Chain attack structure mining method and system based on alarm graph community division and related device

Abstract

The invention provides a chain attack structure mining method and system based on alarm graph community division and a related device. The method comprises the following steps: step 1, constructing an alarm association graph based on an obtained network alarm log; step 2, performing clustering analysis on the obtained alarm association diagram to obtain an alarm community set; 3, constructing an initial chain attack structure based on the alarm community set; step 4, performing time sequence verification on the initial chain type attack structure to obtain a final chain type attack structure; according to the method, the hidden and multi-step chain attack topological structure can be accurately discovered, the complexity of security analysis is greatly reduced, and the advanced threat discovery capability is improved.

Description

Technical Field

[0001] This invention belongs to the field of network security alarm analysis, and specifically relates to a method, system and related device for mining chain attack structures based on alarm graph community segmentation. Background Technology

[0002] With the deepening development of network informatization, network attack methods are becoming increasingly complex and covert. Modern network attacks, especially advanced persistent threats (APTs), are often no longer single, isolated events, but rather exhibit a multi-stage, multi-step chain-like characteristic. Attackers typically first compromise a relatively weakly defended edge node (such as a web server), and then use this as a springboard to gradually move laterally and penetrate into the core assets within the network.

[0003] To address these threats, modern network environments deploy a large number of security devices, such as Intrusion Detection Systems (IDS) and firewalls. These devices generate massive amounts of alert logs, but they also bring three major challenges: (1) Alarm storm problem: The massive amount of alarm data, most of which are false alarms or low-risk events, seriously interferes with the vision of security analysts, causing real high-risk attack signals to be submerged.

[0004] (2) Broken attack chain: The alerts generated by each step of a chain attack are dispersed in time and space, distributed across different log sources, and appear as independent alert events. Existing analysis methods struggle to automatically link these fragmented alerts together to reconstruct the complete attack path.

[0005] (3) High analysis cost: Relying on manual screening and correlation analysis of massive alarms is not only inefficient, but also requires a high level of experience and ability from the analysts, making it difficult to achieve large-scale and timely threat response.

[0006] Although some studies have attempted to associate alarms using graph models, most of them directly perform path searches on the original, massive alarm graph, which is computationally complex and results in a low signal-to-noise ratio, making it unable to effectively cope with complex alarm scenarios in real network environments. Summary of the Invention

[0007] The purpose of this invention is to provide a method, system and related device for mining chain attack structures based on alarm graph community division, which solves the defects of existing alarm association methods, such as high complexity and low signal-to-noise ratio.

[0008] To achieve the above objectives, the technical solution adopted by the present invention is as follows: This invention provides a method for mining chain attack structures based on alarm graph community segmentation, comprising the following steps: Step 1: Construct an alarm correlation graph based on the obtained network alarm logs; Step 2: Perform cluster analysis on the obtained alarm association graph to obtain the alarm community set; Step 3: Construct an initial chain attack structure based on the alarm community collection; Step 4: Perform timing verification on the initial chain attack structure to obtain the final chain attack structure.

[0009] Preferably, an alarm correlation graph is constructed based on the obtained network alarm logs. The specific method is as follows: Standardize and parse the network alarm logs generated by at least one network security device within a specified time period to obtain the parsed alarm data; An alarm correlation graph is constructed based on the parsed alarm data.

[0010] Preferably, a community discovery algorithm is used to perform cluster analysis on the obtained alarm association graph to obtain an alarm community set.

[0011] Preferably, an initial chain attack structure is constructed based on the alarm community set. The specific method is as follows: Determine whether there is a bridging node in each community pair in the alarm community set. If there is a bridging node, construct the corresponding community pair into an initial attack chain fragment. An iterative method is used to connect each initial attack chain fragment to any alarm community in the alarm community set that has not yet been used by the initial attack chain fragment, thus obtaining the initial chain attack structure.

[0012] Preferably, the specific method for determining whether a community has a bridging node is that the condition for designating a node as a bridging node is: The node is in one of the alerting communities in the community pair and is the destination node of at least one edge; The node is in another alerting community within the community pair and is the source node of at least one edge.

[0013] Preferably, an iterative method is used to connect each obtained initial attack chain fragment with any alarm community in the alarm community set that has not yet been used by the initial attack chain fragment, to obtain the initial chain attack structure. Specifically, the method is as follows: Determine whether there is a bridging node between the alarm community placed at the end of each initial attack chain segment and any alarm community in the alarm community set that is not used by that initial attack chain segment, where: If a bridging node exists, the corresponding other alarm communities are added to the end of the initial attack chain segment for connection. All initial attack chain segments are traversed until there is no bridging node between any initial attack chain segment and any alarm community in the alarm community set that is not used by the initial attack chain segment, thus obtaining the initial chain attack structure.

[0014] Preferably, the initial chain attack structure is subjected to timing verification to obtain the final chain attack structure. The specific method is as follows: Calculate the average timestamp of each alerting community in each initial chain attack structure; If the average timestamps in each initial chain attack structure satisfy a temporally increasing relationship, then the initial chain attack structure is the final chain attack structure.

[0015] Secondly, the present invention provides a chain attack structure mining system based on alarm graph community segmentation, comprising: The correlation graph construction unit is used to construct an alarm correlation graph based on the obtained network alarm logs; The community set acquisition unit is used to perform cluster analysis on the obtained alarm correlation graph to obtain the alarm community set; The chain attack acquisition unit is used to construct an initial chain attack structure based on the alarm community set; the initial chain attack structure is time-series verified to obtain the final chain attack structure.

[0016] Thirdly, the present invention provides an electronic device including a processor and a memory, wherein the memory stores computer instructions, and when the computer instructions are executed by the processor, the electronic device performs the method described thereon.

[0017] Fourthly, the present invention provides a computer program product, the computer program product including computer-executable instructions, which, when executed, implement the method described.

[0018] Compared with the prior art, the beneficial effects of the present invention are: This invention provides a method for mining chain attack structures based on alarm graph community segmentation. It constructs an alarm association graph from massive network alarm logs; applies a community discovery algorithm to cluster the alarm association graph, generating a set of alarm communities representing security events; and then, by searching for bridging nodes acting as stepping stones and verifying temporal relationships among these alarm community sets, it mines chain attack structures formed by connecting multiple alarm communities. This invention employs a "clustering first, then searching" strategy, effectively separating real attack activity aggregates from massive amounts of irrelevant alarms, and accurately discovering hidden, multi-step chain attack topologies, greatly reducing the complexity of security analysis and improving the ability to detect advanced threats. Attached Figure Description

[0019] Figure 1 This is an overall flowchart of the chain attack structure mining method of the present invention; Figure 2 This is the original topology diagram for the alarm log association graph; Figure 3 The results of cluster analysis of alarm log association graphs; Figure 4 The results of mining the alarm log association graph chain structure. Detailed Implementation

[0020] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0021] Example 1 This embodiment provides a method for mining chain attack structures based on alarm graph community segmentation, which includes the following steps: Step 1: Construct an alarm correlation graph based on the obtained network alarm logs; Step 2: Perform cluster analysis on the obtained alarm association graph to obtain the alarm community set; Step 3: Construct an initial chain attack structure based on the alarm community collection; Step 4: Perform timing verification on the initial chain attack structure to obtain the final chain attack structure.

[0022] Example 2 Figure 1 This is an overall flowchart of the chain attack structure mining method based on alarm graph community segmentation proposed in this embodiment, which shows the basic framework of this method for chain attack mining in the industrial Internet scenario.

[0023] Specifically, this embodiment provides a chain attack structure mining method based on alarm graph community segmentation, which includes the following steps: Step 1: Construct an alarm correlation graph This embodiment first obtains a set of network alarm logs generated by one or more network security devices within a specified time period. These logs are then standardized and parsed to extract key fields for each alarm. These key fields include at least: alarm timestamp, source IP address, and destination IP address.

[0024] Based on the parsed alarm data, a directed graph, namely the alarm correlation graph, is constructed. As attached Figure 2 As shown, its construction rules are as follows: Node set Iterate through all alarm logs and abstract each unique IP address appearing in them as a node in a graph. The final set of nodes This represents all network entities involved in the alerting activity.

[0025] edge set Iterate through each alarm log entry, and based on its source IP address (sip) and destination IP address (dip), create a directed edge in the graph from node sip to node dip. Each edge It can carry attribute information such as the timestamp of the original alarm.

[0026] After this step is completed, the discrete alarm logs are transformed into a graph structure that reflects the global alarm topology, laying the foundation for subsequent structured analysis.

[0027] Step 2: Cluster Analysis Since the original alarm association graph is usually large in scale and has complex connections, this embodiment uses a community discovery algorithm to perform cluster analysis on the graph.

[0028] The Louvain algorithm, which exhibits low complexity and good performance when processing large-scale networks, is preferred. This algorithm maximizes the modularity of the network and integrates the entire alarm correlation graph. Divided into an alert community collection As attached Figure 3 As shown, each alert community It is a subgraph where the nodes and edges inside are more tightly connected than their connections to the outside. In business terms, an alert community represents a security incident or activity, such as a concentrated scanning activity or a persistent attack targeting a specific objective.

[0029] This step achieves the first effective noise reduction and aggregation of massive alerts, shifting the focus of analysis from tens of thousands of individual alerts to a much smaller community of alerts with clear event meaning.

[0030] Step 3: Construct the initial attack chain fragment This step aims to gather information from the alerting community. In the study, the most basic unit constituting a chain attack was discovered, namely, an attack fragment consisting of two alerting communities.

[0031] This method systematically traverses the alarm community set. All communities ,in For each community pair, this method searches for the existence of a bridging node. A node is defined as a bridge node only if both of the following conditions are met: This node is in the alert community. In this context, a node is the destination node of at least one edge.

[0032] This node is in the alert community. In this context, is the source node of at least one edge.

[0033] If such a bridging node is found, it means that there exists a connection from the alerting community. The events represented by the alert community The potential attack flow of the event it represents. At this point, the community's response... Construct an initial attack chain fragment and store it in a temporary attack chain fragment set.

[0034] Step 4: Iterative Expansion of the Initial Attack Chain The purpose of this step is to gradually expand the initial attack chain fragment of length 2 discovered in the previous step into a complete attack chain that may contain more steps.

[0035] This method expands the chain iteratively. In each iteration, the system traverses all current attack chain fragments. And try to integrate it with the alerting community. Any alerting community that has not yet been used by this initial attack chain fragment Establish a connection.

[0036] The connection conditions are similar to those in step 3: determine the end of the chain and alert the community. With any of the alert communities Does a bridging node exist between them? If so, then... Append to the end of the chain to expand it to .

[0037] This iterative process continues until no attack chain fragment can be further extended. Through this step, multiple initial attack chain fragments may be connected into a longer chain attack structure.

[0038] Step 5: Timing Verification This step involves a final logical verification of all constructed chain attack structures to ensure their temporal validity. Since attack actions logically have a sequential order, for each discovered chain attack structure, chain = This embodiment verifies its timing monotonicity. The specific method is as follows: For any pair of adjacent alert communities in a chain attack structure (in ), calculate the community separately and The average timestamp of all alarms is denoted as and .

[0039] Determine whether a strict increasing relationship is satisfied, i.e. .

[0040] A chain is considered a valid, logically consistent chain attack structure and is output as the final result only when all adjacent communities in a chain satisfy this timing condition. Any chain that does not meet this condition will be considered an illogical pseudo-chain and filtered out. The final mined chain attack structure is as follows: Figure 4 As shown.

[0041] Chain attack structures reveal the suspicious attack processes that pose potential risks in current network scenarios, providing a foundation for in-depth investigation of hidden attack behaviors submerged under massive false alarms.

[0042] Example 3 This embodiment provides a chain attack structure mining system based on alarm graph community segmentation, including: The correlation graph construction unit is used to construct an alarm correlation graph based on the obtained network alarm logs; The community set acquisition unit is used to perform cluster analysis on the obtained alarm correlation graph to obtain the alarm community set; The chain attack acquisition unit is used to construct an initial chain attack structure based on the alarm community set; the initial chain attack structure is time-series verified to obtain the final chain attack structure.

[0043] Example 4 This embodiment also provides a computing device. The computing device includes a bus, a processor, a memory, and a communication interface. The processor, memory, and communication interface communicate with each other via the bus. The computing device can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memory in the computing device.

[0044] A bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, a bus can include a path for transmitting information between various components of a computing device (e.g., memory, processor, communication interfaces).

[0045] The processor may include any one or more of the following: central processing unit (CPU), graphics processing unit (GPU), tensor processing unit (TPU), application specific integrated circuit (ASIC), field-programmable gate array (FPGA), microprocessor (MP), or digital signal processor (DSP).

[0046] The memory may include volatile memory, such as random access memory (RAM). The processor may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0047] The memory stores executable program code, which the processor executes to implement the functions of the aforementioned units, thereby achieving, for example, the method described in Embodiment 1. That is, the memory may store instructions for the methods and functions relating to the computing device in any of the above embodiments.

[0048] The communication interface uses transceiver modules such as, but not limited to, network interface cards and transceivers to enable communication between computing devices and other devices or communication networks.

[0049] Example 5 This embodiment also provides a computer-readable storage medium storing computer instructions that, when executed by a processor, cause the processor to perform the methods and functions of the computing device involved in any of the above embodiments.

[0050] Generally, the various embodiments of this disclosure can be implemented in hardware or dedicated circuitry, software, logic, or any combination thereof. Some aspects can be implemented in hardware, while others can be implemented in firmware or software, which can be executed by a controller, microprocessor, or other computing device. Although various aspects of the embodiments of this disclosure are shown and described as block diagrams, flowcharts, or represented using some other illustration, it should be understood that the blocks, apparatuses, systems, techniques, or methods described herein can be implemented as, as non-limiting examples, in hardware, software, firmware, dedicated circuitry or logic, general-purpose hardware or controllers or other computing devices, or some combination thereof.

[0051] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method for mining chain attack structures based on alarm graph community segmentation, characterized in that, Includes the following steps: Step 1: Construct an alarm correlation graph based on the obtained network alarm logs; Step 2: Perform cluster analysis on the obtained alarm association graph to obtain the alarm community set; Step 3: Construct an initial chain attack structure based on the alarm community collection; Step 4: Perform timing verification on the initial chain attack structure to obtain the final chain attack structure.

2. The method for mining chain attack structures based on alarm graph community segmentation according to claim 1, characterized in that, The alarm correlation graph is constructed based on the obtained network alarm logs. The specific method is as follows: Standardize and parse the network alarm logs generated by at least one network security device within a specified time period to obtain the parsed alarm data; An alarm correlation graph is constructed based on the parsed alarm data.

3. The chain attack structure mining method based on alarm graph community segmentation according to claim 1, characterized in that, The obtained alarm association graph is clustered using a community discovery algorithm to obtain an alarm community set.

4. The method for mining chain attack structures based on alarm graph community segmentation according to claim 1, characterized in that, The initial chain attack structure is constructed based on the alarm community collection. The specific method is as follows: Determine whether there is a bridging node in each community pair in the alarm community set. If there is a bridging node, construct the corresponding community pair into an initial attack chain fragment. An iterative method is used to connect each initial attack chain fragment to any alarm community in the alarm community set that has not yet been used by the initial attack chain fragment, thus obtaining the initial chain attack structure.

5. The method for mining chain attack structures based on alarm graph community segmentation according to claim 4, characterized in that, The specific method for determining whether a community has a bridging node is as follows: the condition for a node to be considered a bridging node is: The node is in one of the alerting communities in the community pair and is the destination node of at least one edge; The node is in another alerting community within the community pair and is the source node of at least one edge.

6. The method for mining chain attack structures based on alarm graph community segmentation according to claim 4, characterized in that, An iterative method is used to connect each initial attack chain fragment to any alarm community in the alarm community set that has not yet been used by the initial attack chain fragment, thus obtaining the initial chain attack structure. The specific method is as follows: Determine whether there is a bridging node between the alarm community placed at the end of each initial attack chain segment and any alarm community in the alarm community set that is not used by that initial attack chain segment, where: If a bridging node exists, the corresponding other alarm communities are added to the end of the initial attack chain segment for connection. All initial attack chain segments are traversed until there is no bridging node between any initial attack chain segment and any alarm community in the alarm community set that is not used by the initial attack chain segment, thus obtaining the initial chain attack structure.

7. The method for mining chain attack structures based on alarm graph community segmentation according to claim 1, characterized in that, The initial chain attack structure is time-tested to obtain the final chain attack structure. The specific method is as follows: Calculate the average timestamp of each alerting community in each initial chain attack structure; If the average timestamps in each initial chain attack structure satisfy a temporally increasing relationship, then the initial chain attack structure is the final chain attack structure.

8. A chain attack structure mining system based on alarm graph community segmentation, characterized in that, include: The correlation graph construction unit is used to construct an alarm correlation graph based on the obtained network alarm logs; The community set acquisition unit is used to perform cluster analysis on the obtained alarm correlation graph to obtain the alarm community set; Chain attack acquisition unit, used to construct an initial chain attack structure based on the alarm community collection; The initial chain attack structure is time-tested to obtain the final chain attack structure.

9. An electronic device, characterized in that, It includes a processor and a memory, the memory storing computer instructions that, when executed by the processor, cause the electronic device to perform the method of any one of claims 1 to 7.

10. A computer program product, characterized in that, The computer program product includes computer-executable instructions that, when executed, implement the method of any one of claims 1 to 7.

Images