Detection method and system for APT attack behavior

Abstract

The present invention belongs to the field of network security technology and provides a detection method and system for APT attack behavior. Its technical solution is to reconstruct the early warning upgrade mechanism through a triple decision-making engine. On the basis of retaining the original confidence scoring system, it combines the newly added threat entropy change analysis and attack feature matching, and comprehensively verifies the primary early warning based on multiple factors. This avoids the frequent triggering of the primary early warning due to misjudgment, and at the same time ensures that truly threatening abnormal behaviors can be upgraded to early warning in a timely and rapid manner, thereby improving the reliability of the early warning and allowing security personnel to more accurately judge the threat level and reasonably arrange response measures.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and in particular relates to a detection method and system for APT attack behavior. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] Advanced Persistent Threat (APT) attacks are long-term, targeted cyberattacks. Attackers typically use a variety of methods, such as phishing attacks, vulnerability exploits, and malware implants, to continuously monitor target systems and steal data, posing significant security risks to businesses and organizations.

[0004] The stealthy nature of APT attacks poses a significant challenge to existing detection systems. Attackers often mimic normal operations at extremely low frequencies, exfiltrating only a few megabytes of data per month. Existing detection systems, which rely on fixed thresholds or short-term behavioral analysis, struggle to detect this long-term, covert activity. For example, if an attacker accesses a sensitive port more than once per day, traditional detection systems will often interpret this as normal fluctuation, allowing the attacker to remain undetected within the network for months.

[0005] At the same time, existing detection solutions oversimplify their early warning assessments for abnormal behavior, leading to frequent false positives and delayed responses. On the one hand, normal business fluctuations, such as traffic increases during quarterly report generation, frequently trigger primary alerts, generating thousands of invalid alerts annually. On the other hand, genuine APT attacks, such as domain controller access during the early hours of a weekend, take an average of four to six hours to escalate to a high-level alert due to flaws in the confidence scoring mechanism, missing the golden window for action.

[0006] Furthermore, attackers are increasingly leveraging legitimate system tools like PowerShell and RDP to launch attacks. Existing behavioral baseline technologies are unable to distinguish between normal administrative operations and malicious command execution, allowing attacks like the NotPetya ransomware's abuse of the PsExec tool to completely evade detection. Traditional approaches treat each anomaly in isolation, failing to identify the phases of the attack chain. For example, they can't correlate a spearphishing email attachment with subsequent lateral movement, nor can they predict the potential for data exfiltration after the reconnaissance phase. This results in delayed defense measures and an inability to effectively address the complexity of APT attacks. Summary of the Invention

[0007] The present invention provides a detection method and system for APT attack behavior, which can promptly detect APT attacks in their early stages when the behavior is relatively covert, thereby triggering early warnings and preventing attackers from lurking in the network for a long time and conducting early activities.

[0008] First, a method for detecting APT attack behaviors is provided, which includes the following steps:

[0009] Based on the network traffic data and host behavior data obtained in different time zones under normal business scenarios, a normal behavior model is built, and an APT attack feature knowledge base is constructed;

[0010] Based on the traffic data and behavior data performance in different time zones, real-time feature data is constructed. The difference degree is compared between the real-time feature data and the normal behavior model, and a difference degree index is generated based on the difference degree comparison result. The corresponding warning signal is triggered based on the matching result of the difference degree index and the preset difference degree threshold index range.

[0011] Confidence scores are set for different types of warning signals respectively. The type of warning signal triggered is determined based on the confidence score. When a primary warning is triggered, the confidence score is adjusted for the second time. After the secondary adjustment of the confidence score is completed, the adjusted confidence score result and the APT attack feature knowledge base are combined to determine whether the primary warning needs to be upgraded. When an advanced warning is triggered, a threat data packet indicating the hidden danger is generated based on historical APT attack data.

[0012] Optionally, comparing the difference between the real-time feature data and the normal behavior model and generating a difference index based on the comparison result may include:

[0013] Calculate the difference between the current traffic data performance and the traffic data performance under normal behavior mode;

[0014] Identify the number of sensitive resource accesses, resource types for each access, and total duration of sensitive resource accesses in the current time zone, and calculate the ratio of the number of sensitive resource accesses, resource types for each access, and total duration of sensitive resource accesses in the current time zone to the normal behavior mode, including the different access ratio, different source value, and different time ratio;

[0015] The difference degree index is calculated by combining the quantity difference value, visit difference ratio, source difference value and time difference ratio calculated in the current time zone.

[0016] Optionally, the calculation formula of the difference degree index is:

[0017] ,

[0018] Among them, cis is the difference degree index, represent the heterogeneous visit ratio, heterogeneous source value, and heterogeneous time ratio, respectively; are the impact weight factors corresponding to the quantity difference value, visit difference ratio, source difference value and time difference ratio respectively.

[0019] Optionally, the corresponding warning signal is triggered according to the matching result of the difference degree index and the preset difference degree threshold index range, including: if the difference degree index cis is within the difference degree threshold index range, a primary warning is triggered; if the difference degree index cis is higher than the difference degree threshold index range, an advanced warning is triggered.

[0020] Optionally, when a primary warning is triggered, a secondary adjustment is made to the confidence score, including:

[0021] Calculate the level threshold of the normal behavior pattern traffic data at each time point in the current time zone, filter out the traffic data above the level threshold, and count the number as the number of abnormal flows;

[0022] Arrange the filtered flow data above the level threshold in the order of time points, and obtain the flow time series after the arrangement is completed;

[0023] Set the moving window size X, calculate each group of flow data in the flow time series, obtain the moving flow average of each group, calculate the difference between the average values ​​of two adjacent groups of moving flow, and determine the flow trend value based on the difference;

[0024] Extract users who access sensitive resources in the current time zone and build a list of abnormal users. Count the number of behavioral deviations and access deviations in the abnormal user list in the current time zone.

[0025] Construct a basic data set that includes the number of outliers, trend flow values, number of behavioral deviations, and number of access deviations. Set a confidence additional score transformation set corresponding to the basic data set. After matching and transforming the basic data set with the confidence additional score transformation set, add the converted confidence additional scores of each group, and then sum the summed value with the confidence score of the primary warning to obtain the secondary adjusted confidence score.

[0026] Optionally, the determining whether it is necessary to upgrade the primary warning based on the adjusted confidence score result and the APT attack feature knowledge base includes:

[0027] If the adjusted confidence score reaches or exceeds the advanced warning threshold, the primary warning will be upgraded to an advanced warning;

[0028] Based on the tactical behavior chain library, the matching degree between the time series feature vector of the current network behavior and the historical APT attack feature vector is determined. If the matching degree reaches the set threshold, the primary warning is upgraded to an advanced warning.

[0029] Based on the traffic entropy baseline library, the Shannon entropy of the current traffic is compared with the Shannon entropy baseline value. When the set conditions are met, the primary warning is upgraded to an advanced warning;

[0030] The current feature is detected based on the high-risk feature fingerprint library. Once it is consistent with the feature in the high-risk feature fingerprint library, the primary warning is immediately upgraded to a high-level warning.

[0031] Optionally, when the advanced warning is triggered, generating a threat data packet indicating a potential threat by combining historical APT attack data includes:

[0032] Construct the feature vector dataset for the current triggering of advanced warning, including the quantity outlier value, visit outlier ratio, source outlier value, and time outlier ratio;

[0033] Extract the historical vector data set before each historical APT attack, including historical quantity outliers, historical outlier ratios, historical outlier source values, and historical outlier time ratios;

[0034] The cosine similarity formula is used to calculate the numerical values ​​contained in the feature vector dataset and the historical vector dataset. The absolute value of the difference between the calculated result and the integer one is taken to obtain the historical evaluation value. The historical APT attack data with the lowest historical evaluation value is taken as the reference data.

[0035] The attack paths and vulnerabilities corresponding to the reference data are integrated into threat data packages for affected assets.

[0036] In a second aspect, a system for detecting APT attacks is provided. The system has the functionality to implement the method for detecting APT attacks described in the first aspect. The system includes one or more modules configured to implement the method for detecting APT attacks described in the first aspect.

[0037] That is, the present invention provides a detection system for APT attack behavior, which includes:

[0038] Normal behavior model building module, which is used to build a normal behavior model based on the network traffic data and host behavior data obtained in different time zones under normal business scenarios, and to build an APT attack feature knowledge base;

[0039] An anomaly detection module is used to construct real-time feature data based on traffic data and behavior data performance in different time zones, compare the difference between the real-time feature data and the normal behavior model, and generate a difference index based on the difference comparison results; trigger a corresponding warning signal based on the match between the difference index and the preset difference threshold index range;

[0040] The early warning module is used to set confidence scores for different types of early warning signals, determine the type of triggered early warning signaling based on the confidence score, and when a primary early warning is triggered, make a secondary adjustment to the confidence score. After completing the secondary adjustment of the confidence score, it is used to determine whether the primary early warning needs to be upgraded based on the adjusted confidence score result and the APT attack feature knowledge base; when an advanced early warning is triggered, a threat data packet indicating the hidden danger is generated based on historical APT attack data.

[0041] In a third aspect, a computer-readable storage medium is provided.

[0042] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the method for detecting APT attack behavior as described in the first aspect above.

[0043] In a fourth aspect, a computer device is provided.

[0044] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the steps of the method for detecting APT attack behaviors as described in the first aspect above are implemented.

[0045] The technical effects obtained in the above-mentioned second, third, fourth and fifth aspects are similar to those obtained by the corresponding technical means in the first aspect, and will not be repeated here.

[0046] The technical solution provided by the present invention can at least bring the following beneficial effects:

[0047] 1. The present invention reconstructs the early warning upgrade mechanism through a triple decision-making engine. On the basis of retaining the original confidence scoring system, it combines the newly added threat entropy change analysis and attack feature matching, and comprehensively verifies the primary early warning based on multiple factors. This avoids the frequent triggering of primary early warnings due to misjudgment, while ensuring that truly threatening abnormal behaviors can be quickly and timely upgraded to early warnings, thereby improving the reliability of early warnings and allowing security personnel to more accurately judge the degree of threat and reasonably arrange response measures.

[0048] 2. This invention constructs a dynamic normal behavior model to accurately characterize traffic and access behavior characteristics in multiple time zones. Combined with a dual-modal detection system consisting of a tactical behavior chain library and a high-risk feature fingerprint library, it can not only detect hidden anomalies through multi-dimensional indicators such as quantity anomaly, access ratio, source value, and time ratio, but also identify hardware-level traces (such as specific CPU instruction sequences) and tactical-level behavior chains (such as permission transition paths) that must be left by APT attacks.

[0049] Advantages of additional aspects of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The accompanying drawings, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0051] Figure 1 This is a flow chart of a method for detecting APT attack behaviors provided by an embodiment of the present invention;

[0052] Figure 2 This is a logic diagram of a detection method for APT attack behavior provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0053] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0054] It should be noted that the following detailed descriptions are illustrative and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which the present invention belongs.

[0055] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or combinations thereof.

[0056] Example 1

[0057] like Figure 1 and 2 As shown, this embodiment provides a detection method for APT attack behavior, including the following steps:

[0058] Step 1: Build a normal behavior model based on the network traffic data and host behavior data obtained in different time zones under normal business scenarios, and construct an APT attack feature knowledge base;

[0059] In this embodiment, network traffic data and host behavior data in different time zones under normal business scenarios are obtained. Different time zones can be, for example, UTC+8, UTC-5, etc.

[0060] Before learning network traffic data and host behavior data in normal business scenarios, the data is first labeled and data with abnormal behavior is removed. This data is used as learning data and a normal behavior model is constructed.

[0061] In this embodiment, when constructing the normal behavior model, a long short-term memory network (LSTM) algorithm is used in combination with an attention mechanism to learn network traffic data and host behavior data under normal business scenarios, and a normal behavior model is pre-built.

[0062] Furthermore, the APT attack feature knowledge base includes a high-risk feature fingerprint library, a tactical behavior chain library, and a traffic entropy baseline library. The specific construction process includes:

[0063] When building the high-risk fingerprint library, the deterministic features of known attack tools are stored, including:

[0064] The Intel PEBS mechanism is used to collect CPU instruction signatures of typical APT tools. For example, regarding the instruction sequence signature of Cobalt Strike, the system will determine the presence of Cobalt Strike malware activity when the following three situations occur. First, if the processor executes the read timestamp counter instruction more than a set number of times, such as 50 times, this usually means that the attacker is performing precise time measurements in order to evade sandbox detection. Second, if a cache line refresh instruction appears in the instruction sequence, this is a typical sign of Cobalt Strike clearing memory traces. Finally, if a load barrier instruction appears in the instruction stream, this instruction is often used to coordinate the multi-threaded execution of malicious code. Abnormal memory access patterns are also recorded, such as the DRAM access frequency of the Rowhammer attack.

[0065] When building the tactical behavior chain library, we collected typical TTPs (tactics, techniques, and processes) of APT organizations. The format example is as follows:

[0066] JSON

[0067] {

[0068] "APT29": {

[0069] "initial_access": ["spear phishing email", "malicious document"],

[0070] "execution": ["Scheduled Task", "PowerShell"],

[0071] "lateral_movement": ["PsExec", "WMI"]

[0072] }

[0073] }

[0074] When building the traffic entropy baseline library, it includes:

[0075] Calculate the Shannon entropy baseline value Hbaseline and standard deviation σ for normal traffic in each time zone. Store the entropy change threshold for typical APT communications. For example, the entropy change threshold for DNS tunnels is ΔH > 2.3σ.

[0076] Step 2: Based on the traffic data and behavior data performance in different time zones, real-time feature data is constructed. The difference degree is compared between the real-time feature data and the normal behavior model. Based on the difference degree comparison results, a difference degree index is generated. The corresponding warning signal is triggered based on the matching result of the difference degree index and the preset difference degree threshold index range.

[0077] The specific steps include:

[0078] Step 201: Calculate the difference between the real-time flow data and the flow data under normal behavior mode;

[0079] Identify the time zone where the current traffic data is located, extract the traffic data of the normal behavior pattern at each time point in the time zone from the normal behavior model, and use Indicates that i Indicates the number of each time point, i=1,2,......,r, r is the total number of time points; extract the traffic data performance of each time point in the current time zone, and use Express; use the formula Calculate the difference between the current traffic data performance and the traffic data performance under normal behavior mode ;

[0080] Step 202: Identify the number of sensitive resource accesses, the resource type of each access, and the total duration of sensitive resource accesses in the current time zone, and calculate the ratio of the number of sensitive resource accesses, the resource type of each access, and the total duration of sensitive resource accesses in the current time zone to the normal behavior mode, including the different access ratio, different source value, and different time ratio;

[0081] Extract the number of sensitive resource accesses, resource types, and total duration of sensitive resource accesses within the time zone from the access behavior data within the normal behavior pattern; identify the number of sensitive resource accesses, resource types for each access, and total duration of sensitive resource accesses within the current time zone;

[0082] Calculate the ratio between the number of sensitive resource accesses in the current time zone and the number of sensitive resource accesses under normal behavior patterns to obtain the abnormal access ratio. This ratio is calculated using the number of sensitive resource accesses in the current time zone as the numerator and the number of sensitive resource accesses under normal behavior patterns as the denominator.

[0083] Calculate the ratio between the number of resource types accessed in the current time zone and the number of resource types accessed in the normal behavior mode to obtain the heterogeneous value, that is, use the number of resource types accessed in the current time zone as the numerator and the number of resource types accessed in the normal behavior mode as the denominator for calculation;

[0084] Calculate the ratio of the total duration of sensitive resource access in the current time zone to the total duration of sensitive resource access in the normal behavior mode to obtain the asynchrony ratio. This ratio is calculated using the total duration of sensitive resource access in the current time zone as the numerator and the total duration of sensitive resource access in the normal behavior mode as the denominator.

[0085] Step 203: Calculate the difference index by combining the quantity difference value, visit difference ratio, source difference value, and time difference ratio calculated in the current time zone;

[0086] In this embodiment, the calculation formula of the difference degree index is:

[0087] ,

[0088] Among them, cis is the difference degree index, represent the heterogeneous visit ratio, heterogeneous source value, and heterogeneous time ratio, respectively; are the impact weight factors corresponding to the quantity difference value, visit difference ratio, source difference value and time difference ratio respectively;

[0089] Step 204: Compare the difference degree index with the difference degree threshold index range and trigger a corresponding early warning mode;

[0090] In this embodiment, if the difference degree index cis is within the difference degree threshold index range, a primary warning is triggered; if the difference degree index cis is higher than the difference degree threshold index range, an advanced warning is triggered;

[0091] To illustrate this with a practical example, let's assume there is a multinational company whose business is distributed across multiple time zones. For example, let's analyze the office area located in the UTC+8 time zone.

[0092] Over a period of time (e.g., one month), network traffic data and host behavior data from normal business scenarios in the UTC+8 time zone are collected. This data is labeled, and after removing abnormal behavior data, a long short-term memory (LSTM) algorithm combined with an attention mechanism is used to learn this data and construct a normal behavior model. This model records traffic data performance at different time points under normal behavior patterns, as well as behavioral data such as the number of sensitive resource accesses, the type of resource accessed, and the total duration of sensitive resource accesses.

[0093] For example, in the normal behavior pattern, the network traffic recorded during the working hours of 9:00-18:00 on weekdays in this time zone ranged from 100MB to 200MB per hour. The average number of accesses to sensitive resources (such as the company's financial data system) was 5 times per hour. The accessed resource types included office software systems, internal document systems, and customer relationship management systems. The total duration of sensitive resource access was 30 minutes per hour.

[0094] When calculating the difference degree index, relevant data of the normal behavior pattern of the corresponding time zone can be extracted and calculated with the real-time data of the corresponding time zone;

[0095] If the difference degree index cis is within the difference degree threshold index range, a primary warning is triggered; if the difference degree index cis is higher than the difference degree threshold index range, an advanced warning is triggered.

[0096] Step 3: Set confidence scores for different types of warning signals. Determine the type of warning signal triggered based on the confidence score. When a primary warning is triggered, make a secondary adjustment to the confidence score. After completing the secondary adjustment, determine whether the primary warning needs to be upgraded based on the adjusted confidence score and the APT attack feature knowledge base. When an advanced warning is triggered, generate a threat data packet for subsequent hidden dangers based on historical APT attack data.

[0097] The specific steps include:

[0098] Step 301: Set confidence scores for different types of warning signals.

[0099] Set a confidence score for each of the primary and advanced warnings. For example, the confidence score range can be set to 70-100, and it is an integer. The primary warning can be set to 70, and the advanced warning can be set to 100.

[0100] Step 302: When a primary warning is triggered, a basic data set containing multiple indicators is constructed, a confidence score conversion set corresponding to the basic data set is set, and a secondary adjustment is made to the confidence score based on the matching results of the basic data set and the confidence score conversion set. The specific steps include the following:

[0101] Step 3021: Calculate the average value of the normal behavior pattern traffic data performance at each time point in the current time zone, record it as the horizontal threshold, compare the traffic data performance at each time point in the current time zone with the horizontal threshold, filter out the traffic data that exceeds the horizontal threshold, and count the number of traffic flows as the number of outliers;

[0102] Step 3022: Arrange the filtered flow data that are above the level threshold in chronological order, and obtain a flow time series after the arrangement is completed;

[0103] It should be noted that if there are missing time points, they are filled with the previous valid value or marked as invalid to ensure that the time series are equally spaced, which facilitates subsequent window sliding;

[0104] Step 3023: Set the moving window size X, calculate each group of flow data in the flow time series, obtain the moving flow average of each group, calculate the difference between the moving flow averages of two adjacent groups, and determine the flow trend value based on the difference;

[0105] In this embodiment, X is specifically set according to the number of flow data above the horizontal threshold;

[0106] Specifically, the intervals of the number of groups corresponding to the number of flow data can be preset, and each interval of the number of groups can be set to correspond to a window size. The number of flow data above the horizontal threshold flow data can be matched with the intervals of the number of groups to determine the moving window size X.

[0107] Specifically, according to the set moving window size X, each group of flow data in the flow time series is calculated to obtain the moving flow average of each group, and the difference between the two adjacent moving flow averages is calculated. The difference calculation logic is as follows: subtract the value in the next digit from the value in the previous digit of the two adjacent moving flow averages; if the calculated difference is a positive value, it is marked as an increasing value; if the calculated difference is a negative value, the absolute value is taken and marked as a decreasing value; the sum of the increasing values ​​is subtracted from the sum of the decreasing values ​​in each group to obtain the trend flow value;

[0108] In this embodiment, the trend flow value is positive and has a large value, indicating that the flow rate is continuously increasing in the current time zone;

[0109] Step 3024: Extract users who access sensitive resources in the current time zone and construct a list of abnormal users. For each user in the abnormal user list, extract the historical access data for each user in the current time zone, including the resource type and number of accesses by each user in the current time zone.

[0110] Match the resource types accessed by each user in the current time zone with the resource types accessed historically. If the match fails, it is considered a behavior deviation. Count the number of users with behavior deviations in the abnormal user list in the current time zone and record it as the number of behavior deviations.

[0111] Set the required access rights for each sensitive resource, extract the access rights of each user in the abnormal user list, and compare them with the access rights required to access sensitive resources. If the access rights are lower than the required access rights, it is considered an access deviation. Count the number of users in the abnormal user list with access deviations in the current time zone and record them as the number of access deviations.

[0112] If the audit log shows access application records and permission approval records, the corresponding behavior deviation number and access deviation number will be reduced by one each;

[0113] Step 3025: Construct a basic data set containing the number of outliers, trend flow values, number of behavioral deviations, and number of access deviations. Set a confidence bonus conversion set corresponding to the basic data set. After matching and converting the basic data set with the confidence bonus conversion set, add the converted confidence bonus scores of each group and then sum the sum with the confidence score of the primary warning to obtain a secondary adjusted confidence score.

[0114] Specifically, the confidence additional score conversion set includes the value ranges of each group corresponding to the number of different flows, the value ranges of each group corresponding to the trend flow value, the value ranges of each group corresponding to the number of behavior deviations, and the value ranges of each group corresponding to the number of access deviations:

[0115] Each different value range corresponds to a confidence bonus score. The confidence bonus score range is set to 1-10 and is an integer. The more different flows, the higher the probability of matching 10. The larger the trend flow value, the higher the probability of matching 10. The more behavioral deviations, the higher the probability of matching 10. The more access deviations, the higher the probability of matching 10.

[0116] The confidence score after secondary adjustment is the sum of the initial score and the additional scores of the four indicators:

[0117] ,

[0118] in, x 1 is the number of different flows, x 2 is the trend flow value, x 3 is the number of behavioral deviations, x 4 is the number of access deviations; taking the number of different flows as an example, the range of values ​​for each group and the corresponding confidence additional score can be set as follows:

[0119] ,

[0120] For example, if the number of detected outliers is 7, the additional score is 5, and the sum of other indicators is calculated in the same way.

[0121] Similarly, the specific value range and corresponding confidence score are set by technical personnel, and the trend flow value may be negative. If it is negative, the confidence additional score is directly set to 1;

[0122] It should be noted that if the confidence score after the second adjustment is higher than the confidence score of the advanced warning, they are also considered equal;

[0123] Step 303: After completing the secondary adjustment of the confidence score,

[0124] The constructed APT attack feature knowledge base and corresponding judgment conditions determine whether the primary warning needs to be upgraded, including:

[0125] Step 3031: If the adjusted confidence score reaches or exceeds the advanced warning threshold of 100 points, the primary warning needs to be upgraded to an advanced warning;

[0126] Step 3032: Based on the tactical behavior chain library, determine the matching degree between the time series feature vector of the current network behavior and the historical APT attack feature vector. If the matching degree reaches the set threshold, upgrade the primary warning to an advanced warning.

[0127] In this embodiment, the attack signature matching degree (Sim value) is calculated as follows:

[0128] ,

[0129] in, is the temporal feature vector of the current network behavior, is the historical APT attack feature vector, is the weight factor of network topology entropy change, is the entropy change value of the current network topology; when Sim>γ, an attack organization identification code is generated and combined with the cis index to generate the final threat level.

[0130] In this embodiment, the attack signature matching degree (Sim value) reaches 0.8 or above, which means that a known APT attack signature is detected.

[0131] Step 3033: Based on the traffic entropy baseline library, the Shannon entropy of the current traffic is compared with the Shannon entropy baseline value. If the set conditions are met, the primary warning is upgraded to an advanced warning.

[0132] In this embodiment, the CPU instruction sequence is collected through the performance counter (PMC) to detect unusual instruction combinations (such as more than 10 consecutive rdtsc instructions); the permission transition path in the process tree is monitored, and when the "office software → powershell → domain controller access mode" is detected, it is marked as suspicious;

[0133] Calculate the Shannon entropy of the current flow:

[0134] ,

[0135] in, The byte value in the traffic is k probability of occurrence.

[0136] when When the entropy abnormality alarm is triggered;

[0137] Step 3034: Detect the current feature based on the high-risk feature fingerprint library. Once a feature in the high-risk feature fingerprint library appears, immediately upgrade the primary warning to a high-level warning.

[0138] The system features a fast-track system for critical signatures. Upon discovering certain high-risk signatures within the high-risk signature fingerprint library, the alert is immediately upgraded, without waiting for the full confidence calculation process to complete. For example, if the signature instruction sequence of the Equation group's "Dual Pulsar" backdoor is detected—that is, the continuous execution of a specific combination of privileged instructions—the alert is upgraded. Another example is if a complete match is found for the typical attack steps of the Emissary Panda group, such as "phishing email → macro virus → scheduled task creation → lateral movement," the alert is also immediately upgraded.

[0139] If any of the above conditions is met, the primary warning will be upgraded to a high-level warning;

[0140] Step 304: When an advanced warning is triggered, historical APT attack data is used to generate a threat data packet of potential risks and push it to management personnel; the threat data packet includes the attack path, existing vulnerabilities, and affected assets;

[0141] The specific steps include:

[0142] Step 3041: construct a feature vector dataset for the current triggering of an advanced warning, including the quantity outlier value, the outlier visit ratio, the outlier source value, and the outlier time ratio;

[0143] Step 3042: extract the historical vector data set before each historical APT attack, including the historical quantity outlier value, historical outlier visit ratio, historical outlier source value, and historical outlier time ratio;

[0144] Step 3043: Calculate each set of values ​​contained in the feature vector dataset and the historical vector dataset using the cosine similarity formula, perform a difference calculation between the calculated result and the integer one, and then take the absolute value to obtain the historical evaluation value. The historical APT attack data with the lowest historical evaluation value is selected as the reference data.

[0145] It should be noted that cosine similarity measures the directional consistency of vectors and ranges from -1 to 1, with values ​​closer to 1 indicating greater similarity. In APT detection, this embodiment focuses on positive similarity. To convert similarity into difference for intuitive evaluation, 1-cosine similarity is used. When the cosine similarity is 1, the difference is 0, indicating a perfect match; when the cosine similarity is 0, the difference is 1, indicating complete dissimilarity. 1-cosine similarity is a practical similarity distance, and the absolute value is used to avoid interference from negative values.

[0146] Step 3044: Each historical APT attack data also includes the attack path and the assets affected by the existing vulnerabilities. The attack paths and assets affected by the existing vulnerabilities corresponding to the reference data are integrated into a threat data package and pushed to the management personnel.

[0147] Through the above comprehensive analysis of similarity and threat levels, we can have a more comprehensive understanding of the APT attack behaviors corresponding to the current advanced warnings, providing a basis for taking effective countermeasures;

[0148] Example 2

[0149] This embodiment provides a detection system for APT attack behavior, including:

[0150] Normal behavior model building module, which is used to build a normal behavior model based on the network traffic data and host behavior data obtained in different time zones under normal business scenarios, and to build an APT attack feature knowledge base;

[0151] An anomaly detection module is used to construct real-time feature data based on traffic data and behavior data performance in different time zones, compare the difference between the real-time feature data and the normal behavior model, and generate a difference index based on the difference comparison results; trigger a corresponding warning signal based on the match between the difference index and the preset difference threshold index range;

[0152] The early warning module is used to set confidence scores for different types of early warning signals, determine the type of triggered early warning signaling based on the confidence score, and when a primary early warning is triggered, make a secondary adjustment to the confidence score. After completing the secondary adjustment of the confidence score, it is used to determine whether the primary early warning needs to be upgraded based on the adjusted confidence score result and the APT attack feature knowledge base; when an advanced early warning is triggered, a threat data packet indicating the hidden danger is generated based on historical APT attack data.

[0153] It should be noted that the above-mentioned embodiments of the detection system for APT attack behavior only illustrate the division of the above-mentioned functional modules when detecting attack behaviors. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the system can be divided into different functional modules to complete all or part of the functions described above. In addition, the above-mentioned embodiments of the detection system for APT attack behavior and the embodiments of the detection method for APT attack behavior are based on the same concept. The specific implementation process is detailed in the method embodiments and will not be repeated here.

[0154] Example 3

[0155] This embodiment provides a computer-readable storage medium having a computer program stored thereon. When the program is executed by a processor, the steps described above for detecting APT attack behaviors are implemented.

[0156] Example 4

[0157] This embodiment provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the steps described above for detecting APT attack behaviors are implemented.

[0158] In the above embodiments, all or part of the embodiments can be implemented using software, hardware, firmware, or any combination thereof. When implemented using software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that can be accessed by a computer, or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, or a magnetic tape), an optical medium (e.g., a digital versatile disc (DVD)), or a semiconductor medium (e.g., a solid state disk (SSD)). It is worth noting that the computer-readable storage medium mentioned in the present invention may be a non-volatile storage medium, in other words, a non-transitory storage medium.

[0159] The above description is an embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made by those skilled in the art based on the description of the embodiments of the present invention should be included in the scope of protection of the present invention.

Claims

1. A detection method for APT attack behavior, characterized in that: The steps include: Based on the network traffic data and host behavior data obtained in different time zones under normal business scenarios, a normal behavior model is built, and an APT attack feature knowledge base is constructed; Based on the traffic data and behavior data performance in different time zones, real-time feature data is constructed. The difference degree is compared between the real-time feature data and the normal behavior model, and a difference degree index is generated based on the difference degree comparison result. The corresponding warning signal is triggered based on the matching result of the difference degree index and the preset difference degree threshold index range. Confidence scores are set for different types of warning signals. The type of warning signal triggered is determined based on the confidence score. When a primary warning is triggered, the confidence score is adjusted twice. After the secondary adjustment of the confidence score is completed, the adjusted confidence score result and the APT attack feature knowledge base are combined to determine whether the primary warning needs to be upgraded. When an advanced warning is triggered, a threat data packet is generated based on historical APT attack data. When a primary warning is triggered, the confidence score is adjusted twice, including: Calculate the level threshold of the normal behavior pattern traffic data at each time point in the current time zone, filter out the traffic data above the level threshold, and count the number as the number of abnormal flows; Arrange the filtered flow data above the level threshold in the order of time points, and obtain the flow time series after the arrangement is completed; Set the moving window size X, calculate each group of flow data in the flow time series, obtain the moving flow average of each group, calculate the difference between the average values ​​of two adjacent groups of moving flow, and determine the flow trend value based on the difference; Extract users who access sensitive resources in the current time zone and build a list of abnormal users. Count the number of behavioral deviations and access deviations in the abnormal user list in the current time zone. Construct a basic data set containing the number of outliers, trend flow values, number of behavioral deviations, and number of access deviations. Set a confidence bonus conversion set corresponding to the basic data set. After matching and converting the basic data set with the confidence bonus conversion set, add the converted confidence bonus scores of each group and then sum the summed value with the confidence score of the primary warning to obtain the secondary adjusted confidence score. The determination of whether to upgrade the primary warning based on the adjusted confidence score result and the APT attack feature knowledge base includes: If the adjusted confidence score reaches or exceeds the advanced warning threshold, the primary warning will be upgraded to an advanced warning; Based on the tactical behavior chain library, the matching degree between the time series feature vector of the current network behavior and the historical APT attack feature vector is determined. If the matching degree reaches the set threshold, the primary warning is upgraded to an advanced warning. Based on the traffic entropy baseline library, the Shannon entropy of the current traffic is compared with the Shannon entropy baseline value. When the set conditions are met, the primary warning is upgraded to an advanced warning; The current feature is detected based on the high-risk feature fingerprint library. Once it is consistent with the feature in the high-risk feature fingerprint library, the primary warning is immediately upgraded to a high-level warning.

2. The method for detecting APT attack behavior according to claim 1, wherein: The comparing the difference between the real-time feature data and the normal behavior model and generating a difference index based on the comparison result include: Calculate the difference between the current traffic data performance and the traffic data performance under normal behavior mode; Identify the number of sensitive resource accesses, resource types for each access, and total duration of sensitive resource accesses in the current time zone, and calculate the ratio of the number of sensitive resource accesses, resource types for each access, and total duration of sensitive resource accesses in the current time zone to the normal behavior mode, including the different access ratio, different source value, and different time ratio; The difference degree index is calculated by combining the quantity difference value, visit difference ratio, source difference value and time difference ratio calculated in the current time zone.

3. The method for detecting APT attack behavior according to claim 1, wherein: The calculation formula of the difference degree index is: ， Among them, cis is the difference degree index, represent the heterogeneous visit ratio, heterogeneous source value, and heterogeneous time ratio, respectively; are the impact weight factors corresponding to the quantity difference value, visit difference ratio, source difference value and time difference ratio respectively.

4. The method for detecting APT attack behavior according to claim 1, wherein: The corresponding warning signal is triggered according to the matching result of the difference degree index and the preset difference degree threshold index range, including: if the difference degree index cis is within the difference degree threshold index range, a primary warning is triggered; if the difference degree index cis is higher than the difference degree threshold index range, an advanced warning is triggered.

5. The method for detecting APT attack behavior according to claim 1, wherein: When an advanced warning is triggered, a threat data packet is generated based on historical APT attack data, including: Construct the feature vector dataset for the current triggering of advanced warning, including the quantity outlier value, visit outlier ratio, source outlier value, and time outlier ratio; Extract the historical vector data set before each historical APT attack, including historical quantity outliers, historical outlier ratios, historical outlier source values, and historical outlier time ratios; The cosine similarity formula is used to calculate the numerical values ​​contained in the feature vector dataset and the historical vector dataset. The absolute value of the difference between the calculated result and the integer one is taken to obtain the historical evaluation value. The historical APT attack data with the lowest historical evaluation value is taken as the reference data. The attack paths and vulnerabilities corresponding to the reference data are integrated into threat data packages for affected assets.

6. A detection system for APT attack behavior, characterized by: The method for detecting APT attack behavior according to any one of claims 1 to 5 comprises: Normal behavior model building module, which is used to build a normal behavior model based on the network traffic data and host behavior data obtained in different time zones under normal business scenarios, and to build an APT attack feature knowledge base; An anomaly detection module is used to construct real-time feature data based on traffic data and behavior data performance in different time zones, compare the difference between the real-time feature data and the normal behavior model, and generate a difference index based on the difference comparison results; trigger a corresponding warning signal based on the match between the difference index and the preset difference threshold index range; The early warning module is used to set confidence scores for different types of early warning signals, determine the type of triggered early warning signaling based on the confidence score, and when a primary early warning is triggered, make a secondary adjustment to the confidence score. After completing the secondary adjustment of the confidence score, it is used to determine whether the primary early warning needs to be upgraded based on the adjusted confidence score result and the APT attack feature knowledge base; when an advanced early warning is triggered, a threat data packet indicating the hidden danger is generated based on historical APT attack data.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method for detecting APT attack behaviors as described in any one of claims 1 to 5 are implemented.

8. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the method for detecting APT attack behavior according to any one of claims 1 to 5 are implemented.

Images