain samples in the graph clustering result set, and use the pseudo-label self-enhancement mechanism to iteratively optimize clustering to generate enhanced clustering results of the time series graph, and within each cluster of the enhanced clustering results of the time series graph, perform multi-window aligned path sorting and splicing based on topological dependencies and time sequence to form a set of attack path candidate graphs arranged continuously by stage; perform integrity assessment and consistency verification on the attack path candidate graphs, remove logically conflicting fragments, and obtain the APT attack path reconstruction result. This solves the problem that the APT attack path reconstruction method mainly relies on rule matching, single-dimensional feature comparison and manual analysis of security logs or alarm streams, greatly enhances the interpretability of APT traceability, reduces the subjective errors of manual judgment, and improves the response efficiency and accuracy of APT attack path reconstruction.

[0076] Example 2

[0077] Figure 2 is a detailed flowchart of an APT attack path reconstruction method based on timing diagram comparison clustering according to Embodiment Two of the present application. This embodiment is refined based on the above-mentioned embodiments. In this embodiment, the multi-scale graph similarity algorithm using time alignment perception is used to compare two timing diagrams in the phase embedding timing diagram set, and a timing diagram similarity matrix is output for further refinement.

[0078] S210, acquire a security event standardized dataset.

[0079] The security event standardized dataset includes at least one security event.

[0080] S220, map each security event to a multi-modal node and generate a directed edge to complete the construction of a heterogeneous timing diagram set by using a pre-set heterogeneous timing diagram set construction method.

[0081] S230, based on the heterogeneous timing diagram set, perform phase embedding annotation on each multi-modal node by using a pre-set joint attack phase set to obtain a phase embedding timing diagram set.

[0082] S240, for the phase embedding timing diagram set, define a multi-scale graph similarity calculation function, and sequentially input any two phase embedding timing diagrams in the phase embedding timing diagram set as input, and calculate the corresponding structural topology similarity, phase order similarity and time deviation similarity through three dimensions of structural topology, phase order and time deviation.

[0083] Optionally, for the phase embedding timing diagram set, according to the pre-set multi-scale graph similarity calculation function, any two phase embedding timing diagrams in the phase embedding timing diagram set are sequentially input as input, and the corresponding structural topology similarity, phase order similarity and time deviation similarity are calculated through three dimensions of structural topology, phase order and time deviation, including: for the phase embedding timing diagram set, according to the pre-set multi-scale graph similarity calculation function, any two phase embedding timing diagrams in the phase embedding timing diagram set are sequentially input as input, and the adjacency matrix topology consistency of the two phase embedding timing diagrams is calculated through structural topology to obtain the structural topology similarity ; wherein the expression of the structural topology similarity is , wherein, is the mth phase embedding timing diagram; is the nth phase embedding timing diagram; is the directed edge set in ; the directed edge set in ; the cosine similarity of the multi-modal node phase embedding vector is calculated through the phase order to obtain the phase order similarity ​; wherein the expression of the stage order similarity is ; is a stage embedding vector of the multimodal node in ; is a stage embedding vector of the multimodal node in ; is the i-th multimodal node in ; is the j-th multimodal node in ; is the m-th multimodal node set in the stage embedding time sequence graph in ; is the n-th multimodal node set in the stage embedding time sequence graph in ; the time weight difference of the directed edge corresponding edge is calculated by the time deviation, and the time deviation similarity is obtained ; wherein the expression of the time deviation similarity is ; is the time weight corresponding to the directed edge in ; is the time weight corresponding to the directed edge in ; is a directed edge in the directed edge set, from the multimodal node to the multimodal node .

[0084] wherein the stage embedding time sequence graph set can be , wherein is a node set in the k-th stage embedding time sequence graph; is an edge set in the k-th stage embedding time sequence graph, and k is the number of stages.

[0085] S250, the structural topology similarity, the stage order similarity and the time deviation similarity are integrated to obtain a comprehensive weight time sequence graph similarity.

[0086] S260, all the stage embedding time sequence graphs in the stage embedding time sequence graph set are combined in pairs, and the comprehensive weight time sequence graph similarity is calculated to obtain a time sequence graph similarity matrix.

[0087] S270, based on the threat intelligence knowledge graph, the semantic similarity of each security event in the security event standardized data set is calculated to generate an event semantic sparse matrix.

[0088] S280. Taking the time sequence graph similarity matrix as input, under the constraint of the event semantic sparse matrix, execute the semantic-guided weakly supervised graph clustering framework method, and perform cluster analysis on the heterogeneous time sequence graph set through density reachability rules and hierarchical merging strategy to obtain a graph clustering result set.

[0089] S290. Obtain uncertain samples from the graph clustering result set, and use the pseudo-label self-enhancement mechanism to perform iterative clustering optimization to generate a time-series graph enhanced clustering result. In addition, within each cluster of the time-series graph enhanced clustering result, perform multi-window aligned path sorting and splicing based on topological dependencies and time sequence to form a set of attack path candidate graphs arranged continuously by stage.

[0090] S2100: Perform integrity assessment and consistency check on the candidate attack path graphs, remove logically conflicting segments, and obtain the APT attack path reconstruction result.

[0091] The technical solution of the embodiment of the present invention realizes the unified modeling of heterogeneous timing graphs that integrate topological structure and timing information, improves the integrity and accuracy of multi-stage APT attack chain reconstruction, and constructs a set of heterogeneous timing graphs by standardizing multi-source security events and mapping them into nodes with multimodal attributes, and using multiple associated directed edges with semantic labels and time weights. The attack stage embedding vector is combined to integrate topological dependencies and stage timing information in the same graph structure, so that various fragments of the multi-stage attack chain can be merged with high precision in a unified space, effectively solving the problems of fragmentation of attack chain fragments, lateral movement and incomplete reconstruction of persistence links in the prior art. Through time-aligned multi-scale graph similarity calculation and weakly supervised clustering algorithm, the ability to distinguish concurrent APT paths and the robustness of clustering are significantly improved. A graph similarity measurement method based on the triple factors of structural topology, attack stage sequence and time deviation is designed. Combined with the threat intelligence knowledge graph, an event semantic sparse matrix is ​​constructed through entity embedding vectors and normalized cosine similarity. In the clustering stage, the graph similarity matrix is ​​used as input, combined with semantic constraints and multi-dimensional verification to effectively prevent the mis-merging of parallel attack chain fragments. The pseudo-label self-enhancement mechanism further optimizes the clustering boundaries, improving the automatic separation capability of attack paths and clustering convergence efficiency in complex scenarios. It realizes the automatic splicing of attack path candidate graphs with continuous stages and topological coherence and highly interpretable path visual playback, improving the traceability efficiency and decision-making ability of security operations. Within each cluster, the nodes are sorted in a multi-level orderly manner according to the attack stage and unified timestamp through multi-window alignment, and the attack path candidate graph with continuous arrangement and complete time sequence is automatically generated. The candidate graph supports dynamic visualization, which is convenient for analysts to trace back the causal flow relationship of each stage and each step with one click, greatly enhancing the interpretability of APT traceability and reducing the subjective errors of manual research and judgment.

[0092] A specific embodiment:

[0093] Consider the security operations scenario of an energy group. Its system-on-chip (SOC) is responsible for maintaining the network security of over 1,200 industrial control hosts and office servers across the city. From March 8th to 15th, the energy group's SOC received numerous distributed security alerts covering multiple network segments, including office areas, dispatch centers, and plant control rooms. During this period, the SOC discovered multiple security event logs containing suspected multi-stage intrusions carried out by the same hacker group. The attacks were accompanied by clear signs of lateral movement, privilege escalation, and data exfiltration. Some alerts displayed overlapping and mixed signals, and some threat signals were extremely fragmented.

[0094] The SOC imported various raw security event data from March 8 to 15 into the platform. The raw data included 28,000 host logs, 15,000 network traffic records, 3,200 intrusion detection system alerts, and 480 sandbox analysis results. The data included fields such as timestamp, device IP (Internet Protocol), event type, alert level, and detailed information.

[0095] Under the method of the present invention, the platform first automatically performs unified field mapping and timestamp alignment on all original security event streams. Take a host log as an example: "2025-03-10 19:45:02, Dispatch Center PC-38, CMD execution, , confidence level 0.88”, after processing, it is standardized into a unified format, all events are automatically sorted in ascending order, and the maximum time alignment error does not exceed 1 millisecond.

[0096] During the same period, the traditional method stored the above events in the form of a database table, searched by time and device number, and set preliminary classification rules based on "multiple high-risk alarms from the same IP within 5 minutes are considered related."

[0097] The platform maps all standardized security events into a set of heterogeneous time-series graphs. Each event is treated as a node, with node attributes including event type (in this example, "remote login," "local privilege escalation," and "abnormal file write"), host identifier (in this example, "dispatch center PC-38"), device role (in this example, "dispatch server"), account privilege level (in this example, "root"), and confidence level (in this example, "0.88"). If a causal relationship exists between events (in this example, process forking, communication, or resource forking), a directed edge with a contextual label and a time weight is established. For example, in this example, a remote login event (2025-03-10 19:42:12) and a subsequent local privilege escalation event (2025-03-10 19:45:02) are automatically identified as causally related. A directed edge with the label "privilege escalation" and a time weight of 170 seconds is established between the nodes. Traditional methods simply merge time intervals and fail to incorporate the structural relationships between events and attack semantics into the model.

[0098] The platform leverages expert knowledge and industry threat intelligence to embed attack stage labels (in this example, "initial penetration," "privilege escalation," "lateral movement," "persistence," and "data exfiltration") into each node, preserving the original timestamps and contextual attributes for all nodes and edges. For example, after automated analysis, it detected "SMB communication from PC-38 in the dispatch center to PC-05 in the finance office at 19:50:08 on March 10, 2025, accompanied by the derivation of a suspicious EXE file." This node is labeled "lateral movement," the edge label is "resource derivation," and the timestamp is 19:50:08. Traditional solutions cannot distinguish multi-stage attacks at a granular level and can only identify anomalous traffic or high-risk processes, making it difficult to connect the entire attack chain.

[0099] The platform performs a triple similarity calculation on each pair of time sequence graphs, including structural topology consistency, attack phase sequence consistency, and event time deviation. After comprehensive calculation, a time sequence graph similarity matrix is ​​output. For example, in this embodiment, two seemingly isolated event fragments were detected, occurring in "Dispatch Center PC-38 - Finance Office PC-05" and "Plant Control Room PLC-22 - Operations and Maintenance Laptop PC-08," respectively. However, the combined triple similarity scores were 0.84 and 0.22, respectively. The former was clustered into the same attack chain, while the latter was judged as noise. Traditional methods use a simple time + IP threshold for clustering, which results in some lateral movement events in the plant and office areas being mistakenly merged into the same attack chain, causing confusion.

[0100] The platform uses the threat intelligence knowledge graph to calculate embedding vectors for all event nodes and constructs a sparse event semantic matrix using normalized cosine similarity. In this case, the semantic similarity between "2025-03-11 07:58:42, PC-05, sensitive table exfiltrated.xls transmitted to an unknown external IP address" and "2025-03-11 07:58:57, PC-07, CMD executing curl to the same IP address" reached 0.93, automatically clustering them as events related to the "data exfiltration" phase. Traditional approaches only partially match these events through keyword or rule retrieval, resulting in a high rate of missed detections. Based on the similarity matrix and the semantic sparse matrix, the platform employs a graph clustering algorithm combining density-reachable and hierarchical merging to automatically group together phase-embedded time series graphs with high structural similarity and consistent semantics. Boundary events and noise events are eliminated, and a pseudo-labeling mechanism automatically corrects the attribution of some boundary samples. Ultimately, all events are classified into four complete APT attack paths, and the remaining 27 isolated events are classified as noise. Traditional clustering methods rely solely on a single rule threshold, mistakenly merging eight factory lateral movement events and three office abnormal login events into the same attack chain. This results in a confusing link structure and makes it difficult for analysts to interpret.

[0101] Based on clustering, the platform integrates multi-window alignment and sliding time window sorting for each attack path, sorting all nodes by attack stage and timestamp. Ultimately, it automatically constructs a complete chain of attack paths: "phishing email entry—remote login—local privilege escalation—lateral movement—sensitive data exfiltration." The system automatically generates candidate attack paths with continuous stages, clear structure, and time-coherent behavior, and displays them dynamically and visually with a single click.

[0102] SOC analysis utilizes the platform's backtracking capabilities to review all attack paths. For example, using the link starting from "Dispatch Center PC-38," the platform automatically displays the entire process from phishing email triggering, remote login, SMB lateral movement, CMD local privilege escalation, and sensitive data export. All nodes can be traced back to the original logs, and the relevant hosts are automatically isolated. However, traditional solutions require analysts to manually screen tens of thousands of logs, missing the intermediate link between lateral movement and data exfiltration, misidentifying multiple isolated alerts and delaying response.

[0103] The comparative data in this embodiment are as follows: the SOC collected a total of 46,280 original security events. After processing by the method of the present invention, 4 APT attack chains were accurately reconstructed, with a link coverage rate of 92.3%, a noise misjudgment rate of 2.1%, and an average single-chain reconstruction time of about 42 seconds; using the traditional rule threshold clustering method, only 2 attack chains were reconstructed, with a link coverage rate of 54.7%, a noise misjudgment rate of 16.3%, and an average single-chain reconstruction time of 213 seconds.

[0104] Table 1 Comparison between this embodiment and the traditional solution:

[0105] Table 1

[0106]

[0107] The actual training sample display (example extraction) is:

[0108] 1. 2025-03-10 19:41:23, Dispatch Center PC-38, phishing email opened, confidence level 0.96;

[0109] 2. 2025-03-10 19:42:12, dispatch center PC-38, remote login, confidence level 0.91;

[0110] 3. 2025-03-10 19:45:02, Dispatch Center PC-38, Local Privilege Escalation ( ), confidence level 0.88;

[0111] 4. 2025-03-10 19:50:08, Dispatch Center PC-38 - Finance Office PC-05, SMB communication, resource derivation, confidence level 0.85, stage "lateral movement";

[0112] 5. 2025-03-11 07:58:42, PC-05, sensitive table exfiltrated.xls leaked to xx.xx.xx.42, confidence level 0.98, stage "data leakage";

[0113] 6. 2025-03-11 07:58:57, PC-07, CMD executed curl, target xx.xx.xx.42, confidence level 0.87, stage "data exfiltration";

[0114] 7. 2025-03-11 08:05:13, PC-38, remote control tool rebound, confidence level 0.80, stage "persistence".

[0115] Through the technical solution of the present invention, all the above events are connected in series to form a complete attack path, and the stage relationship, time sequence, and causal chain can be dynamically visualized and traced. Analysts can locate all key links and jointly block them with one click.

[0116] Example 3

[0117] Figure 3This is a schematic diagram of the structure of an APT attack path reconstruction device based on timing diagram comparison and clustering provided in the third embodiment of the present invention. The APT attack path reconstruction device based on timing diagram comparison and clustering provided in this embodiment can be implemented through software and / or hardware, and can be configured in a terminal device or server to implement an APT attack path reconstruction method based on timing diagram comparison and clustering in the embodiment of the present invention. Figure 3 As shown, the device includes: a security event standardized data set acquisition module 310, a heterogeneous timing diagram set construction module 320, a stage embedded timing diagram set determination module 330, a timing diagram similarity matrix output module 340, an event semantic sparse matrix generation module 350, a graph clustering result set determination module 360, an attack path candidate graph set formation module 370 and an APT attack path reconstruction result determination module 380.

[0118] The security event standardized data set acquisition module 310 is configured to acquire a security event standardized data set; wherein the security event standardized data set includes at least one security event;

[0119] The heterogeneous timing graph set construction module 320 is used to map each of the security events into a multimodal node and generate directed edges to complete the construction of the heterogeneous timing graph set by using a preset heterogeneous timing graph set construction method;

[0120] The phase-embedded timing diagram set determining module 330 is configured to perform phase-embedded annotation on each multimodal node based on the heterogeneous timing diagram set using the preset joint attack phase set to obtain a phase-embedded timing diagram set;

[0121] A timing graph similarity matrix output module 340 is configured to perform pairwise comparisons on the set of stage-embedded timing graphs using a time-alignment-aware multi-scale graph similarity algorithm and output a timing graph similarity matrix;

[0122] An event semantic sparse matrix generation module 350 is configured to calculate semantic similarity for each security event in the security event standardized dataset based on the threat intelligence knowledge graph and generate an event semantic sparse matrix;

[0123] A graph clustering result set determination module 360 ​​is configured to take the time sequence graph similarity matrix as input, execute a semantically guided weakly supervised graph clustering framework method under the constraints of the event semantic sparse matrix, and perform cluster analysis on the heterogeneous time sequence graph set through a density reachability rule and a hierarchical merging strategy to obtain a graph clustering result set;

[0124] Attack path candidate graph set formation module 370 is used to obtain uncertain samples from the graph clustering result set and perform iterative clustering optimization using a pseudo-label self-enhancement mechanism to generate a time-series graph enhanced clustering result. In addition, within each cluster of the time-series graph enhanced clustering result, multi-window aligned path sorting and splicing are performed based on topological dependencies and time sequence to form a set of attack path candidate graphs arranged continuously by stage.

[0125] The APT attack path reconstruction result determination module 380 is used to perform integrity assessment and consistency verification on the attack path candidate graphs, remove logically conflicting segments, and obtain the APT attack path reconstruction result.

[0126] The technical solution of the embodiment of the present invention is to obtain a standardized data set of security events; map each of the security events into a multimodal node through a pre-set heterogeneous timing graph set construction method, and generate directed edges to complete the construction of a heterogeneous timing graph set; perform phase embedding annotation on each multimodal node based on the heterogeneous timing graph set through a pre-set joint attack phase set to obtain a phase embedded timing graph set; use a time alignment-aware multi-scale graph similarity algorithm to perform pairwise comparison on the phase embedded timing graph set and output a timing graph similarity matrix; calculate the semantic similarity of each security event in the standardized data set of security events based on a threat intelligence knowledge graph to generate an event semantic sparse matrix; use the timing graph similarity matrix as Input, under the constraints of the event semantic sparse matrix, execute the semantic-guided weakly supervised graph clustering framework method, and cluster analysis is performed on the heterogeneous time series graph set through density reachability rules and hierarchical merging strategy to obtain a graph clustering result set; obtain uncertain samples in the graph clustering result set, and use the pseudo-label self-enhancement mechanism to iteratively optimize clustering to generate enhanced clustering results of the time series graph, and within each cluster of the enhanced clustering results of the time series graph, perform multi-window aligned path sorting and splicing based on topological dependencies and time sequence to form a set of attack path candidate graphs arranged continuously by stage; perform integrity assessment and consistency verification on the attack path candidate graphs, remove logically conflicting fragments, and obtain the APT attack path reconstruction result. This solves the problem that the APT attack path reconstruction method mainly relies on rule matching, single-dimensional feature comparison and manual analysis of security logs or alarm streams, greatly enhances the interpretability of APT traceability, reduces the subjective errors of manual judgment, and improves the response efficiency and accuracy of APT attack path reconstruction.

[0127] Based on the above embodiments, the security event standardized data set acquisition module 310 can be specifically used to: construct an original security event data set, wherein the original security event data set includes at least one type of security event original data; input each type of the security event original data into a preset field mapping function, and perform field standardization processing to generate an intermediate set of security events after field mapping; perform time alignment processing on the intermediate set of security events after field mapping through a preset time reference to obtain a time-aligned standardized data set of security events; obtain and sort in ascending time order according to the timestamps corresponding to each security event in the standardized data set of security events to obtain a standardized data set of security events.

[0128] Based on the above embodiments, the heterogeneous timing diagram set construction module 320 can be specifically used to: map each of the security events into a multimodal node through a pre-set heterogeneous timing diagram set construction method, and obtain a multimodal node set; wherein the attributes of each of the multimodal nodes include: event type label, host identifier, event source device role, account authority level and event confidence score; according to each of the security events, identify event pairs with temporal sequence logic and semantic association, and generate directed edges based on each of the event pairs, and obtain a directed edge set; wherein each directed edge is composed of an event association type label, a context label and a time weight; integrate the multimodal node set and the directed edge set to construct a heterogeneous timing diagram set; wherein each heterogeneous timing diagram in the heterogeneous timing diagram set is composed of a group of multimodal nodes and a group of directed edges that satisfy the temporal sequence logic.

[0129] Based on the above embodiments, the joint attack phase set includes: initial penetration phase, privilege escalation phase, lateral movement phase, persistence phase and data exfiltration phase.

[0130] On the basis of the above embodiments, the stage embedding timing diagram set determination module 330 can be specifically used to: assign each multimodal node to any target attack stage in the joint attack stage set through a stage mapping function according to the joint attack stage set; wherein the stage mapping function takes the attributes of the multimodal node and the acquired context information as input, and outputs the attack stage label to which each multimodal node belongs; construct a stage embedding vector for each multimodal node; append the stage embedding vector as the attribute of each multimodal node to obtain a multimodal stage embedding node set containing the stage embedding vector; and construct a stage embedding timing diagram set with the multimodal stage embedding node set and the directed edge set as components.

[0131] Based on the above embodiments, the timing diagram similarity matrix output module 340 can be specifically used to: define a multi-scale graph similarity calculation function for the stage-embedded timing diagram set, take any two stage-embedded timing diagrams in the stage-embedded timing diagram set as input, and calculate the corresponding structural topology similarity, stage sequence similarity and time deviation similarity respectively through the three dimensions of structural topology, stage sequence and time deviation; comprehensively calculate the structural topology similarity, stage sequence similarity and time deviation similarity, and obtain the comprehensive weighted timing diagram similarity by weighting; and perform pairwise combination of all stage-embedded timing diagrams in the stage-embedded timing diagram set, calculate the comprehensive weighted timing diagram similarity, and obtain the timing diagram similarity matrix.

[0132] On the basis of the above embodiments, the timing graph similarity matrix output module 340 can also be specifically used to: for the stage embedded timing graph set, according to the pre-set multi-scale graph similarity calculation function, take any two stage embedded timing graphs in the stage embedded timing graph set as input, calculate the topological consistency of the adjacency matrix of the two stage embedded timing graphs through the structural topology, and obtain the structural topological similarity. ; Among them, the expression of structural topological similarity is ,in, Embed the timing diagram for the mth stage; Embed the timing diagram for the nth stage; for The set of directed edges in ; for The directed edge set in ; the cosine similarity of the multimodal node stage embedding vector is calculated by stage order to obtain the stage order similarity ; Among them, the expression of stage sequence similarity is ; for The stage embedding vector of the multimodal nodes in ; for The stage embedding vector of the multimodal nodes in ; for The i-th multimodal node in ; for The j-th multimodal node in ; for The set of multimodal nodes in the m-th stage embedded timing graph; for The multimodal node set in the nth stage embedded in the time series graph; the time weight difference of the corresponding edges of the directed edge set is calculated by time deviation to obtain the time deviation similarity ; Among them, the expression of time deviation similarity is ; for Directed edges in Corresponding time weight; for Directed edges in Corresponding time weight; For directed edges in the directed edge set, from multimodal nodes Pointing to multimodal nodes A directed edge of .

[0133] Based on the above embodiments, the event semantic sparse matrix generation module 350 can be specifically used to: construct a threat intelligence knowledge graph; wherein the threat intelligence knowledge graph includes an entity set and an entity relationship set, establish a threat intelligence knowledge graph through a structured threat intelligence source, and convert each entity and each entity relationship into a vector embedding representation; extract event semantic feature representations for the standardized data of each security event in the security event standardized data set; calculate the security event semantic similarity between the standardized data of any two security events in the security event standardized data set based on the semantic feature representations of each event; set a semantic similarity sparse threshold, when the security event semantic similarity is less than the semantic similarity sparse threshold, set its corresponding element in the event semantic sparse matrix to 0, when the security event semantic similarity is not less than the semantic similarity sparse threshold, the corresponding element in the event semantic sparse matrix is ​​the semantic similarity between the two security event standardized data, and generate an event semantic sparse matrix.

[0134] On the basis of the above embodiments, the graph clustering result set determination module 360 ​​can be specifically used to: take the time sequence graph similarity matrix as input, and introduce the event semantic sparse matrix as the semantic guidance constraint to construct the time sequence graph semantic adjacency graph; wherein, the nodes in the time sequence graph semantic adjacency graph are multimodal stage embedding nodes of all stage-embedded time sequence graphs in the stage-embedded time sequence graph set, and the edges in the time sequence graph semantic adjacency graph are established only when two preset conditions are met at the same time; wherein, the first condition is that the corresponding element in the time sequence graph similarity matrix is ​​greater than or equal to the similarity threshold, and the second ... The condition is that between the standardized data of security events corresponding to the two stage-embedded time sequence diagrams, there is at least one pair of events whose security event semantic similarity in the event semantic sparse matrix is ​​greater than or equal to the semantic similarity threshold; in the semantic adjacency graph of the time sequence diagram, the weakly supervised graph clustering framework method is executed, the density core minimum adjacency number and the search radius parameter are set, and each stage-embedded time sequence diagram in the node set in the semantic adjacency graph of the time sequence diagram is classified according to whether the number of adjacent stage-embedded time sequence diagrams within the search radius parameter is greater than or equal to the density core minimum adjacency number, and the initial Graph clustering result set; wherein, the initial graph clustering result set is divided into core stage embedded timing graph, boundary stage embedded timing graph and noise stage embedded timing graph; each cluster in the initial graph clustering result set is composed of at least one stage embedded timing graph, and each stage embedded timing graph is assigned to any one of the core cluster cluster, boundary cluster cluster or noise cluster cluster; based on the initial graph clustering result set, a hierarchical merging strategy is executed to aggregate each initial cluster according to the average similarity between clusters, and when the average similarity between any two clusters is greater than When the similarity between the two clusters is less than or equal to the cluster merging similarity threshold, the two clusters are merged to obtain a new cluster. The aggregation process is repeated until the average similarity between all clusters is less than the cluster merging similarity threshold, and the current graph clustering result set is obtained. The hierarchical merging strategy is iteratively executed until the average similarity between any two clusters is less than the graph cluster merging similarity threshold, and the graph clustering result set is obtained. Each cluster in the graph clustering result set consists of at least one stage embedded in the time sequence graph, representing a cluster of APT attack path fragments.

[0135] On the basis of the above embodiments, the attack path candidate graph set forming module 370 can be specifically used to: identify cluster clusters including boundary stage embedded timing graphs and noise stage embedded timing graphs and isolated graph samples for the graph clustering result set, and calculate the pseudo-label similarity distribution between the uncertain stage embedded timing graph and each cluster cluster based on the stage embedded timing graph assigned to each core cluster cluster; adopt a pseudo-label self-enhancement mechanism to reallocate all uncertain stage embedded timing graphs that meet the pseudo-label assignment conditions to the target cluster cluster according to the principle of maximum pseudo-label similarity mean, to form a new enhanced graph clustering result set, repeat the process of calculating pseudo-label assignment and graph clustering update, until the difference ratio between the enhanced graph clustering result set and the previous round of clustering result set is less than the cluster boundary convergence threshold, and obtain the enhanced graph clustering result set; for the enhanced A graph clustering result set is obtained, in each cluster, the node set and edge set of all stage embedded timing graphs in each cluster are extracted, and the node set and edge set are integrated to construct an attack path fusion graph containing the structural information of all stage embedded timing graphs of each cluster; all nodes of the attack path fusion graph are jointly sorted according to the unified timestamp and stage embedding vector of each node; wherein, the joint sorting rule arranges the nodes in the order of the attack stages represented by the stage embedding vector; the node sequence after the joint sorting is sequentially composed into path segments, and the path is spliced ​​by executing multi-window alignment in time sequence to obtain a set of attack path candidate graphs that are continuously arranged by stage and have complete time sequence; wherein, the attack path candidate graph set includes at least one attack path candidate graph, and each attack path candidate graph represents an APT attack path.

[0136] The APT attack path reconstruction device based on timing diagram comparison and clustering provided by an embodiment of the present invention can execute the APT attack path reconstruction method based on timing diagram comparison and clustering provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0137] Example 4

[0138] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement the fourth embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or claimed herein.

[0139] like Figure 4 As shown, electronic device 10 includes at least one processor 11 and memory, such as read-only memory (ROM) 12 and random access memory (RAM) 13, communicatively connected to at least one processor 11. The memory stores computer programs executable by the at least one processor. Processor 11 can perform various appropriate actions and processes based on the computer programs stored in ROM 12 or loaded from storage unit 18 into RAM 13. RAM 13 can also store various programs and data required for the operation of electronic device 10. Processor 11, ROM 12, and RAM 13 are interconnected via bus 14. An input / output (I / O) interface 15 is also connected to bus 14.

[0140] Multiple components in the electronic device 10 are connected to the I / O interface 15, including an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0141] Processor 11 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any other suitable processors, controllers, microcontrollers, etc. Processor 11 executes the various methods and processes described above, such as the APT attack path reconstruction method based on timing diagram comparison and clustering.

[0142] In some embodiments, the APT attack path reconstruction method based on timing graph comparison and clustering can be implemented as a computer program tangibly embodied in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the APT attack path reconstruction method based on timing graph comparison and clustering described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to execute the APT attack path reconstruction method based on timing graph comparison and clustering via any other appropriate means (e.g., via firmware).

[0143] The method comprises: obtaining a standardized data set of security events; wherein, the standardized data set of security events includes at least one security event; mapping each of the security events into a multimodal node through a pre-set heterogeneous time sequence diagram set construction method, and generating directed edges to construct a heterogeneous time sequence diagram set; performing phase embedding annotation on each multimodal node based on the heterogeneous time sequence diagram set through a pre-set joint attack phase set to obtain a phase embedded time sequence diagram set; using a time alignment-aware multi-scale graph similarity algorithm to perform pairwise comparison on the phase embedded time sequence diagram set, and output a time sequence diagram similarity matrix; calculating the semantic similarity of each security event in the standardized data set of security events based on a threat intelligence knowledge graph, and generating an event semantic sparse matrix; using the The timing graph similarity matrix is ​​taken as input. Under the constraint of the event semantic sparse matrix, a semantic-guided weakly supervised graph clustering framework method is executed, and the heterogeneous timing graph set is clustered and analyzed through density reachability rule and hierarchical merging strategy to obtain a graph clustering result set; uncertain samples in the graph clustering result set are obtained, and pseudo-label self-enhancement mechanism is used to perform iterative clustering optimization to generate timing graph enhanced clustering results, and within each cluster cluster of the timing graph enhanced clustering results, multi-window aligned path sorting and splicing are performed according to topological dependency and time sequence to form a set of attack path candidate graphs arranged continuously by stage; integrity assessment and consistency verification are performed on the attack path candidate graphs respectively, and logically conflicting fragments are removed to obtain the APT attack path reconstruction result.

[0144] Various embodiments of the systems and techniques described above can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0145] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the computer program is executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program may be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0146] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or apparatus. A computer-readable storage medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or apparatus, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media may include an electrical connection based on one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0147] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device that has: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0148] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0149] A computing system may include clients and servers. The clients and servers are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services.

[0150] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the present invention can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of the present invention can be achieved. This is not limited herein.

[0151] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

[0152] Example 5

[0153] The fifth embodiment of the present invention also provides a computer-readable storage medium, wherein the computer-readable instructions are used to execute a method for reconstructing an APT attack path based on time sequence diagram comparison clustering when executed by a computer processor, the method comprising: obtaining a standardized data set of security events; wherein the standardized data set of security events includes at least one security event; through a pre-set heterogeneous time sequence diagram set construction method, each of the security events is mapped into a multimodal node, and a directed edge is generated to complete the construction of a heterogeneous time sequence diagram set; through a pre-set joint attack stage set, each multimodal node is subjected to stage embedding annotation based on the heterogeneous time sequence diagram set to obtain a stage embedded time sequence diagram set; a time alignment-aware multi-scale graph similarity algorithm is used to perform pairwise comparison on the stage embedded time sequence diagram set, and a time sequence diagram similarity matrix is ​​output; based on a threat intelligence knowledge graph, the security events are analyzed. The semantic similarity of each security event in the standardized data set is calculated to generate an event semantic sparse matrix; with the time sequence graph similarity matrix as input, under the constraint of the event semantic sparse matrix, a semantic-guided weakly supervised graph clustering framework method is executed, and the heterogeneous time sequence graph set is clustered and analyzed through density reachability rule and hierarchical merging strategy to obtain a graph clustering result set; uncertain samples in the graph clustering result set are obtained, and pseudo-label self-enhancement mechanism is used to perform iterative clustering optimization to generate time sequence graph enhanced clustering results, and within each cluster cluster of the time sequence graph enhanced clustering results, multi-window aligned path sorting and splicing are performed according to topological dependency and time sequence to form a set of attack path candidate graphs arranged continuously by stage; integrity assessment and consistency verification are performed on the attack path candidate graphs respectively, and logically conflicting fragments are removed to obtain the APT attack path reconstruction results.

[0154] Of course, the computer-readable storage medium provided in an embodiment of the present invention has computer-executable instructions that are not limited to the method operations described above, and can also execute related operations in the APT attack path reconstruction based on timing diagram comparison clustering provided in any embodiment of the present invention.

[0155] Through the above description of the embodiments, those skilled in the art can clearly understand that the present invention can be implemented with the help of software and necessary general-purpose hardware. Of course, it can also be implemented with hardware, but in many cases the former is a better embodiment. Based on this understanding, the technical solution of the present invention, or the part that contributes to the existing technology, can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory (FLASH), hard disk or optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments of the present invention.

[0156] It is worth noting that in the above-mentioned embodiment of APT attack path reconstruction based on timing diagram comparison clustering, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other and are not used to limit the scope of protection of the present invention.

[0157] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. A method for reconstructing APT attack paths based on time series graph comparison and clustering, characterized in that: include: Obtaining a standardized security event data set; wherein the standardized security event data set includes at least one security event; By using a preset heterogeneous time sequence graph set construction method, each of the security events is mapped into a multimodal node and a directed edge is generated to complete the construction of the heterogeneous time sequence graph set; Through the pre-set joint attack phase set, each multimodal node is annotated with phase embedding based on the heterogeneous timing graph set to obtain the phase embedding timing graph set; A time-alignment-aware multi-scale graph similarity algorithm is used to perform pairwise comparisons on the set of stage-embedded timing graphs, and output a timing graph similarity matrix. Based on the threat intelligence knowledge graph, the semantic similarity of each security event in the security event standardized data set is calculated to generate an event semantic sparse matrix; Taking the time sequence graph similarity matrix as input, under the constraint of the event semantic sparse matrix, a semantic-guided weakly supervised graph clustering framework method is executed, and cluster analysis is performed on the heterogeneous time sequence graph set through density reachability rule and hierarchical merging strategy to obtain a graph clustering result set; Acquire uncertain samples from the graph clustering result set and perform iterative clustering optimization using a pseudo-label self-enhancement mechanism to generate a time-series graph enhanced clustering result. Furthermore, within each cluster of the time-series graph enhanced clustering result, perform multi-window aligned path sorting and splicing based on topological dependencies and time order to form a set of attack path candidate graphs arranged continuously by stage. The candidate attack path graphs are evaluated for integrity and checked for consistency, logically conflicting segments are removed, and the APT attack path reconstruction results are obtained.

2. The method according to claim 1, characterized in that The step of obtaining a standardized security event data set includes: Constructing an original security event data set, wherein the original security event data set includes at least one type of security event original data; Inputting the raw data of each type of security event into a preset field mapping function, performing field standardization processing, and generating an intermediate set of security events after field mapping; Using a pre-set time base, time alignment is performed on the intermediate set of security events after field mapping to obtain a standardized data set of security events after time alignment. The timestamps corresponding to the respective security events in the security event standardized data set are obtained and sorted in ascending time order to obtain the security event standardized data set.

3. The method according to claim 2, characterized in that The method for constructing a heterogeneous time sequence graph set by using a preset method maps each of the security events into a multimodal node and generates directed edges to construct a heterogeneous time sequence graph set, including: By using a pre-set heterogeneous time sequence graph set construction method, each of the security events is mapped into a multimodal node, and a multimodal node set is obtained; The attributes of each multimodal node include: event type label, host identifier, event source device role, account authority level, and event confidence score; According to each of the security events, identifying event pairs that have a temporal logical and semantic association, and generating directed edges according to each of the event pairs to obtain a directed edge set; Among them, each directed edge consists of event association type label, context label and time weight; Integrating the multimodal node set and the directed edge set to construct a heterogeneous time series graph set; Each heterogeneous timing graph in the heterogeneous timing graph set is composed of a group of multimodal nodes and a group of directed edges that satisfy the time sequence logic.

4. The method according to claim 3, characterized in that The joint attack phase set includes: initial penetration phase, privilege escalation phase, lateral movement phase, persistence phase and data exfiltration phase; The method uses a preset joint attack phase set to perform phase embedding annotation on multimodal nodes based on a heterogeneous timing graph set to obtain a phase embedding timing graph set, including: According to the joint attack phase set, each multimodal node is assigned to any target attack phase in the joint attack phase set through a phase mapping function; The stage mapping function takes the attributes of the multimodal nodes and the acquired context information as input, and outputs the attack stage label to which each multimodal node belongs; For each multimodal node, construct a phase embedding vector; Append the stage embedding vector as the attribute of each multimodal node to obtain a set of multimodal stage embedding nodes containing the stage embedding vector; A stage embedding sequence graph set is constructed with the multimodal stage embedding node set and the directed edge set as constituent elements.

5. The method according to claim 4, characterized in that The multi-scale graph similarity algorithm using time alignment awareness performs pairwise comparison on the set of stage-embedded timing graphs and outputs a timing graph similarity matrix, including: For the set of stage-embedded time-series graphs, a multi-scale graph similarity calculation function is defined. It takes any two stage-embedded time-series graphs in the set as input and calculates the corresponding structural topology similarity, stage sequence similarity, and time deviation similarity respectively through the three dimensions of structural topology, stage sequence, and time deviation. The structural topology similarity, stage sequence similarity and time deviation similarity are integrated and weighted to obtain the comprehensive weighted time series graph similarity; All the stage-embedded timing diagrams in the stage-embedded timing diagram set are combined in pairs, and the similarity of the timing diagrams is calculated by comprehensive weights to obtain the timing diagram similarity matrix.

6. The method according to claim 5, characterized in that The method comprises the following steps: for the set of stage-embedded time sequence graphs, according to a pre-set multi-scale graph similarity calculation function, taking any two stage-embedded time sequence graphs in the set of stage-embedded time sequence graphs as input, and respectively calculating the corresponding structural topology similarity, stage sequence similarity, and time deviation similarity through the three dimensions of structural topology, stage sequence, and time deviation: For the set of stage-embedded timing graphs, according to the pre-set multi-scale graph similarity calculation function, any two stage-embedded timing graphs in the set of stage-embedded timing graphs are taken as input in turn, and the topological consistency of the adjacency matrix of the two stage-embedded timing graphs is calculated through the structural topology to obtain the structural topological similarity. ; Among them, the expression of structural topological similarity is ,in, Embed the timing diagram for the mth stage; Embed the timing diagram for the nth stage; for The set of directed edges in ; for The set of directed edges in ; The cosine similarity of the multimodal node stage embedding vector is calculated by stage order to obtain the stage order similarity ; Among them, the expression of stage sequence similarity is ; for The stage embedding vector of the multimodal nodes in ; for The stage embedding vector of the multimodal nodes in ; for The i-th multimodal node in ; for The j-th multimodal node in ; for The set of multimodal nodes in the m-th stage embedded timing graph; for The set of multimodal nodes in the n-th stage embedded timing diagram; The time deviation is used to calculate the time weight difference of the corresponding edges of the directed edge set to obtain the time deviation similarity ; Among them, the expression of time deviation similarity is: ; for Directed edges in Corresponding time weight; for Directed edges in Corresponding time weight; For directed edges in the directed edge set, from multimodal nodes Pointing to multimodal nodes A directed edge of .

7. The method according to claim 6, characterized in that The method of calculating the semantic similarity of each security event in the security event standardized data set based on the threat intelligence knowledge graph to generate an event semantic sparse matrix includes: Build a threat intelligence knowledge graph; The threat intelligence knowledge graph includes a set of entities and a set of entity relationships. The threat intelligence knowledge graph is established through structured threat intelligence sources, and each entity and its relationship is converted into a vector embedding representation. Extracting semantic feature representations of events from the standardized data of each security event in the standardized security event dataset; Based on the semantic feature representation of each event, the semantic similarity of security events between any two standardized data of security events in the security event standardized dataset is calculated; A semantic similarity sparse threshold is set. When the semantic similarity of a security event is less than the semantic similarity sparse threshold, the corresponding element in the event semantic sparse matrix is ​​set to 0. When the semantic similarity of a security event is not less than the semantic similarity sparse threshold, the corresponding element in the event semantic sparse matrix is ​​the semantic similarity between the two standardized security event data, and an event semantic sparse matrix is ​​generated.

8. The method according to claim 7, characterized in that The method uses the time sequence graph similarity matrix as input and executes a semantically guided weakly supervised graph clustering framework method under the constraints of the event semantic sparse matrix. The method also performs cluster analysis on the heterogeneous time sequence graph set through density reachability rules and hierarchical merging strategies to obtain a graph clustering result set, including: Taking the time sequence graph similarity matrix as input and introducing the event semantic sparse matrix as semantic guidance constraint, the time sequence graph semantic adjacency graph is constructed. Among them, the nodes in the semantic adjacency graph of the time sequence graph are the multimodal stage-embedded nodes of all stage-embedded time sequence graphs in the set of stage-embedded time sequence graphs, and the edges in the semantic adjacency graph of the time sequence graph are established only when two preset conditions are met at the same time; among them, the first condition is that the corresponding elements in the time sequence graph similarity matrix are greater than or equal to the similarity threshold, and the second condition is that between the standardized data of security events corresponding to the two stage-embedded time sequence graphs, there is at least one pair of events whose security event semantic similarity in the event semantic sparse matrix is ​​greater than or equal to the semantic similarity threshold; In the semantic adjacency graph of the time sequence graph, the weakly supervised graph clustering framework method is executed, the density core minimum adjacency number and the search radius parameter are set, and each stage in the node set in the semantic adjacency graph of the time sequence graph is embedded in the time sequence graph, and the embedding is classified according to whether the number of adjacent stages embedded in the time sequence graph within the search radius parameter is greater than or equal to the density core minimum adjacency number, thereby obtaining an initial graph clustering result set; The initial graph clustering result set is divided into a core phase embedding time sequence graph, a boundary phase embedding time sequence graph, and a noise phase embedding time sequence graph; each cluster in the initial graph clustering result set is composed of at least one phase embedding time sequence graph, and each phase embedding time sequence graph is assigned to any one of the core cluster cluster, the boundary cluster cluster, or the noise cluster cluster; Based on the initial graph clustering result set, a hierarchical merging strategy is executed to aggregate each initial cluster according to the average similarity between clusters. When the average similarity between any two clusters is greater than or equal to the cluster merging similarity threshold, the two clusters are merged to obtain a new cluster. The aggregation process is repeated until the average similarity between all clusters is less than the cluster merging similarity threshold, and the current graph clustering result set is obtained. Iterate the operation of the hierarchical merging strategy until the average similarity between any two clusters is less than the graph cluster merging similarity threshold, and obtain the graph clustering result set; Among them, each cluster in the graph clustering result set consists of at least one stage embedded in the time sequence graph, representing a cluster of APT attack path fragments.

9. The method according to claim 8, characterized in that The method obtains uncertain samples from the graph clustering result set and uses a pseudo-label self-enhancement mechanism to perform iterative clustering optimization to generate a time-series graph enhanced clustering result. In addition, within each cluster of the time-series graph enhanced clustering result, multi-window aligned path sorting and splicing are performed based on topological dependencies and time sequence to form a set of attack path candidate graphs arranged continuously by stage, including: For the graph clustering result set, clusters containing boundary phase embedding time series graphs and noise phase embedding time series graphs as well as isolated graph samples are identified. Based on the phase embedding time series graphs assigned to each core cluster, the pseudo-label similarity distribution between the uncertain phase embedding time series graphs and each cluster is calculated. A pseudo-label self-enhancement mechanism is used to embed all uncertain phases that meet the pseudo-label assignment conditions into the time series graph. According to the principle of maximizing the mean pseudo-label similarity, they are redistributed to the target clusters to form a new enhanced graph clustering result set. The pseudo-label assignment and graph clustering update process is repeated until the difference ratio between the enhanced graph clustering result set and the previous round of clustering result set is less than the cluster boundary convergence threshold, thus obtaining the enhanced graph clustering result set. For the enhanced graph clustering result set, extract the node set and edge set of all phase embedded time sequence graphs in each cluster, and integrate the node set and edge set to construct an attack path fusion graph containing the structural information of all phase embedded time sequence graphs of each cluster; All nodes of the attack path fusion graph are jointly sorted according to the unified timestamp and stage embedding vector of each node; wherein the joint sorting rule arranges the nodes according to the attack stage order represented by the stage embedding vector; The node sequences after joint sorting are sequentially organized into path segments, and the paths are spliced ​​by executing multi-window alignment in time sequence to obtain a set of attack path candidate graphs that are continuously arranged in stages and have complete temporal sequence. The attack path candidate graph set includes at least one attack path candidate graph, and each attack path candidate graph represents an APT attack path.

10. An APT attack path reconstruction device based on time sequence diagram comparison and clustering, characterized in that: include: A security event standardized data set acquisition module, configured to acquire a security event standardized data set; wherein the security event standardized data set includes at least one security event; A heterogeneous timing graph set construction module is used to map each of the security events into a multimodal node and generate directed edges to complete the construction of the heterogeneous timing graph set through a preset heterogeneous timing graph set construction method; A phase-embedded timing diagram set determination module is used to perform phase-embedded annotation on each multimodal node based on a pre-set joint attack phase set and a heterogeneous timing diagram set to obtain a phase-embedded timing diagram set; The timing graph similarity matrix output module is used to use the time alignment-aware multi-scale graph similarity algorithm to perform pairwise comparisons on the set of stage-embedded timing graphs and output the timing graph similarity matrix; An event semantic sparse matrix generation module is used to calculate the semantic similarity of each security event in the security event standardized data set based on the threat intelligence knowledge graph to generate an event semantic sparse matrix; A graph clustering result set determination module is configured to take the time sequence graph similarity matrix as input, execute a semantically guided weakly supervised graph clustering framework method under the constraint of the event semantic sparse matrix, and perform cluster analysis on the heterogeneous time sequence graph set through density reachability rules and hierarchical merging strategies to obtain a graph clustering result set; The attack path candidate graph set formation module is used to obtain uncertain samples from the graph clustering result set and use a pseudo-label self-enhancement mechanism to perform iterative clustering optimization to generate a time-series graph enhanced clustering result. In addition, within each cluster of the time-series graph enhanced clustering result, multi-window aligned path sorting and splicing are performed based on topological dependencies and time sequence to form a set of attack path candidate graphs arranged continuously by stage. The APT attack path reconstruction result determination module is used to perform integrity assessment and consistency verification on the attack path candidate graphs, remove logically conflicting fragments, and obtain the APT attack path reconstruction result.

11. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method for reconstructing an APT attack path based on timing graph comparison and clustering according to any one of claims 1 to 9 is implemented.

12. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement an APT attack path reconstruction method based on timing diagram comparison and clustering according to any one of claims 1 to 9 when executed.

Images