一种基于攻击阶段语义对齐的异构事件关联表征模型构建方法、系统及设备
By constructing a heterogeneous event association representation model based on the ATT&CK framework and a large language model, the semantic gap problem of heterogeneous security logs is solved, enabling complete reconstruction and efficient tracing of multi-step attack processes.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- XI AN JIAOTONG UNIV
- Filing Date
- 2025-08-01
- Publication Date
- 2026-07-17
AI Technical Summary
Existing technologies struggle to effectively integrate heterogeneous security logs at the network and host levels, and cannot automatically and comprehensively correlate multi-source heterogeneous security logs, making it difficult to fully reconstruct multi-step attack processes and heavily reliant on manual analysis.
By extracting hexagram and octet features, abnormal log fragment sequences and sensitive behavior log fragment sequences are constructed from inter-host and intra-host logs. Based on the ATT&CK framework and large language model, semantic alignment is performed to construct a heterogeneous event association representation model.
It enables a more comprehensive and complete reconstruction of the multi-step attack process, significantly improving the accuracy of attack behavior identification and event correlation, reducing the complexity of manual analysis, and improving the efficiency of attack tracing.
Smart Images
Figure BDA0005529967320000101 
Figure BDA0005529967320000111 
Figure BDA0005529967320000121