Information security attack tracing method based on artificial intelligence

Abstract

According to the information security attack tracing method based on artificial intelligence, when a system monitors that an attack is received, an attack chain is constructed based on an information flow direction; processing the attack chain to obtain a type identification feature; inputting the type recognition features into a trained neural network for processing to obtain an attack type; processing the attack chain to obtain environment fingerprint features, wherein the environment fingerprint features comprise static features, dynamic features and context features; performing attack tracing based on the attack type and the environment fingerprint feature; after artificial intelligence is combined into attack type recognition, different features can be selected from static features, dynamic features and context features of environment fingerprint features for combined judgment, and after the attack type is determined in advance, the environment fingerprint features are added for tracing, so that the source positioning efficiency and accuracy can be greatly improved, and the source positioning accuracy is improved. Therefore, obstruction can be handled timely, normal operation of the system is prevented from being affected, and information leakage is prevented.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an information security attack tracing method based on artificial intelligence. Background Art

[0002] With the rapid development of information technology, especially the widespread popularization of technologies such as the Internet, the Internet of Things, and cloud computing in various fields, the scale and complexity of information systems are growing. Enterprises, government agencies and even individuals are highly dependent on information systems to store, process and transmit massive amounts of sensitive information, covering all aspects such as commercial secrets, personal privacy, and security data. However, this also makes information systems face unprecedented security threats, network attacks occur frequently, and attack methods are becoming more diverse, complex, and covert.

[0003] Traditional information security protection methods focus on perimeter defense, such as firewalls and intrusion detection systems (IDS), which aim to prevent illegal external access to internal networks. However, this passive defense model is difficult to cope with new and complex attack scenarios such as advanced persistent threats (APTs), zero-day vulnerability exploits, and attacks caused by illegal operations by insiders. Once an attack breaks through the perimeter defense line and moves laterally within the network, stealing data or damaging the system, traditional protection tools can often only detect it after the fact, making it difficult to quickly and accurately trace the source of the attack. Summary of the Invention

[0004] In view of this, the present invention proposes an information security attack tracing method based on artificial intelligence, which can uniquely identify the source of the attack based on environmental fingerprint characteristics, so as to facilitate timely processing and isolation to ensure information security.

[0005] The technical solution of the present invention is achieved as follows:

[0006] An information security attack tracing method based on artificial intelligence includes the following steps:

[0007] Step S1: When the system is under attack, an attack chain is constructed based on the information flow;

[0008] Step S2: Process the attack chain to obtain type identification features;

[0009] Step S3: Input the type identification features into the trained neural network for processing to obtain the attack type;

[0010] Step S4: Process the attack chain to obtain environmental fingerprint features, which include static features, dynamic features, and context features;

[0011] Step S5: Tracing the attack source based on the attack type and environmental fingerprint characteristics.

[0012] Preferably, the specific steps of the system monitoring attack in step S1 are:

[0013] Step S11: deploying a traffic analysis engine, a behavior analysis module, and a transaction monitoring module at the network layer, host layer, and application layer of the system respectively;

[0014] Step S12: Collect monitoring data through the traffic analysis engine, behavior analysis module, and transaction monitoring module;

[0015] Step S13: Compare the monitoring data with the abnormal behavior database to determine whether the monitoring system is under attack.

[0016] Preferably, the specific steps of constructing the attack chain based on the information flow in step S1 are:

[0017] Step S14: Constructing a blockchain-based attack chain;

[0018] Step S15: In each block of the blockchain, the monitoring data is added to the block in the order in which the monitoring data was collected.

[0019] Preferably, the specific steps of step S2 are:

[0020] Step S21: Clean, time-synchronize, and filter redundant data in the attack chain.

[0021] Step S22: extracting network features, time features, and behavior features from the processed data;

[0022] Step S23: normalize the network features, time features, and behavior features.

[0023] Preferably, the specific steps of step S3 are:

[0024] Step S31: Construct a convolutional neural network and collect historical data of the same system, wherein the historical data includes historical attack types and historical type identification features collected when the attack occurred;

[0025] Step S32: Divide the historical type identification features and the corresponding historical attack types into a training set and a test set;

[0026] Step S33: Use the training set to train the convolutional neural network and test the accuracy using the test set;

[0027] Step S34: Input the type identification features into the trained convolutional neural network, and the convolutional neural network processes the features to obtain the attack type.

[0028] Preferably, the attack types include malware attacks, APT attacks, covert channel attacks and supply chain attacks.

[0029] Preferably, the specific steps of obtaining the static features in step S4 are:

[0030] Step S41: Read the processor microcode version and calculate the hash value to obtain the hard disk factory identification. At the same time, parse the first 3 bytes of the MAC address, match the manufacturer database, and output the hash value, hard disk factory identification, and manufacturer database as a hardware fingerprint.

[0031] Step S42: Calculate a hash whitelist for key system files, extract the structural hash of a specific registry entry, and output the hash whitelist and structural hash as a software baseline.

[0032] Preferably, the specific steps of obtaining dynamic features in step S4 are:

[0033] Step S43: monitor the CPU usage cycle of the malicious process, record the cache miss rate timing sequence through a performance monitoring timer, and output the CPU usage cycle of the malicious process and the cache miss rate timing sequence as a timing behavior feature;

[0034] Step S44: Count the changes in TCP initial window size and TLS handshake parameters and output them as a network dynamic fingerprint;

[0035] Step S45 : collecting the RF signal during the attack period, extracting the short-time Fourier transform spectrum characteristics, collecting the power ripple transient response during the attack period, and outputting the short-time Fourier transform spectrum characteristics and the power ripple transient response as a hardware dynamic signal.

[0036] Preferably, the specific steps of obtaining context features in step S4 are:

[0037] Step S46: Obtain geographic spatiotemporal context, behavior pattern context, and network topology context, and output them as context features.

[0038] Preferably, the specific steps of step S5 are:

[0039] Step S51: When the attack type is a malware attack, static features and dynamic features are selected as the basis for tracing the source;

[0040] Step S52: When the attack type is an APT attack, static features, dynamic features, and context features are selected as the basis for tracing the source;

[0041] Step S53: When the attack type is a covert channel attack, dynamic features and context features are selected as the basis for tracing the source;

[0042] Step S54: When the attack type is a supply chain attack, context features and static features are selected as the basis for tracing the source.

[0043] Compared with the prior art, the present invention has the following beneficial effects:

[0044] The present invention provides an information security attack tracing method based on artificial intelligence. When a system is attacked, the information flow at the time of the attack is constructed into an attack chain, and a blockchain method is introduced to ensure the authenticity and unmodified nature of the attack chain data. The attack chain can then be processed separately to obtain type identification features and environmental fingerprint features. The type identification features are used to combine with neural networks to process possible attack types. The environmental fingerprint features are the unique identifier of the attack. After determining the attack type, the environmental fingerprint features can be combined to trace the attack source. Different environmental fingerprint features can be selected for different attack types, so that the source of the attack can be accurately located for timely isolation and cutting off, avoiding the system from suffering long-term attacks that lead to information leakage and system paralysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only preferred embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0046] Figure 1 This is a flow chart of an information security attack tracing method based on artificial intelligence of the present invention;

[0047] Figure 2 This is a flowchart of step S1 of an information security attack tracing method based on artificial intelligence of the present invention;

[0048] Figure 3 This is a flowchart of step S2 of an information security attack tracing method based on artificial intelligence of the present invention;

[0049] Figure 4 This is a flowchart of step S3 of the information security attack tracing method based on artificial intelligence of the present invention;

[0050] Figure 5 This is a flowchart of step S4 of an information security attack tracing method based on artificial intelligence of the present invention;

[0051] Figure 6 This is a flowchart of step S5 of the information security attack tracing method based on artificial intelligence of the present invention; DETAILED DESCRIPTION

[0052] In order to better understand the technical content of the present invention, a specific embodiment is provided below, and the present invention is further described in conjunction with the accompanying drawings.

[0053] See also Figures 1 to 6 The present invention provides an information security attack tracing method based on artificial intelligence, comprising the following steps:

[0054] Step S1: When the system is under attack, an attack chain is constructed based on the information flow;

[0055] Step S2: Process the attack chain to obtain type identification features;

[0056] Step S3: Input the type identification features into the trained neural network for processing to obtain the attack type;

[0057] Step S4: Process the attack chain to obtain environmental fingerprint features, which include static features, dynamic features, and context features;

[0058] Step S5: Tracing the attack source based on the attack type and environmental fingerprint characteristics.

[0059] The present invention provides an information security attack tracing method based on artificial intelligence. When a system is attacked, an attack chain can be constructed according to the information flow at the time of the attack. The attack chain includes the attack location, attack means, affected systems and resources, and time series when the system is attacked. By constructing the attack chain, the attack can be digitized and stored, which is convenient for subsequent data processing. After obtaining the attack chain, the attack chain can be processed separately to obtain type identification features and environmental fingerprint features respectively, wherein the type identification features are used to input into a neural network, and the neural network is used to process the attack type. By introducing the neural network in artificial intelligence, data can be processed at high speed, and the attack type can be quickly determined based on historical data. After determining the attack type, it is necessary to efficiently locate the source of the attack. At this time, the attack type and environmental fingerprint data can be combined for tracing. After determining the source of the attack, it can be quickly processed and blocked to avoid information leakage and system paralysis.

[0060] For environmental fingerprint features, it is the unique identifier of the attack. Among them, static features are features that are solidified and difficult to change in the attack carrier or tool. They are highly stable and can quickly match known threats. Dynamic features are behavioral features generated in real time during the attack process. Their advantage is that they can detect unknown attacks and have strong anti-interference capabilities. Contextual features are environmental information when the attack occurs. Their advantage is that they can provide spatiotemporal correlation of the attack chain and enhance the accuracy of tracing. Based on different attack types, different combinations of environmental fingerprint features can be selected for tracing. In attack tracing, the three features need to be used in coordination. Among them, static features are the basis and are suitable for quickly matching known threats. Dynamic features are the core and play a key role, especially in unknown attacks. Contextual features are the link and can provide spatiotemporal correlation of the attack chain.

[0061] Preferably, the specific steps in step S1 are:

[0062] Step S11: deploying a traffic analysis engine, a behavior analysis module, and a transaction monitoring module at the network layer, host layer, and application layer of the system respectively;

[0063] Step S12: Collect monitoring data through the traffic analysis engine, behavior analysis module, and transaction monitoring module;

[0064] Step S13: Compare the monitoring data with the abnormal behavior database to determine whether the monitoring system is under attack.

[0065] Step S14: Constructing a blockchain-based attack chain;

[0066] Step S15: In each block of the blockchain, the monitoring data is added to the block in the order in which the monitoring data was collected.

[0067] The main architecture of the system includes the network layer, host layer and application layer. To ensure the stability of the system, attack monitoring modules are deployed in the network layer, host layer and application layer respectively. The network layer deploys a traffic analysis engine, the host layer deploys a behavior analysis module, and the application layer deploys a transaction monitoring model. Monitoring data can be collected through the traffic analysis engine, behavior analysis module and transaction monitoring module respectively. The monitoring data is used to compare with the preset abnormal behavior database to determine whether the system is under attack. When attacked, a blockchain-based attack chain is constructed. Each block in the attack chain can store monitoring data at different times. By introducing blockchain, the authenticity and unmodified nature of the data can be guaranteed.

[0068] Preferably, the specific steps of step S2 are:

[0069] Step S21: Clean, time-synchronize, and filter redundant data in the attack chain.

[0070] Step S22: extracting network features, time features, and behavior features from the processed data;

[0071] Step S23: normalize the network features, time features, and behavior features.

[0072] Before processing the attack chain to obtain type identification features, the data in the attack chain is first cleaned, including processing missing values. For key information missing in some logs, such as timestamps and source IP addresses, data interpolation is used to supplement them. If the timestamp of a record is missing, it can be supplemented based on the timestamps of the previous and next records. After data cleaning is completed, the logs across systems can be synchronized, and duplicate session records can be removed to clear redundant data and noise.

[0073] After data preprocessing is completed, network features, time features, and behavioral features can be extracted from the data. Network features include traffic packet size and port entropy value, time features include event interval and nighttime activity ratio, and behavioral features include privileged operation frequency and process tree depth. After feature extraction is completed, the feature data is normalized to standardize the feature data.

[0074] Preferably, the specific steps of step S3 are:

[0075] Step S31: Construct a convolutional neural network and collect historical data of the same system, wherein the historical data includes historical attack types and historical type identification features collected when the attack occurred;

[0076] Step S32: Divide the historical type identification features and the corresponding historical attack types into a training set and a test set;

[0077] Step S33: Use the training set to train the convolutional neural network and test the accuracy using the test set;

[0078] Step S34: Input the type identification features into the trained convolutional neural network, and the convolutional neural network processes the features to obtain the attack type.

[0079] The present invention applies convolutional neural networks in artificial intelligence to information security attacks. The convolutional neural network can be trained through historical type recognition features and historical attack types. After training to a certain level, it is tested using a test set. When the test accuracy meets the requirements, the convolutional neural network can be put into use. After the type recognition features obtained by attack chain processing are input into the convolutional neural network, possible attack types can be identified, so as to facilitate tracing in combination with environmental fingerprint features.

[0080] Preferably, the attack types include malware attacks, APT attacks, covert channel attacks and supply chain attacks.

[0081] Malware attacks refer to attackers using malicious programs such as viruses, worms, Trojans, spyware, and ransomware to invade target systems through networks, storage devices, or other channels in order to steal information, control devices, destroy data, or extort money.

[0082] APT attacks are a long-term and covert form of network attack. Attackers usually target specific targets and use a variety of advanced attack methods to bypass traditional security defense systems. They lurk in the target network for a long time and continuously steal sensitive information or carry out destructive activities.

[0083] A covert channel attack is when an attacker uses some non-traditional communication paths in the system to establish a covert information transmission channel to bypass security mechanisms and achieve illegal information transmission;

[0084] Supply chain attacks occur when attackers target the supply chain of a product or service, indirectly attacking the end user or target organization by invading the systems of suppliers, partners or third-party service providers.

[0085] Different attack types manifest differently in the system, and their corresponding unique identifiers also vary. After determining the attack type, different environmental fingerprint features can be selected for tracing based on the attack type.

[0086] Preferably, the specific steps of obtaining static features, dynamic features and context features in step S4 are:

[0087] Step S41: Read the processor microcode version and calculate the hash value through the CPUID instruction, use the SMART command to obtain the hard disk factory identification, and parse the first 3 bytes of the MAC address to match the manufacturer database. The hash value, hard disk factory identification, and manufacturer database are output as a hardware fingerprint.

[0088] Step S42: Calculate a hash whitelist for key system files, extract the structural hash of specific registry entries, and output the hash whitelist and structural hash as a software baseline;

[0089] Step S43: monitor the CPU usage cycle of the malicious process, record the cache miss rate timing sequence through a performance monitoring timer, and output the CPU usage cycle of the malicious process and the cache miss rate timing sequence as a timing behavior feature;

[0090] Step S44: Count the changes in TCP initial window size and TLS handshake parameters and output them as a network dynamic fingerprint;

[0091] Step S45: collecting the RF signal during the attack period, extracting the short-time Fourier transform spectrum characteristics, collecting the power ripple transient response during the attack period, and outputting the short-time Fourier transform spectrum characteristics and the power ripple transient response as a hardware dynamic signal;

[0092] Step S46: Obtain geographic spatiotemporal context, behavior pattern context, and network topology context, and output them as context features.

[0093] For static features, they are persistent environmental properties that are difficult for attackers to change quickly. They are usually related to physical hardware or firmware, and mainly include hardware fingerprints, software baselines, and firmware features. Firmware features also include calculating the CRC32 value of the firmware image, detecting unauthorized modifications, reading the PCR register value of the trusted platform module, and verifying the integrity of the boot chain. For dynamic features, they mainly reflect the real-time changes in system status or behavior patterns during the attack process, including timing behavior features, network dynamic fingerprints, and hardware dynamic signals. Timing behavior features include process CPU occupancy fluctuations and memory access patterns. Process CPU occupancy fluctuations can be detected by monitoring the CPU usage cycle of the malicious process, and the memory access pattern is to record the cache miss rate timing sequence through the performance monitoring timer (PMC). Network dynamic fingerprints include changes in TCP initial window size and TLS handshake parameters. The hardware dynamic signals include electromagnetic radiation time-frequency analysis and power ripple transient response. The electromagnetic radiation time-frequency analysis is obtained by collecting the RF signal during the attack period and extracting the short-time Fourier transform spectrum characteristics, while the power ripple transient response can be obtained by recording the voltage fluctuation pattern of the 12V power line when a high load is triggered. The contextual features include geographic spatiotemporal context, behavioral pattern context, and network topology context. The geographic spatiotemporal context can calculate the attacker's time zone through clock deviation, and can estimate the physical location of the attack device through triangulation combined with the pre-deployed AP location database. In the behavioral pattern context, the initiation time distribution of historical attack events can be counted to determine the attack event preference. At the same time, the unique string in the vulnerability exploitation code can be matched for tool chain association. In the topology context, the AS path of the attacking IP can be queried to associate with the suspicious autonomous system.

[0094] Preferably, the specific steps of step S5 are:

[0095] Step S51: When the attack type is a malware attack, static features and dynamic features are selected as the basis for tracing the source;

[0096] Step S52: When the attack type is an APT attack, static features, dynamic features, and context features are selected as the basis for tracing the source;

[0097] Step S53: When the attack type is a covert channel attack, dynamic features and context features are selected as the basis for tracing the source;

[0098] Step S54: When the attack type is a supply chain attack, context features and static features are selected as the basis for tracing the source.

[0099] After determining the attack type, you need to select different environmental fingerprint features for tracing. Different attack types require different environmental fingerprint features:

[0100] The hash value of malware is highly specific. By calculating the hash value of a file, it can be quickly compared with a library of known malware samples. Once the hash match is successful, the malicious nature of the software can be basically determined. This is because mature malware families usually have fixed code structures and characteristics, and their hashes are highly recognizable. In addition to using static features for tracing the source, dynamic features can be used as an auxiliary. Even if the hash match does not find any anomalies, the behavior of the software during runtime can provide key clues.

[0101] In APT attacks, dynamic features have a higher priority. The biggest feature of APT attacks is that they are covert and persistent. Attackers will gradually infiltrate the target network over a long period of time. By monitoring abnormal operations in the system, such as batch downloading of sensitive files late at night, unreasonable attempts to escalate permissions, and frequent use of system vulnerabilities to connect to other hosts on the intranet during lateral movement, signs of attack can be detected at the earliest. These dynamic behaviors reflect the real-time progress of the attack and are the key window for capturing APT attacks. In addition, contextual features can be used to understand the network nodes, jump servers, attacked servers, and the connection relationships between them through which the attack passed, which helps to restore the complete attack trajectory. Static features serve as a supplement. After locking in suspicious behaviors and attack paths, analyzing the tools used by the attacker, such as static features of specific malware and vulnerability exploitation toolkits, can be associated with known APT organizations or attack methods.

[0102] In covert channel attacks, dynamic features dominate, with contextual features serving as an auxiliary. The core of covert channels lies in using seemingly normal traffic to transmit illegal information, so analyzing various traffic patterns is key. Contextual features can be used to understand the system's network environment, such as its subnet, connection relationships with surrounding devices, network access rules, etc., helping to eliminate misjudgments.

[0103] Finally, there are supply chain attacks. Contextual features have a higher priority. In supply chain attack scenarios, it is crucial to understand the environment of each link in the distribution process of software or hardware products. Static features are used for confirmation. Once suspicion arises about the distribution node environment, the hash value of the software product flowing out of the node is calculated and compared with the official original version hash. If the hashes are inconsistent, it means that the software is very likely to have been tampered with during the distribution process, and there may be a risk of supply chain attacks.

[0104] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. An information security attack tracing method based on artificial intelligence, characterized in that: The following steps are involved: Step S1: When the system is under attack, an attack chain is constructed based on the information flow; Step S2: Process the attack chain to obtain type identification features; Step S3: Input the type identification features into the trained neural network for processing to obtain the attack type; Step S4: Process the attack chain to obtain environmental fingerprint features, which include static features, dynamic features, and context features. ； Step S5: Tracing the attack source based on the attack type and environmental fingerprint characteristics.

2. The information security attack tracing method based on artificial intelligence according to claim 1 is characterized in that: The specific steps of the system monitoring attack in step S1 are: Step S11: deploying a traffic analysis engine, a behavior analysis module, and a transaction monitoring module at the network layer, host layer, and application layer of the system respectively; Step S12: Collect monitoring data through the traffic analysis engine, behavior analysis module, and transaction monitoring module; Step S13: Compare the monitoring data with the abnormal behavior database to determine whether the monitoring system is under attack.

3. The information security attack tracing method based on artificial intelligence according to claim 2 is characterized in that: The specific steps of constructing the attack chain based on information flow in step S1 are: Step S14: Constructing a blockchain-based attack chain; Step S15: In each block of the blockchain, the monitoring data is added to the block in the order in which the monitoring data was collected.

4. The information security attack tracing method based on artificial intelligence according to claim 1 is characterized in that: The specific steps of step S2 are: Step S21: Clean, time-synchronize, and filter redundant data in the attack chain. Step S22: extracting network features, time features, and behavior features from the processed data; Step S23: normalize the network features, time features, and behavior features.

5. The information security attack tracing method based on artificial intelligence according to claim 1 is characterized in that: The specific steps of step S3 are: Step S31: Construct a convolutional neural network and collect historical data of the same system, wherein the historical data includes historical attack types and historical type identification features collected when the attack occurred; Step S32: Divide the historical type identification features and the corresponding historical attack types into a training set and a test set; Step S33: Use the training set to train the convolutional neural network and test the accuracy using the test set; Step S34: Input the type identification features into the trained convolutional neural network, and the convolutional neural network processes the features to obtain the attack type.

6. The information security attack tracing method based on artificial intelligence according to claim 1 or 5, characterized in that: The attack types include malware attacks, APT attacks, covert channel attacks, and supply chain attacks.

7. The information security attack tracing method based on artificial intelligence according to claim 1 is characterized in that: The specific steps of obtaining the static features in step S4 are: Step S41: Read the processor microcode version and calculate the hash value to obtain the hard disk factory identification. At the same time, parse the first 3 bytes of the MAC address, match the manufacturer database, and output the hash value, hard disk factory identification, and manufacturer database as a hardware fingerprint. Step S42: Calculate a hash whitelist for key system files, extract the structural hash of a specific registry entry, and output the hash whitelist and structural hash as a software baseline.

8. The information security attack tracing method based on artificial intelligence according to claim 1 is characterized in that: The specific steps of obtaining dynamic features in step S4 are as follows: Step S43: monitor the CPU usage cycle of the malicious process, record the cache miss rate timing sequence through a performance monitoring timer, and output the CPU usage cycle of the malicious process and the cache miss rate timing sequence as a timing behavior feature; Step S44: Count the changes in TCP initial window size and TLS handshake parameters and output them as a network dynamic fingerprint; Step S45 : collecting the RF signal during the attack period, extracting the short-time Fourier transform spectrum characteristics, collecting the power ripple transient response during the attack period, and outputting the short-time Fourier transform spectrum characteristics and the power ripple transient response as a hardware dynamic signal.

9. The information security attack tracing method based on artificial intelligence according to claim 1 is characterized in that: The specific steps of obtaining context features in step S4 are: Step S46: Obtain geographic spatiotemporal context, behavior pattern context, and network topology context, and output them as context features.

10. The information security attack tracing method based on artificial intelligence according to claim 6 is characterized in that: The specific steps of step S5 are: Step S51: When the attack type is a malware attack, static features and dynamic features are selected as the basis for tracing the source; Step S52: When the attack type is an APT attack, static features, dynamic features, and context features are selected as the basis for tracing the source; Step S53: When the attack type is a covert channel attack, dynamic features and context features are selected as the basis for tracing the source; Step S54: When the attack type is a supply chain attack, context features and static features are selected as the basis for tracing the source.

Images