APT attack traceability method and system based on time sequence characteristics and traceability graph sampling

Abstract

The invention provides an APT attack traceability method and system based on time sequence characteristics and traceability graph sampling, and solves the technical problems of low detection precision and poor real-time performance of an existing APT attack traceability method. The method comprises the steps of constructing an initial traceability graph; obtaining threat knowledge, analyzing conditional probabilities of different node types in the benign behavior, and supplementing the initial traceability graph according to the node types and the conditional probabilities to obtain an enhanced traceability graph; using an encoder-decoder structure to learn structural features and time sequence features in the enhanced traceability graph, predicting an edge type, comparing the edge type with an actual edge type, and minimizing a prediction error to obtain an attack traceability model; and constructing a K-order sub-graph by taking the edge to be detected as a center, and judging whether the edge to be detected is abnormal or not by the attack traceability model according to the interactive behavior type in the range of the K-order sub-graph. The method can be widely applied to the technical field of network security.

Description

Technical Field

[0001] This application belongs to the field of network security technology, and more specifically, it relates to an APT attack tracing method and system based on temporal characteristics and source graph sampling. Background Technology

[0002] Source graphs have become the most commonly used method for tracing the origins of APT attacks because they can describe the interactions between system entities, provide rich contextual information to system entities, and connect causal events separated by long periods of time. However, existing source graph-based APT attack tracing methods still have some problems.

[0003] First, conventional graph neural networks (GNNs) are unsuitable for APT attack detection due to their extremely high computational and time costs, and it is difficult to detect covert APT attacks using a single system entity. Second, the computational complexity of GNNs limits their dynamic update capabilities. Specifically, when a new system entity is added to the source graph, rerunning the embedding procedure to update the model representation incurs significant computational and time overhead, making real-time updates difficult. Furthermore, graph compression or abstraction operations performed to simplify the structure during source graph construction often inevitably lose the semantic information contained in the original data, affecting detection accuracy. Moreover, compared to the prevalent benign system activity, the number of APT attack samples available for learning and analysis is relatively scarce; this imbalanced sample problem also introduces additional difficulties to APT attack detection based on source graphs. Summary of the Invention

[0004] The purpose of this application is to provide an APT attack tracing method and system based on temporal features and source graph sampling, so as to solve the technical problems of low detection accuracy and poor real-time performance of existing APT attack tracing methods.

[0005] To achieve the above objectives, the first embodiment of this application provides an APT attack tracing method based on temporal features and source graph sampling, including: Construct an initial source graph; Acquire threat knowledge, analyze the conditional probabilities of different node types in benign behaviors, and supplement the initial source graph with node types and conditional probabilities to obtain an enhanced source graph; By using the encoder-decoder structure to learn and enhance the structural and temporal features in the source tracing graph, the edge type is predicted. The prediction error is then minimized after comparing the prediction with the actual edge type to obtain the attack source tracing model. A K-order subgraph is constructed with the edge to be tested as the center. The attack tracing model determines whether the edge to be tested is abnormal based on the interaction behavior types within the range of the K-order subgraph.

[0006] Preferably, the process of learning and enhancing structural and temporal features in the source graph includes: A graph neural network is used to compute the feature vector embedding of the interaction edges in the enhanced source graph at time t. The state of the source node and destination node of the enhanced tracing graph at time t is updated by gating loop units.

[0007] Preferably, the process of predicting edge types includes: A multilayer perceptron is used to reconstruct and predict the type of interaction behavior based on feature vector embedding. Formula for predicting interaction behavior type: ; In the formula, The type of the calculated interaction edge prediction. Embed the feature vectors of the edges. To enhance the interaction edges of the source graph at time t.

[0008] Preferably, minimizing the prediction error means minimizing the reconstruction error between the predicted edge type and the actual edge type through cross-entropy loss.

[0009] Preferably, the process of constructing a K-order subgraph centered on the edge to be tested includes: The operation nodes of the edge to be tested are connected with the interaction nodes in the enhanced source graph to form the source graph to be tested. The K-order subgraph centered on the interaction behavior and operation nodes is obtained from the source graph to obtain the K-order subgraph.

[0010] Preferably, the formula for sampling the K-order subgraph is: ; In the formula, For a K-order subgraph, for For a subgraph of order k-1, For operation nodes, This is the source map to be tested.

[0011] Preferably, the interaction nodes of the enhanced feature map are connected to the operation nodes of the interaction behavior to be tested to obtain the source map to be tested.

[0012] Preferably, the process of constructing the initial source map includes: Analyze the interaction records between entities in the system entity interaction log, and construct a system-wide traceability diagram based on the interaction records; The feature vector embeddings of nodes and edges in the initial traceability graph of the entire system are initialized and then denoised to obtain the initial traceability graph.

[0013] Preferably, the process of supplementing the initial source graph with node types and conditional probabilities to obtain an enhanced source graph includes: Recorded in benign behavior, at any node When it is the head node, the operation edge is... probability ,as well as When a type node is used as the tail node, the operation is as follows: probability ; For process nodes and file nodes in the initial source graph In its type node is At that time, with probability Generate operation edges With tail node ; For process nodes and file nodes in the initial source graph In its type node is At that time, with probability Generate operation edges With head node ; Node and As the head node and tail node, with probability and Recursively generate operation edges By connecting the head and tail nodes, and continuing until a threshold is reached, an enhanced source graph is obtained.

[0014] The second embodiment of this application provides an APT attack tracing system based on temporal features and source graph sampling, including: The initial source graph construction module is used to construct the initial source graph; The threat activity sample supplementation module is used to acquire threat knowledge, analyze the conditional probability of different node types in benign behavior, and supplement the initial source map to obtain an enhanced source map based on the node type and conditional probability. The source graph learning representation module is used to learn and enhance the structural and temporal features of the source graph using the encoder-decoder structure, predict the edge type, and minimize the prediction error after comparing it with the actual edge type to obtain the attack source tracing model. The anomaly attack detection and analysis module is used to construct a K-order subgraph centered on the edge to be tested. The attack tracing model determines whether the edge to be tested is abnormal based on the interaction behavior types within the range of the K-order subgraph.

[0015] The beneficial effects of this application are as follows: This application proposes an APT attack tracing method and system based on temporal features and source graph sampling. First, before the attack tracing model is learned, an initial source graph is constructed, and threat knowledge is extracted at the same time. Based on the conditional probability of different node types in benign behavior, the initial source graph is supplemented, thereby optimizing the structure of the initial source graph and enabling the constructed initial source graph to achieve a balance between efficiency and accuracy when detecting attack behavior. Next, during the training process of the attack tracing model, the attack tracing model is trained based on the structural and temporal features of the enhanced tracing graph. This enables the model to learn the connections between entities and other entities in the tracing graph, as well as the event sequences and evolutionary relationships involving the entities, resulting in a more accurate attack tracing model.

[0016] Finally, during the attack tracing model detection process, K-order subgraph sampling is performed on the edge to be tested to centrally reflect the key contextual information of the system entity, preventing the huge time consumption caused by repeatedly re-running the overall embedding of the tracing graph, saving the cost of attack tracing, and improving real-time performance. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 A flowchart illustrating an APT attack tracing method based on temporal features and source graph sampling, provided as an embodiment of this application; Figure 2 A schematic diagram of the overall process of an APT attack tracing method based on temporal features and source graph sampling provided in an embodiment of this application; Figure 3 This is a structural block diagram of an APT attack tracing system based on temporal features and source graph sampling, provided as an embodiment of this application. Detailed Implementation

[0019] To make the technical problems, technical solutions, and beneficial effects to be solved by this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and are not intended to limit the scope of this application.

[0020] This application proposes an APT attack tracing method and system based on temporal features and source graph sampling. First, before learning the attack tracing model, a source graph is constructed based on system interaction logs and noise behavior is reduced. At the same time, real threat intelligence knowledge is extracted, and interaction edges and interaction nodes are added to the process and file type entities in the system interaction logs, thereby optimizing the structure of the initial source graph and enabling the constructed initial source graph to achieve a balance between efficiency and accuracy when detecting attack behavior. Next, during the training of the attack attribution model, the structural and temporal features of the interaction operations between the interaction edges and nodes are referenced. The structural features of the operation edges represent the connections between the entity and other entities in the attribution graph; the temporal features of the interaction edges represent the event sequences and evolutionary relationships involving the entities. By learning the temporal and structural relationships of the attribution graph through a temporal graph network, a more accurate attack attribution model is obtained.

[0021] Finally, during the attack detection process, multi-level subgraph sampling is performed on the source graph centered on the newly added interaction edge to centrally reflect the key contextual information of system entities, preventing the huge time consumption caused by repeatedly re-running the overall embedding of the source graph and saving the cost of attack source tracing.

[0022] Please see Figure 1-2 The first embodiment of this application provides an APT attack tracing method based on temporal features and source graph sampling, comprising: S1: Construct the initial source graph.

[0023] The interaction records between entities in the system entity interaction log are parsed. Based on the interaction records, a system-wide source graph G is constructed. The feature vector embeddings of nodes (entities) and edges (interaction relationships between entities) in the system-wide source graph G are initialized, and the feature vector embeddings are denoised to obtain an initial source graph G1, so as to reduce the time and storage cost of subsequent graph learning and anomaly attack detection.

[0024] Specifically, firstly, based on the audit data (interaction records between entities) in the system entity interaction log, an edge-directed, timestamped, full-system traceability graph G is constructed.

[0025] Next, entity feature encoding mapping is performed on the nodes (entities) and edges (interactions between entities) in the entire system's source graph G to initialize feature vector embedding. Hierarchical feature hashing is used to divide the nodes or edges a in the entire system's source graph G into strings of different levels. The feature vector of each substring s in dimension i is shown in the following formula: ; In the formula, substring In dimensions eigenvectors, It is a sub-character. The position of the sub-character, where, , A hash function that maps each subcharacter to a dimension in the feature space.

[0026] Each node or edge eigenvectors with the same dimension d ; Next, the feature vector embedding is denoised, and the edges with the same feature vector between two identical nodes in the whole system source graph G are merged (redundant interactive edge merging). Finally, the feature vector of each edge between two nodes is averaged in each dimension to obtain the feature vector of the unique edge, thus forming the initial source graph. Among them, the source map Feature vectors including nodes and unique edges.

[0027] S2: Acquire threat knowledge, analyze the conditional probabilities of different node types of the head and tail nodes of benign behaviors, and supplement the initial source graph with the node types and conditional probabilities to obtain an enhanced source graph.

[0028] Automated tools are used to extract threat knowledge from network threat intelligence reports to obtain intelligence on attack behavior. By analyzing the patterns of conditional probabilities of interactions between entity pairs during normal system operation, the conditional probabilities of benign behavior can be obtained. This information is then used to supplement APT activity training samples and improve the accuracy of subsequent attack detection.

[0029] Specifically, automated tools (EXTRACATOR, TTPDrill, etc.) are used to extract threat knowledge query graphs from network threat intelligence reports to obtain threat knowledge and attack behavior intelligence. Simultaneously, analysis is performed on any node within the benign behavior recorded during normal system operation. When it is the head node, the operation edge is... probability ,as well as When a type node is used as the tail node, the operation is as follows: probability .

[0030] For the process nodes and file nodes in the initial source graph G1 In its type node is At that time, with probability Generate operation edges With tail node ; For the process nodes and file nodes in the initial source graph G1 In its type node is At that time, with probability Generate operation edges With head node .

[0031] Node and As the head node and tail node, with probability and Recursively generate operation edges By connecting the head and tail nodes, and continuing until a threshold is reached, an enhanced source graph is obtained. This is used to supplement the training samples for APT activities and enhance the edge detection of malicious operations. There are no restrictions on the threshold setting here; you can set it as needed.

[0032] S3: Utilize the encoder-decoder structure to learn the structural and temporal features provided by the interactive operations in the enhanced source graph G2, predict the edge type, compare it with the actual edge type, adjust the internal parameters of the encoder-decoder structure to minimize the prediction error, and obtain the attack source tracing model.

[0033] By utilizing the encoder-decoder structure to learn the contextual and structural relationship information provided by each dynamic interaction of nodes in the enhanced source graph G2, edge types are predicted. By comparing the predicted edge types with the actual edge types, the internal parameters of the encoder-decoder structure are adjusted to minimize the prediction error and reduce the difference between the edge types predicted by the neural network and the actual operation types. This process is used to train the encoder-decoder structure and obtain the attack source tracing model.

[0034] Specifically, regarding enhancing the source map G2 in Momentary interaction edge The encoder uses a graph neural network to compute the feature vector embeddings of its edges. .in, For the edge The nearest neighbor graph in The state at any given moment, This represents the interaction time of the currently computed embedded edge.

[0035] Next, the state of the interaction source node in the enhanced source graph G2 at time t is updated through a gated loop unit. ,in, This is the updated source node state. For gated loop unit, This represents the state of the source node at the moment before the interaction occurred. For the interaction edges; the state of the interaction destination node in the enhanced source graph G2 at time t is updated through a gated cyclic unit. ,in, The updated state of the destination node. This represents the node state at the previous time step.

[0036] Furthermore, the decoder employs a multilayer perceptron (MLP) to reconstruct and predict the type of interactive behavior based on the feature vector embedded from the encoder output.

[0037] ; In the formula, The type of the calculated interaction edge prediction. Embed the feature vectors of the edges.

[0038] Finally, the edge type is minimized using cross-entropy loss. With actual edge type Reconstruction error between By minimizing this prediction error to update the internal parameters of the encoder-decoder structure, the updated encoder-decoder structure can more accurately predict the type of edges, thus obtaining the attack tracing model.

[0039] S4: Construct a K-order subgraph centered on the edge to be tested. The attack tracing model determines whether the edge to be tested is abnormal based on the interaction behavior types within the range of the K-order subgraph.

[0040] Centered on the structural and temporal features of the edge to be tested, source graph subgraph sampling is performed. By using the attack source tracing model and the feature vector of the unique edge, fast and efficient interaction behavior type classification and abnormal alarm analysis are achieved.

[0041] Specifically, for a new system interaction behavior (edge ​​to be tested), the operation node Enhanced source map The internal interactive nodes are connected to form the source graph to be tested. From the source map to be tested Obtain interactive behaviors and operation nodes First-order subgraph sampling centered on In the formula, For a first-order subgraph, For the neighboring nodes of the operating node.

[0042] Iterative computation with interactive behavior and operation nodes Sampling of the k-th order subgraph centered on In the formula, For a K-order subgraph, for For a subgraph of order k-1, For operation nodes, Source map to be tested .

[0043] Finally, the interaction behavior type is calculated within the acquired k-order subgraph using the behavior detection model, and the source graph learning model is updated using false positive samples.

[0044] Please see Figure 3 The second embodiment of this application provides an APT attack tracing method based on temporal features and source graph sampling, comprising: The initial source map construction module is used to construct the initial source map through entity feature mapping and redundant interactive edge noise reduction.

[0045] The threat activity sample supplementation module is used to acquire threat knowledge from attack behavior intelligence, analyze the conditional probability of different node types in benign behavior, and enhance the edge of malicious operations based on node type and conditional probability to supplement the initial source map and obtain an enhanced source map.

[0046] The source graph learning representation module is used to learn and enhance the structural and temporal features of the source graph using the encoder-decoder structure, calculate edge embeddings, predict edge types, compare them with the actual observed edge types, and then reconstruct to minimize the prediction error, thus obtaining the attack source tracing model.

[0047] The abnormal attack detection and analysis module is used to construct a K-order subgraph centered on the edge to be tested. The attack tracing model determines whether the edge to be tested is abnormal based on the interaction behavior types within the range of the K-order subgraph.

[0048] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0049] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method for tracing the source of APT attacks based on temporal features and source graph sampling, characterized in that, include: Construct an initial source graph; Acquire threat knowledge, analyze the conditional probabilities of different node types in benign behaviors, and supplement the initial source graph with the node types and conditional probabilities to obtain an enhanced source graph; By using an encoder-decoder structure to learn the structural and temporal features of the enhanced source tracing graph, the edge type is predicted. After comparing the prediction error with the actual edge type, the attack source tracing model is obtained. A K-order subgraph is constructed with the edge to be tested as the center. The attack tracing model determines whether the edge to be tested is abnormal based on the interaction behavior types within the range of the K-order subgraph.

2. The APT attack tracing method based on temporal features and source graph sampling as described in claim 1, characterized in that, The process of learning the structural and temporal features in the enhanced source graph includes: A graph neural network is used to calculate the feature vector embedding of the interactive edges of the enhanced source graph at time t; The state of the enhanced tracing graph interaction source node and interaction destination node at time t is updated by the gated loop unit.

3. The APT attack tracing method based on temporal features and source graph sampling as described in claim 2, characterized in that, The process of predicting edge types includes: The interaction behavior type is predicted by reconstructing the feature vector embedding using a multilayer perceptron. The formula for predicting the type of interaction behavior is: ； In the formula, The type of the calculated interaction edge prediction. Embed the feature vectors of the edges. To enhance the interaction edges of the source graph at time t.

4. The APT attack tracing method based on temporal features and source graph sampling as described in claim 1, characterized in that, Minimizing the prediction error refers to minimizing the reconstruction error between the predicted edge type and the actual edge type through cross-entropy loss.

5. The APT attack tracing method based on temporal features and source graph sampling as described in claim 1, characterized in that, The process of constructing a K-order subgraph centered on the edge to be tested includes: The operation node of the edge to be tested is connected with the interaction node in the enhanced tracing graph to form the tracing graph to be tested. The K-order subgraph is obtained by sampling the K-order subgraph centered on the interaction behavior and the operation node from the tracing graph.

6. The APT attack tracing method based on temporal features and source graph sampling as described in claim 5, characterized in that, The formula for sampling the K-order subgraph is as follows: ； In the formula, For a K-order subgraph, for For a subgraph of order k-1, For operation nodes, This is the source map to be tested.

7. The APT attack tracing method based on temporal features and source graph sampling as described in claim 1, characterized in that, The interaction nodes of the enhanced feature map are connected to the operation nodes of the interaction behavior to be tested to obtain the source map to be tested.

8. The APT attack tracing method based on temporal features and source graph sampling as described in claim 1, characterized in that, The process of constructing the initial source graph includes: Analyze the interaction records between entities in the system entity interaction log, and construct a full system traceability diagram based on the interaction records; The feature vector embeddings of nodes and edges in the system-wide source map are initialized and then denoised to obtain the initial source map.

9. The APT attack tracing method based on temporal features and source graph sampling as described in claim 1, characterized in that, The process of supplementing the initial source graph with the node type and the conditional probability to obtain the enhanced source graph includes: Recorded in benign behavior, at any node When it is the head node, the operation edge is... probability ,as well as When a type node is used as the tail node, the operation is as follows: probability ; For the process nodes and file nodes in the initial source graph In its type node is At that time, with probability Generate operation edges With tail node ; For the process nodes and file nodes in the initial source graph In its type node is At that time, with probability Generate operation edges With head node ; Node and As the head node and tail node, with probability and Recursively generate operation edges The enhanced source map is obtained by connecting the tail and head nodes until a threshold is reached.

10. An APT attack tracing system based on temporal features and source graph sampling, characterized in that, An APT attack tracing method based on temporal features and source graph sampling, as described in any one of claims 1-9, includes: The initial source graph construction module is used to construct the initial source graph; The threat activity sample supplementation module is used to acquire threat knowledge, analyze the conditional probabilities of different node types in benign behavior, and supplement the initial source map to obtain an enhanced source map based on the node types and the conditional probabilities. The source graph learning representation module is used to learn the structural and temporal features of the enhanced source graph using the encoder-decoder structure, predict the edge type, and minimize the prediction error after comparing it with the actual edge type to obtain the attack source tracing model. An anomaly attack detection and analysis module is used to construct a K-order subgraph centered on the edge to be tested. The attack tracing model determines whether the edge to be tested is abnormal based on the interaction behavior types within the range of the K-order subgraph.

Images