A deep behavior-aware APT attack intelligence tracing analysis method

Abstract

The application relates to the technical field of APT attack tracing, and discloses a deep behavior perception APT attack intelligent tracing analysis method, which comprises the following steps: extracting information system subjects in cleaned multi-source heterogeneous data, calculating the interaction relationship between the information system subjects based on the interaction information between the information system subjects; calculating the multi-dimensional behavior relationship between behavior actions, and constructing a multi-dimensional behavior graph; adopting an improved large-scale graph matching algorithm to perform attack mode matching on the multi-dimensional behavior graph, obtaining the APT attack mode corresponding to the multi-dimensional behavior graph, and tracing to obtain the attack behavior chain of the APT attack. The application automatically constructs a complete attack behavior chain based on the interaction relationship of information system subjects and the deep behavior perception behavior relationship, realizes a systematic closed-loop process from data collection to attack behavior chain construction, and can comprehensively improve the accuracy, completeness and interpretability of APT attack detection and tracing.

Description

Technical Field

[0001] This invention relates to the field of APT attack attribution, and more particularly to a deep behavior-aware intelligent attribution analysis method for APT attacks. Background Technology

[0002] As information systems expand in scale and business complexity increases, the various entities involved, such as users, hosts, processes, files, and network devices, exhibit highly heterogeneous and dynamic characteristics. Simultaneously, APT attack methods are constantly evolving. Attackers typically employ multi-stage, multi-path, and multi-carrier strategies to gradually infiltrate and spread covertly. Traditional APT attack detection methods often rely on single-source log information or isolated security alerts, such as operating system logs, application logs, or firewall alerts. These methods are often inadequate when facing complex attack chains, making accurate and timely identification difficult. APT attacks are characterized by long incubation periods, dispersed behavior, and strong concealment. Their attack actions may closely resemble normal operations and are distributed across multiple nodes and time periods within the system. Simply relying on static rules or event triggers can easily miss potential attack nodes, leading to incomplete attack chain reconstruction and hindering the comprehensive reconstruction of the attack path.

[0003] To improve the intelligence level of APT attack tracing, existing technologies, such as patent CN118898071B, disclose an APT attack tracing method that integrates sequence learning and causal analysis. Its main process includes: acquiring system kernel logs and Points of Interest (POI) events; constructing a POI strong dependency impact module to generate a POI strong dependency impact graph; obtaining a trained key sequence recognition model through a key sequence recognition model training module; and using a key component recognition module for APT attack tracing. Specifically, the embedded vector generated based on the POI strong dependency impact graph is input into the trained model for recognition, thereby identifying key processes and key events, and finally combining them to generate a key component graph and achieve APT attack tracing. This method, by combining sequence learning and causal analysis, can identify key attack components and assist in tracing to a certain extent. However, this patent relies solely on the POI strong dependency impact graph, which cannot dynamically depict the multi-dimensional interaction relationships and fluctuations between information system entities, making it difficult to detect subtle abnormal behaviors lurking in the context of normal operation. Furthermore, although causal analysis is used, it lacks unified modeling for the multi-dimensional correlation of behavioral actions (timing, interaction impact, and causal triggering), affecting the ability to reconstruct complex APT attack paths.

[0004] To address this problem, this invention proposes a deep behavior-aware intelligent source tracing analysis method for APT attacks, which enables intelligent source tracing of APT attacks and improves the timeliness and accuracy of attack detection. Summary of the Invention

[0005] This invention provides a deep behavior-aware APT attack intelligent tracing analysis method. It addresses existing APT attack detection and tracing methods by resolving issues such as data dispersion, missing interaction relationships, unclear behavioral correlations, and difficulty in fully reconstructing attack chains. To address the difficulty in quantifying subject interaction relationships, step S2 extracts information system subjects from cleaned multi-source data and calculates their interaction relationships, solving the problem that traditional methods cannot dynamically depict the strength and evolution of interactions between information system subjects. To address the lack of system correlation in behavioral actions, step S3 extracts the behavioral actions of information system subjects and, combined with interaction relationships, calculates multi-dimensional relationships such as temporal dependence, interactive influence, and causal triggering between behavioral actions, constructing a multi-dimensional behavior graph. This overcomes the limitations of single-dimensional modeling in accurately identifying... This approach accurately reflects the complex logical chain of APT attacks. Traditional methods typically rely on single log features or static rules, making it difficult to simultaneously characterize the temporal dependencies, interactive effects, and causal triggering relationships between actions. This results in low pattern matching accuracy and incomplete attack chain reconstruction. Step S4 introduces an improved large-scale graph matching algorithm to perform deep matching between multi-dimensional behavioral graphs and APT attack patterns, achieving APT attack pattern matching and identification. Combined with the interaction relationships between information system entities, it enables tracing the entire APT attack process, effectively improving the accuracy and reliability of APT attack detection and tracking in complex environments. At the same time, it utilizes the edge weights between nodes in the multi-dimensional behavioral graph to conduct tracing, automatically splicing together the attack behavior chain, thus solving the shortcomings of existing methods such as fragmented attack paths and difficulty in tracing back to the attack source.

[0006] To achieve the above objectives, this invention provides a deep behavior-aware APT attack source tracing analysis method, comprising the following steps:

[0007] S1: Collect multi-source heterogeneous data related to APT attacks and perform data cleaning to obtain cleaned multi-source heterogeneous data. The multi-source heterogeneous data includes network traffic data, operating system logs, process logs, file logs, and security device logs.

[0008] S2: Extract the information system entities from the cleaned multi-source heterogeneous data, and calculate the interaction relationships between the information system entities based on the interaction information between them;

[0009] S3: Extract the behavior actions of information system subjects from the cleaned multi-source heterogeneous data, and calculate the multi-dimensional behavior relationships between behavior actions based on the interaction relationships between information system subjects. Construct a multi-dimensional behavior graph of the behavior actions of information system subjects and the multi-dimensional behavior relationships between behavior actions.

[0010] S4: An improved large-scale graph matching algorithm is used to match attack patterns on multi-dimensional behavior graphs to obtain the APT attack patterns corresponding to the multi-dimensional behavior graphs. Based on the APT attack patterns, the interaction relationships between information system subjects, and the multi-dimensional behavioral relationships between actions in the multi-dimensional behavior graphs, the APT attacks are traced to obtain the attack behavior chain of the APT attacks.

[0011] As a further improvement of the present invention:

[0012] Furthermore, multi-source heterogeneous data related to APT attacks are collected and cleaned, including:

[0013] Deploy network traffic collection tools to network ports to collect network traffic data;

[0014] Deploy a host log collection tool to the host to collect operating system logs, process logs, and file logs within the host. The operating system logs, process logs, and file logs are each composed of various events. The operating system logs include operating system running status events and authenticated user identity events. The process logs include process-operating system interaction events, process-network port interaction events, and process-file interaction events. The file logs include file communication events. All process-operating system interaction events, process-network port interaction events, process-file interaction events, and file communication events are interactive events.

[0015] The events in the operating system log, process log, and file log include event timestamps and event descriptions. The event descriptions of the interaction events include the device numbers of the two interacting parties and the interaction behavior, wherein the interaction behavior includes reading, writing, creating, transmitting, controlling, and modifying.

[0016] Logs from firewalls, IDS / IPS, VPNs, and WAFs are sent to an alarm log receiver as security device logs, which are alarm information from events in operating system logs, process logs, and file logs.

[0017] The data cleaning methods include timestamp alignment and discarding events with more than 30% missing information;

[0018] The cleaned multi-source heterogeneous data is used as the cleaned multi-source heterogeneous data.

[0019] Further, information system entities are extracted from the cleaned multi-source heterogeneous data. The entity types of these entities include network ports, processes, operating systems, and files. Based on the interaction information between these entities, the interaction relationships between them are calculated, including:

[0020] The interaction behaviors between the main entities of the information system include whether there is an interaction event, the form of the interaction behavior in the interaction event, and the duration of the interaction behavior;

[0021] The calculation method for the interaction relationship between the main entities of an information system is as follows:

[0022] ;

[0023] ;

[0024] ;

[0025] in, Represents the main body of the information system The interaction relationship between the information system subject j and the main body j. Represents a symbolic function, if the main body of the information system If there is an interaction event between the information system subject j and the system within a preset time window, then... If the main body of the information system If there are no interaction events with information system subject j within the preset time window, then , This represents the main body of the information system obtained in the most recent calculation. The historical interaction relationship between the information system subject j and the main body j. Indicates historical interaction relationships The time decay coefficient;

[0026] Indicates the current timestamp. Represents the computational history of interaction relationships The timestamp of the time, Represents the attenuation constant. Represents an exponential function with the natural constant as its base;

[0027] This represents the Sigmoid function. Represents the main body of the information system The duration of the most recent interaction event between the system and the information system entity j. Represents the main body of the information system The interaction confidence level of the most recent interaction event between the information system subject j and the information system subject j. Represents the main body of the information system The time decay coefficient of the most recent interaction event between the information system subject j and the main body j. Represents the main body of the information system The timestamp of the most recent interaction event between the information system subject j and the main body j. This indicates the control weight.

[0028] Furthermore, the behavioral actions of the information system entities in the cleaned multi-source heterogeneous data are extracted, including:

[0029] The network port's behavior types include external communication and establishing encrypted communication;

[0030] The types of behavior actions of the process include process startup, inter-process calls, and interaction between the process and non-process type information system entities;

[0031] The types of actions performed by the operating system include registry modification and system configuration change.

[0032] The file's actions include creation, reading, deletion, writing, and communication transmission;

[0033] The behavior of network ports, operating systems, and files is all controlled by processes.

[0034] Based on the behavioral action types of information system subjects, the behavioral actions of information system subjects are extracted from cleaned multi-source heterogeneous data.

[0035] Furthermore, based on the interaction relationships between the subjects of the information system, multi-dimensional behavioral relationships between actions are calculated, including:

[0036] The multi-dimensional behavioral relationships include temporal dependency relationships, interactive influence relationships, and causal triggering relationships;

[0037] The formula for calculating the multi-dimensional behavioral relationships between actions is as follows:

[0038] ;

[0039] ;

[0040] ;

[0041] ;

[0042] in, This represents the multi-dimensional behavioral relationship between action n and action e. This represents the set of behavioral actions constituted by the behavioral actions of the extracted information system subject;

[0043] Let these represent the temporal dependency, interactive influence, and causal triggering relationship of action n on action e, respectively; if If the value is 0, then there is no multi-dimensional behavioral relationship between behavior n and behavior e;

[0044] These represent the timestamps of actions n and e, respectively. This indicates the preset timestamp threshold. This is used to measure whether there is a common information system entity between action n and action e. If action n and action e have the same information system entity, then... =1, otherwise =0;

[0045] The information system entities that respectively represent actions n and e are described. Represents the main body of the information system The interaction between them This represents the semantic similarity between action n and action e;

[0046] This is used to measure the causal relationship between action n and action e. If action n directly leads to action e, then... ,otherwise , This represents the number of new processes added after action n occurs. This represents the control coefficient.

[0047] Furthermore, the actions of the information system's subjects and the multi-dimensional behavioral relationships between these actions are constructed into a multi-dimensional behavioral diagram, including:

[0048] The multi-dimensional behavior graph is a graph network structure, in which the behavior actions of the information system subject are the nodes, and the multi-dimensional behavior relationships between different behavior actions are the edge weights. The multi-dimensional behavior graph is in the form of a directed graph. If the temporal dependency relationship between behavior actions is 1, then the behavior actions form a directed edge, and the multi-dimensional behavior relationship between behavior actions is the edge weight.

[0049] Furthermore, an improved large-scale graph matching algorithm is used to perform attack pattern matching on the multi-dimensional behavioral graph to obtain the APT attack patterns corresponding to the multi-dimensional behavioral graph, including:

[0050] Extract the behavior topology matrix A from the multi-dimensional behavior graph. The behavior topology matrix consists of the adjacency behavior information between different behaviors. The behavior topology matrix is ​​in the form of an N-row N-column matrix, where N represents the number of behaviors in the multi-dimensional behavior graph.

[0051] Calculate the temporal decay coefficient between actions, perform temporal decay on the adjacent action information between actions in the action topology matrix A to obtain the temporally decayed adjacent action information, and reconstruct the temporally decayed adjacent action information into a temporally decayed action topology matrix, where the temporally decayed action topology matrix is ​​an N-row N-column matrix.

[0052] A behavioral description feature for a behavior action is constructed, which consists of word vectors corresponding to the behavior action and the behavior centrality of the behavior action in a multi-dimensional behavior graph.

[0053] A coarse screening method based on behavioral description feature hash projection is used to select the behavioral description features that are closest to the current multi-dimensional behavioral graph from all APT attack patterns. These APT attack patterns constitute a coarsely filtered set of APT attack patterns.

[0054] A hierarchical graph convolution model is used to perform hierarchical graph convolution matching between the behavior topology matrix after temporal decay and the pattern adjacency matrix corresponding to the APT attack patterns in the coarsely screened APT attack pattern set. The APT attack pattern with the highest degree of hierarchical graph convolution matching is selected as the APT attack pattern corresponding to the multi-dimensional behavior graph.

[0055] The structure of the hierarchical graph convolutional model includes an input layer, a behavior graph embedding layer, a pattern graph embedding layer, and a matching layer. The input layer receives the behavior topology matrix after temporal decay and the pattern adjacency matrix corresponding to the APT attack pattern, respectively. The behavior graph embedding layer performs graph convolution on the behavior topology matrix after temporal decay to obtain behavior graph embedding information. The pattern graph embedding layer performs graph convolution on the pattern adjacency matrix corresponding to the APT attack pattern to obtain pattern graph embedding information. The matching layer calculates the matching degree between the behavior graph embedding information and the pattern graph embedding information, which is used as the hierarchical graph convolutional matching degree of the APT attack pattern.

[0056] Furthermore, based on APT attack patterns, the interaction relationships between information system entities, and the multi-dimensional behavioral relationships between actions in a multi-dimensional behavioral graph, APT attacks are traced to their source, revealing the attack behavior chain of APT attacks, including:

[0057] Initial attack probabilities for different information system subjects are pre-generated based on APT attack patterns. Based on the interaction relationships between information system subjects, the fluctuation of the interaction relationships between information system subjects is calculated in combination with the initial attack probabilities. Information system subjects whose interaction relationship fluctuations are higher than a preset fluctuation threshold are selected as APT attack subjects. The greater the fluctuation of the interaction relationship, the greater the impact on the information system subject after the interaction event occurs.

[0058] Extract the actions performed by the APT attacker and calculate the degree centrality of the extracted actions in the multi-dimensional behavior graph. Select the K actions with the highest degree centrality as nodes in the attack behavior chain.

[0059] Starting from a node in the attack behavior chain, the chain is expanded in a multi-dimensional behavior graph until it can no longer expand. The expanded attack behavior chain nodes are then spliced ​​together according to the pointing relationship of the attack behavior chain in the multi-dimensional behavior graph to form a continuous attack behavior chain, which serves as the source tracing result of the APT attack.

[0060] Furthermore, the degree centrality of the extracted actions in the multi-dimensional behavior graph is calculated, including:

[0061] The formula for calculating the degree centrality of the extracted action in the multi-dimensional behavior graph is as follows:

[0062] ;

[0063] ;

[0064] in, This indicates the degree centrality of the extracted action in the multi-dimensional behavior graph. This indicates the in-degree centrality of the extracted action in the multi-dimensional behavior graph. This indicates the out-degree centrality of the extracted action in the multi-dimensional behavior graph;

[0065] This represents the number of nodes in a multi-dimensional behavioral graph. This represents the number of nodes pointing to actions in the multi-dimensional behavior graph. This indicates the number of nodes that the action node points to in the multi-dimensional behavior graph.

[0066] Furthermore, starting from a node in the attack behavior chain, the attack spreads across a multi-dimensional behavior graph, including:

[0067] Starting from a node in the attack behavior chain, extract the node that the attack behavior chain node directly points to in the multi-dimensional behavior graph, and calculate the relationship weight between the extracted node and the attack behavior chain node. If the relationship weight is higher than a preset relationship threshold, the extracted node is taken as an attack behavior chain node, and the extraction of nodes in the multi-dimensional behavior graph is repeated until no attack behavior chain node can be selected. The relationship weight is calculated as the product of the edge weights of the directed edges between the node and the attack behavior chain node, where the edge weight is the multi-dimensional behavior relationship.

[0068] Compared with existing technologies, this invention proposes a deep behavior-aware APT attack source tracing analysis method, which has the following beneficial effects:

[0069] First, this invention constructs a multi-dimensional quantitative model to finely quantify the interaction relationships between information system entities, thereby achieving a dynamic characterization of the behavioral patterns of these entities. Unlike traditional methods that merely count the number of interaction events or simply determine the existence of interaction, this invention considers not only the occurrence of interaction events during the quantification process but also introduces multi-dimensional weighting factors, including the time decay of interaction events, the duration of interaction, and interaction confidence. Specifically, the introduction of a time decay coefficient gradually reduces the impact of earlier interaction events on current behavior analysis, effectively suppressing the interference of historical data on real-time anomaly detection. This design ensures that interaction relationships dynamically reflect the true behavioral patterns between information system entities, while enhancing the timeliness of interaction analysis results. The use of the sign function `sgn` clearly distinguishes between the occurrence and non-occurrence of interaction events, allowing interaction weights to not only quantify event intensity but also retain information about the event's existence, thereby improving the model's interpretability and transparency, facilitating security analysts' understanding and verification of the interaction relationships between information system entities.

[0070] Meanwhile, existing technologies for analyzing information system behaviors often rely solely on single event features or static correlations, such as log keyword matching or simple time-series statistics, which fail to accurately reveal the deep connections between actions. These methods often cannot effectively distinguish the temporal logic, semantic relevance, and causal triggering relationships of different actions, resulting in insufficient ability to identify complex attack chains and easily overlooking latent abnormal behaviors. This invention proposes to comprehensively characterize the connections between behaviors through three aspects: temporal dependency, interactive influence, and causal triggering, achieving multi-dimensional capture of behavioral relationship. Specifically, temporal dependency constrains the time difference of action occurrence and subject consistency, thereby accurately modeling the contextual logic of continuous actions; interactive influence introduces the interaction relationships and semantic similarity between information system subjects, enabling the quantification of collaborative effects between information system subjects such as hosts, processes, and files; and causal triggering utilizes strict triggering conditions to capture potential causal chains and triggering patterns. Attached Figure Description

[0071] Figure 1 This is a flowchart illustrating a deep behavior-aware APT attack source tracing analysis method provided in an embodiment of the present invention.

[0072] Figure 2 This invention provides a multi-dimensional behavioral graph for intelligent source tracing analysis of APT attacks, as an embodiment of the present invention. Detailed Implementation

[0073] The realization of the objectives, functional characteristics, and advantages of this invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0074] This invention provides a deep behavior-aware APT attack intelligent tracing and analysis method. The executing entity of this deep behavior-aware APT attack intelligent tracing and analysis method includes, but is not limited to, at least one of the following electronic devices that can be configured to execute the method provided in this invention: a server, a terminal, etc. In other words, the deep behavior-aware APT attack intelligent tracing and analysis method can be executed by software or hardware installed on a terminal device or a server device, and the software can be a blockchain platform. The server includes, but is not limited to, a single server, a server cluster, a cloud server, or a cloud server cluster.

[0075] Reference Figure 1 as well as Figure 2 Embodiment 1 of the present invention is as follows:

[0076] S1: Collect multi-source heterogeneous data related to APT attacks and perform data cleaning to obtain cleaned multi-source heterogeneous data.

[0077] Collect multi-source heterogeneous data related to APT attacks and perform data cleaning, including:

[0078] Deploy the network traffic collection tool to a network port to collect network traffic data. The network traffic data is in JSON format and includes the following data types: ts: timestamp of the communication event; src_ip: host address of the initiating communication; src_port: port bound to the initiating process; dst_ip: host address of the receiver; dst_port: service port of the receiver; proto: application or transport protocol; bytes: total number of bytes transmitted in this traffic session; duration: total duration of the communication from start to finish (in seconds); ja3: TLS fingerprint, used to distinguish client application characteristics.

[0079] Optionally, the selected data acquisition tool is either Wireshark or tcpdump;

[0080] Deploy a host log collection tool to the host to collect operating system logs, process logs, and file logs within the host. The operating system logs include operating system running status events and user authentication events. The process logs include process-operating system interaction events, process-network port interaction events, and process-file interaction events. The file logs include file communication events. All process-operating system interaction events, process-network port interaction events, process-file interaction events, and file communication events are interactive events.

[0081] Specifically, the events in the operating system log, process log, and file log include event timestamps and event descriptions. The event descriptions of the interaction events include the device numbers of the two interacting parties and the interaction behavior, wherein the interaction behavior includes reading, writing, creating, transmitting, controlling, and modifying.

[0082] The operating system's running state events are described as changes in the operating system's running state (on or off) and changes in the registry; the user authentication events are described as the user sending a login authentication request to the host.

[0083] The process-operating system interaction event, process-network port interaction event, and process-file interaction event are respectively the interaction events of the process with the operating system, network port, and file.

[0084] The file communication event refers to the communication transmission between the file and the network port;

[0085] Optionally, the selected host log collection tool is Sysmon;

[0086] Logs from firewalls, IDS / IPS, VPNs, and WAFs are sent to an alarm log receiver as security device logs, which are alarm information from events in operating system logs, process logs, and file logs.

[0087] The data cleaning methods include timestamp alignment and discarding events with more than 30% missing information;

[0088] The cleaned multi-source heterogeneous data is used as the cleaned multi-source heterogeneous data.

[0089] S2: Extract the information system entities from the cleaned multi-source heterogeneous data, and calculate the interaction relationships between the information system entities based on the interaction information between them.

[0090] Information system entities are extracted from cleaned multi-source heterogeneous data. The entity types of these entities include network ports, processes, operating systems, and files. Based on the interaction information between these entities, the interaction relationships between them are calculated, including:

[0091] The interaction behaviors between the information system entities include whether there is an interaction event, the form of the interaction behavior in the interaction event, and the duration of the interaction behavior; there are multiple different information system entities under each entity type;

[0092] The calculation method for the interaction relationship between the main entities of an information system is as follows:

[0093] ;

[0094] ;

[0095] ;

[0096] in, Represents the main body of the information system The interaction relationship between the information system subject j and the main body j. Represents a symbolic function, if the main body of the information system If there is an interaction event between the information system subject j and the system within a preset time window, then... If the main body of the information system If there are no interaction events with information system subject j within the preset time window, then , This represents the main body of the information system obtained in the most recent calculation. The historical interaction relationship between the information system subject j and the main body j. Indicates historical interaction relationships The time decay coefficient;

[0097] Specifically, the preset time window is a 10-minute time window ending at the current timestamp. This applies if the information system entity has never been calculated. The historical interaction relationship between the system and the main body j is then set. =0;

[0098] Indicates the current timestamp. Represents the computational history of interaction relationships The timestamp of the time, Represents the attenuation constant, set For 360 seconds, Represents an exponential function with the natural constant as its base;

[0099] This represents the Sigmoid function. Represents the main body of the information system The duration of the most recent interaction event between the system and the information system entity j. Represents the main body of the information system The interaction confidence level of the most recent interaction event between the information system subject j and the information system subject j. Represents the main body of the information system The time decay coefficient of the most recent interaction event between the information system subject j and the main body j. Represents the main body of the information system The timestamp of the most recent interaction event between the information system subject j and the main body j. Indicates control weight, setting It is 0.5;

[0100] Specifically, the steepness of the Sigmoid function is set to 1.2;

[0101] As a preferred embodiment of the present invention, the interaction confidence level The calculation method is as follows:

[0102] ;

[0103] ;

[0104] ;

[0105] ;

[0106] ;

[0107] ;

[0108] in, Represents the main body of the information system The traffic anomaly degree of the most recent interaction event between the information system entity j and the main body j. Indicated in the main body of the information system The network port's throughput per unit time after the most recent interaction event between the network and the main body j of the information system. Indicated in the main body of the information system The network port's throughput per unit time before the most recent interaction event between the network and the main body j of the information system. This represents the standard deviation of the network port's traffic transmission rate per unit time. Indicates the control coefficient, set =1, Represents the logistic function;

[0109] Represents the main body of the information system The entropy increase anomaly of the most recent interaction event between information system subject j and the information system subject j. Indicated in the main body of the information system The information entropy of information system subject c after the most recent interaction event between information system subject j and information system subject c. Represents the main body of the information system The information entropy of information system subject c prior to the most recent interaction event between information system subject j and information system subject c is, where c represents the main body of the information system. Any information system entity between information system entity j and information system entity j;

[0110] Represents the main body of the information system The alarm anomaly degree of information system subject j; if information system subject c has alarm information, then... =1, otherwise =0; This represents the timestamp of the alarm message issued by entity c of the information system. ;

[0111] It should be noted that traffic anomaly can quickly quantify the deviation of the transmission rate after the interaction time from the average transmission rate in the past. It is suitable for detecting abnormally large traffic uploads / downloads or covert low-frequency communications, and is effective for detecting data theft and tunnel communication.

[0112] To more comprehensively characterize the anomalies in inter-subject interactions, this invention introduces the concept of interaction confidence, organically integrating traffic anomaly, entropy increase anomaly, and alarm anomaly to achieve a multi-dimensional comprehensive confidence assessment. Traffic anomaly analyzes the degree to which the data transmission rate deviates from the historical average within a unit of time, capturing sudden fluctuations in data transmission rates. Entropy increase anomaly quantifies the suddenness and information gain of data from an information theory perspective, reflecting the complex changes in interactive behavior. Alarm anomaly utilizes alarm information generated by security devices to provide external verification for anomaly assessment. When these three types of anomalies are combined to form interaction confidence, the credibility of the interaction relationship calculated for each interaction event can be dynamically evaluated. This allows interaction relationships to not only identify obvious abnormal behaviors but also uncover weak anomalies lurking in the background of normal operation, providing a reliable quantitative foundation for APT attack phase identification and multi-dimensional behavior graph construction.

[0113] S3: Extract the behavior actions of information system subjects from the cleaned multi-source heterogeneous data, and calculate the multi-dimensional behavior relationships between behavior actions based on the interaction relationships between information system subjects. Construct a multi-dimensional behavior graph of the behavior actions of information system subjects and the multi-dimensional behavior relationships between behavior actions.

[0114] Extracting the behavioral actions of information system entities from cleaned, multi-source heterogeneous data, including:

[0115] The network port's behavior types include external communication and establishing encrypted communication;

[0116] The types of behavior actions of the process include process startup, inter-process calls, and interaction between the process and non-process type information system entities;

[0117] The types of actions performed by the operating system include registry modification and system configuration change.

[0118] The file's actions include creation, reading, deletion, writing, and communication transmission;

[0119] The behavior of network ports, operating systems, and files is all controlled by processes.

[0120] Based on the behavioral action types of information system subjects, the behavioral actions of information system subjects are extracted from cleaned multi-source heterogeneous data.

[0121] Specifically, the external communication refers to communication initiated by a process through a network port to an external network address (public IP or target IP outside the organizational boundary). This is often seen in C2 (Command & Control) communication in APT attacks. Attackers interact with remote control servers through external communication. If the source IP in the network traffic data belongs to the internal network and the target IP belongs to the external network, it is determined that there is external communication behavior on that network port.

[0122] Inter-process calls are interactions between one process and another process via APIs or system calls, such as remote thread injection, process handle access, and DLL injection.

[0123] An example of the action is as follows: process A starts; process B performs writing interaction on file C; the file content of file C is transmitted to the outside world via network port D.

[0124] The multi-dimensional behavioral relationships between actions are calculated based on the interaction relationships between entities in the information system, including:

[0125] The multi-dimensional behavioral relationships include temporal dependency relationships, interactive influence relationships, and causal triggering relationships;

[0126] The formula for calculating the multi-dimensional behavioral relationships between actions is as follows:

[0127] ;

[0128] ;

[0129] ;

[0130] ;

[0131] in, This represents the multi-dimensional behavioral relationship between action n and action e. This refers to the set of behavioral actions constituted by the extracted information system subject's actions; specifically, the behavioral actions... The multidimensional behavioral relationships between them include the multidimensional behavioral relationship between action n and action e, and the multidimensional behavioral relationship between action e and action n.

[0132] Let these represent the temporal dependency, interactive influence, and causal triggering relationship of action n on action e, respectively; if If the value is 0, then there is no multi-dimensional behavioral relationship between behavior n and behavior e;

[0133] These represent the timestamps of actions n and e, respectively. This indicates the preset timestamp threshold (e.g., 30 seconds). This is used to measure whether there is a common information system entity between action n and action e. If action n and action e have the same information system entity, then... =1, otherwise =0;

[0134] The information system entities that respectively represent actions n and e are described. Represents the main body of the information system The interaction between them This represents the semantic similarity between action n and action e;

[0135] Optionally, the BERT model is used to convert action n and action e into word vectors, and the Transformer model is used to calculate the semantic similarity of the word vectors;

[0136] This is used to measure the causal relationship between action n and action e. If action n directly leads to action e, then... ,otherwise , This represents the number of new processes added after action n occurs. Indicates the control coefficient, set The causal relationship is 0.1. For example, if a file is created after a process starts, then the causal relationship between the process startup action and the file creation action is 1.

[0137] It should be noted that current technologies for analyzing the behavior of information systems often rely solely on single event features or static correlations, such as log keyword matching or simple time-series statistics. These methods struggle to accurately reveal the deep connections between actions. They often fail to effectively distinguish the temporal logic, semantic relevance, and causal triggering relationships of different actions, resulting in insufficient ability to identify complex attack chains and easily overlooking latent abnormal behaviors.

[0138] This invention proposes a comprehensive approach to characterizing the relationships between actions through three aspects: temporal dependency, interactive influence, and causal triggering. Temporal dependency constrains the time difference of actions and subject consistency, thereby accurately modeling the contextual logic of continuous actions; interactive influence introduces the interaction relationships and semantic similarity between information system subjects, enabling the quantitative expression of collaborative effects between information system subjects such as hosts, processes, and files; causal triggering utilizes strict triggering conditions to capture potential causal chains and triggering patterns.

[0139] Through the aforementioned improvements, this invention not only preserves the temporal information of actions but also enhances the interpretability at the semantic and causal levels, achieving multi-dimensional and multi-granular behavior modeling. Compared with traditional methods, it can more accurately reconstruct attack paths in complex threats such as APT attacks, and mine hidden abnormal behavior patterns based on multi-dimensional behavioral relationships, providing solid data support and scientific basis for attack tracing and real-time detection, thereby significantly improving the accuracy and timeliness of security analysis.

[0140] The actions of information system subjects and the multi-dimensional behavioral relationships between these actions are constructed into a multi-dimensional behavior diagram, including:

[0141] The multi-dimensional behavior graph is a graph network structure, in which the behavior actions of the information system subject are the nodes, and the multi-dimensional behavior relationships between different behavior actions are the edge weights. The multi-dimensional behavior graph is in the form of a directed graph. If the temporal dependency relationship between behavior actions is 1, then the behavior actions form a directed edge, and the multi-dimensional behavior relationship between behavior actions is the edge weight.

[0142] Specifically, if the temporal dependency of action n on action e is 0, then there is no directed edge from action n to action e. If the temporal dependency of action n on action e is 1, then there exists a directed edge from action n to action e, and the weight of this directed edge is... . Reference Figure 2 As shown, this is a multi-dimensional behavior graph provided in an embodiment of the present invention. If there is a dotted directed edge between behaviors or actions, or if there is no directed edge, it indicates that the temporal dependency between behaviors and actions is 0.

[0143] S4: An improved large-scale graph matching algorithm is used to match attack patterns on multi-dimensional behavior graphs to obtain the APT attack patterns corresponding to the multi-dimensional behavior graphs. Based on the APT attack patterns, the interaction relationships between information system subjects, and the multi-dimensional behavioral relationships between actions in the multi-dimensional behavior graphs, the APT attacks are traced to obtain the attack behavior chain of the APT attacks.

[0144] An improved large-scale graph matching algorithm is used to perform attack pattern matching on multi-dimensional behavioral graphs to obtain the APT attack patterns corresponding to the multi-dimensional behavioral graphs, including:

[0145] A behavior topology matrix A is extracted from the multi-dimensional behavior graph. This matrix consists of adjacency behavior information between different behaviors. The behavior topology matrix is ​​an N x N matrix, where N represents the number of behaviors in the multi-dimensional behavior graph. In one embodiment of the invention, adjacency behavior information between behaviors is calculated using the number of consecutive occurrences of behaviors or the product of multi-dimensional behavior relationships. Specifically, based on the number of consecutive occurrences of behaviors, the adjacency behavior information between behavior action n and behavior action e is calculated. The calculation method is as follows:

[0146] ;

[0147] in, This indicates the number of times that action n and action e occur in pairs. This represents the set of actions in a multi-dimensional behavior graph. s represents the set of actions. Any action in the process, This indicates the number of times that action n and action s occur in pairs. Specifically, if action e occurs within Len seconds after action n occurs, then it is recorded as one instance of action n and action e occurring in pairs. Len is set to 60.

[0148] The method for calculating the adjacency behavior information of action n to action e based on the product of multi-dimensional behavioral relationships is as follows: ;

[0149] Calculate the temporal decay coefficient between actions, perform temporal decay on the adjacent action information between actions in the action topology matrix A to obtain the temporally decayed adjacent action information, and reconstruct the temporally decayed adjacent action information into a temporally decayed action topology matrix, where the temporally decayed action topology matrix is ​​an N-row N-column matrix.

[0150] Specifically, adjacency behavior information The time decay formula is:

[0151] ;

[0152] in, This represents the temporal decay coefficient between action n and action e. Indicates the time decay factor, set It is 0.1. This represents an exponential function with the natural constant as its base. Represents adjacency behavior information Corresponding adjacency behavior information after temporal decay;

[0153] A behavioral description feature for a behavior action is constructed, which consists of word vectors corresponding to the behavior action and the behavior centrality of the behavior action in a multi-dimensional behavior graph.

[0154] Specifically, the BERT model is used to convert actions into word vectors, and the behavior centrality of the action in the multi-dimensional behavior graph is the degree centrality of the action in the multi-dimensional behavior graph.

[0155] A coarse screening method based on behavioral description feature hash projection is used to select the behavioral description features that are closest to the current multi-dimensional behavioral graph from all APT attack patterns. Several APT attack patterns constitute a coarsely filtered set of APT attack patterns; set It is 5;

[0156] As an embodiment of the present invention, the process of the coarse screening method is as follows:

[0157] The behavior centrality in the behavior description features is converted into normalized behavior centrality weights. The word vectors corresponding to the behavior actions are weighted to obtain weighted behavior vectors that represent the overall behavior features in the current multi-dimensional behavior graph. The weighted behavior vectors are projected onto the low-dimensional hash signature space using locality-sensitive hashing to obtain the behavior hash signatures corresponding to the weighted behavior vectors.

[0158] Obtain the attack behavior vectors corresponding to different APT attack modes, and project the attack behavior vectors onto the low-dimensional hash signature space using the locality-sensitive hashing method to obtain the pattern hash signatures corresponding to the APT attack modes. The attack behavior vectors corresponding to the APT attack modes are composed of the average word vectors of the actions belonging to the APT attack modes.

[0159] Calculate the similarity between the behavioral hash signature and the pattern hash signatures corresponding to different APT attack modes, and select the one with the highest similarity. APT attack patterns are selected to form a coarsely filtered set of APT attack patterns; optionally, the similarity calculation method is cosine similarity or Hamming distance similarity.

[0160] A hierarchical graph convolution model is used to perform hierarchical graph convolution matching between the behavior topology matrix after temporal decay and the pattern adjacency matrix corresponding to the APT attack patterns in the coarsely screened APT attack pattern set. The APT attack pattern with the highest degree of hierarchical graph convolution matching is selected as the APT attack pattern corresponding to the multi-dimensional behavior graph.

[0161] The structure of the hierarchical graph convolutional model includes: an input layer, a behavior graph embedding layer, a pattern graph embedding layer, and a matching layer. The input layer is used to receive the behavior topology matrix after temporal decay and the pattern adjacency matrix corresponding to the APT attack mode, respectively. The behavior graph embedding layer is used to perform graph convolution on the behavior topology matrix after temporal decay to obtain behavior graph embedding information. The pattern graph embedding layer is used to perform graph convolution on the pattern adjacency matrix corresponding to the APT attack mode to obtain pattern graph embedding information. The matching layer is used to calculate the matching degree between the behavior graph embedding information and the pattern graph embedding information, which is used as the hierarchical graph convolution matching degree of the APT attack mode.

[0162] Specifically, the graph convolution formula is:

[0163] ;

[0164] Where H represents the graph convolution result, Y represents the matrix used for graph convolution, I represents the identity matrix, and D represents the matrix... The degree matrix, This represents a trainable graph convolution matrix. The activation function is represented by the graph convolution matrix, which includes graph convolution matrices in the behavioral graph embedding layer and the pattern graph embedding layer. Optionally, the activation function is a ReLU activation function or a Sigmoid activation function.

[0165] By collecting temporally decayed behavior topology matrices and pattern adjacency matrices of different APT attack modes under different scenarios, and labeling the temporally decayed behavior topology matrices with real APT attack modes, a training loss function for the hierarchical graph convolution model is constructed with the goal of maximizing the hierarchical graph convolution matching degree of the real APT attack modes calculated by the hierarchical graph convolution model. The Adam optimizer or gradient descent algorithm is used to solve the training loss function to obtain the solution result of the trainable graph convolution matrix.

[0166] The adjacency matrix corresponding to the APT attack mode is an N-row N-column matrix. The matrix elements are the attack mode chains between corresponding actions. If the matrix element is 1, both actions are attack actions under the APT attack mode and occur sequentially; otherwise, the matrix element is 0.

[0167] Specifically, the matching layer calculates the degree of matching between the behavior graph embedding information and the pattern graph embedding information using a cosine similarity algorithm.

[0168] Specifically, the APT attack mode includes the penetration phase, the lateral movement phase, and the data theft phase;

[0169] Optionally, a dynamic Bayesian network is constructed using historical APT attack data and known associations between APT attack patterns. This network extracts the dynamic transition probabilities between different APT attack patterns and incorporates these probabilities into the matching degree calculation process of the matching layer, yielding the dynamic transition matching degree. The formula for calculating the dynamic transition matching degree between the behavioral graph embedding information L and the pattern graph embedding information corresponding to the APT attack pattern g is as follows:

[0170] ;

[0171] in, This indicates the degree of dynamic transition matching between the behavior graph embedding information L and the pattern graph embedding information corresponding to the APT attack pattern g. This indicates the degree of matching between the behavioral graph embedding information L calculated by the matching layer and the pattern graph embedding information corresponding to the APT attack pattern g. This indicates the APT attack pattern identified during the previous APT attack attribution process. Indicates APT attack mode The dynamic transition probability to APT attack mode g;

[0172] It should be noted that this invention, by introducing an attack pattern matching and dynamic attribution mechanism based on multi-dimensional behavioral graphs into the APT attack detection process, provides reliable support for APT attack detection, early warning, and attribution, significantly improving the overall security level of information systems. Specifically, by using a time-decayed behavioral topology matrix combined with the pattern adjacency matrix of APT attack patterns for hierarchical graph convolutional matching, it can fully preserve the multi-dimensional relationships such as temporal dependencies, interactive effects, and causal triggers between behavioral actions, thereby improving the accuracy and robustness of APT attack pattern matching. Compared with traditional detection methods based solely on single-dimensional adjacency relationships or static features, this invention can effectively reduce the false negative rate and false positive rate in complex scenarios.

[0173] This invention constructs behavioral description features by combining word vectors and centrality features of behavioral actions, and combines them with a coarse screening strategy based on hash projection to achieve efficient reduction of the APT attack pattern set. While ensuring detection accuracy, it significantly reduces computational overhead and improves the real-time performance and scalability of the method.

[0174] Based on APT attack pattern matching results, a dynamic Bayesian network is introduced to model the transition probabilities between patterns. This enables the modeling of the dynamic evolution of different attack stages, such as penetration, lateral movement, and data theft, allowing for the step-by-step reconstruction of the APT attack chain. This not only helps to accurately identify the attackers and key behavioral nodes in APT attacks but also quantifies the probability of different actors being attacked, aiding in attribution analysis. Furthermore, based on the identified APT attack patterns, initial attack probabilities for different information system actors are generated, effectively screening key information system actors as APT attackers and enhancing attack localization and tracking capabilities.

[0175] Based on APT attack patterns, the interaction relationships between information system entities, and the multi-dimensional behavioral relationships between actions in a multi-dimensional behavioral graph, APT attacks are traced back to their source, revealing the attack behavior chain of APT attacks, including:

[0176] Initial attack probabilities for different information system subjects are pre-generated based on APT attack patterns. Based on the interaction relationships between information system subjects, the fluctuation of the interaction relationships between information system subjects is calculated in combination with the initial attack probabilities. Information system subjects whose interaction relationship fluctuations are higher than a preset fluctuation threshold (e.g., 0.3) are selected as APT attack subjects. The greater the fluctuation of the interaction relationship, the greater the impact on the information system subject after the interaction event occurs.

[0177] Specifically, the penetration phase mainly involves external port scanning and vulnerability exploitation. In the APT attack model of the penetration phase, the initial attack probability of information system subjects with network port type is set to 0.4, and the initial attack probability of other types of information system subjects is set to 0.3. The lateral movement phase mainly involves process creation and remote invocation. In the APT attack model of the penetration phase, the initial attack probability of process type is set to 0.4, and the initial attack probability of other types of information system subjects is set to 0.3. The data theft phase mainly involves file access and system calls. In the APT attack model of the data theft phase, the initial attack probability of information system subjects with file type and operating system type is set to 0.4, and the initial attack probability of other types of information system subjects is set to 0.3.

[0178] Specifically, the main body of the information system The fluctuation of the interaction relationship between the main body j of the information system and the system is as follows: :

[0179] ;

[0180] in, This represents the main body of the information system obtained in the most recent calculation. The historical interaction relationship between the information system subject j and the main body j. This represents the main body of the information system obtained in the most recent calculation. The historical interaction relationship between the information system subject j and the main body j. Indicates historical interaction relationships Time decay coefficient, Indicates the fluctuation control coefficient, set It is 0.1. These represent the main body of the information system under the identified APT attack modes, respectively. The initial attack probability of information system subject j. Indicates selection The minimum value in;

[0181] like If the fluctuation exceeds a preset threshold (e.g., 0.3), the main body of the information system will be... The information system entity j is the subject of the APT attack;

[0182] Extract the actions of the APT attacker and calculate the degree centrality of the extracted actions in the multi-dimensional behavior graph. Select the K actions with the highest degree centrality as nodes in the attack behavior chain and set K to 10% of the number of nodes in the multi-dimensional behavior graph.

[0183] Starting from a node in the attack behavior chain, the chain is expanded in a multi-dimensional behavior graph until it can no longer expand. The expanded attack behavior chain nodes are then spliced ​​together according to the pointing relationship of the attack behavior chain in the multi-dimensional behavior graph to form a continuous attack behavior chain, which serves as the source tracing result of the APT attack.

[0184] Existing APT attack detection and tracing methods mostly rely on single-dimensional log statistics or security alert triggers. Their shortcomings are: firstly, static thresholds or fixed rules are difficult to dynamically depict the real interaction changes between information system subjects, causing latent attack behaviors to often be masked by normal backgrounds; secondly, existing methods lack effective screening of key behavioral nodes during the tracing process, easily introducing a large number of irrelevant actions, generating redundant attack chains with poor interpretability, and failing to meet the high-precision analysis requirements for complex APT attacks.

[0185] To address the aforementioned issues, this invention proposes an APT (Aggressive Persistent Threat) agent identification mechanism based on the fluctuation of interaction relationships. By calculating the fluctuation of interaction relationships between information system agents, agents with fluctuations exceeding a threshold are selected as potential attack sources, thus overcoming the limitations of relying solely on static event triggers. Furthermore, after identifying the APT attack agent, this invention introduces a degree centrality index to rank behavioral actions, prioritizing the selection of the K actions with the highest centrality as nodes in the attack chain. This ensures that the source tracing analysis focuses on the most influential and propagating actions. Based on a multi-dimensional behavioral graph, combined with temporal dependencies, interactive influence relationships, and causal triggering relationships, the mechanism conducts diffusion analysis and automatically assembles a complete attack chain, achieving accurate reconstruction of the APT attack path. This invention not only significantly improves the accuracy and robustness of APT attack detection and source tracing but also provides stronger interpretability while ensuring real-time performance, offering solid data support and scientific basis for security operations and defense strategy formulation.

[0186] Calculate the degree centrality of the extracted actions in the multi-dimensional behavior graph, including:

[0187] The formula for calculating the degree centrality of the extracted action in the multi-dimensional behavior graph is as follows:

[0188] ;

[0189] ;

[0190] in, This indicates the degree centrality of the extracted action in the multi-dimensional behavior graph. This indicates the in-degree centrality of the extracted action in the multi-dimensional behavior graph.

[0191] This indicates the out-degree centrality of the extracted action in the multi-dimensional behavior graph;

[0192] This represents the number of nodes in a multi-dimensional behavioral graph. This represents the number of nodes pointing to actions in the multi-dimensional behavior graph. This indicates the number of nodes that the action node points to in the multi-dimensional behavior graph.

[0193] Specifically, behaviors with high degree centrality represent those behaviors that interact with numerous other behaviors, potentially acting as critical processes, core hosts, or potential attack springboards. By combining volatility analysis of interaction relationships, it's possible to dynamically monitor abnormal trends in behaviors over short periods and identify nodes with drastic changes that are linked to core behaviors as attack chain nodes. This strategy not only effectively identifies nodes that play a crucial relay or amplification role in the attack process but also detects latent behaviors in the attack chain at an early stage, preventing its spread. Compared to traditional detection methods that rely on static features or single alarm triggers, this invention achieves an organic combination of temporal dynamics and structural centrality, significantly improving the accuracy and completeness of APT attack path identification and providing more reliable data support and scientific basis for subsequent source tracing analysis and defense strategy deployment.

[0194] Starting from a node in the attack behavior chain, the attack spreads across a multi-dimensional behavior graph, including:

[0195] Starting with a node in the attack behavior chain, the nodes directly pointed to by the attack behavior chain node in the multi-dimensional behavior graph are extracted. The relationship weight between the extracted node and the attack behavior chain node is calculated. If the relationship weight is higher than a preset relationship threshold (e.g., 0.6), the extracted node is considered an attack behavior chain node, and the extraction of nodes in the multi-dimensional behavior graph is repeated until no more attack behavior chain nodes can be selected. The relationship weight is calculated as the product of the edge weights of the directed edges between the node and the attack behavior chain node, where the edge weights represent the multi-dimensional behavior relationship. Specifically, for attack behavior chain nodes... and the node it points to The edge weights of the two are Then the product of the edge weights is

[0196] .

[0197] It should be understood that the embodiments described are for illustrative purposes only and are not limited to this structure in the scope of the patent application.

[0198] It should be noted that the sequence numbers of the above embodiments of the present invention are merely for descriptive purposes and do not represent the superiority or inferiority of the embodiments. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, apparatus, article, or method that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, apparatus, article, or method. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, apparatus, article, or method that includes that element.

[0199] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0200] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A deep behavior-aware APT attack source tracing and analysis method, characterized in that, The method includes: S1: Collect multi-source heterogeneous data related to APT attacks and perform data cleaning to obtain cleaned multi-source heterogeneous data. The multi-source heterogeneous data includes network traffic data, operating system logs, process logs, file logs, and security device logs. S2: Extract the information system entities from the cleaned multi-source heterogeneous data, and calculate the interaction relationships between the information system entities based on the interaction information between them; The types of information system entities in the cleaned multi-source heterogeneous data include network ports, processes, operating systems, and files; based on the interaction information between information system entities, the interaction relationships between information system entities are calculated, including: Interactions between information system entities include the existence of interaction events, the form of interaction within those events, and the duration of the interaction; each entity type contains multiple different information system entities. The calculation method for the interaction relationship between the main entities of an information system is as follows: ； ； ； in, Represents the main body of the information system With the main body of the information system j The interaction between them Represents a symbolic function, if the main body of the information system With the main body of the information system j If an interactive event occurs within the preset time window, then If the main body of the information system With the main body of the information system j If no interactive events occur within the preset time window, then , This represents the main body of the information system obtained in the most recent calculation. With the main body of the information system j The historical interaction between them Indicates historical interaction relationships The time decay coefficient; The preset time window is a 10-minute window ending at the current timestamp. This is if the information system entity has never been calculated before. With the main body of the information system j The historical interaction relationships between them are then set. =0; Indicates the current timestamp. Represents the computational history of interaction relationships The timestamp of the time, Represents the attenuation constant. Represents an exponential function with the natural constant as its base; This represents the Sigmoid function. Represents the main body of the information system With the main body of the information system j The duration of the most recent interaction event between them. Represents the main body of the information system With the main body of the information system j The interaction confidence of the most recent interaction event between them. Represents the main body of the information system With the main body of the information system j The time decay factor of the most recent interaction event between them. Represents the main body of the information system With the main body of the information system j The timestamp of the most recent interaction event between them. Indicates control weight; Interactive confidence The calculation method is as follows: ； ； ； ； ； ； in, Represents the main body of the information system With the main body of the information system j The degree of traffic anomaly in the most recent interaction event between them. Indicated in the main body of the information system With the main body of the information system j The network port's throughput per unit time after the most recent interaction event between them; Indicated in the main body of the information system With the main body of the information system j The network port's throughput per unit time before the most recent interaction event occurred; This represents the standard deviation of the network port's traffic transmission rate per unit time. Indicates the control coefficient, set =1, Represents the logistic function; Represents the main body of the information system With the main body of the information system j The entropy increase anomaly of the most recent interaction event between them. Indicated in the main body of the information system With the main body of the information system j The information entropy of information system subject c after the most recent interaction event between them. Represents the main body of the information system With the main body of the information system j The information entropy of information system subject c before the most recent interaction event occurred, where c represents the main body of the information system. With the main body of the information system j Any information system entity between them; Represents the main body of the information system With the main body of the information system j The alarm anomaly level; if information system subject c has alarm information, then... =1, otherwise =0; This represents the timestamp of the alarm message issued by entity c of the information system. ; S3: Extract the behavior actions of information system subjects from the cleaned multi-source heterogeneous data, and calculate the multi-dimensional behavior relationships between behavior actions based on the interaction relationships between information system subjects. Construct a multi-dimensional behavior graph of the behavior actions of information system subjects and the multi-dimensional behavior relationships between behavior actions. S4: An improved large-scale graph matching algorithm is used to match attack patterns on multi-dimensional behavior graphs to obtain the APT attack patterns corresponding to the multi-dimensional behavior graphs. Based on the APT attack patterns, the interaction relationships between information system subjects, and the multi-dimensional behavioral relationships between actions in the multi-dimensional behavior graphs, the APT attacks are traced to obtain the attack behavior chain of the APT attacks.

2. The deep behavior-aware APT attack source tracing analysis method as described in claim 1, characterized in that, Collect multi-source heterogeneous data related to APT attacks and perform data cleaning, including: Deploy network traffic collection tools to network ports to collect network traffic data; Deploy a host log collection tool to the host to collect operating system logs, process logs, and file logs within the host. The operating system logs, process logs, and file logs are each composed of various events. The operating system logs include operating system running status events and authenticated user identity events. The process logs include process-operating system interaction events, process-network port interaction events, and process-file interaction events. The file logs include file communication events. All process-operating system interaction events, process-network port interaction events, process-file interaction events, and file communication events are interactive events. The events in the operating system log, process log, and file log include event timestamps and event descriptions. The event descriptions of the interaction events include the device numbers of the two interacting parties and the interaction behavior, wherein the interaction behavior includes reading, writing, creating, transmitting, controlling, and modifying. Logs from firewalls, IDS / IPS, VPNs, and WAFs are sent to an alarm log receiver as security device logs, which are alarm information from events in operating system logs, process logs, and file logs. The data cleaning methods include timestamp alignment and discarding events with more than 30% missing information; The cleaned multi-source heterogeneous data is used as the cleaned multi-source heterogeneous data.

3. The deep behavior-aware APT attack source tracing analysis method as described in claim 1, characterized in that, Extracting the behavioral actions of information system entities from cleaned, multi-source heterogeneous data, including: The network port's behavior types include external communication and establishing encrypted communication; The types of behavior actions of the process include process startup, inter-process calls, and interaction between the process and non-process type information system entities; The types of actions performed by the operating system include registry modification and system configuration change. The file's actions include creation, reading, deletion, writing, and communication transmission; The behavior of network ports, operating systems, and files is all controlled by processes. Based on the behavioral action types of information system subjects, the behavioral actions of information system subjects are extracted from cleaned multi-source heterogeneous data.

4. The deep behavior-aware APT attack source tracing analysis method as described in claim 1, characterized in that, The multi-dimensional behavioral relationships between actions are calculated based on the interaction relationships between entities in the information system, including: The multi-dimensional behavioral relationships include temporal dependency relationships, interactive influence relationships, and causal triggering relationships; The formula for calculating the multi-dimensional behavioral relationships between actions is as follows: ； ； ； ； in, This represents the multi-dimensional behavioral relationship between action n and action e. This represents the set of behavioral actions constituted by the behavioral actions of the extracted information system subject; Let these represent the temporal dependency, interactive influence, and causal triggering relationship of action n on action e, respectively; if If the value is 0, then there is no multi-dimensional behavioral relationship between behavior n and behavior e; These represent the timestamps of actions n and e, respectively. This indicates the preset timestamp threshold. This is used to measure whether there is a common information system entity between action n and action e. If action n and action e have the same information system entity, then... =1, otherwise =0; The information system entities that respectively represent actions n and e are described. Represents the main body of the information system The interaction between them This represents the semantic similarity between action n and action e; This is used to measure the causal relationship between action n and action e. If action n directly leads to action e, then... ,otherwise , This represents the number of new processes added after action n occurs. This represents the control coefficient.

5. The deep behavior-aware APT attack source tracing analysis method as described in claim 4, characterized in that, The actions of information system subjects and the multi-dimensional behavioral relationships between these actions are constructed into a multi-dimensional behavior diagram, including: The multi-dimensional behavior graph is a graph network structure, in which the behavior actions of the information system subject are the nodes, and the multi-dimensional behavior relationships between different behavior actions are the edge weights. The multi-dimensional behavior graph is in the form of a directed graph. If the temporal dependency relationship between behavior actions is 1, then the behavior actions form a directed edge, and the multi-dimensional behavior relationship between behavior actions is the edge weight.

6. The deep behavior-aware APT attack source tracing analysis method as described in claim 1, characterized in that, An improved large-scale graph matching algorithm is used to perform attack pattern matching on multi-dimensional behavioral graphs to obtain the APT attack patterns corresponding to the multi-dimensional behavioral graphs, including: Extract the behavior topology matrix A from the multi-dimensional behavior graph. The behavior topology matrix consists of the adjacency behavior information between different behaviors. The behavior topology matrix is ​​in the form of an N-row N-column matrix, where N represents the number of behaviors in the multi-dimensional behavior graph. Calculate the temporal decay coefficient between actions, perform temporal decay on the adjacent action information between actions in the action topology matrix A to obtain the temporally decayed adjacent action information, and reconstruct the temporally decayed adjacent action information into a temporally decayed action topology matrix, where the temporally decayed action topology matrix is ​​an N-row N-column matrix. A behavioral description feature for a behavior action is constructed, which consists of word vectors corresponding to the behavior action and the behavior centrality of the behavior action in a multi-dimensional behavior graph. A coarse screening method based on behavioral description feature hash projection is used to select the behavioral description features that are closest to the current multi-dimensional behavioral graph from all APT attack patterns. These APT attack patterns constitute a coarsely filtered set of APT attack patterns. A hierarchical graph convolution model is used to perform hierarchical graph convolution matching between the behavior topology matrix after temporal decay and the pattern adjacency matrix corresponding to the APT attack patterns in the coarsely screened APT attack pattern set. The APT attack pattern with the highest degree of hierarchical graph convolution matching is selected as the APT attack pattern corresponding to the multi-dimensional behavior graph. The structure of the hierarchical graph convolutional model includes an input layer, a behavior graph embedding layer, a pattern graph embedding layer, and a matching layer. The input layer receives the behavior topology matrix after temporal decay and the pattern adjacency matrix corresponding to the APT attack pattern, respectively. The behavior graph embedding layer performs graph convolution on the behavior topology matrix after temporal decay to obtain behavior graph embedding information. The pattern graph embedding layer performs graph convolution on the pattern adjacency matrix corresponding to the APT attack pattern to obtain pattern graph embedding information. The matching layer calculates the matching degree between the behavior graph embedding information and the pattern graph embedding information, which is used as the hierarchical graph convolutional matching degree of the APT attack pattern.

7. The deep behavior-aware APT attack source tracing analysis method as described in claim 6, characterized in that, Based on APT attack patterns, the interaction relationships between information system entities, and the multi-dimensional behavioral relationships between actions in a multi-dimensional behavioral graph, APT attacks are traced back to their source, revealing the attack behavior chain of APT attacks, including: Initial attack probabilities for different information system subjects are pre-generated based on APT attack patterns. Based on the interaction relationships between information system subjects, the fluctuation of the interaction relationships between information system subjects is calculated in combination with the initial attack probabilities. Information system subjects whose interaction relationship fluctuations are higher than a preset fluctuation threshold are selected as APT attack subjects. The greater the fluctuation of the interaction relationship, the greater the impact on the information system subject after the interaction event occurs. Extract the actions performed by the APT attacker and calculate the degree centrality of the extracted actions in the multi-dimensional behavior graph. Select the K actions with the highest degree centrality as nodes in the attack behavior chain. Starting from a node in the attack behavior chain, the chain is expanded in a multi-dimensional behavior graph until it can no longer expand. The expanded attack behavior chain nodes are then spliced ​​together according to the pointing relationship of the attack behavior chain in the multi-dimensional behavior graph to form a continuous attack behavior chain, which serves as the source tracing result of the APT attack.

8. The deep behavior-aware APT attack source tracing analysis method as described in claim 7, characterized in that, Calculate the degree centrality of the extracted actions in the multi-dimensional behavior graph, including: The formula for calculating the degree centrality of the extracted action in the multi-dimensional behavior graph is as follows: ； ； in, This indicates the degree centrality of the extracted action in the multi-dimensional behavior graph. This indicates the in-degree centrality of the extracted action in the multi-dimensional behavior graph. This indicates the out-degree centrality of the extracted action in the multi-dimensional behavior graph; This represents the number of nodes in a multi-dimensional behavioral graph. This represents the number of nodes pointing to actions in the multi-dimensional behavior graph. This indicates the number of nodes that the action node points to in the multi-dimensional behavior graph.

9. The deep behavior-aware APT attack source tracing analysis method as described in claim 7, characterized in that, Starting from a node in the attack behavior chain, the attack spreads across a multi-dimensional behavior graph, including: Starting from a node in the attack behavior chain, extract the node that the attack behavior chain node directly points to in the multi-dimensional behavior graph, and calculate the relationship weight between the extracted node and the attack behavior chain node. If the relationship weight is higher than a preset relationship threshold, the extracted node is taken as an attack behavior chain node, and the extraction of nodes in the multi-dimensional behavior graph is repeated until no attack behavior chain node can be selected. The relationship weight is calculated by multiplying the edge weights of the directed edges between the node and the attack behavior chain node, where the edge weights are multi-dimensional behavior relationships.

Images