An apt organization homology determination method based on threat intelligence analysis

Abstract

The application provides an APT organization homology determination method based on threat intelligence analysis, and relates to the field of computer network security.The method provided by the application comprises the following steps: extracting tactical behavior text, campaign activity text and target description text in threat intelligence; constructing a tactical label library, using a semantic coding model to identify and match the tactical behavior text with the tactical label library, and optimizing based on reinforcement learning to obtain a tactical label set and calculate the tactical similarity thereof; calculating campaign similarity based on the attack stage sequence dimension, infrastructure feature dimension and tactical technology procedure dimension of APT attack; decoupling the target description text into the target industry dimension, geographic region dimension and organization type dimension based on a pre-trained multilingual model, calculating the alignment degree of each dimension, and weighting and fusing to obtain target similarity; and determining the homology of threat intelligence based on the similarity indexes obtained based on the above similarities.The application realizes APT organization homology determination with multi-dimensional semantic fusion.

Description

Technical Field

[0001] This invention relates to the field of computer network security, and in particular to a method for determining the origin of APT organizations based on threat intelligence analysis. Background Technology

[0002] Cybersecurity, particularly protection against Advanced Persistent Threats (APTs), has become a core concern for various industries and government agencies. APT attacks are typically launched by highly specialized groups aiming to steal sensitive information, conduct espionage, or disrupt critical infrastructure. These attacks are highly organized, targeted, technically sophisticated, and possess long-term stealth capabilities. However, with the increasing complexity of APT attacks and the diversification of threat intelligence sources, different intelligence texts often exhibit significant semantic differences in describing similar attack behaviors or characteristics. Therefore, effectively and reliably determining whether different intelligence texts point to the same APT organization has become a critical challenge.

[0003] Existing methods for identifying APT groups are mainly divided into two categories: academic and industrial. Academic methods focus on semantic understanding of threat intelligence and use external knowledge bases for correlation verification; industrial methods focus on analyzing behavioral logs generated by system operation to identify organizations. However, existing methods generally suffer from problems such as a single discriminative dimension, heavy reliance on external knowledge frameworks, and difficulty in understanding the semantic polymorphism of tactical texts. Therefore, there is an urgent need to provide a solution to improve upon these issues. Summary of the Invention

[0004] The purpose of this invention is to provide a method for determining the homology of APT organizations based on threat intelligence analysis, which can improve the problems of existing methods for determining the homology of APT organizations, such as the single discrimination dimension, high dependence on external knowledge frameworks, and difficulty in understanding the semantic polymorphism of tactical texts.

[0005] This invention provides a method for determining the homology of APT organizations based on threat intelligence analysis, comprising:

[0006] Extract tactical action text, campaign activity text, and target description text from threat intelligence;

[0007] A tactical tag library is constructed, and a semantic encoding model is used to identify and match the tactical behavior text with the tactical tag library. The identification and matching process is optimized based on reinforcement learning to obtain a set of tactical tags, and the tactical similarity of the set of tactical tags is calculated.

[0008] The campaign similarity of the campaign text is calculated based on the attack phase sequence dimension, infrastructure feature dimension, and tactical and technical procedure dimension of APT attacks.

[0009] Based on a pre-trained multilingual model, the target description text is decoupled into target industry dimension, geographic region dimension, and organization type dimension. The alignment degree of each dimension is calculated and weighted and fused to obtain the target similarity.

[0010] The tactical similarity, campaign similarity, and target similarity are weighted and fused to obtain a similarity index; the homogeneity of threat intelligence is determined based on the similarity index.

[0011] This invention provides a method for determining the homology of APT organizations based on threat intelligence analysis. By extracting tactical behavior text, campaign activity text, and target description text from threat intelligence, the similarity of the three types of fragments is calculated respectively. Finally, a weighted fusion is performed to obtain a similarity index, thereby achieving a multi-dimensional determination of whether threat intelligence belongs to the same APT organization.

[0012] Optionally, when constructing the tactical tag library, the following steps are included: condensing the tactical phases of an APT attack into reconnaissance, initial access, persistence, lateral movement, privilege escalation, and objective achievement, and associating tactical intent tags with each tactical phase to obtain tactical tags, and constructing a tactical tag library based on the tactical tags.

[0013] Optionally, when using a semantic encoding model to identify and match the tactical behavior text with the tactical tag library, the process includes: constructing the semantic encoding model based on the RoBERTa-wwm-ext model and combining it with a multi-head attention mechanism; performing word segmentation preprocessing on the tactical behavior text using a WordPiece word segmenter and injecting positional encoding; and matching the processed tactical behavior text with the tactical tag library based on the semantic encoding model.

[0014] Optionally, when optimizing the identification and matching process based on reinforcement learning to obtain the tactical label set, the process includes:

[0015] A classification model is constructed based on the actor-critic architecture in reinforcement learning. A semantic encoding model is used to encode the tactical behavior text to generate semantic vectors, which are then used as state inputs into the classification model.

[0016] The tactical tag probability distribution in the state is obtained based on the policy network, the long-term value of the tactical tag probability distribution in the state is evaluated based on the value network, and the tactical tag probability distribution is updated based on the long-term value.

[0017] A reward function is constructed by integrating the instantaneous accuracy reward of the tactical tag probability distribution with the continuous reward of the tactical phase. The update process is optimized based on the reward function, the policy gradient algorithm and the hybrid loss function, and the tactical tag set is output.

[0018] Optionally, when calculating the tactical similarity of the set of tactical tags, the method includes: calculating the tactical similarity based on the Jaccard similarity coefficient and a phased veto mechanism, wherein the phased veto mechanism is to forcibly set the tactical similarity to 0 if two pieces of threat intelligence have at least four different tactical tags.

[0019] Optionally, when calculating the campaign similarity of the campaign activity text based on the attack phase sequence dimension, infrastructure feature dimension, and tactical and technical procedure dimension of an APT attack, the method includes: vectorizing the infrastructure feature dimension and the tactical and technical procedure dimension to obtain a comprehensive vector, and calculating the cosine similarity; calculating the attack similarity of the attack phase sequence dimension; and performing a weighted fusion of the cosine similarity and the attack similarity to obtain the campaign similarity.

[0020] Optionally, obtaining target similarity includes: decoupling the target description text into target industry dimension, geographic region dimension, and organization type dimension based on the pre-trained multilingual model paraphrase-multilingual-mpnet-base-v2, independently encoding semantic vectors for each dimension, calculating cosine similarity, calculating the alignment degree of each dimension based on cosine similarity, and weightedly fusing the alignment degrees of each dimension to obtain the target similarity.

[0021] Optionally, when weighted and fused to obtain a similarity index from the tactical similarity, the campaign similarity, and the target similarity, the method includes: assigning weights to the tactical similarity, the campaign similarity, and the target similarity respectively, and fusing them to obtain a similarity index, wherein the target similarity is set to have the highest weight.

[0022] Optionally, when determining the homology of threat intelligence based on the similarity index, if the similarity index exceeds a preset threshold, then the two threat intelligences are determined to be from the same source.

[0023] Optionally, the target industry dimension includes energy and finance; the geographical region dimension includes countries and cities; and the organization type dimension includes government agencies and military enterprises. Attached Figure Description

[0024] Figure 1 This is a flowchart illustrating a method for determining the homology of APT organizations based on threat intelligence analysis, provided as an embodiment of the present invention. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Unless otherwise defined, the technical or scientific terms used herein should have the ordinary meaning understood by those skilled in the art to which this invention pertains.

[0026] See Figure 1 This invention provides a method for determining the homology of APT organizations based on threat intelligence analysis, comprising the following steps:

[0027] S1. Extract tactical action text, campaign activity text, and target description text from threat intelligence;

[0028] S2. Construct a tactical tag library, use a semantic encoding model to identify and match tactical behavior texts with the tactical tag library, optimize the identification and matching process based on reinforcement learning, obtain a set of tactical tags, and calculate the tactical similarity of the tactical tag set.

[0029] S3. Calculate campaign similarity of campaign texts based on the attack phase sequence dimension, infrastructure feature dimension, and tactical and technical procedure dimension of APT attacks.

[0030] S4. Based on the pre-trained multilingual model, the target description text is decoupled into the target industry dimension, geographical region dimension, and organization type dimension. The alignment degree of each dimension is calculated and weighted and fused to obtain the target similarity.

[0031] S5. Weighted fusion of tactical similarity, campaign similarity, and target similarity to obtain a similarity index; determine the homogeneity of threat intelligence based on the similarity index.

[0032] In fact, the homology determination method provided by this invention first extracts tactical behavior text, campaign activity text, and target description text from threat intelligence. It then constructs a tactical tag library and uses a semantic encoding model to identify and match the tactical behavior text with the tactical tag library. Furthermore, it optimizes the identification and matching process based on reinforcement learning, thus obtaining a set of tactical tags and calculating their tactical similarity, achieving optimized processing of the semantic polymorphism of tactical behavior text. Based on the attack phase sequence dimension, infrastructure feature dimension, and tactical technical procedure dimension of APT attacks, it calculates campaign similarity. Based on a pre-trained multilingual model, it decouples the target description text into target industry dimension, geographical region dimension, and organization type dimension, calculates the alignment degree of each dimension, and weights and fuses them to obtain target similarity. Finally, it weights and fuses the three similarities to obtain a similarity index. Therefore, it can complete the homology determination of APT organizations in threat intelligence, achieving multi-dimensional determination of APT organization homology, significantly reducing dependence on external knowledge bases, and effectively understanding the semantic polymorphism of tactical text.

[0033] In some embodiments, in step S1, based on the input original threat intelligence text content, the system manually extracts comparable tactical behavior text, campaign text, and target description text from two threat intelligence documents by comprehensively analyzing the semantic features of the three complementary dimensions of tactics (TTPs), campaign activities, and targets.

[0034] In some embodiments, when constructing the tactical tag library in step S2, this method, based on the structured principle of abstracting the essence of tactical intent, highly condenses the complex attack process of APT attacks into six key tactical stages: reconnaissance, initial access, persistence, lateral movement, extraction, and target achievement. Around each stage, 8-10 tactical intent tags representing high-frequency attack techniques are associated to generate tactical tags (e.g., "Initial Access - Supply Chain Contamination," "Lateral Movement - Credential Relay"), and a tactical tag library is constructed based on these tactical tags.

[0035] This method effectively aggregates fragmented technical points within the ATT&CK framework, significantly reducing the total number of tags by approximately 87%. This compression is not due to capability reduction, but rather because each tactical tag, acting as a semantic clustering center, naturally covers multiple specific technical implementations with the same tactical intent (e.g., using Mimikatz, LaZagne, or different mechanisms to extract credentials all fall under the "credential extraction" intent). This process actively filters out a large amount of technical noise that lacks operational differentiation from a defensive perspective (such as distinguishing specific variations of planned tasks), thereby significantly reducing the computational complexity of the detection engine and the number of independent detection rules that need to be processed. Simultaneously, the detection focus shifts from subtle differences in technical implementation to more fundamental and stable tactical intent tags, effectively suppressing false positives based on non-critical differences and significantly reducing the overall false positive rate.

[0036] First, the lightweight tactical tag library not only optimizes real-time detection but also significantly improves the efficiency of in-depth attack event analysis. When tracing attack chains, analysts are faced with six structured core paths (i.e., six key tactical stages), rather than hundreds of scattered and disordered atomic technical points, allowing the analysis target to be highly focused on key attack stages and their intent tags. This greatly improves the efficiency of incident response and threat hunting, and significantly shortens the overall analysis time of the attack chain. Second, the tag library is designed around tactical stages and tactical intent, rather than being bound to specific technical numbers, enabling it to respond agilely to new threats. For example, when dealing with new and complex threats such as SolarWinds supply chain attacks, even if the attack uses an unprecedented combination of specific technologies, its core behavioral logic (such as malicious code implanting software update packages) can be quickly attributed to the existing tag "Initial Access - Supply Chain Contamination" with clear intent, enabling rapid understanding and response. In contrast, models that rely on highly granular technical numbers must wait for the release and integration of new numbers. Finally, despite the highly streamlined total number of tags, the model ensures adaptability through reserved dynamic expansion interfaces (such as tag-associated feature libraries). When a new class of techniques with truly unique defensive value emerges (such as AI-driven specific attacks), this knowledge can be quickly incorporated to maintain the model's continued effectiveness in technological evolution.

[0037] In summary, this method achieves approximately 87% tag compression by constructing a lightweight tactical tag library based on tactical intent. Essentially, it's a process of optimizing and refining the defense model: eliminating redundant noise from technical implementation details, anchoring the core of tactical intent, and structuring attack paths. While ensuring high coverage of known and emerging threats, it comprehensively optimizes detection efficiency (reducing complexity and rules), accuracy (suppressing false positives), analysis efficiency (accelerating response and hunting), and response agility (adapting to new threats). Table 1 shows a statistical example of the six tactical stages and their corresponding tag counts in the tactical tag library.

[0038] Table 1. Statistical Examples of the Tactical Tag Library

[0039] ,

[0040] In some embodiments, when using a semantic encoding model to identify and match tactical behavior text with a tactical tag library in step S2, considering the characteristics of highly concealed technical terms and strong semantic context dependencies in tactical behavior text (e.g., "credential relay" may imply multiple tool variants), firstly, this system adopts the RoBERTa-wwm-ext architecture as the core engine for semantic understanding and integrates a multi-head attention mechanism to construct a semantic encoding model; secondly, the tactical behavior text is decomposed into a sequence of sub-words using a WordPiece segmenter (e.g., "credential relay" is decomposed into ["credential", "certificate", "relay", "relay"]), effectively adapting to the characteristics of professional terms in the cybersecurity field. Subsequently, learnable positional encoding is injected to explicitly mark the serialization logic and temporal dependencies of the attack flow in the technical description; finally, based on the semantic encoding model, the preprocessed tactical behavior text is matched with the tactical tag library. This preprocessing mechanism and the multi-head attention layer form a synergistic effect: positional encoding accurately preserves the temporal characteristics of technical behavior, and the multi-head attention layer dynamically reconstructs the implicit semantic weight distribution in the text (e.g., focusing on the core tactical intent "lateral movement" rather than secondary technical details "exploitation protocol"). Ultimately, this processing chain transforms the discrete technical representation of tactical texts into dense vectors rich in contextual semantics, providing highly discriminative feature representations for core tasks such as tactical tag classification and similarity calculation.

[0041] Specifically, to enhance the model's semantic understanding of Chinese tactical texts, the RoBERTa-wwm-ext architecture undergoes key optimizations during the pre-training phase: dynamic masking (15% masking probability) is implemented on 24,000 professional tactical terminology corpora, employing a full-word masking strategy. This forces the model to learn the complete semantic continuity of technical entities (such as "Mimikatz" and "LSASS memory injection"), rather than fragmented character combinations, significantly improving its ability to capture the boundaries and complex semantics of tactical technical entities, laying the foundation for accurate intent recognition. The essential abstraction of tactical intent requires the model to deeply analyze the contextual logical relationships in technical descriptions (e.g., determining that "using the SMB protocol to transmit NTML hashes" strongly corresponds to the "lateral movement - credential relay" label). To this end, the model embeds a 12-head parallel attention layer (Multi-Head Attention): different attention heads focus in parallel on the differentiated semantic dimensions in the technical description (such as tool fingerprints, protocol types, and behavioral purposes); in the attention output layer ( It dynamically fuses features from various dimensions, achieving multi-granular semantic focusing and simultaneously capturing the co-occurrence relationships between core tactical intentions (such as the primary dimension of "passing hash") and specific implementation details (such as the secondary dimension of "SMB protocol"), significantly improving the accuracy and robustness of intention recognition. The mathematical representation of the 12-head parallel attention layer is as follows: ,

[0042] ,

[0043] in, To query the vector matrix, The key vector matrix, It is a value vector matrix. For the number of long positions, To be The outputs of each attention head are concatenated into a matrix. To output the weight matrix, For the first One's attention, For scaling dot product attention functions, To be Projected to the The query space of the size, To be Projected to the Key space of size To be Projected to the The value space of each head.

[0044] The core challenge of APT attack detection addressed by this invention stems from the strict temporal logic constraint of the attack chain: the attack process must follow a causal sequence of reconnaissance → initial access → persistence → lateral movement → privilege escalation → target achievement. This constraint leads to: the formation of directional transition networks between tags (e.g., "lateral movement - credential relay" inevitably leads to "privilege escalation - token theft," while the reverse is rarely true); current stage identification (e.g., determining "privilege escalation") requires tracing back to previous technical means (e.g., the specific implementation of "lateral movement"), significantly reflecting the long-term dependency of decision-making; threat intelligence only labels scattered and fragmented tactical tags (e.g., isolated "spear phishing emails"), lacking complete attack chain sequence labeling, making it difficult for the model to learn stage transition patterns; redundant technical descriptions (e.g., "Mimikatz tool extracts LSASS memory credentials") obscure the core tactical intent ("credential relay"), filled with technical detail noise; and an imbalance between high-frequency tags (e.g., "initial access - spear phishing emails" accounting for well over 30%) and low-frequency tags (e.g., "persistence - COM hijacking" less than 2%), hindering the model from learning complete attack paths and identifying a few types of techniques.

[0045] The aforementioned contradictions make it difficult for traditional classification models to capture tactical-level correlations and adapt to technological variations. To address this, this invention reconstructs the tactical label identification of threat intelligence into a sequential decision-making problem under temporal constraints and introduces a reinforcement learning (RL) framework—the Actor-Critic algorithm.

[0046] In some embodiments, when optimizing the identification and matching process based on reinforcement learning to obtain the tactical label set in step S2, firstly, a classification model is constructed based on the actor-critic architecture in reinforcement learning, and the 768-dimensional semantic vector generated by encoding the tactical behavior text based on the semantic encoding model is used as the current state. The decision-making core unit in the model, the policy network (Actor), analyzes and outputs the predicted tactical label probability distribution (action). The Critic network evaluates the long-term value of the tactical tag probability distribution in the current state, providing the Actor with a direction for policy optimization. A policy gradient algorithm drives the Actor to adjust parameters along the direction of maximizing cumulative reward. Secondly, to simultaneously improve single-point identification accuracy and attack chain evolution logic awareness, this invention integrates the instantaneous accuracy reward of the currently predicted tactical tag probability distribution. ) and continuous rewards in the tactical phase ( Constructing the reward function Simultaneously, a hybrid loss function is employed to ensure training efficiency and convergence stability; finally, the tactical label set output by the model (e.g., the set obtained after analyzing two intelligence fragments) is processed. and The tactical similarity is calculated using the Jaccard Index.

[0047] Specifically, the reward function The formula is as follows:

[0048] ,

[0049] in, These are the weighting coefficients.

[0050] Specifically, the formula used in the policy gradient algorithm is as follows:

[0051] ,

[0052] in, The gradient of the policy objective function, In strategy The expected value of the generated trajectory distribution To accumulate rewards, In the state Select action The direction of the probability.

[0053] Specifically, the formula used for the hybrid loss function is as follows:

[0054] ,

[0055] in, For the comprehensive scoring results, To supervise the learning of cross-entropy loss, To reinforce the learning strategy gradient loss.

[0056] Specifically, the Jaccard similarity coefficient is used to calculate tactical similarity. The formula used is as follows:

[0057] ,

[0058] Furthermore, to mitigate misjudgments caused by common technical methods (such as port scanning, which may occur in multiple scenarios), a phased veto mechanism is introduced: if two threat intelligence reports have completely disjoint core tactical tag sets in at least four of the six tactical phases (i.e., the intersection is an empty set), then the tactical similarity is forcibly set. This mechanism significantly improves the semantic discriminative power of similarity assessment and its robustness against common technical interference, suppresses misjudgments caused by common techniques (such as port scanning), and ensures that the system only triggers high-confidence associations when the attack paths are essentially similar.

[0059] Table 2 shows a comparison of the technical effects of the actor-critic architecture solution of this invention with traditional solutions. It can be seen that the core value of this architecture compared with traditional solutions lies in: global constraint modeling, the temporal modeling capability of the Critic network ensures the global logical consistency of the six-stage attack chain; knowledge-guided exploration, the reward function is injected with stage transition rules defined by network security experts to guide the model to learn efficiently in weakly labeled scenarios; and noise immunity mechanism, the policy gradient update avoids excessive dependence on single sample labels, effectively mitigating the impact of labeling noise and long-tail distribution.

[0060] Table 2 Comparison of the technical effects of the Actor-Critic solution and its alternatives

[0061] ,

[0062] In some embodiments, when calculating the campaign similarity of campaign texts in step S3, the similarity calculation in campaign evaluation needs to cover three key dimensions. This design is rooted in the three essential characteristics of APT attacks: the tactical phase sequence reflects the tactical evolution logic (such as the directed transfer from initial access to lateral movement); infrastructure characteristics (C2 server IP / domain name, communication protocol, tool fingerprint, etc.) reveal the attacker's resource dependencies and technical preferences; and the Tactical Techniques (TTP) abstracts the essence of technical means, stripping away specific variant interference. A comprehensive vector is constructed after normalizing the infrastructure characteristic dimension and the TTP dimension. and And calculate the cosine similarity. Simultaneously, independently calculate the attack similarity at the attack phase sequence dimension. Finally, a weighted fusion calculation is performed to obtain the campaign similarity. Among these, infrastructure characteristics and tactical technical procedures are given higher weights (total weight approximately 0.6) because they have direct correlation value for attribution tracing (e.g., shared C2 domains can strongly associate with the same organization). The core advantage of this design lies in modular feature fusion: precise modeling of the inherent phase transition logic of APT attacks using tactical phase sequences, and strong identification of technical fingerprints using infrastructure characteristics and TTPs. This comprehensively improves the robustness and scalability of campaign behavior identification.

[0063] Specifically, the formula for calculating cosine similarity is as follows:

[0064] ,

[0065] in, and For vectors sum vector In the Dimensional component values.

[0066] Specifically, calculating campaign similarity The weighted formula is as follows:

[0067] ,

[0068] in, Similarity in terms of tactical and technical procedures; , and These are the weighting coefficients; typical weighting allocation is as follows: .

[0069] In some embodiments, cross-lingual semantic alignment (intelligence often contains descriptions in multiple languages ​​such as Chinese, English, Russian, and Hebrew) is a core challenge in attack target assessment when obtaining target similarity in step S4. Therefore, this invention uses a pre-trained multilingual model, paraphrase-multilingual-mpnet-base-v2, to decouple the target description text into target industry dimension, geographic region dimension, and organization type dimension. Among these, due to the highly region-oriented nature of APT attacks, geographic region similarity usually contributes the largest weight. Subsequently, semantic vectors are generated by independently encoding the text descriptions of each dimension, and the alignment degree of each dimension is calculated using cosine similarity. The weighted fusion calculation then yields the target similarity. The calculation formula is as follows:

[0070] ,

[0071] in, , and The alignment levels are calculated for the target industry dimension, geographic region dimension, and organization type dimension, respectively. , and These are the weighting coefficients; typical weighting allocation is as follows: .

[0072] Specifically, the target industry dimension includes energy and finance; the geographical region dimension includes countries and cities; and the organization type dimension includes government agencies and military enterprises.

[0073] The core advantage of pre-trained multilingual models lies in their ability to achieve near-1.0 semantic matching accuracy, even when faced with cross-linguistic heterogeneous expressions such as "Beijing Haidian District" and the Russian "PaИOHXaЙДaHЬ", ensuring the cross-linguistic discriminability of the target profile.

[0074] In some embodiments, the tactical similarity obtained from the above calculation is used in step S5. Battle similarity Similarity to target Perform weighted fusion to obtain similarity index The calculation formula is as follows:

[0075] ,

[0076] in, , and These are weighting coefficients, as ATP tissues typically strictly adhere to a target selection strategy. Set to the highest level (e.g., 0.4). and All below (e.g., 0.3 each).

[0077] In some embodiments, when determining the homology of threat intelligence based on a similarity index in step S5, if the similarity index exceeds a threshold... If the value is 0.7, then the two threat intelligence reports are determined to belong to the same APT group.

[0078] To illustrate the method for determining the homology of APT organizations based on threat intelligence analysis proposed in this invention, its technical implementation is explained through the following typical application scenarios.

[0079] During tactical dimension analysis, input threat intelligence text fragments (e.g., "Attackers deliver malicious LNK files via spear-phishing emails and use PowerShell for lateral movement within the intranet"): semantic parsing is performed, "spear-phishing emails" corresponds to the initial access phase, "LNK files" is associated with the execution phase, and "using PowerShell for lateral movement within the intranet" points to the lateral movement phase; the legality of the sequence is verified based on the logical constraints of the attack phase (e.g., "initial access → execution" is a valid transition), and high-confidence standardized tactical labels are output, such as "initial access - spear-phishing emails" and "execution - malicious shortcuts"; the generalization ability of this method is reflected in the ability to remove specific tool interference from descriptions of tool differences (e.g., "using Mimikatz to dump credentials and then execute remote commands via WMI" and "using LaZagne to extract passwords and propagate via PsExec"), accurately mapping them to core tactical labels ("privilege escalation - credential dumping" and "lateral movement - remote execution").

[0080] When linking campaign-level data, input campaign activity text (e.g., "In Q2 2023, targeting Southeast Asian energy companies, using C2 server xyz1, infiltrated via spear-phishing emails and deployed a backdoor"): Multi-dimensional analysis is performed on the attack phase sequence (e.g., reconnaissance → initial access → persistence), infrastructure characteristic identification (e.g., specific C2 server identifiers), and frequently used tactical techniques (e.g., spear-phishing emails and persistent backdoors). For correlation determination, even if different reports have temporal and spatial differences (e.g., different attack times, target countries, and C2 infrastructure), if the attack phase sequence is highly consistent (e.g., both contain [reconnaissance → initial access → target achievement]) and the target industry is the same (e.g., the energy industry), campaign-level similarity can still be calculated. This demonstrates the importance of phase sequence and target industry characteristics in campaign-level correlation judgment, significantly alleviating the correlation breakage problem caused by frequent infrastructure changes.

[0081] When processing multilingual target description text, the input target description text (e.g., the English report "Targeting government servers in somewhere" and the Chinese report "Attack a municipal data center in a certain place") is decoupled and analyzed based on the target industry dimension, geographic region dimension, and organization type dimension. Leveraging its cross-language semantic understanding capabilities, it identifies the same substantive concepts referred to in different language expressions: "government" and "government agency," "somewhere" and "certain place," and "servers" and "data center." Quantifying semantic consistency demonstrates precise matching, particularly emphasizing core features such as geographic location.

[0082] Finally, the system weighted and fused the similarity results from the three dimensions of tactics, campaigns, and objectives to obtain a similarity index. Among them, tactical similarity and objective similarity are given the primary weight, followed by campaign similarity. At the same time, a phased veto mechanism is introduced to prevent false associations caused by local behavioral similarities (such as general vulnerability scanning) or common technical means, thereby improving the rigor and reliability of the overall judgment results.

[0083] While embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations fall within the scope and spirit of the invention as set forth in the claims. Furthermore, the invention described herein may have other embodiments and can be implemented or carried out in various ways.

Claims

1. A method for determining the homology of APT organizations based on threat intelligence analysis, characterized in that, include: Extract tactical action text, campaign activity text, and target description text from threat intelligence; A tactical tag library is constructed, and a semantic encoding model is used to identify and match the tactical behavior text with the tactical tag library. The identification and matching process is optimized based on reinforcement learning to obtain a set of tactical tags, and the tactical similarity of the set of tactical tags is calculated. The campaign similarity of the campaign text is calculated based on the attack phase sequence dimension, infrastructure feature dimension, and tactical and technical procedure dimension of APT attacks. Based on a pre-trained multilingual model, the target description text is decoupled into target industry dimension, geographic region dimension, and organization type dimension. The alignment degree of each dimension is calculated and weighted and fused to obtain the target similarity. The tactical similarity, campaign similarity, and target similarity are weighted and fused to obtain a similarity index; the homogeneity of threat intelligence is determined based on the similarity index.

2. The determination method as described in claim 1, characterized in that, When constructing the tactical tag library, the following steps are taken: the tactical phases of an APT attack are condensed into reconnaissance, initial access, persistence, lateral movement, privilege escalation, and objective achievement, and tactical tags are obtained by associating tactical intent tags with each tactical phase, and a tactical tag library is constructed based on the tactical tags.

3. The determination method as described in claim 1, characterized in that, When using a semantic encoding model to identify and match the tactical behavior text with the tactical tag library, the process includes: constructing the semantic encoding model based on the RoBERTa-wwm-ext model and combining it with a multi-head attention mechanism; performing word segmentation preprocessing on the tactical behavior text using a WordPiece word segmenter and injecting positional encoding; and matching the processed tactical behavior text with the tactical tag library based on the semantic encoding model.

4. The determination method as described in claim 1, characterized in that, When obtaining the tactical label set by optimizing the recognition and matching process based on reinforcement learning, the following are included: A classification model is constructed based on the actor-critic architecture in reinforcement learning. A semantic encoding model is used to encode the tactical behavior text to generate semantic vectors, which are then used as state inputs into the classification model. The tactical tag probability distribution in the state is obtained based on the policy network, the long-term value of the tactical tag probability distribution in the state is evaluated based on the value network, and the tactical tag probability distribution is updated based on the long-term value. A reward function is constructed by integrating the instantaneous accuracy reward of the tactical tag probability distribution with the continuous reward of the tactical phase. The update process is optimized based on the reward function, the policy gradient algorithm and the hybrid loss function, and the tactical tag set is output.

5. The determination method as described in claim 1, characterized in that, Calculating the tactical similarity of the set of tactical tags includes: calculating its tactical similarity based on the Jaccard similarity coefficient and a phased veto mechanism, wherein if two pieces of threat intelligence have at least four different tactical tags, the tactical similarity is forcibly set to 0.

6. The determination method as described in claim 1, characterized in that, When calculating the campaign similarity of the campaign text based on the attack phase sequence dimension, infrastructure feature dimension, and tactical and technical procedure dimension of APT attacks, the process includes: vectorizing the infrastructure feature dimension and the tactical and technical procedure dimension to obtain a comprehensive vector, and calculating the cosine similarity; calculating the attack similarity of the attack phase sequence dimension; and weightedly fusing the cosine similarity and the attack similarity to obtain the campaign similarity.

7. The determination method as described in claim 1, characterized in that, When obtaining target similarity, the process includes: decoupling the target description text into target industry dimension, geographic region dimension and organization type dimension based on the pre-trained multilingual model paraphrase-multilingual-mpnet-base-v2, independently encoding semantic vectors for each dimension, calculating cosine similarity, calculating the alignment degree of each dimension based on cosine similarity, and weightedly fusing the alignment degree of each dimension to obtain the target similarity.

8. The determination method as described in claim 1, characterized in that, When obtaining a similarity index by weighted fusion of the tactical similarity, the campaign similarity, and the target similarity, the method includes: assigning weights to the tactical similarity, the campaign similarity, and the target similarity respectively, and fusing them to obtain a similarity index, wherein the target similarity is set with the highest weight.

9. The determination method as described in claim 1, characterized in that, When determining the homology of threat intelligence based on the similarity index, if the similarity index exceeds a preset threshold, then the two threat intelligences are determined to be from the same source.

10. The determination method as described in claim 1, characterized in that, The target industry dimension includes energy and finance; the geographical region dimension includes countries and cities; and the organization type dimension includes government agencies and military enterprises.

Images