Full-link attack tracing method
By integrating logs and event data from all levels of the network system, and combining cross-platform correlation analysis and causal inference models, the problems of incomplete tracing and misjudgment in existing technologies have been solved, achieving accuracy and completeness in full-link attack tracing.
Patent Information
- Application Number
- CN202511504363.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-10-21
- Publication Date
- 2025-11-18
AI Technical Summary
Existing security tracing methods cannot comprehensively and accurately track attack behavior, especially when cross-platform data is fragmented and time attributes are ignored, resulting in incomplete tracing results and frequent misjudgments.
By integrating logs and event data from all levels of the network system, combining cross-platform correlation analysis, utilizing causal inference models and graph neural networks, a complete attack chain is constructed, and combined with malicious confidence quantification assessment, hidden attack behaviors are identified.
It enables the tracing of the entire attack chain from the source of the attack to the target, reducing false positives and false negatives, and improving the accuracy of attack feature identification and the completeness of the tracing results.
Smart Images
Figure CN120979847A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of network security, specifically a method for tracing the source of a full-link attack. Background Technology
[0002] With the development of information technology and the massive generation of data, security incidents such as data breaches, information tampering, and DDoS attacks are emerging one after another. Existing security protection methods for these incidents include: first, using deep packet inspection and AI-based identification of network traffic for security defense; and second, analyzing security events by collecting security logs to determine the attack scope and protecting business systems and data accordingly. However, the first method requires significant system resources to support traffic identification, and detection and defense have considerable lag. The second method, while protecting business systems and data, cannot completely prevent damage to business systems from security incidents, and both methods have the problem of attack attribution. To solve these problems, security incident attribution is particularly important, as it can directly reflect the attack source, attack scope, and damage caused to business systems and data, which is crucial for subsequent protection.
[0003] Existing security incident attribution methods typically analyze network traffic, starting with raw data and sequentially tracing MAC addresses, IP addresses, and applications based on network attributes to ultimately pinpoint network attacks. However, this method can only analyze IP addresses and cannot effectively trace attack behaviors. Another existing security attribution method utilizes network, host, and application-related logs to establish a security log chain. It then performs correlation analysis on each log entry based on the time of the security incident to obtain the attribution result. Due to incomplete log records, this method relies on the correlation between log events and time, resulting in incomplete attribution of attack behaviors. Existing technologies also analyze application and data call relationships and transmission paths to ensure the traceability of link data. However, this method identifies links based on data flow attributes, ignoring time attributes, which can easily lead to misjudgments. Furthermore, existing methods for attributing security incidents through causal inference identify causal events and antecedents / consequences using models to determine the attribution result. However, the causal inference model in this method is specific to a particular security event and cannot be applied across the entire chain.
[0004] Existing attribution methods mainly analyze single attack behaviors targeting networks, hosts, applications, and data, and ultimately determine the attribution result. However, the attribution result of this method is singular and inaccurate.
[0005] Therefore, improvements are urgently needed to propose a method for tracing the source of attacks. Summary of the Invention
[0006] This invention proposes a method for tracing the source of a full-link attack.
[0007] A method for tracing the source of a full-link attack includes the following: obtaining network security events by correlating network access events and data flow events, wherein the data flow events include data flow events at the application layer and network layer, as well as physical link layer events at the host layer; network security events include original security events, associated security events, associated insecure events, and analyzed insecure events, wherein the original security events include initially detected attack events, associated security events include other security events related to the original events, associated insecure events include non-attack events related to the time of the original events, such as normal business operations, and analyzed insecure events include irrelevant events to be analyzed. Tracing the source starts from the original security event and includes the following steps: S1: Based on the attack target, associate network access events and data stream events to generate an original security event, and trace the source of the original security event to obtain the target data and transmission path contained in the original security event; S2: Based on the time of the event, associate the original security event with the related non-security event, and determine whether the associated non-security event is a malicious event based on the source tracing results; S3: Associate the associated non-security events with new security events and new business events, update the tracing results, and determine whether the updated tracing results are complete. If so, obtain the complete tracing results of the original security event; otherwise, return to S2.
[0008] Preferably, the data flow events include data flow events at the application layer and network layer, as well as physical link layer events at the host layer. Specifically, this includes obtaining physical link layer events at the host layer, data flow events at the network layer, and data flow events at the application layer based on the access target of the network access event, as the data association source of the original security event.
[0009] Preferably, in step S1, network access events and data stream events are correlated according to the attack target to generate an original security event, and the original security event is traced to obtain the target data and transmission path contained in the original security event. Specifically, this includes the following: For the target data contained in the original security event, the source is traced according to its generation time order, including the following sub-steps: S11: If the previous event traced back is the target data, then store it in the queue as the data source for the new original security event, and end the tracing of the target data; S12: If the previous event traced back is an application layer event, then combine the attacker's IP address in the tracing results to obtain the associated host layer event and network layer event, and continue tracing. S13: If the previous event traced back is a network layer event, then combine the attacker's IP address in the tracing results to obtain the associated physical link layer event, and continue tracing. S14: If there are subsequent events, return to S11; otherwise, end the tracing process.
[0010] Preferably, the criteria for determining the associated security events include: when a new security event occurs, performing a correlation analysis on the new security event and the original security event based on the data flow attributes; if there is an intersection between the data flow attributes of the new security event and the original security event, it indicates that it is an associated security event.
[0011] Preferably, if a related security event is obtained, new security events and non-security events are further associated based on the tracing results in S3; if no related security event is obtained, new security events and non-security events are further associated based on the tracing results in S2. If a new security event is obtained, return to S1 to continue tracing; if no new security event is obtained, determine whether there is a business event on the attack chain in the tracing results. If there is, obtain the complete tracing results of the original security event; if not, return to S2.
[0012] As a preferred approach, the original security event and related non-security events are associated based on the time of the event. The source tracing results are used to determine whether the associated non-security event is a malicious event. This includes the following: associating the associated security event with new business time and non-security events based on time, and determining whether there is malicious data in the data chain of the associated event. If so, the associated event is a malicious event; otherwise, it is a non-malicious event.
[0013] As a preferred approach, the determination of malicious events includes the following: The data in the related events is marked and the data flow direction is recorded. The malicious determination of the link layer event data is made based on the source tracing results. The malicious determination includes: whether it carries a malicious label, whether the source IP of the network layer event is a malicious IP, and whether the non-security event carries a malicious mark. The above determinations are used to make a quantitative score. If the score is greater than the preset malicious threshold, it is determined that there is malicious data, and the malicious data chain is summarized with the original security event; otherwise, it returns to S2.
[0014] This invention also discloses a full-link attack tracing system, applied to the aforementioned full-link attack tracing method. The system includes a network system and a tracing system. The network system comprises a business system, an application layer, a network layer, a host layer, and a physical link layer. The tracing system includes a tracing device, an attack chain event pool, and a causal inference model. The tracing device traces the original security events and stores them in the attack chain event pool. The causal inference model constructs a causal network based on the event pool to infer the attack path.
[0015] Preferably, the functions of each layer of the network system include: The business system generates access logs and transaction data; The application layer records malicious attack techniques, vulnerability information, vulnerability exploitation tools, and attack scripts, and extracts attack features through a graph neural network attack feature extraction model; The network layer records network access events, network layer data flow events, and traffic and attack flow information; The host layer records network layer events, host layer events, and host layer physical link layer events. The physical link layer records physical link layer events from the host layer and physical link layer events from the data source; The traceability device includes: The link layer tracing module is used to obtain and trace data flow events at the host layer, network layer, and application layer based on network access events. The original security event creation module is used to create original security events based on time according to network access events and attack flow information in the tracing results. The original security event correlation module is used to perform correlation analysis between original security events and other events; The causal inference module is used to determine whether a complete attack chain exists in the attack chain event pool, and to perform causal inference on the attack chain to obtain causal relationships.
[0016] Preferably, the inference process of the causal inference model is as follows: Transform the attack chains in the attack chain event pool into directed edges of a causal network and extract the event propagation relationships; Extract several events from the attack chain and record the propagation relationship of the events based on their related events; Filter paths containing malicious nodes and mark them as attacker paths; if no malicious nodes are found, remove them from the causal network. The attacker node is established by using the attacker's path and added to the causal network; Using malicious nodes as source nodes, associate and mark directly and indirectly related attack nodes; The marked nodes are used as new paths for propagation. Paths carrying malicious marks that are transmitted during the propagation process are recorded and added to the attacker's path. The source node of the attack and the complete attack path were finally determined.
[0017] The present invention has the following beneficial effects: 1. This invention integrates logs and event data from all levels of the network system and combines them with cross-platform correlation analysis to construct a complete attack chain from the source of the attack to the target. This breaks through the limitations of traditional tracing technology on a single platform or in a partial link, solves the problem of cross-platform data discontinuity, and makes the attack path clear and traceable.
[0018] 2. This invention analyzes the correlation between non-security events and security events through time correlation, combined with quantitative assessment of malicious confidence, which can accurately identify hidden attack behaviors disguised as normal operations, and prevent attackers from evading detection by confusing normal business with attack behaviors.
[0019] 3. This invention uses a causal inference model and an attack chain event pool to sort out and verify the propagation relationship of various events. It ensures the integrity of the tracing results by judging whether the attack chain contains business events. At the same time, the attack feature extraction model based on graph neural network is integrated with security knowledge graph to improve the accuracy of attack feature identification and reduce false positives and false negatives. Attached Figure Description
[0020] Figure 1 This is a flowchart illustrating the steps of a full-link attack tracing method according to the present invention. Figure 2 This is a schematic diagram of the structure of a full-link attack tracing system according to the present invention. Detailed Implementation
[0021] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions in the embodiments of this invention will be clearly described below in conjunction with the examples.
[0022] like Figure 1 As shown, this invention proposes a method for tracing the source of a full-link attack, which includes: Step (1): Divide network security incidents into original security incidents, related security incidents, related non-security incidents, and analyzed non-security incidents, and trace the source of the original security incidents: Step (1-1): Based on the attack target, associate network access events and data flow events to generate the original security event, and trace the source of the original security event to obtain the target data and transmission path contained in the security event; Steps (1-2): Associate the original security event with the associated non-security event based on the time of the event, and determine whether the associated non-security event is a malicious event based on the source tracing results; Step (1-3): Associate the associated non-security events with the new security events and the new business events, update the tracing results, and determine whether the updated tracing results are complete. If they are, obtain the complete tracing results of the original security event; otherwise, return to step (1-2).
[0023] In step (1), the data flow events include application layer data flow events, network layer data flow events, and host layer physical link layer events. Specifically, the host layer, network layer physical link layer events, application layer data flow events, and network layer data flow events are obtained based on the access target of the network access event and used as the source of the original security event data association.
[0024] In step (1-1), the original security event is specifically obtained by: obtaining the associated data stream events and network access events based on the attack target, and obtaining the original security events within the time interval of the occurrence of the malicious original security event based on the attack target.
[0025] The specific process for step (1-1) is as follows: Step (1-1-1): Trace the source of the target data contained in the original security event according to its chronological order of occurrence. Step (1-1-1-1): If the previous event traced back is the target data, then store it and store the target data in the queue as the data source for the new original security event. The tracing of the target data ends. Step (1-1-1-2): If the previous event traced back is an application layer event, obtain the associated network layer event based on the application layer event and the attacker's IP address in the tracing result, and obtain the associated host layer event based on the attacker's IP address, target data and attacker's IP address, and continue to trace the network layer event and host layer event. Step (1-1-1-3): If the previous event traced is a network layer event, obtain the associated physical link layer event based on the network layer event and the attacker's IP address in the tracing result, and continue tracing the physical link layer event; Step (1-1-1-4): If there is a subsequent event, return to step (1-1-1-1), otherwise end the tracing.
[0026] If a new security event exists in step (1-2), the new security event and the original security event are correlated based on the data flow attributes to obtain the correlated security event. If the data flow attributes of the new security event intersect with those of the original security event, it indicates that the data flow event is a correlated security event.
[0027] The associated security events are linked to new business events or non-security events based on time, and it is determined whether there is malicious data in the data chain of the associated events. If so, the associated event is a malicious event; otherwise, it is a non-malicious event.
[0028] The method for determining whether malicious data exists in the data chain of related events is as follows: Mark the data in the related events and record the data flow direction. Based on the source tracing results, determine whether the link-layer event data carries malicious tags, whether the network-layer event source IP is a malicious IP, and whether non-security events carry malicious tags. A malicious confidence scoring formula is then introduced. A quantitative assessment was conducted, including: , , The weighting coefficients for the link layer, network layer, and non-security events are respectively ( ); This is a malicious label for link layer event data; 1 indicates that the malicious label is carried, and 0 indicates that it is not carried. This is a malicious IP identifier for network layer event source IPs; 1 indicates a malicious IP, and 0 indicates a normal IP. This is a malicious marker for non-security events; 1 indicates carrying a malicious marker, and 0 indicates not carrying one. , If a preset threshold is set, typically between 0.6 and 0.8, then malicious data is determined to exist. If malicious data is found, the malicious data chain is summarized with the original security event; otherwise, the process returns to step (1-2).
[0029] The method for updating the source tracing results in steps (1-3) is as follows: If a related security event is obtained from step (1-2), then continue to associate a new security event or a non-security event based on the tracing results; otherwise, continue to associate a new security event or a non-security event based on the tracing results in step (1-2). If a new security event is obtained, return to step (1-1) to continue tracing; otherwise, determine whether there is a business event on the attack chain in the tracing result. If so, obtain the complete tracing result of the original security event; otherwise, return to step (1-2).
[0030] This invention also provides a full-link attack tracing system, which includes: A network system includes business systems, application layer, network layer, host layer, and physical link layer; The tracing system includes a tracing device, an attack chain event pool, and a causal inference model. The tracing device is used to trace the original security events and, during the tracing process, places each traced event into the attack chain event pool. After the tracing device completes the tracing, it puts the original security events into the tracing system. After the tracing device completes the tracing, the causal inference model determines whether the security events in the attack chain event pool are complete attack chain events. Based on the security events in the attack chain event pool, it constructs a causal network and infers the paths in the causal network.
[0031] The business system is used to generate access logs and transaction data; The application layer includes application systems that record malicious attack techniques, vulnerability information, vulnerability exploitation tools, and attack scripts used by attackers. It also establishes an attack feature extraction model based on graph neural networks (GNNs) for network access events and data flow events, integrates entity relationship features from security knowledge graphs, and obtains various attack feature information.
[0032] The network layer, which includes switches, routers, and load balancers, is used to record network access events, network layer data flow events, traffic involved in the network layer, and attack flow information.
[0033] The host layer, which includes host nodes, is used to record network layer, host layer events, and host layer physical link layer events.
[0034] The physical link layer includes a data source, which is used to record host-level physical link layer events and data source physical link layer events.
[0035] The traceability device includes: The link layer tracing module is used to obtain host layer physical link layer events, network layer data flow events, and application layer data flow events based on network access events, and to trace their origins.
[0036] The original security event establishment module, which is connected to the link layer tracing module, is used to establish the original security event according to the attack occurrence time based on the attack flow information in the network access event and tracing results.
[0037] The original security event association module, which is connected to the tracing device, is used to perform correlation analysis between the original security event and other events.
[0038] The attack chain event pool is used to aggregate the various events, related events, and original security events traced by the tracing device according to the direction of their data flow propagation to form an attack chain; The causal inference module is connected to the attack chain event pool. It is used to determine whether an attack chain exists in the attack chain event pool, and to determine the completeness of the attack chain through the causal inference model. It also extracts the attack chain from the attack chain event pool for causal inference to obtain the causal relationship of the attack. Its output is the user's operation. The original security event tracing module is used to record events in the attack chain event pool and to trace the new attack chain or new attack event when a new attack chain or new event is received.
[0039] In the link layer tracing module, based on the access target of the network access event, physical link layer events, application layer data flow events, and network layer data flow events of the host layer and network layer are obtained as the data source for constructing the original security event.
[0040] In the original security event establishment module, the target data and tracing results sent by the link layer tracing module are received, the original security event is stored in the attack chain event pool, and other security events and business events are associated. When associating non-security events, other security events are associated with the original security event according to the network flow attributes to obtain associated security events.
[0041] The causal inference process in the causal inference module is as follows: Step (A) constructs a directed edge for each link of the attack chain in the attack chain event pool and adds it to the corresponding causal network Gv; Step (B) Extract several events from the attack chain in the attack chain event pool, their corresponding relational events and associated insecure events, and record their propagation relationships; Step (C) sequentially determines whether all paths in the causal network Gv contain malicious nodes. If so, the corresponding event is extracted from the attack chain event pool to determine whether it is a malicious event. This can be combined with the above. The value is used for judgment; If so, the path is recorded as an attacker's path; otherwise, the path is removed from the causal network Gv. If not, i.e., there are no malicious nodes, then the path will not be recorded as an attacker's path; Step (D) will construct the attacker node using the recorded attacker path and add the attacker node to the causal network Gv; Step (E) adds the malicious node in the attack flow path recorded in step (C) as the source node P1 to the causal network Gv, and determines whether the attack node in the attacker's path has a direct or indirect relationship with the source node P1. If so, add the attacking node to the causal network Gv and mark it as an attacking node; If not, add the source node P1 to the causal network Gv and mark it as the source node; Step (F) involves propagating the already marked attack node and source node as new paths within the causal network Gv, and determining whether the outgoing nodes carry malicious markings during the propagation process (in conjunction with...). If the value is true, the path is recorded as an attacker's path and added to the attacker's path list; otherwise, the path is removed from the causal network Gv. Step (G) uses the attacker's path recorded in step (F) as the attack flow path and constructs the attack source node through these paths.
[0042] It should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the principles of the present invention should be included within the protection scope of the present invention.
Claims
1. A method for tracing the source of a full-link attack, characterized in that, This includes the following: obtaining network security events by correlating network access events and data flow events, wherein the data flow events include data flow events at the application layer and network layer, as well as physical link layer events at the host layer; network security events include original security events, associated security events, associated insecure events, and analyzed insecure events, wherein original security events include initially detected attack events, associated security events include other security events related to the original event, associated insecure events include non-attack events time-related to the original event, and analyzed insecure events include irrelevant events to be analyzed; tracing the source starting from the original security event includes the following steps: S1: Based on the attack target, associate network access events and data stream events to generate an original security event, and trace the source of the original security event to obtain the target data and transmission path contained in the original security event; S2: Based on the time of the event, associate the original security event with the related non-security event, and determine whether the associated non-security event is a malicious event based on the source tracing results; S3: Associate the associated non-security events with new security events and new business events, update the tracing results, and determine whether the updated tracing results are complete. If so, obtain the complete tracing results of the original security event; otherwise, return to S2.
2. The method for tracing the source of a full-link attack according to claim 1, characterized in that, The data flow events include application layer and network layer data flow events, as well as host layer physical link layer events. Specifically, based on the access target of the network access event, host layer physical link layer events, network layer data flow events, and application layer data flow events are obtained as the data association source of the original security event.
3. The method for tracing the source of a full-link attack according to claim 1, characterized in that, In step S1, network access events and data stream events are correlated according to the attack target to generate an original security event. The original security event is then traced to obtain the target data and transmission path contained within it. Specifically, this includes the following: For the target data contained in the original security event, tracing is performed according to its generation time sequence, including the following sub-steps: S11: If the previous event traced back is the target data, then store it in the queue as the data source for the new original security event, and end the tracing of the target data; S12: If the previous event traced back is an application layer event, then combine the attacker's IP address in the tracing results to obtain the associated host layer event and network layer event, and continue tracing. S13: If the previous event traced back is a network layer event, then combine the attacker's IP address in the tracing results to obtain the associated physical link layer event, and continue tracing. S14: If there are any subsequent events, return to S11; Conversely, the tracing process ends.
4. The method for tracing the source of a full-link attack according to claim 1, characterized in that, The criteria for determining related security events include: when a new security event occurs, a correlation analysis is performed on the new security event and the original security event based on the data flow attributes. If there is an intersection between the data flow attributes of the new security event and the original security event, it indicates that it is a related security event.
5. The method for tracing the source of a full-link attack according to claim 4, characterized in that, If a related security event is obtained, then new security events and non-security events are associated based on the tracing results in S3; if no related security event is obtained, then new security events and non-security events are associated based on the tracing results in S2. If a new security event is detected, return to S1 to continue tracing. If no new security event is obtained, determine whether there is a business event on the attack chain in the tracing results. If there is, obtain the complete tracing results of the original security event. If it does not exist, return S2.
6. The method for tracing the source of a full-link attack according to claim 1, characterized in that, Based on the time of the event, the original security event and related non-security events are associated. Based on the source tracing results, it is determined whether the associated non-security event is a malicious event. This includes the following: associating the associated security event with new business time and non-security events according to time, and judging whether there is malicious data in the data chain of the associated event. If so, the associated event is a malicious event; otherwise, it is a non-malicious event.
7. The method for tracing the source of a full-link attack according to claim 5, characterized in that, The determination of malicious events includes the following: The data in the related events is marked and the data flow direction is recorded. The malicious determination of the link layer event data is made based on the source tracing results. The malicious determination includes: whether it carries a malicious label, whether the source IP of the network layer event is a malicious IP, and whether the non-security event carries a malicious mark. The above determinations are used to make a quantitative score. If the score is greater than the preset malicious threshold, it is determined that there is malicious data, and the malicious data chain is summarized with the original security event; otherwise, it returns to S2.
8. A full-link attack tracing system, applied to the full-link attack tracing method according to any one of claims 1-7, characterized in that, It includes a network system and a tracing system. The network system includes a business system, application layer, network layer, host layer, and physical link layer. The tracing system includes a tracing device, an attack chain event pool, and a causal inference model. The tracing device traces the original security events and stores the events in the attack chain event pool. The causal inference model constructs a causal network based on the event pool and infers the attack path.
9. A full-link attack tracing system according to claim 8, characterized in that, The functions of each layer of the network system include: The business system generates access logs and transaction data; The application layer records malicious attack techniques, vulnerability information, vulnerability exploitation tools, and attack scripts, and extracts attack features through a graph neural network attack feature extraction model; The network layer records network access events, network layer data flow events, and traffic and attack flow information; The host layer records network layer events, host layer events, and host layer physical link layer events. The physical link layer records physical link layer events from the host layer and physical link layer events from the data source; The traceability device includes: The link layer tracing module is used to obtain and trace data flow events at the host layer, network layer, and application layer based on network access events. The original security event creation module is used to create original security events based on time according to network access events and attack flow information in the tracing results. The original security event correlation module is used to perform correlation analysis between original security events and other events; The causal inference module is used to determine whether a complete attack chain exists in the attack chain event pool, and to perform causal inference on the attack chain to obtain causal relationships.
10. A full-link attack tracing system according to claim 8, characterized in that, The inference process of the causal inference model is as follows: Transform the attack chains in the attack chain event pool into directed edges of a causal network and extract the event propagation relationships; Extract several events from the attack chain and record the propagation relationship of the events based on their related events; Filter paths containing malicious nodes and mark them as attacker paths; if no malicious nodes are found, remove them from the causal network. The attacker node is established by using the attacker's path and added to the causal network; Using malicious nodes as source nodes, associate and mark directly and indirectly related attack nodes; The marked nodes are used as new paths for propagation. Paths carrying malicious marks that are transmitted during the propagation process are recorded and added to the attacker's path. The source node of the attack and the complete attack path were finally determined.