Suspicious point forward and backward tracking and attack path restoration method and system based on large model

Abstract

The invention provides a suspicious point forward and backward tracking and attack path restoration method and system based on a large model, and the method comprises the steps: obtaining a suspicious point event, and carrying out the reverse search in a traceability graph based on the suspicious point event, so as to obtain at least one adjacent event; extracting a sequence summary of subsequent nodes between adjacent events and suspicious point events as context information of each adjacent event; frequency scores of adjacent events are inquired from an event frequency database, similar cases are retrieved from a case database based on the adjacent events, and the similar case with the highest similarity is taken as a reasoning case of the current adjacent event; and performing reasoning analysis on the adjacent events based on the reasoning case of each adjacent event by using a reasoning model to obtain an abnormal score, judging an abnormal event based on the abnormal score, storing the abnormal event in a global sub-graph structure, and taking the abnormal event as a suspicious point event of the next round of iteration. A solution thought is provided for attack evidence collection generalization and robustness problems on a large-scale dynamic traceability graph.

Description

Technical Field

[0001] The present invention relates to the field of attack analysis, and in particular to a method and system for forward and backward tracking of suspicious points and restoration of attack paths based on a large model. Background Art

[0002] The system behavior model constructed using a traceability graph has achieved new breakthroughs in network attack behavior detection by accurately depicting the interactions between entities and operational processes within the system. By integrating multi-source data such as system logs, network traffic, and process calls, this model transforms system behavior into nodes and edges with directions and timestamps in a graph structure. Each node represents a system entity (such as a process, file, or user), while edges describe the operational relationships between entities (such as file reads and writes, network connections, and permission calls). This rich semantic information enables attack detection based on this model to accurately identify abnormal behavior patterns, significantly improving the accuracy and efficiency of attack detection.

[0003] However, detecting attack behavior is only the starting point of network security protection. In actual security incident handling, interpreting attack semantics, restoring attack paths, and implementing post-incident response still face numerous challenges. Interpreting attack semantics requires mapping isolated abnormal behaviors to specific attack intent and the degree of harm. This requires a deep understanding of attack methods, target assets, and business logic. Currently, there is a lack of automated tool support, and security personnel still need to spend a considerable amount of time analyzing attack code and consulting threat intelligence libraries, which is inefficient and prone to misjudgment.

[0004] Attack path restoration is a core component of security incident handling. Its goal is to unravel the attacker's complete process from intrusion to achieving their objectives, gleaning from massive amounts of system behavior data. This process typically begins with detected suspicious points of interest (PoIs). By tracing forward (in the direction of the spread of the attack's impact) or backward (in the direction of tracing the attack's source) within the provenance graph, the process gradually uncovers related nodes and events. While provenance graphs inherently contain directional and temporal information, increasing the number of tracing rounds inevitably introduces a large number of new nodes, leading to an exponential increase in the number of dependent nodes. These unrelated nodes require further manual analysis, and analysts can face alert fatigue when faced with a large number of false positives, resulting in a large number of alerts that cannot be effectively analyzed. Specifically, in actual production environments, enterprises generate hundreds of GB of log data every day and receive tens of thousands of security alerts every week, more than half of which are false alarms. This situation results in the scale of security alerts received being too large, with high repetition and many false alarms. Analysts are easily trapped in mechanical processing, leading to "alert fatigue" and reduced time management efficiency. Moreover, in the process of handling a large number of repeated or irrelevant alerts, anomalies that truly pose significant risks are more difficult to detect in a timely manner, and may thus miss key security threats. In order to process and analyze such a large number of logs and alerts, enterprises need to invest a lot of costs and human resources, which puts tremendous pressure on overall security operations and management. Therefore, how to filter out attack-related nodes from massive related nodes is a key research issue.

[0005] One approach to addressing this problem is to perform fine-grained information flow analysis on nodes to reduce the number of nodes involved in each tracking round and mitigate the exponential growth problem. However, such approaches often rely on complex data collection tools and incur additional overhead. Another approach is to use anomalies or rules to sort related nodes, prioritizing analysis of more suspicious paths. However, such methods have low accuracy and are not adaptable to complex environments. In summary, there is an urgent need for a low-cost solution that can quickly and accurately screen attack nodes. Summary of the Invention

[0006] The purpose of the present invention is to provide a method and system for forward and backward tracking of suspicious points and restoration of attack paths based on a large model. It is intended to adopt an intelligent tracking solution based on a large model, and use multiple knowledge such as normal behavior baselines, security knowledge bases, and attack implementations to restore attack paths, and propose solutions to the generalization and robustness problems of attack forensics on large-scale dynamic traceability graphs.

[0007] To achieve the above objectives, this technical solution provides a method for forward and backward tracking of suspicious points and restoration of attack paths based on a large model, comprising the following steps: Obtain a suspicious point event, perform a reverse search in the traceability graph based on the suspicious point event to obtain at least one adjacent event, and extract a sequence summary of subsequent nodes between the adjacent event and the suspicious point event as context information for each adjacent event; The frequency scores of adjacent events are queried from the event frequency database. Similar cases are retrieved from the case database based on the adjacent events. After the adjacent events and similar cases are concatenated, the modified model is used to re-rank the similarity. The similar case with the highest similarity is taken as the inference case of the current adjacent event. The inference model is used to perform reasoning analysis on adjacent events based on the reasoning cases of each adjacent event to obtain anomaly scores. The weighted anomaly scores and the frequency scores of adjacent events are weighted to obtain weighted scores. Adjacent events with weighted scores greater than the set threshold are taken as abnormal events, and the abnormal events are stored in the global subgraph structure and used as suspicious point events in the next round of iteration.

[0008] Secondly, this solution provides a system for forward and backward tracking of suspicious points and restoration of attack paths based on a large model, including: The forensic information construction module is used to obtain suspicious point events, perform a reverse search in the traceability graph based on the suspicious point events to obtain adjacent events, and extract the sequence summary of subsequent nodes between the adjacent events and the suspicious point events as the context information of the adjacent events; The case retrieval module is used to query the frequency scores of adjacent events from the event frequency database, retrieve similar cases from the case database based on adjacent events, concatenate adjacent events and similar cases, and re-rank them by similarity using a modified model. The similar case with the highest similarity is selected as the inference case for the current adjacent event. The reverse tracking prediction module is used to use the inference model to perform inference analysis on adjacent events based on the inference cases of each adjacent event to obtain anomaly scores, and to obtain weighted scores by weighting the anomaly scores and the frequency scores of adjacent events. Adjacent events with weighted scores greater than the set threshold are taken as abnormal events, and the abnormal events are stored in the global subgraph structure, and the abnormal events are used as suspicious point events in the next round of iteration.

[0009] Compared with the existing technology, this technical solution has the following characteristics and beneficial effects: 1. This solution searches for adjacent events to suspicious point events and obtains contextual information related to the suspicious point events based on the adjacent events. It then summarizes the pruned successor nodes representing the contextual information into a sequence text that can be processed by the vertical model, improving the vertical model's understanding of the causal relationship of the forensic task.

[0010] 2. Use case-based reasoning retrieval technology to search for similar cases from the case database, and use the correction model to correct similar cases based on context information to obtain reasoning cases, and use reasoning cases to improve the reasoning ability of subsequent reasoning models for adjacent events.

[0011] 3. Adopt a reverse adjustment strategy based on the reasoning results of the inference model to reversely update the case database and correct the model, so as to dynamically update the inference model and case data at a low cost, while improving the generalization ability and accuracy of the inference model.

[0012] 4. A large language model trained with seed-shot instruction data is used as the inference model to improve the inference model's reasoning capabilities, locate and query accurate abnormal events to build a global subgraph for analysis, and provide intuitive support for subsequent attack tracing and security decision-making. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 This is a flowchart of the method for forward and backward tracking of suspicious points and restoration of attack paths based on a large model according to this solution.

[0014] Figure 2 This is a schematic diagram of the framework of the large-model-based suspicious point forward and backward tracking and attack path restoration system according to this solution.

[0015] Figure 3 This is a logical diagram of the forward and backward tracking of suspicious points and attack path restoration method based on a large model according to this solution.

[0016] Figure 4 Schematic diagram of the hardware structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0017] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention are within the scope of protection of the present invention.

[0018] It should be understood by those skilled in the art that, in the disclosure of the present invention, the terms "longitudinal", "transverse", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating the orientation or position relationship, are based on the orientation or position relationship shown in the accompanying drawings, which are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operate in a specific orientation. Therefore, the above terms should not be understood as limiting the present invention.

[0019] Example 1 This solution provides a method and system for forward and backward tracing of suspicious points and restoration of attack paths based on a large model. It converts the contextual information of the graph structure of the traceability graph into a sequence summary of subsequent nodes. At the same time, a model detection framework based on case reasoning retrieves similar historical problems and reuses solutions in the knowledge base. Then, based on the retrieved solutions and contextual information, reverse tracing and prediction are performed to restore the attack path.

[0020] The following are explanations of the terms involved in this plan: Provenance Analysis: Provenance Analysis on a host is the process of tracing the origin and history of data, files, processes, and operations within a single computer system or network.

[0021] Points of Interest (POI): Refers to key nodes or behaviors in a security incident or specific system operation that may trigger subsequent security risks or have high value for incident research; for example, the launch of a high-risk process, abnormal modification of an executable file, access to a sensitive file, etc.

[0022] Forward and backward tracing: Forward tracing is based on identified suspicious points and investigates the subsequent nodes and operations affected by them. For example, it tracks a malicious process's writing of files or data interaction with other processes, thereby identifying system resources affected by the attack. Backward tracing, on the other hand, analyzes the triggering process and source of suspicious points, gradually tracing back from process startup records, file sources, and download information to locate the root cause of the security incident.

[0023] Hub Processes: These processes perform extensive network, file, and process interactions. These processes have extensive contextual behavior, introducing numerous attack-unrelated nodes during forward and backward tracing, posing scope challenges for analysis. For example, browser processes (Chrome and Firefox) simultaneously establish connections with dozens of websites, read and write cache files, and launch rendering and plug-in processes. A single browsing activity can generate hundreds of associated events.

[0024] Attack reconstruction: Attack reconstruction refers to the process of reconstructing the attacker's activity chain and behavior sequence in the system through system audit logs. It integrates scattered events and evidence into a coherent attack narrative, revealing the complete life cycle of the attack, including initial intrusion, lateral movement, privilege escalation, and goal achievement.

[0025] Case-based reasoning (CBS): Reasoning about complex problems by retrieving similar past problems, reusing their solutions to solve the current problem, and evaluating their effectiveness.

[0026] Specifically, such as Figure 1 As shown in the figure, the method for forward and backward tracking of suspicious points and restoration of attack paths based on a large model provided by this solution includes the following steps: Obtain a suspicious point event, perform a reverse search in the traceability graph based on the suspicious point event to obtain at least one adjacent event, and extract a sequence summary of subsequent nodes between the adjacent event and the suspicious point event as context information for each adjacent event; The frequency scores of adjacent events are queried from the event frequency database. Similar cases are retrieved from the case database based on the adjacent events. After the adjacent events and similar cases are concatenated, the modified model is used to re-rank the similarity. The similar case with the highest similarity is taken as the inference case of the current adjacent event. The inference model is used to perform reasoning analysis on adjacent events based on the reasoning cases of each adjacent event to obtain anomaly scores. The weighted anomaly scores and the frequency scores of adjacent events are weighted to obtain weighted scores. Adjacent events with weighted scores greater than the set threshold are taken as abnormal events, and the abnormal events are stored in the global subgraph structure and used as suspicious point events in the next round of iteration.

[0027] In the attack forensics scenario, this solution implements an end-to-end solution through the case reasoning and retrieval capabilities of the case database, the reverse adjustment capabilities of the reverse adjustment framework, and the model reasoning capabilities of the inference model to address the issues of generalization and robustness of attack forensics on large-scale dynamic traceability graphs.

[0028] Specifically, this solution obtains suspicious point events including subject, operation, object and time, and performs a reverse search in the traceability graph database based on the breadth-first algorithm to obtain adjacent events.

[0029] This solution's provenance graph database stores a chronologically ordered provenance graph consisting of a set of four-tuples: subject, operation, object, and time. Specifically, this solution utilizes an underlying system log collector (e.g., based on eBPF, LTTng, Kernel Module, or Event Tracing for Windows) to capture system behavior data and record it as four-tuples: subject, operation, object, and time. These four-tuples form a chronologically ordered provenance graph.

[0030] In order to meet the needs of offline analysis and alarm, the present invention pre-stores the traceability graph in the Neo4j database as a traceability graph database to support efficient query and analysis.

[0031] In some embodiments, since the kernel data formats of different underlying system log collectors are not uniform and contain a lot of redundant and repeated information, this solution performs data preprocessing on the collected set of quadruple groups to obtain a traceability graph database.

[0032] Since the subsequent reasoning model is obtained by training the large language model LLM in a vertical field, and the large language model LLM is based on the Transformer Decoder-only architecture, the reasoning model can only understand and associate the contextual information of the sequence text. Therefore, the present invention converts adjacent events of the graph structure into the sequence text of the successor nodes. In this way, the graph structure data of the traceability graph can be converted into an input form suitable for reasoning model processing, thereby supporting complex attack forensics tasks.

[0033] Specifically, based on the suspicious point event, a reverse search is performed in the traceability graph to obtain adjacent events, and the sequence summary of the subsequent nodes between the adjacent events and the suspicious point event is extracted as the context information of the adjacent events, where the context information represents the temporal and causal relationship between the adjacent events and the suspicious point event, and exists in the form of sequence text.

[0034] In some embodiments, the context information is converted into sequential text using any of the following methods: attention mechanism, graph convolutional network, or path embedding.

[0035] The event frequency database of this solution records the occurrence frequency of different events. The frequency of adjacent events is queried from the event frequency database. The ratio of the frequency of the adjacent event to the frequency of the same type of event is taken as the frequency score of the current adjacent event. The same type of event is an event with the same subject and operation as the adjacent event but different objects. The calculation formula for the frequency score is as follows: ; in Indicates the frequency of the current event, It represents the frequency of similar events, e(s,r,o) represents the subject, relation and object of the event triple, * all objects, and e represents the event.

[0036] It should be noted that since the collected adjacent events do not carry event information with frequency scores, this solution introduces the frequency scores of the current adjacent events after calculation using the event frequency database, and also uses the frequency scores as event information of the adjacent events for subsequent analysis.

[0037] The case database of this solution stores analysis cases that can be used to analyze whether an event is abnormal.

[0038] Furthermore, adjacent events are encoded into a query vector, and the cosine similarity between the query vector and the event vectors of the analysis cases in the case database is calculated. The analysis cases whose event vectors have a cosine similarity greater than a set threshold are taken as similar cases.

[0039] In some embodiments, the analysis cases in the case database are encoded using a pre-trained word vector model. For each adjacent event e to be retrieved, the query vector is obtained by encoding it using the pre-trained word vector model. The cosine similarity between the query vector of the adjacent event and the event vector of the analysis case is then calculated. The analysis cases whose event vectors have a cosine similarity greater than a set threshold are taken as similar cases. The calculation formula is as follows: ; Where sim(e,c) represents similarity, cos() represents cosine similarity, E() represents the pre-trained word vector model, e represents the adjacent events to be retrieved, and c represents the analysis case.

[0040] Since the number of similar cases matched in the case database is still large, this solution also splices adjacent events and similar cases and uses a modified model to re-rank the similarity to select the reasoning case with the highest similarity.

[0041] Specifically, adjacent events and similar cases are spliced ​​together to obtain context-related "context-similar case" pairs, and then the modified model is used to re-rank the "context-similar case" pairs by similarity, and the similar case with the highest similarity is taken as the inference case of the current adjacent event.

[0042] In some embodiments, the correction model is a reranking model, optionally a model from the bge-reranker family. The BGE model is a powerful text vectorization model that converts text data (such as network logs, attack descriptions, and threat intelligence) into dense vector representations. By calculating the similarity between vectors, it measures the degree of semantic relevance between texts. bge-reranker builds on this by performing a secondary screening and reranking of the candidate result set generated by the initial search or model, selecting the most relevant results. In this solution, bge-reranker recalculates vector similarity for similar cases based on concatenated "context-similar case" pairs. It then reranks the results based on the similarity scores, prioritizing similar cases with nodes, events, or analysis conclusions truly relevant to the attack. This helps security personnel quickly focus on key information, improves the efficiency of attack path restoration and semantic interpretation, and alleviates alert fatigue.

[0043] This solution uses vertical domain instruction data to train a large language model to obtain an inference model, so that the inference model can adapt to the underlying log analysis tasks. The vertical domain instruction data includes: system role, input log, and output inference process and anomaly score. That is, the instruction data format used to train the inference model in this solution is: System_role: "system role"; Input: "log"; Output: "Inference process and anomaly score scoring".

[0044] In some embodiments, supervised fine-tuning SFT is used to train the inference model, and a cross-entropy loss function is used:

[0045] Where wi is the next token value predicted by the inference model, D is the set of all tokens, and w<t means that only the sequence before time t is considered.

[0046] To make the output of the inference model more consistent with human thinking and answers and to enhance the interpretability of the inference model analysis logs, this solution uses the DPO loss function when training the inference model. The DPO loss function is expressed as follows:

[0047] Where x represents the input, y w Indicates the preferred output, y l Represents low-quality output, D is the set of all tokens, β represents the hyperparameter that controls the gradient, sigmoid() represents the activation function, ln() represents the logarithm, πref() represents the probability distribution of the reference model, and π() represents the probability distribution of the training model.

[0048] It should be noted that this solution conducts two independent trainings on the inference model, SFT and DPO. The SFT training method is a cold start process, that is, supplementing the specific domain analysis information missing from the general model to obtain the inference module, while the DPO training method is to make the output of the inference model more stable and guide the inference model to increase the probability of correct answers.

[0049] In addition, to avoid catastrophic forgetting in the inference model, this solution still randomly mixes general instruction data (data for non-log analysis tasks, such as sentiment question answering, mathematical reasoning, etc.) with instruction data in vertical fields to jointly train the inference model to ensure the generalization ability of the inference model.

[0050] In some embodiments, this solution uses a seed-shot approach to construct a vertical field instruction dataset. Specifically, the method for obtaining a vertical field instruction dataset is as follows: Construct seed data including the thought analysis process, where the thought analysis process includes subject-object analysis and contextual association analysis of a single event; Collect a dataset of log events for training as a task pool; Seed examples that match log events from the seed data; The seed sample is input into the large model to output the system role, reasoning process and anomaly score. The system role, seed sample, reasoning process and anomaly score are used as instruction data for the vertical field, where the seed sample is the input log.

[0051] It should be noted that the seed data of this solution can simulate the analysis thinking of professionals on network security incidents. A seed data may record in detail how the attacking program (subject) obtains permissions to access and modify the target file (object) in a file tampering attack, as well as the association between this behavior and other abnormal login and process startup events.

[0052] In addition, this solution can adjust the erroneous data of the seed samples analyzed by the large model to ensure that the instruction data of the vertical field constructed subsequently can achieve good vertical field training effects.

[0053] This solution uses the established inference model to perform inference analysis on the current adjacent events based on the inference case to obtain the anomaly score. The weighted result of the anomaly score and the frequency score of the adjacent events is taken as the weighted score. The calculation formula is as follows: ; Where Q represents the weighted score, E(e) represents the anomaly score of the inference model for the adjacent event, and fre(e) represents the frequency score of the adjacent event. Represents the weight coefficient.

[0054] This solution analyzes the suspiciousness of adjacent events based on their weighted scores. If the weighted score exceeds a set threshold, the event is considered an anomaly. Throughout the analysis process, to ensure that attack forensics results are interpretable and facilitate subsequent review, this solution constructs a global subgraph structure to store detected anomalies. Finally, using visualization tools (such as GraphVis), this subgraph structure is exported to intuitively display potential connections between events, helping security analysts quickly locate and analyze issues.

[0055] In some embodiments, abnormal events are stored in the global subgraph structure of the present solution, wherein each abnormal event includes a subject, an operation, and an object.

[0056] In addition, this solution also uses an evaluation model to evaluate the inference results based on the output of the inference model. If the difference between the inference result and the actual analysis result is less than the set threshold, the inference result is reversely updated to the case database. Otherwise, the inference result is corrected and the case database is reversely updated. The inference result is the anomaly score of the thinking process and prediction.

[0057] That is, if the difference between the true anomaly score and the anomaly score of the inference model is less than the set threshold, the anomaly event is stored in the case database. If it does not meet the requirements, an artificially corrected anomaly event is given and stored in the case database, as shown below: ; Where P(e) represents the true anomaly score, Q(e) represents the anomaly score of the inference model, and α is the set threshold.

[0058] Similarly, when an abnormal event is added to the case database, the abnormal event serves as an analysis case of the case database and continues to participate in the analysis and re-ranking of subsequent similar cases to narrow the gap in the model's understanding of the case.

[0059] like Figure 3 As shown, Figure 3 This is the overall logic diagram of the solution's forward and backward tracking of suspicious points and attack path restoration method based on a large model: First, a suspicious point event (POI event, including subject, operation, object, and time) is input. Based on the breadth-first algorithm, a reverse search is performed in the traceability graph database to obtain adjacent events for the suspicious point event. Secondly, the frequency scores of adjacent events are calculated based on the event frequency database, and similar cases are retrieved based on the case database. The context information of similar cases and adjacent events is spliced ​​together and re-ranked using the modified model. Similar cases with high similarity are selected as inference cases. Furthermore, the inference case is inferred according to the inference model to obtain an anomaly score. The anomaly score and frequency score are combined to analyze whether it is an abnormal event. If so, the abnormal event is stored in the global subgraph structure. After analyzing and evaluating the inference case or abnormal event, the model and case database are reversely updated based on the inference case and abnormal event. Finally, the abnormal events are used as suspicious point events for a new round of iteration.

[0060] This solution provides a large-model-based forward and backward tracing of suspicious points and attack path restoration method. Through CBR-based retrieval and reverse adjustment, it can dynamically update the inference model and case database at a low cost. Compared with directly fine-tuning the large model, the training cost of this solution is lower. Compared with using RAG retrieval, this solution can not only supplement the retrieval content, but also update the case database and retriever through evaluation feedback, giving them stronger generalization ability and accuracy. In addition, this solution can associate abnormal events into a visual global subgraph as a forensic graph, providing intuitive support for subsequent attack tracing and security decision-making.

[0061] Example 2 like Figure 2 As shown in the figure, this solution provides a system for forward and backward tracking of suspicious points and restoration of attack paths based on a large model, including: The forensic information construction module is used to obtain suspicious point events, perform a reverse search in the traceability graph based on the suspicious point events to obtain adjacent events, and extract the sequence summary of subsequent nodes between the adjacent events and the suspicious point events as the context information of the adjacent events; The case retrieval module is used to query the frequency scores of adjacent events from the event frequency database, retrieve similar cases from the case database based on adjacent events, concatenate adjacent events and similar cases, and re-rank them by similarity using a modified model. The similar case with the highest similarity is selected as the inference case for the current adjacent event. The reverse tracking prediction module is used to use the inference model to perform inference analysis on adjacent events based on the inference cases of each adjacent event to obtain anomaly scores, and to obtain weighted scores by weighting the anomaly scores and the frequency scores of adjacent events. Adjacent events with weighted scores greater than the set threshold are taken as abnormal events, and the abnormal events are stored in the global subgraph structure, and the abnormal events are used as suspicious point events in the next round of iteration.

[0062] In some embodiments, the reverse tracking prediction module contains an evaluation module, which uses an evaluation model to evaluate the inference results output based on the inference model. If the difference between the inference result and the actual analysis result is less than a set threshold, the inference result is reversely updated to the case database. Otherwise, the inference result is corrected and the case database is reversely updated.

[0063] like Figure 2The first part of the "Forensic Information Construction Module": "nI" is a suspicious point event. Based on the suspicious point event, a reverse search is performed in the traceability graph to obtain the adjacent events "f1" and "p2". The context information for f1 is "fI-PI-N1", and the context information for "p2" is "p2-pI-nI, p2-fI-pI-nI". The subsequent nodes in the adjacent events are summarized and converted into sequence text as context information. This context information will be passed to subsequent nodes with iterative propagation, and the adjacent events and context information will be used as forensic information.

[0064] like Figure 2 As shown in the second part of the "Case-based Retrieval Module", since general reasoning models in private domain scenarios such as enterprise security usually lack familiarity with reverse tracing reasoning tasks, this solution is inspired by the traditional CBR method and constructs a model retrieval framework based on case reasoning. It retrieves similar cases from the case database based on adjacent events and reuses their solutions to solve the current problem.

[0065] like Figure 2 As shown in the third part of the "Backward Tracking Prediction Module", this scheme performs inference prediction on the reasoning cases retrieved from the case database after each iteration to obtain anomaly scores, and reversely updates the case database based on the anomaly scores and reuses them in the correction module to continuously optimize the content of the case database and the performance of the retriever.

[0066] Other technical contents that are the same as those in the first embodiment are not described here in detail.

[0067] Example 3 This embodiment also provides an electronic device, referring to Figure 4 , including a memory 404 and a processor 402, wherein the memory 404 stores a computer program, and the processor 402 is configured to run the computer program to execute the steps in any of the above-mentioned embodiments of the method for forward and backward tracing of suspicious points and restoration of attack paths based on a large model.

[0068] Specifically, the processor 402 may include a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0069] The memory 404 may include a large-capacity memory 404 for data or instructions.

[0070] The processor 402 reads and executes computer program instructions stored in the memory 404 to implement any one of the large model-based suspicious point forward and backward tracking and attack path restoration methods in the above embodiments.

[0071] Optionally, the electronic device may further include a transmission device 406 and an input / output device 408 , wherein the transmission device 406 is connected to the processor 402 , and the input / output device 408 is connected to the processor 402 .

[0072] Transmission device 406 can be used to receive or transmit data via a network. Specific examples of such networks may include wired or wireless networks provided by the electronic device's communications provider. In one embodiment, the transmission device includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, transmission device 406 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0073] The input and output device 408 is used to input or output information. In this embodiment, the input information may be suspicious point events, etc., and the output information may be abnormal events and global subgraphs, etc.

[0074] Optionally, in this embodiment, the processor 402 may be configured to execute the following steps through a computer program: Obtain a suspicious point event, perform a reverse search in the traceability graph based on the suspicious point event to obtain at least one adjacent event, and extract a sequence summary of subsequent nodes between the adjacent event and the suspicious point event as context information for each adjacent event; The frequency scores of adjacent events are queried from the event frequency database. Similar cases are retrieved from the case database based on the adjacent events. After the adjacent events and similar cases are concatenated, the modified model is used to re-rank the similarity. The similar case with the highest similarity is taken as the inference case of the current adjacent event. The inference model is used to perform reasoning analysis on adjacent events based on the reasoning cases of each adjacent event to obtain anomaly scores. The weighted anomaly scores and the frequency scores of adjacent events are weighted to obtain weighted scores. Adjacent events with weighted scores greater than the set threshold are taken as abnormal events, and the abnormal events are stored in the global subgraph structure and used as suspicious point events in the next round of iteration.

[0075] It should be noted that the specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementation modes, and this embodiment will not be repeated here.

[0076] In general, various embodiments may be implemented in hardware or dedicated circuitry, software, logic, or any combination thereof. Some aspects of the invention may be implemented in hardware, while other aspects may be implemented in firmware or software executed by a controller, microprocessor, or other computing device, but the invention is not limited thereto. Although various aspects of the invention may be shown and described as block diagrams, flow charts, or using some other graphical representation, it should be understood that, as non-limiting examples, the blocks, devices, systems, techniques, or methods described herein may be implemented in hardware, software, firmware, dedicated circuitry or logic, general-purpose hardware or a controller or other computing device, or some combination thereof.

[0077] Embodiments of the present invention can be implemented by computer software, which is executable by the data processor of the mobile device, such as in the processor entity, or is implemented by hardware, or is implemented by a combination of software and hardware. Computer software or programs (also referred to as program products) including software routines, applets and / or macros can be stored in any device-readable data storage medium, and they include program instructions for performing specific tasks. The computer program product can include one or more computer executable components configured to perform the embodiment when the program is running. One or more computer executable components can be at least one software code or a part thereof. In addition, at this point, it should be noted that any box of the logic flow in the figure can represent a program step, or interconnected logical circuits, boxes and functions, or a combination of program steps and logical circuits, boxes and functions. The software can be stored in physical media such as memory chips or storage blocks implemented in the processor, magnetic media such as hard disks or floppy disks, and optical media such as, for example, DVDs and their data variants, CDs. Physical media is non-transient media.

[0078] Those skilled in the art should understand that the technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0079] The above embodiments merely illustrate several embodiments of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, all of which fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A method for forward and backward tracking of suspicious points and restoration of attack paths based on a large model, characterized by: The following steps are involved: Obtain a suspicious point event, perform a reverse search in the traceability graph based on the suspicious point event to obtain at least one adjacent event, and extract a sequence summary of subsequent nodes between the adjacent event and the suspicious point event as context information for each adjacent event; The frequency scores of adjacent events are queried from the event frequency database. Similar cases are retrieved from the case database based on the adjacent events. After the adjacent events and similar cases are concatenated, the modified model is used to re-rank the similarity. The similar case with the highest similarity is taken as the inference case of the current adjacent event. The inference model is used to perform reasoning analysis on adjacent events based on the reasoning cases of each adjacent event to obtain anomaly scores. The weighted anomaly scores and the frequency scores of adjacent events are weighted to obtain weighted scores. Adjacent events with weighted scores greater than the set threshold are taken as abnormal events, and the abnormal events are stored in the global subgraph structure and used as suspicious point events in the next round of iteration.

2. The method for forward and backward tracking of suspicious points and restoration of attack paths based on a large model according to claim 1 is characterized in that: Contextual information represents the temporal and causal relationships between adjacent events and suspicious point events, and exists in the form of sequence text.

3. The method for forward and backward tracking of suspicious points and restoration of attack paths based on a large model according to claim 1 is characterized in that: Adjacent events are encoded into query vectors, and the cosine similarity between the query vector and the event vectors of the analysis cases in the case database is calculated. The analysis cases whose event vectors have a cosine similarity greater than a set threshold are taken as similar cases.

4. The method for forward and backward tracking of suspicious points and restoration of attack paths based on a large model according to claim 1 is characterized in that: The frequency of occurrence of different events is recorded in the event frequency database. The frequency of adjacent events is queried from the event frequency database, and the ratio of the frequency of the adjacent event to the frequency of the same type of event is taken as the frequency score of the current adjacent event. The same type of event is an event with the same subject and operation as the adjacent event but different objects.

5. The method for forward and backward tracking of suspicious points and restoration of attack paths based on a large model according to claim 1 is characterized in that: After splicing adjacent events and similar cases, we obtain context-related "context-similar case" pairs. Then, we use the modified model to re-rank the "context-similar case" pairs by similarity, and take the similar case with the highest similarity as the inference case for the current adjacent event.

6. The method for forward and backward tracking of suspicious points and restoration of attack paths based on a large model according to claim 1 is characterized in that: The inference model is obtained by training a large language model with instruction data from vertical fields. The instruction data from vertical fields includes: system roles, input logs, and output inference processes and anomaly scores.

7. The method for forward and backward tracing of suspicious points and restoration of attack paths based on a large model according to claim 6 is characterized in that: The method for obtaining a vertical domain instruction dataset is as follows: construct seed data that includes the thought analysis process, where the thought analysis process includes subject-object analysis and contextual association analysis of a single event; collect a dataset of log events for training as a task pool; Seed examples that match log events from the seed data; The seed sample is input into the large model to output the system role, reasoning process and anomaly score. The system role, seed sample, reasoning process and anomaly score are used as instruction data for the vertical field, where the seed sample is the input log.

8. The method for forward and backward tracking of suspicious points and restoration of attack paths based on a large model according to claim 1 is characterized in that: The anomaly score output by the inference model is evaluated with the help of the evaluation model. If the difference between the inferred anomaly score and the true anomaly score is less than the set threshold, the abnormal event is reversely updated to the case database. Otherwise, the abnormal event is corrected and the case database is reversely updated.

9. A system for forward and backward tracking of suspicious points and restoration of attack paths based on a large model, characterized by: include: The forensic information construction module is used to obtain suspicious point events, perform a reverse search in the traceability graph based on the suspicious point events to obtain adjacent events, and extract the sequence summary of subsequent nodes between the adjacent events and the suspicious point events as the context information of the adjacent events; The case retrieval module is used to query the frequency scores of adjacent events from the event frequency database, retrieve similar cases from the case database based on adjacent events, concatenate adjacent events and similar cases, and re-rank them by similarity using a modified model. The similar case with the highest similarity is selected as the inference case for the current adjacent event. The reverse tracking prediction module is used to use the inference model to perform inference analysis on adjacent events based on the inference cases of each adjacent event to obtain anomaly scores, and to obtain weighted scores by weighting the anomaly scores and the frequency scores of adjacent events. Adjacent events with weighted scores greater than the set threshold are taken as abnormal events, and the abnormal events are stored in the global subgraph structure, and the abnormal events are used as suspicious point events in the next round of iteration.

10. A readable storage medium, characterized in that: The readable storage medium stores a computer program, which includes a program code for controlling a process to execute a process, and the process includes the forward and backward tracking of suspicious points and attack path restoration method based on a large model according to any one of claims 1 to 8.

Images