Attack detection method, apparatus, device, and program product

Abstract

This application provides an attack detection method, apparatus, device, and program product. The method includes: constructing a corresponding source map based on the network behavior of a target object obtained through continuous monitoring, where each monitored network behavior corresponds to an entity in the source map; classifying the entities in the source map into trusted entities, untrusted entities, and uncertain entities based on their trust level; performing correlation analysis on the temporal distribution characteristics of the trusted entities, untrusted entities, and uncertain entities to identify whether attack escape behavior exists; and determining that the target object is an attacker if attack escape behavior exists.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to an attack detection method, apparatus, device, and program product. Background Technology

[0002] Advanced persistent threat (APT) attacks evade detection through long-term infiltration, phased penetration, and dynamic escape strategies (such as extending the attack cycle and injecting irrelevant operations).

[0003] Currently, attack detection technologies targeting APTs have two major flaws: First, they rely on predefined rule bases or static feature matching (such as signature comparison), making it difficult to correlate low-frequency attack events across time periods, resulting in missed detection of scattered malicious behaviors; second, they lack the ability to correlate events over time, assessing source graph entities based only on instantaneous states, making it impossible to continuously track behavioral evolution, and attackers can obfuscate the detection system by switching between "trusted-malicious" modes in stages. Summary of the Invention

[0004] To address the aforementioned problems, this application provides an attack detection method, apparatus, device, and program product, the technical solution of which is as follows:

[0005] Firstly, an attack detection method is provided, including:

[0006] Based on the network behavior of the target object obtained through continuous monitoring, a corresponding source graph is constructed, and each network behavior obtained through monitoring corresponds to an entity in the source graph.

[0007] Based on the trust level of each entity in the traceability graph, each entity in the traceability graph is classified into trusted entities, untrusted entities, and uncertain entities;

[0008] Correlation analysis is performed on the temporal distribution characteristics of the trusted entities, the untrusted entities, and the uncertain entities to identify whether attack escape behavior exists.

[0009] If an attack escape behavior is detected, the target object is determined to be an attacker.

[0010] Secondly, an attack detection device is provided, comprising:

[0011] The source graph construction module constructs a corresponding source graph based on the network behavior of the target object obtained through continuous monitoring. Each monitored network behavior corresponds to an entity in the source graph.

[0012] The entity classification module classifies each entity in the traceability graph into trusted entities, untrusted entities, and uncertain entities based on the trust level of each entity in the traceability graph.

[0013] The escape detection module performs correlation analysis on the temporal distribution characteristics of the trusted entity, the untrusted entity, and the uncertain entity to identify whether there is an attack escape behavior.

[0014] The attack determination module is used to determine that the target object is an attacker if an attack escape behavior is detected.

[0015] Thirdly, embodiments of this application provide an electronic device, including: a processor; and a memory configured to store computer-executable instructions, which, when executed, cause the processor to perform the method described in the first aspect.

[0016] Fourthly, a computer-readable storage medium is provided for storing computer-executable instructions that, when executed by a processor, implement the method described in the first aspect.

[0017] This application's embodiments construct a corresponding source map based on network behavior obtained through continuous monitoring of the target object. This ensures complete coverage of entity behavior data within the attack cycle, thereby supporting the identification of long-term attack evasion behaviors. Subsequently, based on the trust level of each entity in the source map, entities are classified into trusted entities, untrusted entities, and uncertain entities. This effectively avoids the blind spots caused by binary classification, especially when identifying evasion noise created by attackers through intermittent insertion of uncertain entities (such as camouflage operations), significantly reducing the false negative rate. Next, correlation analysis is performed on the temporal distribution characteristics of trusted, untrusted, and uncertain entities to identify whether attack evasion behaviors exist. This effectively captures the attacker's phased evasion strategies, such as long-term infiltration followed by dispersed attacks, thus solving the problem that static rules cannot adapt to behavioral changes. Finally, if attack evasion behaviors are identified, the target object is determined to be an attacker. This involves a comprehensive analysis of the three types of entities based on temporal distribution characteristics, rather than isolated judgments. Attack behaviors are only determined after confirming the correlation analysis, significantly improving the objectivity of the judgment results. This is particularly suitable for detecting attacks such as APTs that employ dynamic evasion strategies. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a schematic diagram of the first type of attack detection method according to an embodiment of this application.

[0020] Figure 2 This is a schematic diagram of the second process of the attack detection method according to an embodiment of this application.

[0021] Figure 3 This is a schematic diagram of the attack detection device according to an embodiment of this application.

[0022] Figure 4 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0023] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0024] One embodiment of this application provides an attack detection method. Figure 1 This is a flowchart illustrating the attack detection method, including:

[0025] S101. Based on the network behavior of the target object obtained through continuous monitoring, construct the corresponding source map. Each network behavior obtained through monitoring corresponds to an entity in the source map.

[0026] The source graph in this embodiment is a causal temporal relationship graph dynamically constructed by continuously monitoring the network behavior of target objects. Each entity in this graph corresponds to a specific network behavior instance, such as abnormal login attempts, suspicious file downloads, or unconventional port access. Entities are connected by directed edges to form causal chains, with the edges following the "cause → effect" temporal order principle: if behavior A triggers behavior B, an edge is drawn from entity A to entity B, and the difference in their timestamps is marked. For example, after an attacker gains system privileges through vulnerability exploitation (entity E1), they initiate lateral movement (entity E2) at t+5 seconds. An edge E1→E2 will be established between these two entities, with the time interval marked as 5 seconds. This structure not only intuitively displays the evolution path of the attack chain but also identifies the rhythmic patterns of attack phase transitions through timestamp distribution characteristics, providing a spatiotemporal data foundation for subsequent trust analysis and attack escape behavior detection.

[0027] It should be noted that, to counter dynamic evasion strategies, such as extending the attack cycle and injecting irrelevant operations, this embodiment continuously monitors the target object's network behavior to construct a complete source map covering the entire attack cycle. That is, the source map adds entities as the target object initiates new network actions. This dynamic update mechanism ensures that the source map can reflect the latest state of attack activities in real time, thereby supporting continuous tracking and analysis of attack behavior.

[0028] S102, based on the trust level of each entity in the traceability graph, classify each entity in the traceability graph into trusted entities, untrusted entities, and uncertain entities.

[0029] The purpose of this embodiment is to classify entities into trusted, untrusted, and uncertain entities based on their trust levels in the source tracing graph. This process relies on a dynamic trust assessment model, which analyzes the trusted interactions of entities' dynamic escape behaviors by examining multi-dimensional behaviors within the attack chain. The specific entity classification mechanism is as follows:

[0030] A dynamic trust assessment model is used to create a multi-dimensional behavioral profile of the attack chain. When the attacker... Target network devices Initiate During the next network interaction, the system generates a trust value sequence through the source graph entity trust evaluation function. ,in, Indicates attacker Target network devices Initiating the first Trust value during each network interaction, each trust value ( Mapped to the [0,1] interval, and a dual decision threshold is set. and (0≤ < ≤1) Implement three-level classification:

[0031] 1) When At that time, it is classified as a trusted entity. This represents an operation that conforms to the system's whitelist behavior (such as routine maintenance login).

[0032] 2) When At that time, it was classified as an untrustworthy entity. This corresponds to behaviors that match known attack characteristics (such as payload transmission for exploitation).

[0033] 3) When Between , The entity between the two is classified as an uncertain entity. This reflects suspicious behavior that does not reach the attack threshold (such as high-frequency port scanning during abnormal periods).

[0034] Correspondingly, this article uses subscripts. Constraining attackers With the target network device In interactive scenarios, after entity classification, the following types of entity sequences can be obtained:

[0035] 1) Uncertain entity sequence (Composed of time-continuous, uncertain entities):

[0036]

[0037] in, Indicates the length of the entity, and its value is the number of entities; Indicates the number of entity subsequences; This indicates the length of the entity corresponding to the first entity subsequence. Indicates the length of the entity corresponding to the second entity subsequence, ..., Indicates the first The length of the entity corresponding to each entity subsequence; Represents a timestamp; Indicates the timestamp of the entity's action; Indicates the index of an entity subsequence. For uncertain entity sequences The index of the first entity subsequence in the sequence. For uncertain entity sequences The index of the second entity subsequence, ... For uncertain entity sequences The Middle Index of a subsequence of entities; Represents an uncertain entity sequence The timestamp of the first entity in the middle, Represents an uncertain entity sequence The timestamp of the second entity subsequence, ... Represents an uncertain entity sequence The Middle Timestamps of individual entity subsequences; Represents an uncertain entity sequence The timestamp corresponding to the last entity in the first entity subsequence. Represents an uncertain entity sequence The timestamp corresponding to the last entity in the second entity subsequence, ... Represents an uncertain entity sequence The Middle The timestamp corresponding to the last entity in a subsequence of entities; Represents an uncertain entity sequence The behavior flow corresponding to the first entity subsequence in the sequence. Represents an uncertain entity sequence The behavior flow corresponding to the second entity subsequence in the sequence, ... Represents an uncertain entity sequence The Middle The behavior flow corresponding to each entity subsequence.

[0038] 2) Trusted entity sequence (Composed of trusted entities with continuous time):

[0039]

[0040] in, For a sequence of trusted entities The index of the first entity subsequence in the sequence. For a sequence of trusted entities The index of the second entity subsequence, ... For a sequence of trusted entities The Middle Index of a subsequence of entities; Represents a sequence of trusted entities The timestamp of the first entity subsequence in the sequence. Represents a sequence of trusted entities The timestamp of the second entity subsequence, ... Represents a sequence of trusted entities The Middle Timestamps of individual entity subsequences; Represents a sequence of trusted entities The timestamp corresponding to the last entity in the first entity subsequence. Represents a sequence of trusted entities The timestamp corresponding to the last entity in the second entity subsequence, ... Represents a sequence of trusted entities The Middle The timestamp corresponding to the last entity in a subsequence of entities; Represents a sequence of trusted entities The behavior flow corresponding to the first entity subsequence in the sequence. Represents a sequence of trusted entities The behavior flow corresponding to the second entity subsequence in the sequence, ... Represents a sequence of trusted entities The Middle The behavior flow corresponding to each entity subsequence.

[0041] 3) Untrusted entity sequence (Composed of untrusted entities in a continuous timeline):

[0042]

[0043] in, Untrusted entity sequence The index of the first entity subsequence in the sequence. Untrusted entity sequence The index of the second entity subsequence, ... Untrusted entity sequence The Middle Index of a subsequence of entities; Represents a sequence of untrusted entities The timestamp of the first entity subsequence in the sequence. Represents a sequence of untrusted entities The timestamp of the second entity subsequence, ... Represents a sequence of untrusted entities The Middle Timestamps of individual entity subsequences; Represents a sequence of untrusted entities The timestamp corresponding to the last entity in the first entity subsequence. Represents a sequence of untrusted entities The timestamp corresponding to the last entity in the second entity subsequence, ... Represents a sequence of untrusted entities The Middle The timestamp corresponding to the last entity in a subsequence of entities; Represents a sequence of untrusted entities The Middle The behavioral flow of a subsequence of entities Represents a sequence of untrusted entities The Middle The behavioral flow of a sequence of entity subsequences, ... Represents a sequence of untrusted entities The Middle The behavior flow of a sequence of entity subsequences.

[0044] As an example, the target object initiates three consecutive DNS covert tunnel probes between 10:00 and 10:05. If the trust value is satisfied... < < This constitutes an uncertain entity sequence with an entity length of 3. Similarly, a sequence of trusted entities. and untrusted entity sequences This classification mechanism separately captures stable normal operations over long periods and persistent attack behaviors. By constructing a dynamic decision buffer through dual thresholds, it effectively solves the problem of misjudging ambiguous attack behaviors in traditional binary classification models.

[0045] In actual deployment, and Adaptive adjustment strategy: When a target network device is detected In the time window When an uncertain entity exceeding the threshold appears within the system, the system will automatically lower the threshold. Values ​​are used to enhance attack detection sensitivity, while also dynamically optimizing based on historical attack data. The value boundary. This classification mechanism constructs a dynamic decision buffer through dual thresholds, effectively solving the problem of misjudging network behaviors with ambiguous attack definitions. Among them, the target network device It can include a server.

[0046] S103 performs correlation analysis on the temporal distribution characteristics of trusted entities, untrusted entities, and uncertain entities to identify whether attack escape behavior exists.

[0047] Specifically, refer to Figure 2 As shown, the association analysis process in this embodiment includes:

[0048] S1031, extract the trusted entity sequence composed of time-continuous trusted entities in the source graph, and calculate the overall trust value based on the trust level of the entities it contains; wherein, the overall trust value of the trusted entity sequence decays based on a first time decay factor, and the degree of decay of the first time decay factor is positively correlated with the time difference between the last trusted entity in the trusted entity sequence and the current time.

[0049] As an example, a sequence of trusted entities can be described. Perform trust modeling to obtain the overall trustworthiness value. :

[0050]

[0051] The above formula uses subscripts To constrain the timestamp of an entity's behavior, then Represents a sequence of trusted entities The first in Trust value of each entity subsequence. ; This is the current timestamp; For a sequence of trusted entities The Middle The timestamp corresponding to the last entity in a subsequence of entities; The first time decay factor has a value range of (0,1), which represents the trust decay of entities in the source graph over time. This indicates the total number of entities in the current entity sequence; Generalization means that the current entity in the sequence is the first... The length of an entity subsequence; The generalization represents the time window of the current entity sequence.

[0052] It should be understood that the above The modeling has the following characteristics:

[0053] 1) Continuous trust reinforcement mechanism: using Explicitly rewarding long, continuous sequences of trustworthy entities (such as 5 hours of continuous compliance being more credible and persuasive than 1 hour) forces attackers to maintain a disguise for a long time in order to increase their credibility.

[0054] 2) Dynamic time decay control: through Achieving exponential decay (e.g.) (When the trust weight decays by 65% ​​after 10 units of time), it effectively suppresses the current influence of historically trustworthy behavior and blocks attackers' escape strategies of using early legitimate operations to cover up subsequent attacks.

[0055] 3) Linear amplification of continuous sequences: through Explicitly amplify long-duration attacks to counter attackers' evasion strategies of reducing detection intensity by spreading out suspicious operation periods.

[0056] S1032, extract the untrusted entity sequence composed of time-continuous untrusted entities from the source map, and calculate the overall distrust value based on the frequency of occurrence of the entities it contains; wherein, the overall distrust value of the untrusted entity sequence is attenuated based on the second time decay factor and amplified based on the first frequency penalty factor; the degree of attenuation of the second time decay factor is positively correlated with the time difference between the last untrusted entity in the untrusted entity subsequence and the current time; the amplification of the first frequency penalty factor is positively correlated with the frequency of occurrence of the untrusted entities in the untrusted entity subsequence.

[0057] As an example, a sequence of untrusted entities can be described. Trust modeling is performed to obtain the overall distrust value. :

[0058]

[0059] The above formula uses subscripts To constrain the timestamp of an entity's behavior, then Represents a sequence of untrusted entities The first in Trust value of each entity subsequence. Untrusted entity sequence The first in The timestamp corresponding to the last entity in a subsequence of entities; The second time decay factor has a value range of (0,1) and represents the decay effect from the last entity to the current time. The first frequency penalty factor; For adjustment coefficients; For the first The frequency of occurrence of entities in a subsequence of entities.

[0060] It should be understood that the above The modeling has the following characteristics:

[0061] 1) Time decay focuses on near-term threats: employing This ensures that recent attacks retain high weight, preventing attackers from using the time difference of historical attacks to dilute the threat value.

[0062] 2) Frequency Penalty Targeting Low-Frequency Attacks: An innovative first frequency penalty factor is designed to detect slow attacks that evade high-frequency monitoring. This is to achieve the following: low-frequency attacks → increased penalty factor → doubled threat value; high-frequency attacks → penalty factor remains at 1 → maintain baseline value.

[0063] 3) Linear amplification of continuous sequences: through Explicitly amplify long-duration attacks to counter attackers' escape strategies that reduce the intensity of a single attack by spreading it out over multiple attack periods.

[0064] S1033, extract the uncertain entity sequence composed of time-continuous uncertain entities from the source map, and calculate the overall uncertainty value based on the occurrence frequency of the entities it contains; wherein, the overall uncertainty value of the uncertain entity sequence is attenuated based on the third time decay factor and amplified based on the second frequency penalty factor; the degree of attenuation of the third time decay factor is positively correlated with the time difference between the last uncertain entity in the uncertain entity subsequence and the current time; the amplification of the second frequency penalty factor is positively correlated with the occurrence frequency of the uncertain entities in the uncertain entity subsequence.

[0065] As an example, an uncertain entity sequence is introduced. Trust modeling is performed to obtain the overall uncertainty value. :

[0066]

[0067] The above formula uses subscripts Used to constrain the timestamps of entity behavior; The third time decay factor has a value range of (0,1) and represents the decay effect from the last entity to the current time. The second frequency penalty factor; For the first A measure of a subsequence of entities; This is the penalty coefficient; For uncertain entity sequences The first in The timestamp corresponding to the last entity in a subsequence of entities.

[0068] It should be understood that the above The modeling has the following characteristics:

[0069] 1) Time decay focuses on recent suspicious network behavior: using Recent network behavior is weakened and retained with high weight, while historical network behavior is weakened and its weight approaches 0, thus preventing attackers from diluting the current threat value by exploiting the time difference of early suspicious behavior.

[0070] 2) Frequency penalty targeting high-frequency suspicious activity: To address the detection of high-frequency abnormal network behavior (such as port scanning), a second frequency penalty factor is innovatively designed. To achieve the following: high frequency suspicious → penalty factor decreases → threat value doubles; low frequency normal → penalty factor approaches 1 → maintains baseline value.

[0071] 3) Linear amplification of continuous sequences: through Explicitly amplify long-duration attacks to counter attackers' evasion strategies of reducing detection intensity by spreading out suspicious operation periods.

[0072] S1034 identifies attack evasion behavior based on overall trust value, overall distrust value, and overall uncertainty value.

[0073] Specifically, a credibility index (reflecting the lowest certainty probability of an entity's credibility) can be calculated based on the overall trustworthiness value and the overall uncertainty value; at the same time, an untrustworthiness probability index (reflecting the maximum potential probability of an entity's untrustworthiness) can be calculated based on the overall distrust value and the overall uncertainty value; and then, a comprehensive trust value can be calculated based on the credibility index and the untrustworthiness probability index.

[0074] As an example, this embodiment uses the Dempster-Shafer theory's trust evaluation model to calculate the overall trust value. Specifically, an evaluation function based on the Dempster-Shafer theory is defined. :

[0075] ；

[0076] in, For confidence level, The probability that it is true. The proportionality constant represents the set. Relative to sets The proportion of elements in a set. A complete set representing the behavior of all entities (trustworthy entities, untrustworthy entities, and uncertain entities); set Describes a subset of the target hypothesis This model enhances its ability to handle uncertainties by combining confidence level with probability.

[0077] Next, a comprehensive trust assessment is conducted on the attack escape behavior. The formula for this comprehensive assessment is as follows:

[0078] ;

[0079] in, This represents the overall trust value; This represents the overall trustworthiness value; This represents the overall distrust value; This represents the value of the credibility index; This indicates the value of the unreliability probability index.

[0080] That is, an attack evasion detection system is constructed through the coordinated use of three dynamic indicators: firstly, based on the overall trust value. and overall uncertainty Calculate the confidence level Establish the minimum probability threshold for entity trustworthiness (e.g.) =0.25 indicates that at least 25% of entities are absolutely trustworthy, blocking attackers' escape strategy of diluting trustworthiness by injecting uncertain entities; secondly, based on the overall distrust value and overall uncertainty Calculate the probability of unreliability This reveals the maximum potential probability of an entity being untrustworthy (e.g., only 5% explicit malice). =0.92 (early warning of iceberg risk), breaking the long-term latency strategy of APT attacks; finally, innovatively improving the Dempster-Shafer theory, and using the static scaling factor. Replace with dynamic weights To form a comprehensive trust value ,Should The calculation formula uses dynamic weights to suppress sudden malicious interference (such as...). (Automatic balancing of weights and denominators during sudden increases), while simultaneously... Quantifying the gray areas of trust. When If the preset trust threshold is reached, it is determined that there is an attack escape behavior.

[0081] S104. If there is an attack escape behavior, the target object is determined to be the attacker.

[0082] It should be understood that the existence of attack escape behavior also indicates the existence of attack behavior, thus allowing the target to be identified as an attacker. That is, the method in this embodiment constructs a corresponding source map based on network behavior obtained through continuous monitoring of the target, ensuring complete coverage of entity behavior data within the attack cycle, thereby supporting the identification of long-term attack escape behavior. Subsequently, based on the trust level of each entity in the source map, entities are classified into trusted entities, untrusted entities, and uncertain entities, effectively avoiding the blind spots caused by binary classification, especially when identifying escape noise created by attackers through intermittent insertion of uncertain entities (such as camouflage operations), significantly reducing the false negative rate. Next, correlation analysis is performed on the temporal distribution characteristics of trusted, untrusted, and uncertain entities to identify whether attack escape behavior exists, thereby effectively capturing the attacker's phased escape strategies, such as long-term infiltration followed by dispersed attacks, thus solving the problem that static rules cannot adapt to behavioral changes. Ultimately, if an attack escape behavior is identified, the target is determined to be the attacker. This is based on a comprehensive analysis of the three types of entities according to their time distribution characteristics, rather than isolated judgments. The attack behavior is only determined after confirming the correlation analysis, which can significantly improve the objectivity of the judgment results. This is particularly suitable for detecting APTs that use dynamic escape strategies.

[0083] Building upon the above, this embodiment can update the source map as the network behavior of the target object is continuously monitored. For example, a concept drift penalty coefficient is determined based on the frequency of occurrence of the untrusted and uncertain entities within a sliding time window; if the concept drift penalty coefficient reaches a preset threshold, the untrusted and uncertain entities within the sliding time window are associated with entities from previous times to update the source map.

[0084] Furthermore, to address the attack escape behavior created by APT attackers through extending the attack cycle and injecting irrelevant operations, this embodiment designs a dynamic memory storage model to address the concept drift problem. Specifically, by constructing a concept drift penalty coefficient, the entity relationships in the source graph can be dynamically adjusted according to the frequency of occurrence of untrusted and uncertain entities within a sliding time window, thereby assigning lower weights to outdated data to achieve real-time updates and optimization of the source graph.

[0085] The expression for dynamic memory storage is:

[0086]

[0087] in, Indicates the timestamp of the initial traceability graph entity; This is the initial trust assessment value for the entity. , All are constant attenuation coefficients. =2.718, =106; The concept drift penalty coefficient is calculated based on the joint occurrence frequency of untrusted / uncertain entities within a sliding window. = , This represents the frequency of occurrence of untrusted and uncertain entities within the sliding time window. =0.35 is the frequency conversion factor; This represents the factorial of the concept drift penalty coefficient, used to reflect the escape intensity.

[0088] Correspondingly, based on the dynamic memory storage model The dynamic processing mechanism comprises three core components:

[0089] 1) Adaptive sliding time window:

[0090] The initial range of the sliding time window is [ , ];in, The timestamp of the first untrusted / uncertain entity in the sliding time window; This is the timestamp of the last untrusted / uncertain entity in the sliding time window.

[0091] Whenever an untrusted or uncertain entity is added, Automatically expands to the timestamp of the latest entity;

[0092] Maximum time span of sliding time window ,in To add the total number of entities to the window, =0.5 is the expansion coefficient. That is, the time range of the sliding time window is dynamically expanded according to the number of newly added untrusted entities and / or uncertain entities in the source map.

[0093] 2) Association triggering mechanism:

[0094] Real-time computing ;in, Indicates the number of untrusted entities within the window (untrusted entities include exploits, malicious payloads, etc.); This indicates the number of uncertain entities within the window (uncertain entities such as abnormal logins, unconventional port accesses, etc.).

[0095] when + When the value is greater than 3, the entity association operation is performed:

[0096] Establish causal relationships between entities and historical attack chains within a sliding time window, with the relationship strength determined by... Attenuation; where, Indicates the strength of the association; A timestamp representing the current time; Represents the timestamp of the initial traceability graph entity.

[0097] Initial trust evaluation of entities under sliding time window constraints Perform time decay compensation: ′= ;in, express The impact; express The result after compensation.

[0098] Generate POI alarm events and update the source graph structure.

[0099] 3) Data cleansing mechanism:

[0100] when + When the value is ≤3, the aging and cleaning process is initiated:

[0101] Remove entity-associated edges that last longer than 24 hours (example value) within the sliding time window;

[0102] Reset the time decay compensation parameters of entities within the window;

[0103] The topological structure of the original source graph entity sequence remains unchanged.

[0104] In summary, this embodiment addresses the static analysis shortcomings of traditional source graph detection techniques when dealing with dynamic APT attacks by proposing an escape behavior detection mechanism based on dynamic trust assessment. This mechanism constructs a time-aware dynamic source graph by embedding time-series identifiers (including behavior timestamps, sequence association codes, and operation intervals) into multi-dimensional POI alarm points, effectively identifying escape interference created by attackers through injecting irrelevant operations and extending the attack cycle. The core innovation lies in employing a triple trust classification mechanism (trustworthy / untrustworthy / uncertain entities), combining a time decay factor and a frequency penalty factor to construct a dynamic trust assessment model, and deriving an expression formula for comprehensive trust assessment using Dempster-Shafer theory. This enables accurate differentiation between persistent malicious entity sequences and interference operations.

[0105] In addition, corresponding to Figure 1 In addition to the method shown, another embodiment of this example also provides an attack detection device. Figure 3 This is a schematic diagram of the attack detection device 300, including:

[0106] The source graph construction module 310 constructs a corresponding source graph based on the network behavior of the target object obtained through continuous monitoring. Each monitored network behavior corresponds to an entity in the source graph.

[0107] The entity classification module 320 classifies each entity in the traceability graph into trusted entities, untrusted entities, and uncertain entities based on the trust level of each entity in the traceability graph.

[0108] The escape identification module 330 performs correlation analysis on the time distribution characteristics of the trusted entity, the untrusted entity, and the uncertain entity to identify whether there is an attack escape behavior.

[0109] The attack determination module 340 is used to determine that the target object is an attacker if an attack escape behavior is detected.

[0110] Optionally, the escape identification module 330 performs correlation analysis based on the temporal distribution characteristics of the trusted entities, the untrusted entities, and the uncertain entities to identify whether the network behavior of the target object has an attack escape, including: extracting a sequence of trusted entities composed of temporally continuous trusted entities in the source graph, and calculating an overall trust value based on the trust level of the entities it contains; extracting a sequence of untrusted entities composed of temporally continuous untrusted entities in the source graph, and calculating an overall distrust value based on the frequency of occurrence of the entities it contains; extracting a sequence of uncertain entities composed of temporally continuous uncertain entities in the source graph, and calculating an overall uncertainty value based on the frequency of occurrence of the entities it contains; and identifying attack escape behavior based on the overall trust value, the overall distrust value, and the overall uncertainty value.

[0111] Optionally, the escape identification module 330 identifies attack escape behavior based on the overall trust value, overall distrust value, and overall uncertainty value, including: calculating a trustworthiness index value based on the overall trustworthiness value and overall uncertainty value, wherein the trustworthiness index value reflects the minimum certainty probability of an entity being trustworthy; calculating an untrustworthiness probability index value based on the overall distrust value and overall uncertainty value, wherein the untrustworthiness probability index value reflects the maximum potential probability of an entity being untrustworthy; calculating a comprehensive trust value based on the trustworthiness index value and the untrustworthiness probability index value; and determining that attack escape behavior exists if the comprehensive trust value reaches a preset trust threshold.

[0112] Optionally, the formula for calculating the comprehensive trust value is: ;in, This represents the overall trust value; This represents the overall trustworthiness value; This represents the overall distrust value; This represents the value of the credibility index; This indicates the value of the unreliability probability index.

[0113] Optionally, the overall trustworthiness value is decayed based on a first time decay factor; wherein the decay degree of the first time decay factor is positively correlated with the time difference between the last trustworthy entity in the trustworthy entity subsequence and the current time; the overall distrust value is decayed based on a second time decay factor and amplified based on a first frequency penalty factor; wherein the decay degree of the second time decay factor is positively correlated with the time difference between the last untrustworthy entity in the untrustworthy entity subsequence and the current time; the amplification strength of the first frequency penalty factor is positively correlated with the frequency of occurrence of untrustworthy entities in the untrustworthy entity subsequence; the overall uncertainty value is decayed based on a third time decay factor and amplified based on a second frequency penalty factor; wherein the decay degree of the third time decay factor is positively correlated with the time difference between the last uncertain entity in the uncertain entity subsequence and the current time; the amplification strength of the second frequency penalty factor is positively correlated with the frequency of occurrence of uncertain entities in the uncertain entity subsequence.

[0114] Optionally, before performing association analysis based on the temporal distribution characteristics of the trusted entity, the untrusted entity, and the uncertain entity, the source map construction module 310 is further configured to: determine the concept drift penalty coefficient based on the occurrence frequency of the untrusted entity and the uncertain entity within the sliding time window; if the concept drift penalty coefficient reaches a preset coefficient threshold, then associate the untrusted entity and the uncertain entity within the sliding time window with entities from previous times to update the source map.

[0115] Optionally, the time range of the sliding time window is dynamically expanded according to the number of newly added untrusted entities and / or uncertain entities in the source map.

[0116] This embodiment's device constructs a corresponding source map based on network behavior obtained through continuous monitoring of the target object, ensuring complete coverage of entity behavior data within the attack cycle, thereby supporting the identification of long-term attack evasion behaviors. Subsequently, based on the trust level of each entity in the source map, entities are classified into trusted, untrusted, and uncertain entities, effectively avoiding the blind spots caused by binary classification. This is particularly effective in identifying evasion noise created by attackers through intermittent insertion of uncertain entities (such as camouflage), significantly reducing the false negative rate. Next, the temporal distribution characteristics of trusted, untrusted, and uncertain entities are correlated to identify the existence of attack evasion behaviors, effectively capturing the attacker's phased evasion strategies, such as long-term infiltration followed by dispersed attacks, thus solving the problem of static rules being unable to adapt to behavioral changes. Finally, if attack evasion behaviors are identified, the target object is determined to be an attacker. This involves a comprehensive analysis of the three types of entities based on temporal distribution characteristics, rather than isolated judgments. Attack behavior is only determined after confirming the correlation analysis, significantly improving the objectivity of the judgment results, making it particularly suitable for detecting APT attacks that employ dynamic evasion strategies.

[0117] It should be noted that the state prediction device in this embodiment can be used as... Figure 1 The execution body of the method shown is therefore able to achieve... Figure 1 The steps and functions of the method shown are illustrated.

[0118] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Please refer to it. Figure 4 At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and memory. The memory may include main memory, such as high-speed random-access memory (RAM), or non-volatile memory, such as at least one disk drive. Of course, the electronic device may also include other hardware required for other business operations.

[0119] The processor, network interface, and memory can be interconnected via an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 4The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0120] Memory is used to store computer programs. Specifically, the computer program may include program code, which includes computer operation instructions. Memory may include main memory and non-volatile memory, and provides the computer program to the processor.

[0121] Specifically, the processor reads the corresponding computer program from non-volatile memory into memory and then runs it, forming the above-mentioned logical structure. Figure 3 The attack detection device shown. Correspondingly, the processor executes the program stored in memory, and specifically performs the following operations:

[0122] Based on the network behavior of the target object obtained through continuous monitoring, a corresponding source map is constructed, and each monitored network behavior corresponds to an entity in the source map.

[0123] Based on the trust level of each entity in the traceability graph, the entities in the traceability graph are classified into trusted entities, untrusted entities, and uncertain entities.

[0124] Correlation analysis is performed on the temporal distribution characteristics of the trusted entity, the untrusted entity, and the uncertain entity to identify whether there is any attack escape behavior.

[0125] If an attack escape behavior is detected, the target object is determined to be an attacker.

[0126] In this embodiment, the electronic device constructs a corresponding source map based on network behavior obtained through continuous monitoring of the target object. This ensures complete coverage of entity behavior data within the attack cycle, thereby supporting the identification of long-term attack evasion behaviors. Subsequently, based on the trust level of each entity in the source map, entities are classified into trusted entities, untrusted entities, and uncertain entities. This effectively avoids the blind spots caused by binary classification, especially when identifying evasion noise created by attackers through intermittent insertion of uncertain entities (such as camouflage operations), significantly reducing the false negative rate. Next, correlation analysis is performed on the temporal distribution characteristics of trusted, untrusted, and uncertain entities to identify whether attack evasion behaviors exist. This effectively captures the attacker's phased evasion strategies, such as long-term infiltration followed by dispersed attacks, thus solving the problem that static rules cannot adapt to behavioral changes. Finally, if attack evasion behaviors are identified, the target object is determined to be an attacker. This is based on a comprehensive analysis of the three types of entities based on temporal distribution characteristics, rather than isolated judgments. Attack behaviors are only determined after confirming the correlation analysis, which significantly improves the objectivity of the judgment results. This is particularly suitable for detecting attacks such as APTs that employ dynamic evasion strategies.

[0127] The above is as described in this instruction manual. Figure 1 The attack detection method disclosed in the illustrated embodiments can be applied to a processor and implemented by the processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit in the processor or by instructions in the form of software. The processor mentioned above can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of this application can be directly embodied as being executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0128] Of course, in addition to software implementation, the electronic device described in this specification does not exclude other implementation methods, such as logic devices or a combination of hardware and software. In other words, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0129] Furthermore, embodiments of this application also propose a computer-readable storage medium that stores one or more computer programs, the one or more computer programs including instructions.

[0130] When the aforementioned instructions are executed by a portable electronic device that includes multiple applications, they enable the portable electronic device to perform... Figure 1 The steps in the method shown include:

[0131] Based on the network behavior of the target object obtained through continuous monitoring, a corresponding source map is constructed, and each monitored network behavior corresponds to an entity in the source map.

[0132] Based on the trust level of each entity in the traceability graph, the entities in the traceability graph are classified into trusted entities, untrusted entities, and uncertain entities.

[0133] Correlation analysis is performed on the temporal distribution characteristics of the trusted entity, the untrusted entity, and the uncertain entity to identify whether there is any attack escape behavior.

[0134] If an attack escape behavior is detected, the target object is determined to be an attacker.

[0135] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0136] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0137] The above are merely embodiments of this specification and are not intended to limit the scope of this specification. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification. Furthermore, all other embodiments obtained by those skilled in the art without inventive effort should fall within the protection scope of this document.

Claims

1. An attack detection method, characterized in that, include: Based on the network behavior of the target object obtained through continuous monitoring, a corresponding source graph is constructed, and each network behavior obtained through monitoring corresponds to an entity in the source graph. Based on the trust level of each entity in the traceability graph, each entity in the traceability graph is classified into trusted entities, untrusted entities, and uncertain entities; The temporal distribution characteristics of the trusted entities, untrusted entities, and uncertain entities are correlated to identify whether attack evasion behavior exists. This includes: extracting a sequence of trusted entities composed of temporally continuous trusted entities from the source graph, and calculating an overall trustworthiness value based on the trust level of the entities they contain; extracting a sequence of untrusted entities composed of temporally continuous untrusted entities from the source graph, and calculating an overall distrust value based on the frequency of occurrence of the entities they contain; extracting a sequence of uncertain entities composed of temporally continuous uncertain entities from the source graph, and calculating an overall uncertainty value based on the frequency of occurrence of the entities they contain; calculating a trustworthiness index value based on the overall trustworthiness value and the overall uncertainty value, where the trustworthiness index value reflects the minimum certainty probability of an entity being trustworthy; calculating an untrustworthiness probability index value based on the overall distrust value and the overall uncertainty value, where the untrustworthiness probability index value reflects the maximum potential probability of an entity being untrustworthy; calculating a comprehensive trust value based on the trustworthiness index value and the untrustworthiness probability index value; and determining that attack evasion behavior exists if the comprehensive trust value reaches a preset trust threshold. If an attack escape behavior is detected, the target object is determined to be an attacker.

2. The method according to claim 1, characterized in that, The formula for calculating the comprehensive trust value is as follows: ; in, This represents the overall trust value; This represents the overall trustworthiness value; This represents the overall distrust value; This represents the value of the credibility index; This indicates the value of the unreliability probability index.

3. The method according to claim 1, characterized in that, The overall trustworthiness value decays based on a first time decay factor; wherein the degree of decay of the first time decay factor is positively correlated with the time difference between the last trustworthy entity in the trustworthy entity sequence and the current time; The overall distrust value is attenuated based on a second time decay factor and amplified based on a first frequency penalty factor; wherein, the degree of attenuation of the second time decay factor is positively correlated with the time difference between the last untrusted entity in the untrusted entity sequence and the current time; and the amplification of the first frequency penalty factor is positively correlated with the frequency of occurrence of untrusted entities in the untrusted entity sequence. The overall uncertainty value is attenuated based on a third time decay factor and amplified based on a second frequency penalty factor; wherein, the degree of attenuation of the third time decay factor is positively correlated with the time difference between the last uncertain entity in the uncertain entity sequence and the current time; and the amplification of the second frequency penalty factor is positively correlated with the frequency of occurrence of uncertain entities in the uncertain entity sequence.

4. The method according to any one of claims 1 to 3, characterized in that, Before performing correlation analysis based on the temporal distribution characteristics of the trusted entity, the untrusted entity, and the uncertain entity, the method further includes: The concept drift penalty coefficient is determined based on the frequency of occurrence of the untrusted entities and the uncertain entities within the sliding time window; If the concept drift penalty coefficient reaches a preset coefficient threshold, then the untrusted entity and the uncertain entity within the sliding time window will be associated with the entity from the previous time to update the source map.

5. The method according to claim 4, characterized in that, The time range of the sliding time window is dynamically expanded according to the number of newly added untrusted entities and / or uncertain entities in the source graph.

6. An attack detection device, characterized in that, include: The source graph construction module constructs a corresponding source graph based on the network behavior of the target object obtained through continuous monitoring. Each monitored network behavior corresponds to an entity in the source graph. The entity classification module classifies each entity in the traceability graph into trusted entities, untrusted entities, and uncertain entities based on the trust level of each entity in the traceability graph. The escape detection module performs correlation analysis on the temporal distribution characteristics of the trusted entities, untrusted entities, and uncertain entities to identify whether attack escape behavior exists. This includes: extracting a sequence of trusted entities composed of temporally continuous trusted entities from the source map, and calculating an overall trustworthiness value based on the trust level of the entities they contain; extracting a sequence of untrusted entities composed of temporally continuous untrusted entities from the source map, and calculating an overall distrust value based on the frequency of occurrence of the entities they contain; extracting a sequence of uncertain entities composed of temporally continuous uncertain entities from the source map, and calculating an overall uncertainty value based on the frequency of occurrence of the entities they contain; calculating a trustworthiness index value based on the overall trustworthiness value and the overall uncertainty value, where the trustworthiness index value reflects the minimum certainty probability of an entity being trustworthy; calculating an untrustworthiness probability index value based on the overall distrust value and the overall uncertainty value, where the untrustworthiness probability index value reflects the maximum potential probability of an entity being untrustworthy; calculating a comprehensive trust value based on the trustworthiness index value and the untrustworthiness probability index value; and determining that attack escape behavior exists if the comprehensive trust value reaches a preset trust threshold. The attack determination module is used to determine that the target object is an attacker if an attack escape behavior is detected.

7. An electronic device, comprising: processor; And a memory arranged to store computer-executable instructions, characterized in that, when executed, the executable instructions cause the processor to perform the method as described in any one of claims 1 to 5.

8. A computer program product, the computer program product comprising a computer-readable storage medium storing a computer program, characterized in that, The computer program is operable to cause the computer to perform the method as described in any one of claims 1 to 5.

Images