Attack technique and tactics comparison and recognition method based on large model knowledge extraction
By combining an improved low-rank matrix fine-tuning and contrastive learning model with a graph attention network, the accuracy and generalization issues of APT attack technique and tactics recognition are solved, and the alignment of fine-grained kernel logs and coarse-grained CTI reports of APT attacks is achieved, improving the accuracy of APT attack recognition and the robustness of the model.
Patent Information
- Application Number
- CN202510778030.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-06-11
- Publication Date
- 2025-09-19
AI Technical Summary
Existing technologies have difficulty accurately and quickly identifying the techniques and tactics of APT attacks, especially when the attack process is complex and data is scarce. Traditional methods have problems such as poor generalization ability and reliance on expert experience.
A method based on large model knowledge extraction is adopted. Through improved low-rank matrix fine-tuning and contrastive learning model, combined with graph attention network, the first and second traceability graphs are constructed, and the KNN clustering algorithm is used to identify attack techniques and tactics.
It improves the accuracy and generalization ability of APT attack technique and tactics identification, enhances the robustness and adaptability of the model, and can effectively identify semantic information in unseen traceability graphs.
Smart Images
Figure CN120675754A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of network security, and in particular relates to a method for comparing and identifying attack techniques and tactics based on large model-based knowledge extraction. Background Art
[0002] APT (Advanced Persistent Threat) is a complex and covert form of cyber attack, usually launched by well-funded and skilled attackers (such as nation-state hacker groups). Its goal is to lurk in the networks of specific organizations or institutions for a long time to steal sensitive information or destroy critical infrastructure.
[0003] Since APT attacks are usually launched by well-funded and technically skilled attackers, their attack process is complex and covert. Attackers use a variety of advanced techniques and tools to gain and maintain long-term access to target systems.
[0004] This makes identifying APT attack techniques and tactics extremely important. Accurately and quickly identifying the techniques and tactics used in attacks can help cybersecurity experts promptly trace the attack and deploy appropriate defense strategies. However, APT attacks typically involve multiple phases, including reconnaissance, initial intrusion, privilege escalation, lateral movement, data exfiltration, and trace removal. Each phase may employ different techniques and tactics, and attackers dynamically adjust their behavior based on the target environment. This multi-phase and dynamic nature makes comprehensive identification of APT attack techniques and tactics extremely challenging. Furthermore, the covert and complex nature of APT attacks makes relevant attack data often scarce and difficult to obtain.
[0005] Traditional rule-driven approaches to identifying APT attack techniques and tactics are limited due to the diverse nature of attack techniques, resulting in numerous variations. These approaches rely on expert experience and are unable to cover diverse attack techniques. Traditional machine learning approaches, on the other hand, face challenges with limited data samples and poor generalization capabilities. Therefore, an accurate and efficient method for identifying APT attack techniques and tactics is urgently needed. Summary of the Invention
[0006] The purpose of this application is to address the problems of lack of attack data and poor generalization ability of traditional models, and to propose a comparative identification method of attack techniques and tactics based on large model-based knowledge extraction to achieve automated extraction of attack techniques and tactics from kernel logs.
[0007] In order to achieve the above object, the technical solution provided by the present invention is:
[0008] A method for comparing and identifying attack techniques and tactics based on large model-based knowledge extraction, comprising:
[0009] Obtain CTI reports and kernel logs. Each CTI report and kernel log contains attack technique and tactic tags.
[0010] The improved low-rank matrix fine-tuning method is used to fine-tune the large model, and the fine-tuned large model is used to construct the first traceability graph based on the CTI report;
[0011] Compress the kernel log into the second traceability graph;
[0012] Constructing a contrastive learning model, the contrastive learning model including two graph attention networks with shared parameters, constructing a first adjacency matrix and a second adjacency matrix based on the first provenance graph and the second provenance graph, inputting the first adjacency matrix and the second adjacency matrix into the two graph attention networks, respectively, to generate a first provenance graph embedding and a second provenance graph embedding;
[0013] Update the parameters of the contrastive learning model based on the first traceability graph embedding and the second traceability graph embedding to obtain a trained contrastive learning model;
[0014] A graph attention network in the trained contrastive learning model is used to obtain the embedding of the sample to be detected and the embedding of samples of known categories. The cosine similarity between the embedding of the sample to be detected and the embedding of samples of known categories is calculated, and the attack technique and tactic category of the sample to be detected is determined using the KNN clustering algorithm.
[0015] Furthermore, the improved low-rank matrix fine-tuning method is used to fine-tune the large model, including:
[0016] Set up prompt word templates, generate prompt words based on CTI reports, and input the prompt words into the big model;
[0017] The large model updates parameters according to the following formula:
[0018]
[0019]
[0020]
[0021]
[0022] in, represents the new low-rank matrix, represents the original parameter matrix, represents the learning round, and Indicates the The low-rank matrix of the training task, represents the LoRA regularization term, is the regularization coefficient, represents the Frobenius normal form of a low-rank matrix, represents the EWC regularization term, Indicates the The parameters of the training task, Indicates the The parameters of the training task, Indicates the The weight coefficient of each training task, represents the total loss function of LoRA regularization and EWC regularization, and Indicates the balance coefficient.
[0023] Furthermore, compressing the kernel log into a second tracing graph includes:
[0024] Arrange multiple consecutive events that implement the same semantic operation into a rule chain in a logical order, wherein the head event of the rule chain is the trigger condition and the tail event is the end condition;
[0025] Traverse the kernel log, and if there is a continuous event sequence that completely matches the trigger condition, event sequence, and end condition of the rule chain, merge the matching continuous event sequence into a semantic event;
[0026] A second traceability graph is obtained based on the merged semantic events.
[0027] Furthermore, constructing the first adjacency matrix and the second adjacency matrix based on the first traceability graph and the second traceability graph includes:
[0028] Use one-hot encoding to encode the attributes of all nodes and edges in the first and second provenance graphs to obtain the initial embedding of each node and edge;
[0029] When there are multiple edges with different attack technique and tactic labels between a pair of nodes, the edges are merged. The initial embedding of the merged edges is obtained by the following formula:
[0030]
[0031] in, represents the initial embedding of the merged edges, Indicates the The initial embedding of the edges, M represents the number of merged edges;
[0032] Construct a node feature matrix based on the initial embeddings of all nodes, and construct an edge feature matrix based on the initial embeddings of all edges;
[0033] The node feature matrix and the edge feature matrix of the first traceability graph together constitute a first adjacency matrix, and the node feature matrix and the edge feature matrix of the second traceability graph together constitute a second adjacency matrix.
[0034] Furthermore, updating the parameters of the contrastive learning model based on the first traceability graph embedding and the second traceability graph embedding includes:
[0035] The first and second tracing graph embeddings generated from the first and second tracing graphs with the same attack technique and tactics labels are used as positive sample pairs, and the first and second tracing graph embeddings generated from the first and second tracing graphs with different attack technique and tactics labels are used as negative sample pairs.
[0036] Calculate the cosine similarity of the positive sample pair and the cosine similarity of the negative sample pair, and calculate the loss value based on the cosine similarity of the positive sample pair and the cosine similarity of the negative sample pair to update the parameters of the contrastive learning model. The contrastive loss function is expressed as follows:
[0037]
[0038] in, Indicates NT-Xent loss, represents the cosine similarity of the positive sample pair, represents the cosine similarity of the negative sample pair, Represents the temperature parameter.
[0039] Furthermore, the method utilizes a graph attention network in the trained contrastive learning model to obtain the embedding of the sample to be detected and the embedding of samples of known categories, calculates the cosine similarity between the embedding of the sample to be detected and the embedding of samples of known categories, and utilizes the KNN clustering algorithm to determine the attack technique and tactic category of the sample to be detected, including:
[0040] Use a graph attention network from the trained contrastive learning model as the trained graph attention network;
[0041] Input the sample to be tested into the trained graph attention network to obtain the embedding of the sample to be tested, input all the first traceability graphs into the trained graph attention network to obtain the embedding of the known category samples, and calculate the cosine similarity between the embedding of the sample to be tested and the embedding of the known category samples;
[0042] Select the k neighbors whose cosine similarity between the embedding of the sample to be tested and the embedding of the known category samples is closest to 1, and determine the attack technique and tactics category of the sample to be tested as the most common attack technique and tactics label among the k neighbors.
[0043] Compared with the existing technology, the significant advantages of this application are: 1. It improves the large model fine-tuning technology, takes into account the balance between new knowledge learning and knowledge forgetting, and extracts attack features corresponding to TTPs from CTI reports to a certain extent to solve the problems of scarce existing attack data, difficulty in collecting attack samples, and complex screening of sensitive logs. 2. It provides a semantic compression extraction rule paradigm for aligning fine-grained kernel logs with coarse-grained CTI reports, filters a large amount of invalid information in the kernel logs, and completes the scale alignment of the two to provide a good data foundation for subsequent comparative learning and recognition. 3. The graph neural network is trained by combining graph neural networks and comparative learning, which improves the generalization ability compared to traditional machine learning models. Even when faced with a traceability graph that the model has not learned, it can still output an embedding containing its semantics, increasing the robustness and adaptability of the model. BRIEF DESCRIPTION OF THE DRAWINGS
[0044] Figure 1 This is a flow chart of a method for comparing and identifying attack techniques and tactics based on large model-based knowledge extraction in the present invention;
[0045] Figure 2 This is an example diagram of the first traceability graph constructed by extracting entities from a CTI report using a fine-tuned large model in the present invention;
[0046] Figure 3 This is an example diagram of the file movement compression rule chain of the present invention. DETAILED DESCRIPTION
[0047] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.
[0048] like Figure 1 As shown, the present application provides a method for comparing and identifying attack techniques and tactics based on large model knowledge extraction, comprising the following steps:
[0049] Step 1: Crawling CTI reports related to APT attacks from public datasets. MITRE ATT&CK (a knowledge base of adversarial tactics and techniques based on real-world attack incidents) provides extensive structured information on attacker behavior patterns, tactics, and techniques. Each CTI report is also labeled with the corresponding technique or tactic. In this example, all log identification targets are ultimately based on the attack technique and tactic labels (e.g., T1059) in the MITRE ATT&CK matrix.
[0050] Step 2: By improving the fine-tuning method, the large model can accurately extract the content in the CTI report as the first traceability graph. The specific steps include:
[0051] Step 2-1: Extract the text and remove irrelevant information such as advertisements and sidebars. These CTI reports typically use subheadings to divide the report into different sections, each describing the content from a different perspective. Based on the website's layout, the paragraph structure of each section is retained, unnecessary blank lines are removed, and blank lines are used to separate different sections. This facilitates subsequent processing and analysis. The captured report is stored in the format of "attack technique and tactic tags + text content."
[0052] Step 2-2: Improve the low-rank matrix fine-tuning method to allow the large model to build technical and tactical knowledge and continuously improve incrementally.
[0053] The low-rank matrix fine-tuning method is improved through incremental learning. The original matrix parameters are frozen, and low-rank decomposition is used to simulate the parameter changes to improve performance. The incremental sum of the low-rank matrix is added during multiple rounds of training to represent the newly learned knowledge. Regularization is used to limit the learning ratio of new and old knowledge to prevent catastrophic forgetting of large models during training. The formula for fine-tuning large model parameters is as follows:
[0054]
[0055] in, Represents a new low-rank matrix that is used to simulate the change in model parameters, thereby integrating new knowledge in the incremental learning process. is the original parameter matrix, and It is The low-rank matrix of the training task, Indicates the learning round.
[0056] Limit the size of the low-rank matrix to prevent the model from overfitting. and Perform LoRA regularization:
[0057]
[0058] in, represents the LoRA regularization term, is the regularization coefficient, is the Frobenius normal form of the low-rank matrix.
[0059] The introduction of EWC (Elastic Weight Consolidation) regularization ensures that important parameters of the old tasks are not significantly modified when the model learns a new task:
[0060]
[0061] in, represents the EWC regularization term, Indicates the The parameters of the training task, Indicates the The parameters of the training task, For the The weight coefficient of each training task.
[0062] Therefore, the total loss function should be constructed as:
[0063]
[0064] in, represents the total loss function of LoRA regularization and EWC regularization, and Indicates the balance coefficient.
[0065] Combining the total loss function of LoRA regularization and EWC regularization, we balance task performance and knowledge retention when optimizing large models, ensuring that the large model does not forget old knowledge while learning new knowledge.
[0066] Steps 2-3 provide the large model with training data (prompt word patterns) to fine-tune its parameters and better adapt to downstream tasks. For example, a CTI report from an enterprise security team detecting an attack on its internal network is shown below: The prompt format used for fine-tuning and the corresponding traceability graph format (stored as nodes and edges) after extraction are shown. The attack technique and tactic label is T1059, as shown below:
[0067] Instruction: You are a cyber security expert. Kindly extract theentities I require and the relationships among these entities from the following CTI report, such as malware, threat types, processes, threads, files, registries, and network sockets.
[0068] Input: During the period of the compromise, the espionage attackers accessed computers hosting databases and emails and eventually made their way to the domain controller. The first sign of malicious activity occurred onApril 23, when a malicious command was executed via imjpuex.exe. The fileimjputyc.exe is a legitimate Windows XP file that was used by the attackersto side-load a maliciousDLL file (imjputyc.dll), which in turn was used toload a .dat file (payload-imjputyc.dat). Following this activity, imjputyc.exe was used to launch a network service via svchost.exe, likely created by the malicious payload.
[0069] Output: Node: (espionage attackers, imjputyc.exe, svchost.exe...),Edge: (execute, side-load, load, launch).
[0070] Step 2-4: Use the fine-tuned large model to extract entities from the CTI report text to form the first traceability graph. The extracted entities are represented by triples.<subject, edge, object> The form of storage, where subject represents the subject node that initiates the operation, object represents the object node that is operated, subject and object may overlap, and edge represents the semantic relationship connecting the subject node and the object node. The extraction process is taken as an example of the CTI report shown in step 2-3. Figure 2As shown in the figure, the upper part is a CTI report example. The fine-tuned large language model extracts the attack semantics into a traceability graph stored in the form of triples. The specific storage content is as follows:
[0071] <Espionage Attackers, use , T1574> , < Espionage Attackers, execute, imjpuex.exe>, < imjpuex.exe, side-load, imjputyc.dll>, < imjpuex.exe, launch, Svchost.exe>, < imjputyc.dll, load, imjputyc.dat>.
[0072] Step 3: Use the open-source kernel log dataset Kellck4APT collected using the published log collection tool (Patent No.: 202211061051) to align the scale of the CTI report in the traceability graph format to obtain the second traceability graph:
[0073] A rule paradigm was developed to implement semantic compression of kernel logs in the Kellck4APT dataset. This extracted fine-grained kernel logs into a coarse-grained second provenance graph to align with the coarse-grained first provenance graph extracted from the CTI report. The rule paradigm is presented in a chain format, consisting of trigger conditions at the head, dependencies in the middle, and end conditions at the tail. The smallest unit of each rule chain is an event collected by the aforementioned collection tool. Ultimately, a rule chain is compressed into a semantic name containing behavioral information, as shown below:
[0074] <XX_Operation_n> =<event_1> →<event_2> →<event_3> →...→<event_n> .
[0075] Examples of common file operation rule patterns are as follows:
[0076] File movement:<File_Operation_1> = <fileiocreate> → <fileiofilecreate> → <fileioread> → <fileiocleanup>.
[0077] in,<File_Operation_1> Indicates file movement. <fileiocreate>Indicates creating a new file or directory at the target location. <fileiofilecreate>Indicates that the file system allocates resources or initializes file metadata. <fileioread>Indicates that the file system loads the contents of the source file into memory. <fileiocleanup>Indicates that the system releases the resources occupied by the source file.
[0078] File upload:<File_Operation_2> = <tcpipconnect> → <fileiocreate> → <fileioread> → <tcpipsend>.
[0079] in,<File_Operation_2> Indicates file upload. <tcpipconnect>Indicates that the client initiates a connection request to the target server. <fileiocreate>Indicates creating a new file or directory at the target location. <fileioread>Indicates that the file system loads the contents of the source file into memory. <tcpipsend>Indicates sending data through a TCP / IP connection.
[0080] File Download:<File_Operation_3> = <tcpipconnect> → <fileiocreate> → <tcpiprecv> → <fileiowrite>.
[0081] in,<File_Operation_3> Indicates file download. <tcpipconnect>Indicates that the client initiates a connection request to the target server. <fileiocreate>Indicates creating a new file or directory at the target location. <tcpiprecv>Indicates that the client receives data packets from the server through the previously established TCP connection. <fileiowrite>Indicates that the data received from the network will be written to the created local file.
[0082] Move the file to the Recycle Bin:<File_Operation_4> = <fileiocreate> → <fileiorename> → <fileiofiledelete> → <fileiodelete>.
[0083] in,<File_Operation_4> Indicates that the file is moved to the Recycle Bin. <fileiocreate>Indicates creating a new file or directory at the target location. <fileiorename>Rename the file and move it to the Recycle Bin. <fileiofiledelete>Indicates deleting the original directory entry of the file. <fileiodelete>Indicates permanent deletion of files.
[0084] Delete the file directly:<File_Operation_5> = <fileiocreate> → <fileiodelete>.
[0085] in,<File_Operation_5> Indicates that the file is deleted directly. <fileiocreate>Indicates creating a new file or directory at the target location. <fileiodelete>Indicates that the file will be deleted.
[0086] Examples of common operating rule patterns for system services are as follows:
[0087] Service startup:<Sys_Operation_1> = <imageload> → <processstart> → <threadstart> → <fileioread> → <fileiowrite> → <threadend>.
[0088] in,<Sys_Operation_1> Indicates that the service is started. <imageload>Indicates loading an executable module. <processstart>Indicates the creation of a service process. <threadstart>Indicates starting the service thread. <fileioread>Indicates reading local files. <fileiowrite>Indicates writing to a local file. <threadend>Indicates that the thread terminated normally.
[0089] End of service:<Sys_Operation_2> = <processdcstart> → <threadend> → <fileiocleanup> → <tcpipdisconnectipv4 tcpipdisconnectipv6> → <registryclose> → <processend>.
[0090] in,<Sys_Operation_2> Indicates the end of service. <processdcstart>Indicates that the process is closed and the process is started. <threadend>Indicates that the worker thread has terminated. <fileiocleanup>Indicates that the service closes the opened file handle. <tcpipdisconnectipv4 tcpipdisconnectipv6>Indicates that the service actively disconnects the TCP connection (IPv4 or IPv6). <registryclose>Indicates that the service releases the registry key handle opened at runtime. <processend>Indicates that the process has terminated.
[0091] Service Installation:<Sys_Operation_3> = <processstart> → <threadstart> → <fileioread> → <fileiocreate> → <fileiowrite> → <registrycreate> → <registrysetvalue> → <fileiowrite> → <threadend>.
[0092] in,<Sys_Operation_3> Indicates service installation, <processstart>Indicates that the installer process has started. <threadstart>Indicates that the installation thread is started. <fileioread>Indicates reading the installation file, <fileiocreate>Indicates creating a new file or directory at the target location. <fileiowrite>Indicates writing the service file content to the target location, <registrycreate>Indicates the creation of a service registry key, <registrysetvalue>Indicates setting service parameters, <fileiowrite>Indicates writing to the installation log, <threadend>Indicates the end of the installation thread.
[0093] Examples of common operating rule paradigms related to permissions are as follows:
[0094] Permission changes:<PC_Operation_1> = <processstart> → <threadstart> → <registryquery> → <registrysetvalue> → <fileiowrite> → <threadend>.
[0095] in,<PC_Operation_1> Indicates a change in permissions. <processstart>Indicates that the rights management tool process is started. <threadstart>Indicates that the permission operation thread is started. <registryquery>Indicates querying the current permission configuration, <registrysetvalue>Indicates writing new permission rules, <fileiowrite>Indicates the log of permission changes. <threadend>Indicates the end of the permission operation thread.
[0096] This embodiment<File_Operation_1> The rule chain is described in detail, such as Figure 3 As shown, for<File_Operation_1> For file move operations, the triggering condition is FileIOCreate, which creates a new file or directory at the target location, preparing for subsequent operations. Next, file system resources are allocated and file metadata (such as the file name and permissions) is initialized. This corresponds to the FileIOFileCreate event. The file system then loads the source file's contents into memory. This corresponds to the FileIORead event. Finally, the file system releases the resources occupied by the source file and removes the source file record from the file system metadata. This corresponds to the FileIOCleanup event. If this chain of events can be matched in kernel logs, it is condensed into a file move operation, uniformly represented by the semantics File_Operation_1.
[0097] Step 4: Train the contrastive learning model. A variety of contrastive learning models can be used to complete the model's learning of attack behavior patterns. This example uses a twin network structure for training, with a graph attention (GAT) network as the bilateral subnet. The two GAT networks share parameters. The specific implementation steps are as follows: Construct the feature vectors of nodes and edges in the first and second provenance graphs as the first and second adjacency matrices, respectively. Input the first and second adjacency matrices into the two GAT networks through forward propagation to generate the first and second provenance graph embeddings. Define positive and negative sample pairs and calculate their similarity. Calculate the loss value using the contrastive loss function. Update the contrastive learning model parameters through backpropagation to minimize the loss value.
[0098] Step 4-1. Data feature initialization: The attributes of the nodes and edges in the second traceability graph collected and scale-aligned in the above steps are encoded into fixed-size feature vectors of dimension 22 using one-hot encoding:
[0099] Initial embedding generation: Apply one-hot encoding to encode the attributes of all nodes and edges in the first and second traceability graphs, creating a 22-dimensional vector for each node and edge attribute. , where each bit has a value of 0 or 1.
[0100] Complete multi-edge merging to build a simple graph: When there are multiple edges with different labels between a node pair, the multiple edges are merged. The initial embedding of the only edge obtained after the merger is obtained by averaging the initial embeddings of the remaining edges. The formula for the initial embedding is defined as follows:
[0101]
[0102] in, is the initial embedding of the merged edge, Indicates the The initial embedding of the edge has a dimension of 22, Indicates the number of edges merged.
[0103] Step 4-2: Generate feature matrix. The specific steps include:
[0104] 1. Construct node feature matrix , where N is the number of nodes and each row corresponds to the 22-dimensional initial embedding of a node.
[0105] 2. Construct edge feature matrix , where M is the number of edges and each row corresponds to the 22-dimensional initial embedding of an edge.
[0106] 3. The node feature matrix and edge feature matrix of the first traceability graph together constitute the first adjacency matrix, and the node feature matrix and edge feature matrix of the second traceability graph together constitute the second adjacency matrix.
[0107] Step 4-3: Generate traceability graph embedding using the GAT network. The specific steps include:
[0108] 1. Input the first adjacency matrix and the second adjacency matrix into two GAT networks respectively.
[0109] 2. The GAT network linearly changes the node feature matrix. The hidden dimension here is ,in, is the dimension of node features, is the dimension of the output features.
[0110] 2. The GAT network calculates the attention coefficient for each node a and its neighbor node b, combining the features of the node and the edge.
[0111] 3. The GAT network then normalizes the attention coefficients of all neighboring nodes of each node a.
[0112] 4. The GAT network performs multiple rounds of training to update the features of node a. The activation function can be selected arbitrarily. Finally, the embedding representations of all nodes are aggregated into the embedding of the entire graph using average pooling.
[0113] 5. The two GAT networks output the first traceability graph embedding and the second traceability graph embedding respectively.
[0114] Step 4-4: Define positive and negative sample pairs and calculate their similarity. Use the contrastive loss function to calculate the loss value. Update the parameters of the contrastive learning model through backpropagation to minimize the loss value. Specifically,
[0115] Positive sample pair generation: The first and second traceability graph embeddings generated after steps 4-3 of two traceability graphs with the same TTPs labels (one extracted from CTI reports and the other from kernel log data) are used as positive sample pairs, denoted as:
[0116]
[0117] Negative sample pair generation: The first traceability graph embedding and the second traceability graph embedding generated after steps 4-3 of two traceability graphs with different TTPs labels (one extracted from CTI report and the other from kernel log data) are used as negative sample pairs, denoted as:
[0118]
[0119] Positive and negative samples use the same method to calculate similarity. Here we take the positive sample pair as an example:
[0120]
[0121] It is the cosine similarity between the first traceability graph embedding and the second traceability graph embedding, which measures the similarity between graph embeddings and is used for the optimization of comparative learning models.
[0122] The goal of this embodiment is to optimize the contrastive learning model as much as possible so that the similarity of the positive sample pairs after encoding is as high as possible, while the similarity of the negative sample pairs is as low as possible. That is, the NT-Xent loss function is abstracted as the contrastive loss function to optimize the contrastive learning model parameters:
[0123]
[0124] in, represents the cosine similarity of the positive sample pair, represents the cosine similarity of the negative sample pair, represents the temperature parameter, Represents NT-Xent loss. By continuously optimizing NT-Xent loss, graph embeddings of the same label are made closer, and graph embeddings of different labels are made further apart.
[0125] In steps 4-5, the contrastive learning model is optimized through back-propagation iteration to obtain the minimum contrastive loss function. At this point, the contrastive learning model is considered to have converged. This means that the contrastive learning model has learned how to map traceability graphs with the same TTP labels to the nearest neighbor space.
[0126] Step 5: Use the KNN clustering algorithm to complete the attack technique and tactics detection in the kernel log. The specific steps are as follows:
[0127] After training, the contrastive learning model used in this example can map kernel logs into semantically meaningful embeddings, and provenance graphs with the same technique and tactic labels have the highest similarity. Therefore, in the real-world problem of detecting sensitive logs, all CTI reports are fed into the trained graph attention network. The generated graph embeddings serve as n known category samples. For the kernel logs to be detected, the GAT network trained in step 4 is used to generate corresponding embeddings as unknown samples, and all samples are normalized. Since this example maps all provenance graphs into high-dimensional embeddings, cosine similarity is used to calculate distances. Finally, the k neighbors with the cosine similarity closest to 1 are selected. A majority vote is performed based on the attack technique and tactic labels of these k neighbors to determine the attack technique and tactic label of the sample to be detected.
[0128] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art could make various modifications and improvements without departing from the spirit of the present application, all of which fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.< / threadend> < / fileiowrite> < / registrysetvalue> < / registryquery> < / threadstart> < / processstart> < / threadend> < / fileiowrite> < / registrysetvalue> < / registryquery> < / threadstart> < / processstart> < / threadend> < / fileiowrite> < / registrysetvalue> < / registrycreate> < / fileiowrite> < / fileiocreate> < / fileioread> < / threadstart> < / processstart> < / threadend> < / fileiowrite> < / registrysetvalue> < / registrycreate> < / fileiowrite> < / fileiocreate> < / fileioread> < / threadstart> < / processstart> < / processend> < / registryclose> < / fileiocleanup> < / threadend> < / processdcstart> < / processend> < / registryclose> < / tcpipdisconnectipv4> < / fileiocleanup> < / threadend> < / processdcstart> < / threadend> < / fileiowrite> < / fileioread> < / threadstart> < / processstart> < / imageload> < / threadend> < / fileiowrite> < / fileioread> < / threadstart> < / processstart> < / imageload> < / fileiodelete> < / fileiocreate> < / fileiodelete> < / fileiocreate> < / fileiodelete> < / fileiofiledelete> < / fileiorename> < / fileiocreate> < / fileiodelete> < / fileiofiledelete> < / fileiorename> < / fileiocreate> < / fileiowrite> < / tcpiprecv> < / fileiocreate> < / tcpipconnect> < / fileiowrite> < / tcpiprecv> < / fileiocreate> < / tcpipconnect> < / tcpipsend> < / fileioread> < / fileiocreate> < / tcpipconnect> < / tcpipsend> < / fileioread> < / fileiocreate> < / tcpipconnect> < / fileiocleanup> < / fileioread> < / fileiofilecreate> < / fileiocreate> < / fileiocleanup> < / fileioread> < / fileiofilecreate> < / fileiocreate>
Claims
1. A method for comparing and identifying attack techniques and tactics based on large model-based knowledge extraction, characterized in that: The attack technique and tactic comparison and identification method based on large model knowledge extraction includes: Obtain CTI reports and kernel logs. Each CTI report and kernel log contains attack technique and tactic tags. The improved low-rank matrix fine-tuning method is used to fine-tune the large model, and the fine-tuned large model is used to construct the first traceability graph based on the CTI report; Compress the kernel log into the second traceability graph; Constructing a contrastive learning model, the contrastive learning model including two graph attention networks with shared parameters, constructing a first adjacency matrix and a second adjacency matrix based on the first provenance graph and the second provenance graph, inputting the first adjacency matrix and the second adjacency matrix into the two graph attention networks, respectively, to generate a first provenance graph embedding and a second provenance graph embedding; Update the parameters of the contrastive learning model based on the first traceability graph embedding and the second traceability graph embedding to obtain a trained contrastive learning model; A graph attention network in the trained contrastive learning model is used to obtain the embedding of the sample to be detected and the embedding of samples of known categories. The cosine similarity between the embedding of the sample to be detected and the embedding of samples of known categories is calculated, and the attack technique and tactic category of the sample to be detected is determined using the KNN clustering algorithm.
2. The attack technique and tactics comparison and identification method based on large model extraction knowledge according to claim 1 is characterized in that: The improved low-rank matrix fine-tuning method is used to fine-tune the large model, including: Set up prompt word templates, generate prompt words based on CTI reports, and input the prompt words into the big model; The large model updates parameters according to the following formula: ； ； ； ； in, represents the new low-rank matrix, represents the original parameter matrix, represents the learning round, and Indicates the The low-rank matrix of the training task, represents the LoRA regularization term, is the regularization coefficient, represents the Frobenius normal form of a low-rank matrix, represents the EWC regularization term, Indicates the The parameters of the training task, Indicates the The parameters of the training task, Indicates the The weight coefficient of each training task, represents the total loss function of LoRA regularization and EWC regularization, and Indicates the balance coefficient.
3. The attack technique and tactics comparison and identification method based on large model extraction knowledge according to claim 1 is characterized in that: The step of compressing the kernel log into the second tracing graph includes: Arrange multiple consecutive events that implement the same semantic operation into a rule chain in a logical order, wherein the head event of the rule chain is the trigger condition and the tail event is the end condition; Traverse the kernel log, and if there is a continuous event sequence that completely matches the trigger condition, event sequence, and end condition of the rule chain, merge the matching continuous event sequence into a semantic event; A second traceability graph is obtained based on the merged semantic events.
4. The attack technique and tactics comparison and identification method based on large model extraction knowledge according to claim 1 is characterized in that: The step of constructing the first adjacency matrix and the second adjacency matrix based on the first traceability graph and the second traceability graph includes: Use one-hot encoding to encode the attributes of all nodes and edges in the first and second provenance graphs to obtain the initial embedding of each node and edge; When there are multiple edges with different attack technique and tactic labels between a pair of nodes, the edges are merged. The initial embedding of the merged edges is obtained by the following formula: ； in, represents the initial embedding of the merged edges, Indicates the The initial embedding of the edges, M represents the number of merged edges; Construct a node feature matrix based on the initial embeddings of all nodes, and construct an edge feature matrix based on the initial embeddings of all edges; The node feature matrix and the edge feature matrix of the first traceability graph together constitute a first adjacency matrix, and the node feature matrix and the edge feature matrix of the second traceability graph together constitute a second adjacency matrix.
5. The attack technique and tactics comparison and identification method based on large model extraction knowledge according to claim 1 is characterized in that: The updating of parameters of the contrastive learning model based on the first traceability graph embedding and the second traceability graph embedding includes: The first and second tracing graph embeddings generated from the first and second tracing graphs with the same attack technique and tactics labels are used as positive sample pairs, and the first and second tracing graph embeddings generated from the first and second tracing graphs with different attack technique and tactics labels are used as negative sample pairs. Calculate the cosine similarity of the positive sample pair and the cosine similarity of the negative sample pair, and calculate the loss value based on the cosine similarity of the positive sample pair and the cosine similarity of the negative sample pair to update the parameters of the contrastive learning model. The contrastive loss function is expressed as follows: ； in, Indicates NT-Xent loss, represents the cosine similarity of the positive sample pair, represents the cosine similarity of the negative sample pair, Represents the temperature parameter.
6. The attack technique and tactics comparison and identification method based on large model extraction knowledge according to claim 1 is characterized in that: The method uses a graph attention network in a trained contrastive learning model to obtain the embedding of the sample to be detected and the embedding of samples of known categories, calculates the cosine similarity between the embedding of the sample to be detected and the embedding of samples of known categories, and uses the KNN clustering algorithm to determine the attack technique and tactic category of the sample to be detected, including: Use a graph attention network from the trained contrastive learning model as the trained graph attention network; Input the sample to be tested into the trained graph attention network to obtain the embedding of the sample to be tested, input all the first traceability graphs into the trained graph attention network to obtain the embedding of the known category samples, and calculate the cosine similarity between the embedding of the sample to be tested and the embedding of the known category samples; Select the k neighbors whose cosine similarity between the embedding of the sample to be tested and the embedding of the known category samples is closest to 1, and determine the attack technique and tactics category of the sample to be tested as the most common attack technique and tactics label among the k neighbors.