Heterogeneous event association representation model construction method, system and equipment based on attack stage semantic alignment

Abstract

The invention provides a heterogeneous event association representation model construction method, system and device based on attack stage semantic alignment, and the method comprises the following steps: extracting six-tuple features from an obtained inter-host connection log, and obtaining inter-host alarm log data with unified representation; constructing an abnormal log fragment sequence between the hosts based on the alarm log data between the hosts; mapping the inter-host abnormal log fragment sequence to obtain an inter-host attack stage; eight-tuple features are extracted from the obtained operation logs in the hosts, and operation log data, represented in a unified mode, in the hosts are obtained; constructing a sensitive behavior log fragment sequence in the host based on the operation log data in the host; mapping the sensitive behavior log fragment mapping in the host to obtain an attack stage in the host; on the basis of semantic alignment of heterogeneous security events, associating an inter-host attack stage with an in-host attack stage according to topological features, and constructing a heterogeneous event association representation model; according to the method, an observation blind area existing in a single log source can be effectively overcome, network behaviors such as network scanning and vulnerability utilization and activities in a host such as script execution and permission promotion can be captured at the same time, and therefore more comprehensive and more complete restoration of the multi-step attack process is achieved.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of network security log analysis and attack tracing, and particularly relates to a heterogeneous event correlation representation model construction method, system and device based on attack phase semantic alignment. BACKGROUND

[0002] With the continuous evolution of network attack technology, attack activities are increasingly showing the characteristics of complexity and multi-stage. Attackers often combine the use of multiple attack tactics and technologies to achieve the ultimate goal, leaving behind a large number of security logs scattered in different devices and different types in the network environment, such as network intrusion detection system (IDS) generated network alert logs, host operating system generated terminal operation logs, and various application service logs. These logs record attack traces from different dimensions and are the key basis for attack detection and post-tracing. At present, the correlation analysis method for security logs mainly has the following limitations:

[0003] One type of method focuses on the surface field correlation between logs. For example, by analyzing the similarity of IP addresses, port numbers and timestamps, the correlation between alert logs is constructed. However, this type of method ignores the deep attack semantics contained in log data, making it difficult to effectively deal with complex attacks that disguise as legitimate protocols or services, and unable to restore isolated logs to security events with clear attack intent.

[0004] Another type of method attempts to aggregate logs into security events, but often relies on a single type of log source. For example, some studies only use network alert logs, and aggregate attack fragments by analyzing the similarity of alert fingerprints.

[0005] Some other studies rely only on host audit logs, and restore attack behavior within the host by analyzing process call relationships. The inherent defect of this type of method is that a single type of log source has an observation blind area. For example, network alert logs cannot monitor malicious activities that do not generate network traffic occurring within the host (such as script compilation, privilege escalation), and host logs may not be able to record network probing behavior initiated through encrypted tunnels. Therefore, relying on a single log source is difficult to construct a complete attack evidence chain.

[0006] To overcome the limitations of a single log source, the latest research begins to explore the fusion analysis of multi-source logs. For example, by process-level semantic association, the host application log is mapped to the origin graph of the audit log, or a deep learning model (such as LSTM) is used to learn the sequence pattern of heterogeneous logs. Although these methods have made progress in establishing event-level association of multi-source logs, they still have two core problems: first, they mostly use hard-coded association rules or rely on model implicit learning, lack a unified and standardized security model (such as MITRE ATT&CK framework) to represent and align the attack semantics of events from different sources, resulting in weak scalability and explainability of the model; second, the association results generated by them still stay at the event level, and they fail to effectively reveal the attack tactics and strategies reflected behind the events, and the restoration of the complete attack scene still needs a lot of manual analysis and judgment.

[0007] Therefore, how to effectively fuse heterogeneous security logs at the network and host levels, overcome the structural, granularity and semantic gap between them, and automatically associate and align heterogeneous security events based on a unified security model to completely restore the multi-step attack process is a technical problem to be solved in the current network security field. SUMMARY

[0008] The purpose of the present application is to provide a heterogeneous event association representation model construction method, system and equipment based on attack phase semantic alignment, which solves the problem that in network attack traceability analysis, due to the dependence on a single log source or the lack of a unified semantic alignment framework, the semantic gap between events cannot be effectively overcome, it is difficult to automatically and comprehensively associate multi-source heterogeneous security logs, and ultimately it is difficult to completely restore the multi-step attack process and highly rely on manual analysis and judgment.

[0009] In order to achieve the above purpose, the technical scheme adopted by the present application is:

[0010] In a first aspect, the present application provides a heterogeneous event association representation model construction method based on attack phase semantic alignment, comprising the following steps:

[0011] Extract six-tuple features from the obtained inter-host connection log to obtain uniformly represented inter-host alert log data;

[0012] Construct an inter-host abnormal log segment sequence based on the inter-host alert log data;

[0013] Map the inter-host abnormal log segment sequence to obtain an inter-host attack phase;

[0014] Extract eight-tuple features from the obtained intra-host operation log to obtain uniformly represented intra-host operation log data;

[0015] Construct an intra-host sensitive behavior log segment sequence based on the intra-host operation log data;

[0016] mapping the host-in sensitive behavior log fragments to obtain a host-in attack stage;

[0017] On the basis of heterogeneous security event semantic alignment, the inter-host attack stage and the host-in attack stage are associated according to the topological characteristics to obtain a heterogeneous event association representation model.

[0018] Preferably, the six-tuple features are extracted from the obtained inter-host connection log by using a service mapping and fingerprint association method to obtain inter-host alarm log data with unified representation.

[0019] Preferably, based on the inter-host alarm log data, an inter-host abnormal log fragment sequence is constructed by combining a time sequence feature analysis method.

[0020] Preferably, the inter-host abnormal log fragment sequence is mapped to obtain an inter-host attack stage, and the specific method is:

[0021] Based on expert knowledge, an AIF framework and an ATT&CK framework are combined to obtain a mapping rule;

[0022] Based on the mapping rule, the inter-host abnormal log fragment sequence is mapped to obtain an inter-host attack stage.

[0023] Preferably, the eight-tuple features are extracted from the obtained host-in operation log by syntax analysis and entity recognition to obtain host-in operation log data with unified representation.

[0024] Preferably, based on the host-in operation log data, a host-in sensitive behavior log fragment sequence is constructed by combining a sensitive entity association method.

[0025] Preferably, based on a pre-constructed expert knowledge base and a large language model, the host-in sensitive behavior log fragments are mapped to obtain a host-in attack stage.

[0026] Preferably, based on a pre-constructed expert knowledge base and a large language model, the host-in sensitive behavior log fragments are mapped to obtain a host-in attack stage, and the specific method is:

[0027] Based on a pre-constructed expert knowledge base, the host-in sensitive behavior log fragments are mapped to obtain a preliminary mapping attack stage;

[0028] The category of the preliminary mapping attack stage is determined, and the category of the preliminary mapping attack stage is determined.

[0029] When the category of the preliminary mapping attack stage is only one, the preliminary mapping attack stage is taken as the final host-in attack stage;

[0030] When the types of the preliminary mapping attack stage are more than two, the host-in sensitive behavior log fragments are mapped based on a large language model to obtain a mapping attack stage, and the mapping attack stage is taken as a final host-in attack stage.

[0031] In a second aspect, the application provides a heterogeneous event correlation representation model construction system based on attack stage semantic alignment, comprising:

[0032] The inter-host feature extraction unit is configured to extract six-tuple features from the obtained inter-host connection log to obtain inter-host alarm log data in a unified representation.

[0033] The abnormal fragment sequence construction unit is configured to construct an inter-host abnormal log fragment sequence based on the inter-host alarm log data.

[0034] The inter-host attack stage acquisition unit is configured to map the inter-host abnormal log fragment sequence to obtain an inter-host attack stage.

[0035] The intra-host feature extraction unit is configured to extract eight-tuple features from the obtained intra-host operation log to obtain intra-host operation log data in a unified representation.

[0036] The sensitive behavior sequence construction unit is configured to construct an intra-host sensitive behavior log fragment sequence based on the intra-host operation log data.

[0037] The intra-host attack stage acquisition unit is configured to map the intra-host sensitive behavior log fragments to obtain an intra-host attack stage.

[0038] The heterogeneous event representation model acquisition unit is configured to, on the basis of semantic alignment of heterogeneous security events, associate the inter-host attack stage and the intra-host attack stage according to topology features to construct a heterogeneous event correlation representation model.

[0039] In a third aspect, the application provides an electronic device comprising a processor and a memory, wherein the memory stores computer instructions, and when the computer instructions are executed by the processor, the electronic device executes any of the methods.

[0040] Compared with the prior art, the application has the following beneficial effects:

[0041] The heterogeneous event correlation representation model construction method based on attack stage semantic alignment provided by the application aggregates two kinds of heterogeneous data sources into "abnormal fragments" and "sensitive behaviors" by fusing network-level connection logs and host-level operation logs, and finally constructs a unified correlation graph. This method effectively overcomes the observation blind area of a single log source, can simultaneously capture network behaviors such as network scanning and vulnerability exploitation and intra-host activities such as script execution and privilege escalation, and thus realizes more comprehensive and complete restoration of a multi-step attack process.

[0042] Further, the application introduces a unified semantic alignment mechanism based on the ATT&CK framework, and combines expert knowledge base and large language model to solve the semantic gap problem between heterogeneous security events. Especially for complex command sequences, the attack intention can be accurately judged through deep semantic analysis, which significantly improves the accuracy of attack behavior recognition and event correlation.

[0043] Further, the heterogeneous event correlation representation model finally output by the application converts massive, discrete log data into structured, visual attack graphs. The nodes in the graph represent compromised hosts, and the edges represent attack paths with detailed attack stages and behavior characteristics. This allows security and operation personnel to intuitively and quickly understand the overall attack, locate key attack paths, significantly reduce the complexity and workload of manual analysis, and improve the efficiency and automation level of attack tracing. BRIEF DESCRIPTION OF DRAWINGS

[0044] Figure 1 The flowchart of the embodiment of the application is shown in the following figure:

[0045] Figure 2 The prompt words for host internal sensitive behavior semantic analysis in the embodiment of the application are shown in the following figure:

[0046] Figure 3 The heterogeneous event correlation representation model constructed in the embodiment of the application is shown in the following figure. DETAILED DESCRIPTION

[0047] In the following description, specific details are set forth such as particular system architectures, techniques, etc. in order to provide a thorough understanding of the embodiments of the application. However, it will be apparent to one skilled in the art that the application can be practiced without these specific details. In other instances, well-known systems, structures, circuits, and methods have not been described in detail in order to avoid obscuring the description of the application.

[0048] It should be understood that when used in the specification and the appended claims of the present application, the term "comprising" indicates the presence of the described features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0049] It should also be understood that the term "and / or" used in the specification and the appended claims of the present application means any combination of one or more of the associated listed items and all possible combinations thereof, and includes these combinations.

[0050] As used in the description of the application and the appended claims, the term "if' can be interpreted to mean "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrase "if it is determined" or "if [a described condition or event] is detected" can be interpreted to mean "upon determining" or "in response to determining" or "upon detecting [the described condition or event]" or "in response to detecting [the described condition or event]," depending on the context.

[0051] In addition, the terms "first", "second", "third", etc. as used in the description of the application and the appended claims are merely used to differentiate descriptions and cannot be understood as indicating or implying relative importance.

[0052] Reference in the specification to "one embodiment" or "some embodiments" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the application. The appearances of the phrase "in one embodiment" or "in some embodiments" in various places in the specification are not necessarily all referring to the same embodiment, although it can. The terms "including," "containing," "having," and variations thereof are meant to encompass the terms "including but not limited to," unless otherwise indicated.

[0053] Embodiment 1

[0054] Figure 1 A flow chart of a heterogeneous event correlation representation model construction method based on attack phase semantic alignment is proposed in this embodiment.

[0055] The heterogeneous event correlation representation model construction method based on attack phase semantic alignment provided in this embodiment includes the following steps:

[0056] Step 1: For inter-host connection logs, six-tuple features are extracted through service mapping and fingerprint association to obtain uniformly represented inter-host alert log data, and inter-host abnormal log segment sequences are constructed through time sequence feature analysis method.

[0057] Step 2: Attack phase mapping rules are constructed by applying AIF framework and ATT&CK framework and expert knowledge, and inter-host abnormal log segments are mapped to 14 attack phases to obtain inter-host attack phases.

[0058] Step 3: For intra-host operation logs, eight-tuple features are extracted through syntax analysis and entity recognition to obtain uniformly represented intra-host operation log data, and intra-host sensitive behavior log segment sequences are constructed through sensitive entity association method.

[0059] Step 4: Constructing an expert knowledge base, based on the large model and few sample learning method and prompt word engineering technology, mapping the host internal sensitive behavior log segment sequence to 14 attack stages to obtain the host internal attack stage.

[0060] Step 5: On the basis of heterogeneous security event semantic alignment, associating the inter-host attack stage and the host internal attack stage according to the topology characteristics to construct a heterogeneous event association representation model.

[0061] Embodiment 2

[0062] Based on the embodiment 1, the heterogeneous event association representation model construction method based on attack stage semantic alignment provided in this embodiment is based on inter-host alert log data, and combines a time sequence feature analysis method to construct an inter-host abnormal log segment sequence, and the specific method is:

[0063] The inter-host connection log set is aggregated according to the triplets to form a plurality of abnormal sequences, wherein each abnormal sequence includes all connection logs generated between a specific attacker and a victim in the same attack stage;

[0064] A preset time window is used to divide each abnormal sequence into a plurality of continuous abnormal sequence intervals according to the time stamp;

[0065] The number of logs contained in each abnormal sequence interval is counted, and the log data is used as the log frequency feature of the abnormal sequence interval, and the log frequency feature is used to obtain the time sequence of the alert frequency corresponding to each abnormal sequence;

[0066] First-order difference operation is performed on each frequency time sequence to extract the rising edge and falling edge corresponding to each frequency time sequence;

[0067] The inter-host abnormal segment is extracted from the obtained rising edge and falling edge;

[0068] All inter-host abnormal segments are globally sorted according to the start time of each inter-host abnormal segment to obtain an inter-host abnormal log segment sequence.

[0069] Embodiment 3

[0070] Based on the embodiment 1, the heterogeneous event association representation model construction method based on attack stage semantic alignment provided in this embodiment is based on the pre-constructed expert knowledge base and the large language model, and the host internal sensitive behavior log segment is mapped to obtain the host internal attack stage, and the specific method is:

[0071] Based on the pre-constructed expert knowledge base, the host internal sensitive behavior log segment is mapped to obtain a preliminary mapping attack stage;

[0072] determining the category of the preliminary mapping attack phase, wherein:

[0073] when the category of the preliminary mapping attack phase is only one, the preliminary mapping attack phase is taken as the final in-host attack phase;

[0074] when the category of the preliminary mapping attack phase is more than two, the in-host sensitive behavior log segment is mapped based on a large language model to obtain a mapping attack phase, and the mapping attack phase is taken as the final in-host attack phase.

[0075] Embodiment 4

[0076] The network inter-host continuous alarm attack detection method based on context feature enhancement provided in this embodiment specifically includes the following steps:

[0077] S1: processing and analyzing the inter-host connection log to construct an inter-host abnormal segment sequence, specifically including the following steps:

[0078] S101: inter-host connection log acquisition and fusion.

[0079] Firstly, two main types of lightweight log data sources are acquired:

[0080] Network alarm log: as the main component of the inter-host connection log, it is generated by the network deployed intrusion detection system, and the typical fields include source IP address, destination IP address, port number, timestamp, alarm fingerprint, etc.

[0081] Host application log: as a supplement to the network alarm log, it is used to discover abnormal connections that may be missed by the intrusion detection system. This embodiment additionally analyzes three types of lightweight host application logs, including identity authentication log (such as auth.log), email service log (such as imap.log), and database connection log (such as mongo.log).

[0082] Subsequently, the open-source scalable threat detection and response (XDR) platform Wazuh is used to supplement and expand the abnormal detection rule set of Wazuh in combination with domain expert knowledge, to identify and extract potential inter-host abnormal connection patterns (such as “PAM 1more authentication failure”, “MongoDB interactive shell”, etc.) from the above-mentioned host application logs, and convert them into structured data compatible with the format of the network alarm log. Finally, the network alarm log and the abnormal records extracted from the host application log that can represent the inter-host connection behavior are fused to construct a unified, multi-source heterogeneous connection event set, i.e., the inter-host connection log, which serves as the input data for subsequent processing.

[0083] S102: Structured feature extraction and unified representation of inter-host connection logs.

[0084] For each log e in the inter-host connection logs fused in S101, feature processing and structured representation are performed to convert it into a unified six-tuple feature, which specifically includes:

[0085] Service type mapping: Considering that attackers often attack specific service ports, this step maps the destination port number dport in the log to the corresponding service type service. This mapping is mainly based on the open-source IANA (Internet Assigned Numbers Authority) port service mapping table (for example, port 80 is mapped to HTTP service, and port 3306 is mapped to MySQL service).

[0086] In addition, to improve accuracy, the IANA port service mapping table is expanded in combination with actual business scenarios, such as correctly mapping the SSH port 1022 or 22022 commonly used in practice to enhance security to SSH service, and mapping the 4444 port commonly listened to by the Metasploit framework to persistent connection service.

[0087] Attack stage mapping: To extract the attack semantic information contained in the log, this step uses the Action-Intent Framework (AIF) framework to map the alert fingerprint attribute alert_signature of each log to its corresponding attack stage attack_stage.

[0088] After the above feature processing, the original inter-host connection log is uniformly represented as a six-tuple: e = <t, att, vic, serv, nstage, sev>. Where t represents the timestamp of the log generation, att and vic represent the IP addresses of the attacker host and victim host respectively, serv represents the service type name of the attacked service, nstage indicates the attack stage, and sev is the threat level, obtaining the uniformly represented inter-host alarm log data.

[0089] S103: Inter-host abnormal segment identification based on time sequence feature analysis.

[0090] Based on the uniformly represented inter-host alarm log data obtained in S102, the inter-host abnormal segment is identified and extracted by analyzing its time sequence and frequency characteristics, and the algorithm steps are shown in the following table:

[0091]

[0092]

[0093] This step specifically includes:

[0094] 1. Constructing abnormal sequences: Abnormal sequences refer to the sequences of inter-host connection logs aggregated according to the (attacker, victim, attack phase) triplets. The uniformly represented inter-host alert log data is aggregated according to the (attacker host IP, victim host IP, attack phase) triplet to form multiple abnormal sequences. Each abnormal sequence contains all connection logs generated between a specific attacker and a victim in the same attack phase.

[0095] 2. Dividing abnormal sequence intervals: A preset time window parameter wLen (for example, according to the log scale and distribution characteristics of the experimental data set, it can be set to 150 seconds) is set, and each abnormal sequence is divided into multiple continuous abnormal sequence intervals according to the timestamp.

[0096] 3. Constructing alert frequency time series and calculating gradient: The number of logs contained in each abnormal sequence interval is counted as the log frequency feature of the abnormal sequence interval, so as to construct an alert frequency time series for each abnormal sequence, and obtain the frequency time series. Then, first-order difference operation is performed on the frequency time series to extract the rising edge (indicating the start or intensification of attack activity) and falling edge (indicating the weakening or end of attack activity) reflecting the frequency change trend.

[0097] 4. Identifying abnormal segments: Inter-host abnormal segments refer to security events composed of a number of inter-host connection logs with high similarity, which reflect a complete attack attempt or action performed by an attacker between two hosts. By traversing each abnormal sequence corresponding to the identified rising edge, if there is a falling edge between the adjacent two rising edges, the latest falling edge time between the two rising edges is taken as the end time of the current inter-host abnormal segment. If there is no falling edge, it is considered that the current abnormal segment continues until the first falling edge appears. The start time of an rising edge and the end time identified by a falling edge together constitute an inter-host abnormal segment.

[0098] S104: Constructing inter-host abnormal segment sequence.

[0099] All inter-host abnormal segments identified from all abnormal sequences in S103 are globally sorted according to the start time of each inter-host abnormal segment. Finally, an inter-host abnormal log segment sequence reflecting the time sequence of the attacker's network-level activity is obtained, which will be used as the input of S2.

[0100] S2: Applying AIF framework and ATT&CK framework to construct mapping rules to realize attack phase semantic alignment of inter-host abnormal segments, which includes the following steps:

[0101] S201: Constructing attack phase mapping rules from AIF framework to ATT&CK framework.

[0102] Based on the expert knowledge in the field of network security, this step systematically constructs a set of attack phase mapping rules from AIF to MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) framework. This rule set aims to map the 36 specific attack techniques defined in the AIF framework to the 14 attack tactics (i.e., attack phases) covered by the ATT&CK framework. The attack phase mapping rules are as follows:

[0103] Table 1 Attack phase mapping rules

[0104]

[0105]

[0106] S202: Realize semantic alignment of inter-host abnormal fragments in attack phase.

[0107] Traverse each inter-host abnormal log fragment, extract its existing and AIF framework-based attack phase attributes. Then, use the mapping rule set constructed in S201 to query, match and align an ATT&CK framework-based attack phase label for the fragment, and obtain the inter-host attack phase.

[0108] S3: Process and analyze the intra-host operation log to construct a sequence of intra-host sensitive behavior log fragments, which includes the following steps:

[0109] S301: Intra-host operation log key entity recognition and unified representation.

[0110] The terminal operation log generated in the bash command line environment under the Linux platform (such as the.bash_history file) is taken as the processing object. First, the open source syntax analysis tool (such as bashlex) is used to parse each terminal operation log, and the core components are extracted according to the syntax structure (such as command, option, parameter, etc.). Subsequently, in combination with the common position of the parameter and the context semantic information, the five types of key entities, i.e., the permission entity, the command entity, the input entity, the output entity and the target entity, are further identified and extracted from the parsed core components, so as to provide fine structured feature information for each operation log. Then, each host operation log c is uniformly represented as an eight-tuple: c = <t, host, priv, cmd, args, input, output, target>. Where t represents the log execution timestamp, host represents the log host IP address, priv represents the log execution subject permission entity, cmd represents the command entity, args represents the command parameter list, input and output represent the input and output entities respectively, and target represents the target entity, so as to obtain the uniformly represented host operation log data.

[0111] S302: Host internal sensitive behavior identification based on sensitive entity association.

[0112] Based on the association between sensitive entities, the operation logs closely associated in the uniformly represented host operation log data are aggregated into host internal sensitive behaviors, so as to solve the problem that the traditional method is difficult to effectively distinguish multiple sensitive behaviors executed in one session. The algorithm steps are shown in the following table:

[0113]

[0114]

[0115] This step specifically includes:

[0116] 1. Define the association weight between entities: first, define three types of weights reflecting the causal dependence relationship between two operation logs ci and cj (the execution time of ci is later than that of cj):

[0117] Sequential weight (SEQ_W): when the output entity of cj is the same as the input entity of ci (for example, gcc exp.c-oexp followed by. / exp), the highest weight value is given.

[0118] Similar weight (SIM_W): when the input entities of cj and ci are the same (for example, chmod+x shell.sh followed by bash shell.sh), the second highest weight value is given.

[0119] Association weight (ASSO_W): Assign the lowest weight value when the command entities of two logs belong to the same functional type (e.g., arp-scan and nmap are both information discovery type commands).

[0120] 2. Calculate association scores and aggregation: Traverse the unified representation of the in-host operation log data in chronological order. For the current operation log ci, traverse all previous historical logs cj in reverse chronological order. Calculate the association score between ci and each cj by the following formula:

[0121] score = weight / (|ti-tj|)

[0122] where weight is the association weight determined according to the above rules, and |ti-tj| is the execution time interval of the two logs. This formula makes the association score decrease as the time interval increases, in order to avoid mistakenly associating operation logs that are far apart.

[0123] Divide the current operation log ci into the sensitive behavior of the historical log cj with the largest association score. If the association score of ci with all historical logs is 0, but it itself involves sensitive entities, then ci will start a new sensitive behavior.

[0124] S303: Construct the sequence of in-host sensitive behaviors.

[0125] After traversal, all operation logs assigned with the same sensitive behavior ID will be aggregated into an in-host sensitive behavior. Each sensitive behavior is captured by an InfoPath attribute that intuitively presents the information flow and entity causal path from input entities to commands to output entities (e.g., https: / / ... / LinEnum.sh->wget->LinEnum.sh->vim).

[0126] Finally, sort all in-host sensitive behaviors identified for a specific host by their start time to obtain the final sequence of in-host sensitive behavior segments.

[0127] S4: Construct an expert knowledge base and apply a large language model to achieve semantic alignment of the attack phase of the in-host sensitive behavior segment sequence. Specifically, it includes the following steps:

[0128] S401: Construct a sensitive entity knowledge base and perform preliminary attack phase mapping.

[0129] First, reference common attack techniques and methods in network security attack and defense exercises (CTF) and combine expert knowledge to construct a sensitive entity knowledge base containing 578 sensitive entities. The sensitive entity knowledge base specifically includes:

[0130] 294 sensitive files: such as / etc / passwd, / etc / shadow, and other key system files.

[0131] 174 sensitive commands: such as nmap, iptables, dirb, and other commands commonly used for attacks.

[0132] 110 sensitive log patterns: such as the -i>& / dev / tcp pattern commonly used to establish reverse SHELL.

[0133] At the same time, combined with expert knowledge, a mapping relationship between sensitive entities in the sensitive entity knowledge base and the 14 attack stages covered by the MITRE ATT&CK framework is constructed. For example, the dirb and dirsearch commands are mapped to the "information discovery" stage; the -i>& / dev / tcp log pattern is mapped to the "command control" stage.

[0134] In the preliminary mapping, each operation log contained in the sequence of sensitive behavior logs in the host is checked. If the entity (such as the command entity, file entity) in the operation log exists in the knowledge base, the ATT&CK attack stage corresponding to the entity is taken as a candidate attack stage of the sensitive behavior. After this step, each host-sensitive behavior may be assigned one or more candidate attack stage labels, and the initial host attack stage is obtained.

[0135] S402: Deep semantic analysis based on large language model and prompt word engineering.

[0136] To address the problem of semantic uncertainty in host-sensitive behavior (for example, the true intention of the python command depends on whether the script it executes is dirsearch.py or LinEnum.sh), a large language model (Qwen-turbo is used in this embodiment) is applied and combined with prompt word engineering technology to perform deep semantic understanding of complex operation log sequences.

[0137] Specifically, S402 guides the large language model to accurately determine the attack stage by designing a prompt word (Prompt). The prompt word is composed of five core parts, as shown in Figure 2 which contains five parts: instructions, context, examples, input format, and output format. Through this step, the attack stage label of the host-sensitive behavior based on the ATT&CK framework is obtained.

[0138] S403: Implement a hybrid mapping strategy and complete the final attack stage alignment.

[0139] To balance accuracy and efficiency, S403 adopts a hybrid strategy to determine the final attack stage for each host-sensitive behavior:

[0140] For simple cases: if after the preliminary mapping at S401, all operation logs contained in a host-intra sensitive behavior only point to a unique ATT&CK attack phase, then directly take this phase as the final attack phase of this sensitive behavior, without calling the large language model.

[0141] For complex cases: if after the preliminary mapping, the operation logs contained in a host-intra sensitive behavior point to two or more ATT&CK attack phases, which indicates that there is uncertainty in its semantics. At this time, the system will call the analysis capability of the large language model constructed in S402. Take the host-intra sensitive behavior sequence as input, guide the model for comprehensive analysis through the designed prompt words. Finally, the attack phase judgment result returned by the large language model will be taken as the final attack phase of the complex sensitive behavior.

[0142] S5: On the basis of heterogeneous security event semantic alignment, associate the host-intra sensitive behavior with the host-intra sensitive behavior according to the topological characteristics, and construct a heterogeneous event association representation model, specifically:

[0143] This step associates the host-intra sensitive behavior and the host-intra sensitive behavior generated in the previous steps on the unified time dimension, and performs the following operations to construct a topological structure of a directed graph G, and finally obtains a heterogeneous event association representation model:

[0144] S51. Create host nodes (build node set V):

[0145] Traverse all host-intra attack phases and host-intra attack phases in the current time slice, and extract each unique host IP address (including attacker host, victim host and host where sensitive behavior is located) involved therein. Each unique IP address is instantiated as a graph node v, and all created nodes are added to the node set V.

[0146] S52. Create network detected connection edges (build edge set E_N):

[0147] Traverse all host-intra sensitive behaviors in the current time slice. For each segment, from the graph node corresponding to the attacker host to the graph node corresponding to the victim host, create a directed edge e_N. This edge (which can be represented as a solid line in visualization) represents a suspicious connection directly detected by network logs. All created edges of this type are added to the edge set E_N.

[0148] S53. Supplement hidden connection edges detected by host (build edge set E_H and enhance E_N):

[0149] Traverse all the intra-host sensitive behaviors within the current time slice. Only process those sensitive behaviors whose target entity is not null (i.e. the behavior involves interaction with other hosts). For each such behavior, perform the following judgments and operations:

[0150] If the connection is a newly discovered one: check whether the connection constituted by the sensitive behavior (pointed from the host IP where the behavior is located to the target entity IP) already exists in the edge set E_N. If not, create a new directed edge e_H in the graph from the host node where the behavior is located to the target entity node. This edge (which can be represented as a dashed line in the visualization) represents a hidden connection that is not recognized by the network side. Add this new edge to the supplementary edge set E_H.

[0151] If the connection is an already existing one: if the connection constituted by the sensitive behavior already exists in E_N, do not create a new edge. This case indicates that the connection is discovered at both the network and host levels. At this time, update the information of this intra-host sensitive behavior as an additional corroborating evidence to the attributes of the existing edge in E_N.

[0152] The final heterogeneous event correlation representation model is shown in Figure 3 The model captures the evolution process of all inter-host connections and intra-host activities in the network environment, and can provide an intuitive and reliable model basis for mining potential attack processes in the network.

[0153] Embodiment 5

[0154] This embodiment is tested on the CPTC-2018 dataset of a university penetration testing competition. The following table shows the analysis results of the effectiveness of heterogeneous event semantic alignment. Overall, the average accuracy of semantic alignment of each attack scenario in the CPTC-2018 dataset under strict constraints reaches 92.3%, which proves the effectiveness of the semantic alignment method based on the ATT&CK framework, which can accurately identify and correlate heterogeneous security events with the same attack semantics.

[0155] Table 2 Analysis results of the effectiveness of heterogeneous event semantic alignment

[0156]

[0157] a Attack scenarios T-1 ~ T-9 come from the attack logs of 6 teams in the CPTC-2018 public dataset.

[0158] Embodiment 6

[0159] The heterogeneous event correlation representation model construction system based on attack phase semantic alignment provided in this embodiment is characterized by comprising:

[0160] An inter-host feature extraction unit is configured to extract six-tuple features from the obtained inter-host connection logs to obtain inter-host alarm log data uniformly represented.

[0161] An abnormal segment sequence construction unit is configured to construct an inter-host abnormal log segment sequence based on the inter-host alarm log data.

[0162] An inter-host attack stage acquisition unit is configured to map the inter-host abnormal log segment sequence to obtain an inter-host attack stage.

[0163] An intra-host feature extraction unit is configured to extract eight-tuple features from the obtained intra-host operation logs to obtain intra-host operation log data uniformly represented.

[0164] A sensitive behavior sequence construction unit is configured to construct an intra-host sensitive behavior log segment sequence based on the intra-host operation log data.

[0165] An intra-host attack stage acquisition unit is configured to map the intra-host sensitive behavior log segment to obtain an intra-host attack stage.

[0166] A heterogeneous event representation model acquisition unit is configured to, on the basis of semantic alignment of heterogeneous security events, associate the inter-host attack stage and the intra-host attack stage according to topology features to construct a heterogeneous event association representation model.

[0167] Embodiment 7

[0168] This embodiment also provides a computing device. The computing device includes a bus, a processor, a memory, and a communication interface. The processor, the memory, and the communication interface communicate through the bus. The computing device can be a server or a terminal device. It should be understood that the number of processors and memories in the computing device is not limited in the present application.

[0169] The bus can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus can include a path for transmitting information between various components (e.g., the memory, the processor, the communication interface) of the computing device.

[0170] The processor can include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a Tensor Processing Unit (TPU), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), a microprocessor (MP), or a digital signal processor (DSP), etc.

[0171] The memory can include a volatile memory, such as a random access memory (RAM) for example. The processor can also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid-state drive (SSD) for example.

[0172] The memory stores executable program codes, and the processor executes the executable program codes to respectively implement the functions of the aforementioned units, so as to implement the method described in Embodiment 1 and the like. That is, the memory can store instructions for the methods and functions of the computing device in any of the above embodiments.

[0173] The communication interface uses a transceiving module such as, but not limited to, a network interface card, a transceiver, to implement the communication between the computing device and other devices or communication networks.

[0174] The above-described embodiments are only used to illustrate the technical solutions of the present application, but not limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacements to some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A method for constructing a heterogeneous event association representation model based on semantic alignment of attack phases, characterized by: The following steps are involved: Extract six-tuple features from the obtained inter-host connection logs to obtain uniformly represented inter-host alarm log data; Construct an inter-host abnormal log fragment sequence based on inter-host alarm log data; Mapping the abnormal log fragment sequences between hosts to obtain the attack stages between hosts; Extracting octet features from the acquired host operation logs to obtain uniformly represented host operation log data; Construct a sequence of sensitive behavior log fragments within the host based on the host's operation log data; Map the sensitive behavior log fragments within the host to obtain the host attack stage; Based on the semantic alignment of heterogeneous security events, the inter-host attack phase and the intra-host attack phase are associated according to topological features to construct a heterogeneous event association representation model.

2. The method for constructing a heterogeneous event association representation model based on attack phase semantic alignment according to claim 1 is characterized in that: The service mapping and fingerprint association method is used to extract six-tuple features from the obtained host-to-host connection logs to obtain unified representation of host-to-host alarm log data.

3. The method for constructing a heterogeneous event association representation model based on attack phase semantic alignment according to claim 1 is characterized in that: Based on the alarm log data between hosts, the abnormal log fragment sequence between hosts is constructed by combining the time series feature analysis method.

4. The method for constructing a heterogeneous event association representation model based on attack phase semantic alignment according to claim 1 is characterized in that: Mapping the abnormal log fragment sequences between hosts to obtain the attack stages between hosts, the specific method is: Based on expert knowledge, mapping rules are constructed by combining the AIF framework and the ATT&CK framework; Based on the mapping rules, the abnormal log fragment sequences between hosts are mapped to obtain the attack stages between hosts.

5. The method for constructing a heterogeneous event association representation model based on attack phase semantic alignment according to claim 1 is characterized in that: Through syntax parsing and entity recognition, octet features are extracted from the acquired host operation logs to obtain unified representation of the host operation log data.

6. The method for constructing a heterogeneous event association representation model based on attack phase semantic alignment according to claim 1 is characterized in that: Based on the host operation log data, the sensitive entity association method is combined to construct the host sensitive behavior log fragment sequence.

7. The method for constructing a heterogeneous event association representation model based on attack phase semantic alignment according to claim 1 is characterized in that: Based on the pre-built expert knowledge base and large language model, sensitive behavior log fragments within the host are mapped to obtain the host attack stage.

8. The method for constructing a heterogeneous event association representation model based on attack phase semantic alignment according to claim 7 is characterized in that: Based on the pre-built expert knowledge base and large language model, sensitive behavior log fragments within the host are mapped to obtain the host attack stage. The specific method is: Based on the pre-built expert knowledge base, sensitive behavior log fragments in the host are mapped to obtain the initial mapping attack stage; Determine the type of the initial mapping attack phase, where: When there is only one type of preliminary mapping attack stage, the preliminary mapping attack stage is used as the final intra-host attack stage; When there are more than two types of preliminary mapped attack stages, the sensitive behavior log fragments in the host are mapped based on the large language model to obtain the mapped attack stage, which is used as the final host attack stage.

9. A heterogeneous event association representation model construction system based on attack phase semantic alignment, characterized by: include: An inter-host feature extraction unit is used to extract six-tuple features from the obtained inter-host connection logs to obtain uniformly represented inter-host alarm log data; An abnormal fragment sequence construction unit is used to construct an inter-host abnormal log fragment sequence based on the inter-host alarm log data; An inter-host attack stage acquisition unit is used to map the inter-host abnormal log fragment sequence to obtain the inter-host attack stage; The host feature extraction unit is used to extract octet features from the acquired host operation log to obtain uniformly represented host operation log data; A sensitive behavior sequence construction unit is used to construct a sequence of sensitive behavior log fragments in the host based on the operation log data in the host; The host attack stage acquisition unit is used to map the sensitive behavior log fragments in the host to obtain the host attack stage; The heterogeneous event representation model acquisition unit is used to associate the inter-host attack stage with the intra-host attack stage according to topological characteristics on the basis of semantic alignment of heterogeneous security events, and construct a heterogeneous event association representation model.

10. An electronic device, characterized in that: The electronic device comprises a processor and a memory, wherein computer instructions are stored in the memory. When the computer instructions are executed by the processor, the electronic device executes the method according to any one of claims 1 to 8.

Images