APT attack detection method and system based on dynamic multi-layer semantic enhanced provenance graph

Abstract

The application relates to the field of intrusion detection, and provides an APT attack detection method and system based on a dynamic multi-layer semantic enhanced traceability graph. The APT attack detection method based on the dynamic multi-layer semantic enhanced traceability graph comprises the following steps: a dynamic multi-layer semantic enhanced traceability graph is constructed, the graph is gradually characterized by an original event layer, a behavior mode layer and a threat technology mapping layer, the nodes and edges in the graph are subjected to deep semantic enhancement, an incremental updating mechanism is adopted, attack behaviors are captured and semantic contexts are extracted, and a graph snapshot of the dynamic multi-layer semantic enhanced traceability graph is constructed; all nodes in the graph snapshot are embedded into a feature space by using a pre-trained H-STFT model, and node embedding vector sets are obtained; all node embedding vectors in the node embedding vector sets are aggregated, and a graph-level feature vector is obtained; whether an APT attack exists in a current graph snapshot is determined based on the graph-level feature vector; and accurate detection of the APT attack is realized.

Description

Technical Field

[0001] This invention relates to the field of intrusion detection technology, and in particular to an APT attack detection method and system based on a dynamic multi-layer semantically enhanced source graph. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] Advanced Persistent Threats (APTs) have become one of the most serious challenges facing the cybersecurity field today. APT attacks are characterized by high stealth, long-term latency, multi-stage complexity, and specific target targeting. Attackers are usually well-organized and resource-rich entities that can use zero-day vulnerabilities, social engineering, and sophisticated evasion techniques to penetrate target systems and maintain long-term control. Traditional signature- and rule-based detection methods are often ineffective in dealing with such threats.

[0004] In recent years, provenance graphs have been considered a promising technology in APT attack detection due to their ability to connect disparate system events (such as process creation, file access, network connection, and user login) to construct causal chains of system behavior, thereby revealing the full picture of attack behavior. However, existing provenance graph-based detection methods still face many challenges in practical applications to APT attack detection. Most existing provenance graphs only stay at the level of raw events, lacking the abstraction and connection of higher-order behavioral patterns (such as process injection and privilege escalation) and tactical techniques (such as specific techniques in the MITRE ATT&CK framework), making it difficult to effectively extract key features and intentions of APT attacks from massive, heterogeneous raw data. In addition, their nodes and edges often only contain basic attributes, failing to fully integrate external threat intelligence, textual semantic information (such as the meaning of command-line parameters and file paths), and contextual information (such as geographical location and traffic volume), which severely limits the model's ability to deeply understand complex threats. Meanwhile, most source graphs are constructed in a relatively static manner, making it difficult to adapt to real-time and dynamically changing system environments and attack behaviors. This results in high detection latency and low efficiency when facing continuously evolving APT attacks, failing to meet the requirements for real-time response. Even more challenging is the extreme scarcity of APT attack samples, making it difficult to obtain large amounts of real-world labeled data. This makes it difficult to adequately train deep learning models based on source graphs and generalize them to unknown or variant APT attacks, limiting their effectiveness in practical applications. Summary of the Invention

[0005] To address the shortcomings of existing APT attack detection methods based on source graphs, such as insufficient representation granularity, limited semantic information integration, poor dynamic adaptability, and generalization problems caused by the scarcity of attack samples, this invention provides an APT attack detection method and system based on dynamic multi-layer semantically enhanced source graphs (DML-PG) and temporal graph attention networks, aiming to achieve more accurate, adaptive, and interpretable real-time detection of advanced persistent threats.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] The first aspect of the present invention provides an APT attack detection method based on a dynamic multi-layer semantically enhanced source graph.

[0008] An APT attack detection method based on a dynamic multi-layer semantically enhanced source graph includes:

[0009] Acquire multi-source event log data and perform standardization processing;

[0010] A dynamic multi-layer semantic enhancement source graph is constructed by sequentially fusing features from the original event layer, behavior pattern layer, and threat technology mapping layer. Deep semantic enhancement is performed on the nodes and edges in the dynamic multi-layer semantic enhancement source graph, and an incremental update mechanism is used to maintain the dynamic multi-layer semantic enhancement source graph. Attack behaviors are captured and semantic context is extracted to construct a graph snapshot of the dynamic multi-layer semantic enhancement source graph.

[0011] Using a pre-trained H-STFT model, all nodes in the graph snapshot are embedded into the feature space to obtain a node embedding vector set. All node embedding vectors in the node embedding vector set are aggregated to obtain a graph-level feature vector. The graph-level feature vector is input into a multilayer perceptron classifier with two hidden layers to output the probability that the current graph snapshot is attacked by an APT. If the probability exceeds a preset threshold, the current system behavior is determined to be attacked by an APT.

[0012] Furthermore, the method for constructing a dynamic multi-layer semantically enhanced source map by sequentially fusing features from the original event layer, behavior pattern layer, and threat technology mapping layer includes:

[0013] Each standardized system event data is treated as a graph node, and the causal relationships between events are treated as directed edges, thus constructing the graph structure of the original event layer; discrete features are one-hot encoded to obtain discrete feature vectors; preliminary semantic encoding is performed on text features to obtain semantic embedding vectors of text features; the discrete feature vectors are concatenated with the semantic embedding vectors of text features to obtain event node feature vectors.

[0014] Based on a set of related original events in the graph structure of the original event layer, behavioral patterns are identified, the type of behavioral pattern is defined as node type, and the relationship between behavioral nodes is defined as edge type, thus constructing the graph structure of the behavioral pattern layer; the feature vector of each behavioral node is aggregated from the feature vectors of all the event nodes it contains.

[0015] Behavioral patterns are associated with known attack tactics through a predefined set of mapping rules; a graph structure for the threat technology mapping layer is constructed based on the node and edge types defined by the attack tactics; the feature vector of each attack tactic node is aggregated from the feature vectors of all the behavioral nodes it contains;

[0016] Based on the graph structures of the original event layer, the behavior pattern layer, and the threat technology mapping layer, a dynamic multi-layer semantically enhanced source tracing graph is constructed.

[0017] Furthermore, the method for performing deep semantic enhancement on nodes and edges in the dynamic multi-layer semantic enhancement source graph includes:

[0018] Based on the text fields contained in the node features of the graph structures of the original event layer, the behavior pattern layer, and the threat technology mapping layer, a semantic embedding representation is obtained; the discrete feature vector is concatenated with the semantic embedding representation to obtain the enhanced initial feature vector of the node.

[0019] By integrating important contextual information about the event occurrence into the corresponding node features, introducing a threat intelligence knowledge graph, identifying the association between nodes in the dynamic multi-layer semantically enhanced tracing graph and entities in the threat intelligence knowledge graph, and injecting features, a fused feature is obtained.

[0020] Furthermore, the identification of the association between nodes in the dynamic multi-layer semantically enhanced tracing graph and entities in the threat intelligence knowledge graph includes:

[0021] For nodes in the threat technology mapping layer, a direct identifier matching mechanism is used to find the corresponding attack behavior entities;

[0022] For nodes in the behavior pattern layer, an underlying event attribute matching mechanism is used to check the attributes of all event nodes of the behavior; based on the attributes, attack behavior entities in the threat intelligence knowledge graph are matched.

[0023] Furthermore, the method for maintaining a dynamic multi-layer semantic enhancement source graph using an incremental update mechanism includes:

[0024] New node and edge creation: For newly arrived original event layer events that are not in this dynamic multi-layer semantically enhanced tracing graph, create new original event layer nodes and their causal relationship edges;

[0025] When a new batch of raw events from the raw event layer flows in, a deterministic layered update process will be executed, including: behavior pattern identification and judgment in the behavior pattern layer, creation of new nodes in the behavior pattern layer; updating of existing nodes in the behavior pattern layer, synchronization of the threat technology mapping layer triggered by the creation of nodes in the behavior pattern layer, and synchronization of the threat technology mapping layer triggered by the updating of nodes in the behavior pattern layer.

[0026] If the attributes of an existing node change, its feature vector is updated synchronously.

[0027] Furthermore, the pre-training process of the H-STFT model includes:

[0028] A snapshot of the dynamic multi-layer semantically enhanced source graph is input into the encoder for temporal encoding to obtain temporal encoded features. Local spatial structure information is aggregated into the temporal encoded features to obtain spatiotemporal features, which are then enhanced.

[0029] Contrastive learning was used to train the added spatiotemporal features, and a pre-trained H-STFT model was obtained after the termination condition was met.

[0030] A second aspect of the present invention provides an APT attack detection system based on a dynamic multi-layer semantically enhanced source graph.

[0031] An APT attack detection system based on a dynamic multi-layer semantically enhanced source graph includes:

[0032] The data acquisition and standardization module is configured to acquire multi-source event log data and perform standardization processing.

[0033] The dynamic multi-layer semantic enhancement source graph module is configured to: construct a dynamic multi-layer semantic enhancement source graph by fusing features layer by layer, namely the original event layer, the behavior pattern layer, and the threat technology mapping layer; perform deep semantic enhancement on the nodes and edges in the dynamic multi-layer semantic enhancement source graph; maintain the dynamic multi-layer semantic enhancement source graph using an incremental update mechanism; capture attack behavior and extract semantic context; and construct a graph snapshot of the dynamic multi-layer semantic enhancement source graph.

[0034] The attack detection module is configured to: use a pre-trained H-STFT model to embed all nodes in the graph snapshot into the feature space to obtain a node embedding vector set; aggregate all node embedding vectors in the node embedding vector set to obtain a graph-level feature vector; input the graph-level feature vector into a multilayer perceptron classifier with two hidden layers to output the probability that the current graph snapshot is attacked by an APT attack; if the probability exceeds a preset threshold, the current system behavior is determined to be attacked by an APT attack.

[0035] A third aspect of the present invention provides a computer device comprising:

[0036] A processor, adapted to execute computer programs;

[0037] A computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in the APT attack detection method based on a dynamic multi-layer semantically enhanced source graph as described in the first aspect above.

[0038] A fourth aspect of the present invention provides a computer-readable storage medium storing a computer program adapted to be loaded by a processor and to execute the steps of the APT attack detection method based on a dynamic multi-layer semantically enhanced source graph as described in the first aspect above.

[0039] The fifth aspect of the present invention provides a computer program product or computer program.

[0040] This invention provides a computer program product or computer program comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps in the APT attack detection method based on a dynamic multi-layer semantically enhanced source graph as described in the first aspect above.

[0041] Compared with the prior art, the beneficial effects of the present invention are:

[0042] This invention provides an APT attack detection method and system based on a dynamic multi-layer semantically enhanced source graph. The method includes: acquiring multi-source event log data and performing standardization processing; constructing a dynamic multi-layer semantically enhanced source graph by sequentially fusing features from the original event layer, behavior pattern layer, and threat technology mapping layer; performing deep semantic enhancement on nodes and edges in the dynamic multi-layer semantically enhanced source graph; maintaining the dynamic multi-layer semantically enhanced source graph using an incremental update mechanism; capturing attack behaviors and extracting semantic context; constructing a graph snapshot of the dynamic multi-layer semantically enhanced source graph; using a pre-trained H-STFT model, embedding all nodes in the graph snapshot into the feature space to obtain a node embedding vector set; aggregating all node embedding vectors in the node embedding vector set to obtain a graph-level feature vector; inputting the graph-level feature vector into a multi-layer perceptron classifier with two hidden layers, and outputting the probability that the current graph snapshot contains an APT attack; if the probability exceeds a preset threshold, the current system behavior is determined to contain an APT attack. This invention can achieve early, accurate, and adaptive detection of APT attacks, significantly improving network security defense capabilities. Attached Figure Description

[0043] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0044] Figure 1 This is a flowchart illustrating an APT attack detection method based on a dynamic multi-layer semantically enhanced source graph, as shown in an embodiment of the present invention.

[0045] Figure 2 This is a flowchart illustrating APT attack detection and alerting in an embodiment of the present invention;

[0046] Figure 3 This is a flowchart illustrating the self-supervised pre-training of the H-STFT model according to an embodiment of the present invention;

[0047] Figure 4 This is a structural diagram of an APT attack detection system based on a dynamic multi-layer semantically enhanced source graph, as shown in an embodiment of the present invention.

[0048] Figure 5 This is a structural diagram of a computer device shown in an embodiment of the present invention. Detailed Implementation

[0049] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0050] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0051] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0052] To facilitate understanding of the technical solutions of this invention, some technical terms involved in this invention will be introduced below.

[0053] (1) Provenance Graph: A provenance graph is a structured graph representation built by parsing system audit logs, where nodes represent system entities (such as processes, files, network sockets, etc.), edges represent causal relationships between events, and nodes and edges contain rich contextual information (such as timestamps and event types).

[0054] (2) Dynamic Multilayer Semantic Enhanced Provenance Graph (DML-PG): The core data representation of this technical solution is a graph structure enhanced on the basis of traditional provenance graphs. It includes a raw event layer, a behavior pattern layer, and a tactical technology layer (MITRE ATT&CK framework). It enriches node and edge features through deep semantic embedding and external threat intelligence knowledge graphs, and supports dynamic incremental updates based on time windows, aiming to comprehensively and meticulously depict complex attack behavior chains.

[0055] (3) Node Embedding: The representation of nodes in a graph (including semantic information, structural information, etc.) in a low-dimensional vector space (i.e., dense vectors). Node embeddings are usually generated by graph neural networks or word embedding techniques (such as Word2Vec) to facilitate subsequent machine learning tasks.

[0056] Figure 1 This is a flowchart illustrating an APT attack detection method based on a dynamic multi-layer semantically enhanced source graph, as shown in an embodiment of the present invention; see reference. Figure 1 The method includes:

[0057] Acquire multi-source event log data and perform standardization processing;

[0058] A dynamic multi-layer semantic enhancement source graph is constructed by sequentially fusing features from the original event layer, behavior pattern layer, and threat technology mapping layer. Deep semantic enhancement is performed on the nodes and edges in the dynamic multi-layer semantic enhancement source graph, and an incremental update mechanism is used to maintain the dynamic multi-layer semantic enhancement source graph. Attack behaviors are captured and semantic context is extracted to construct a graph snapshot of the dynamic multi-layer semantic enhancement source graph.

[0059] Using a pre-trained H-STFT model, all nodes in the graph snapshot are embedded into the feature space to obtain a node embedding vector set. All node embedding vectors in the node embedding vector set are aggregated to obtain a graph-level feature vector. The graph-level feature vector is input into a multilayer perceptron classifier with two hidden layers to output the probability that the current graph snapshot is attacked by an APT. If the probability exceeds a preset threshold, the current system behavior is determined to be attacked by an APT.

[0060] This invention provides an APT attack detection method based on a dynamic multi-layer semantic augmentation source graph. By constructing a dynamic multi-layer semantic augmentation source graph to comprehensively capture attack behaviors, and using a temporal graph attention Transformer network model to perform deep learning on the semantic information of nodes, it ultimately achieves efficient and adaptive detection of APT attacks.

[0061] Figure 2 This is a flowchart illustrating APT attack detection and alerting in an embodiment of the present invention; as shown below. Figure 2 As shown below, the APT attack detection method based on dynamic multi-layer semantic enhancement source graph described in this embodiment will be described in detail, specifically including the following steps:

[0062] Step 1: Data Standardization

[0063] This step is responsible for data standardization, providing a unified and high-quality data input for subsequent DML-PG construction.

[0064] 1.1 Event Type:

[0065] The system transmits the raw event logs to the central processing unit for centralized processing via a unified secure data bus, Apache Kafka.

[0066] (1) Process events: record the creation, termination, parent-child process relationship, complete command line argument string, user context (user SID or UID) of the executing process, executable file path and SHA256 hash value of the file.

[0067] (2) File system events: record file creation, modification, deletion, reading operations, file permission changes, complete file path and the SHA256 hash value of the file.

[0068] (3) Network connection events: Record the establishment and disconnection of TCP / UDP connections, including source IP address, destination IP address, source port, destination port, protocol type, connection status, and the associated process ID that initiated or received the connection.

[0069] (4) Registry events: Records the creation, modification, deletion, and query operations of registry keys, the complete registry path, and the value of the operated key. This data collection module is mainly applicable to the Windows operating system environment.

[0070] (5) Identity authentication events: Record user login (success and failure), logout, and permission change events, including user account name, authentication type, and source IP address (if remote authentication is involved).

[0071] (6) Dynamic Link Library (DLL) Loading Event: Records the path of the DLL file loaded by a specific process and its associated process ID.

[0072] 1.2 Event Data Standardization and Formatting:

[0073] The raw logs are structured using a unified log parser. In this embodiment, the parser is built on top of the open-source data processing pipeline Logstash. By combining Grok, JSON, and Mutate filter plugins, the system can deterministically parse heterogeneous logs from different data sources: using the Grok filter, fields of key-value pair format logs generated by the auditd daemon are precisely extracted using preset regular expression patterns; and other corresponding parsers are used to process XML format logs generated by the Sysmon agent. Subsequently, the Mutate filter is responsible for renaming, type conversion, and normalization operations on all parsed fields. This process ultimately converts each event into a standardized JSON format to ensure data consistency and processability. Each standardized event contains the following core fields and their defined data types and content definitions:

[0074] (1) event_id: String type, unique event identifier, which is a UUID string.

[0075] (2) timestamp: Integer type, the Coordinated Universal Time (UTC) timestamp of the event, accurate to milliseconds, and represented as a Unix timestamp.

[0076] (3) event_type: String type, event type, fixed enumeration value, including "ProcessCreate", "FileWrite", "NetworkConnect", "RegistrySet", "UserLogin", "DLLLoad".

[0077] (4) source_process_id: Integer type, a unique identifier of the source process. If the event has no explicit source process, it is 0.

[0078] (5) source_process_name: String type, the name of the source process.

[0079] (6) source_user: String type, the user account name for performing the operation.

[0080] (7) target_object_type: String type, the type of the target object, a fixed enumeration value, including "File", "Process", "RegistryKey", "NetworkSocket", "User".

[0081] (8) target_object_id: String type, a unique identifier or path of the target object, such as file path, process ID (string form), registry path.

[0082] (9) action: String type, the specific operation to be performed on the target object, a fixed enumeration value, including "Create", "Read", "Write", "Connect", "Modify", "Execute", "Load".

[0083] (10) additional_attributes: JSON object type containing additional attributes for specific event types (target port of network connection (integer), file hash (string, SHA256), command line argument characters).

[0084] Step 2: Construction of Dynamic Multi-Layer Semantic Augmentation Source Graph (DML-PG)

[0085] DML-PG, based on traditional source graphs, introduces dynamic incremental updates, hierarchical abstraction, and deep semantic enhancement mechanisms to capture the complex behavioral patterns of APT attacks more comprehensively and meticulously.

[0086] 2.1 Hierarchical Abstraction of Source Diagram:

[0087] DML-PG comprises three abstraction levels, constructed and associated in a bottom-up manner, reflecting different granularities of attack behavior.

[0088] (1) L1 Original Event Layer:

[0089] The L1 layer consists directly of the raw system events standardized in step 1.2. Each event is modeled as a graph node, and the causal relationships between events are modeled as directed edges.

[0090] a. Node types: The L1 layer defines five node types: Process, File, NetworkSocket, RegistryKey, and User.

[0091] b. Edge Types: The L1 layer defines seven directed edge types to represent causal or operational relationships between events: creates, writes, reads, executes, connects, accesses, and modifies. Each edge has an event_type attribute, corresponding to the event_type of the original event.

[0092] c. Node feature initialization: Each L1 node Initialize as a feature vector ,in, This is the total dimension of the original feature vector of the L1 layer nodes, determined by the sum of the dimensions of the concatenated encoded features. The generation process of this vector is as follows: First, discrete features such as event_id, timestamp, source_process_id, and source_user are encoded using one-hot encoding to form discrete feature vectors. Second, preliminary semantic encoding is performed on the text features: for short texts like source_process_name, a pre-trained Word2Vec model is used to generate word embeddings; for longer texts or structured texts such as target_object_id (e.g., file paths) and command-line arguments contained in additional_attributes, a pre-trained Sentence-BERT model is used to generate sentence-level embeddings. Finally, the discrete feature vector is concatenated with the semantic embedding vectors of all text features to generate the initialized node feature vector. .

[0093] (2) L2 Behavior Pattern Layer:

[0094] Layer L2 abstracts a set of related raw events from L1 into higher-level behavioral patterns through pattern recognition. These behavioral patterns reflect the tactical attack behaviors commonly used by attackers.

[0095] a. Behavioral Pattern Recognition: The recognition mechanism combines a predefined expert rule set with a sequence pattern mining model. The expert rule set contains a series of preset event sequence patterns, such as "process A creates a hidden file B and then modifies the registry startup item C," constituting "Persistence_Mechanism." The sequence pattern mining model employs a pre-trained recurrent neural network (RNN), specifically a Long Short-Term Memory (LSTM) network. Its input is the feature embedding of the L1 event sequence arranged chronologically within a sliding time window, and its output is the identified behavioral pattern type. The identified behavioral pattern types include, but are not limited to: Process_Injection, Privilege_Escalation, Lateral_Movement_Attempt, Persistence_Mechanism, Data_Exfiltration, and Credential_Access.

[0096] b. Node type: Defined as the specific behavior pattern type string identified above, such as the "Process_Injection" node.

[0097] c. Edge Type: Defines the temporal or causal relationships between L2 behavior nodes, such as leads_to, followed_by, and uses. These edges are generated by aggregating upwards through the causal chain of L1 events.

[0098] d. Node feature aggregation: Each L2 behavior is a node. eigenvectors The feature vectors of all L1 event nodes it contains It is aggregated. The aggregation method is average pooling, that is:

[0099]

[0100] in, This is the set of L1 nodes associated with this L2 node.

[0101] (3) L3 Threat Technique Mapping Layer:

[0102] This layer further abstracts and maps the high-level behaviors identified by the L2 behavioral pattern layer to a standard attack behavior knowledge base. In this embodiment, the knowledge base is specifically the MITRE ATT&CK framework, which associates specific system behaviors with known attack tactics and techniques through this mapping.

[0103] a. Mapping Mechanism: L2 behavior patterns are associated with one or more MITRE ATT&CK tactics (Initial Access, Execution, Persistence, Privilege Escalation, LateralMovement, Exfiltration, Command and Control) or specific MITRE ATT&CK technique IDs (e.g., T1059 Command and Scripting Interpreter, T1055 Process Injection) through a predefined set of mapping rules (e.g., Process Injection maps Process_Injection to Execution and Defense Evasion tactics).

[0104] b. Node type: Defined as a MITRE ATT&CK tactical ID string or technical ID string, such as "Execution" node, "T1059" node.

[0105] c. Edge Type: Defines the logical or temporal relationships between nodes in the L3 threat technology mapping layer, such as uses, part of, and precedes. These edges are generated based on the chain relationships in the MITRE ATT&CK framework and the temporal relationships of L2 behaviors.

[0106] d. Node feature aggregation: for each L3 node eigenvectors The feature vector of all L2 behavior nodes associated with it The aggregation method also uses average pooling.

[0107] 2.2 Semantic Enhancement of Node and Edge Features:

[0108] To capture deeper semantic information, deep semantic embedding is performed on all node and edge features in DML-PG, thereby providing a richer semantic context.

[0109] (1) Text feature semantic embedding:

[0110] For the text fields (including process name, file path, command line arguments, user account name, behavior pattern description, and technical description) contained in the L1, L2, and L3 (threat technology mapping layer) node features in DML-PG, a high-dimensional dense vector is generated using a pre-trained natural language processing model.

[0111] a. Semantic Embedding: For short text fields (process name, file name), a pre-trained Word2Vec model is used to generate word embeddings. For long text fields (command line arguments, file paths, detailed descriptions of behavioral patterns), a pre-trained Sentence-BERT model is used to generate sentence embeddings.

[0112] For each text field Inputting it into the above process yields its embedded representation:

[0113]

[0114] in, This represents the original text field that was input. The pre-trained natural language processing model used (specifically, Word2Vec or Sentence-BERT models, depending on the text length). This represents the model Text processing The high-dimensional dense vector output is the semantic embedding representation of the text.

[0115] b. Feature Fusion: These semantic embedding representations are concatenated with the encoded vectors of the original discrete features to form enhanced initial feature vectors for the nodes. Here, the encoded vectors of the original discrete features (i.e.,...) The result () originates from the processing of the node's original attributes in step 2.1, specifically referring to the generation of a numerical vector from non-textual, discrete metadata such as event_id, timestamp, and source_process_id through one-hot encoding or integer encoding. The concatenation operation is represented as:

[0116]

[0117] in, It is the original discrete feature encoding. It is the first Semantic embedding of text fields, This represents the initial feature vector of the enhanced node.

[0118] (2) Contextual feature integration:

[0119] Integrate important contextual information about the event into the corresponding node features to provide a more comprehensive description of the behavior.

[0120] a. Process node: Its feature vector additionally includes the encoding of its parent process ID, process start time, semantic embedding of the process execution path, and semantic embedding of the complete command-line arguments.

[0121] b. File node: Its feature vector additionally includes the semantic embedding of its directory, the encoding of the file's SHA256 hash value, creation time, and file size (in bytes).

[0122] c. Network connection node: Its feature vector additionally includes the geographical location information of the source and destination IP addresses (encoded latitude and longitude coordinates), the encoding of the Autonomous System Number (ASN), and the size of the connection traffic (number of bytes).

[0123] (3) External knowledge graph fusion:

[0124] This invention utilizes an external threat intelligence knowledge graph This knowledge graph is built and maintained based on the open-source OpenCTI (Open Cyber ​​Threat Intelligence) platform. By configuring OpenCTI's data connectors, the system can automatically and continuously pull and integrate threat intelligence data from multiple authoritative sources, forming a unified knowledge base. Specifically, this knowledge graph... It includes the following core entities and their relationships:

[0125] MITRE ATT&CK entities: tactical, technical, and sub-technical entities and their interrelationships, imported directly from MITRE CTI's official STIX data source via connectors.

[0126] CVE vulnerability information entity: a known common vulnerability disclosure entity, obtained from the data feed of the vulnerability database (NVD) via a connector.

[0127] Known IOCs (Indicators of Compromise) entities: including but not limited to known malicious file hashes (SHA256), malicious IP addresses, malicious domain names, etc., are continuously synchronized from public threat intelligence sources such as MISP (Malware Information Sharing Platform) instances and AlienVault OTX (Open Threat Exchange) through connectors.

[0128] In this way, the system will have a dynamically updated, structured threat knowledge base. It is ready for subsequent semantic enhancement.

[0129] a. Knowledge Graph Embedding: The knowledge graph embedding model RotatE is used to... We learn from the entities and relationships in the dataset to obtain their embedding vectors. and The RotatE model represents entities and relations by rotation in the complex domain, and its scoring function... for:

[0130]

[0131] in , , These are the complex embedding vectors of the head entity, relation, and tail entity, respectively. It represents the Hadamardi (or Hadama) stack.

[0132] b. Feature Injection: To integrate external threat intelligence into the graph representation, the system employs a set of deterministic association rules to proactively identify DML-PG nodes and... The association between entities is determined, and feature injection is performed. This association determination process involves two mechanisms:

[0133] First, for nodes in the L3 threat technology mapping layer, the system employs a direct identifier matching mechanism. Since the ID of this layer's node is itself a standard MITRE ATT&CK tactical or technical identifier (such as 'T1055'), this ID is directly used as the query key in the threat intelligence knowledge graph. A precise search is performed to locate the unique corresponding ATT&CK technology entity.

[0134] Secondly, for nodes in the L2 behavior pattern layer, the system employs a low-level event attribute matching mechanism. Since L2 nodes are abstract aggregations of L1 raw events, the system deeply examines the attributes of all underlying L1 event nodes constituting the L2 behavior. Specifically, the system extracts key fields from these L1 events, primarily including the SHA256 hash value of file nodes, the destination IP address and domain name in network connection events, and command-line parameters in process creation events. These extracted attribute values ​​are then used as query content in... The matching is performed within the set of known IOCs (Indicators of Compromise) entities stored in the database. For example, a Data_Exfiltration L2 behavior node, if the target IP address of a NetworkConnect L1 event it contains, is matched with... If an L2 node matches an IP address entity that is marked as a known command and control (C2) server, the system determines that there is a clear association between the L2 node and this C2 server entity.

[0135] Once the DML-PG node and... are determined through any of the above mechanisms... When a system identifies a relationship between two entities, it extracts the pre-trained embedding vector of that entity from the knowledge graph. Then, it is concatenated to the existing feature vector of the corresponding DML-PG node to complete feature injection. Specifically, the concatenation operation is performed as follows:

[0136]

[0137] in, This represents the fused feature after the embedding vector is injected into the corresponding DML-PG node.

[0138] 2.3 Dynamic Incremental Update Mechanism:

[0139] DML-PG employs a time window-based and incremental update strategy to adapt to real-time streaming data, ensuring the real-time performance and efficiency of the graph structure.

[0140] (1) Time window management: The system will manage the real-time event stream according to a fixed time window parameter. (The default value is 30 seconds) The images are processed in batches to form a sequence of snapshots arranged in chronological order: , , …,in Each graph snapshot (to be in) Generated in time For example, it is a standalone, complete instance of a Dynamic Multi-Level Semantic Augmented Source Graph (DML-PG). It specifically contains and represents the source graph within a time interval. The detailed composition of all system activities occurring within is as follows:

[0141] (a) Contents of L1 original event layer: It contains all L1 level nodes (Process, File, NetworkSocket, etc.) and L1 level edges (creates, writes, connects, etc.) generated based on the original events within the 30-second window. These nodes and edges constitute a causal graph of all underlying system operations within this time window.

[0142] (b) L2 Behavioral Pattern Layer Content: Based on the L1 event sequence generated within this window, the pattern recognition mechanism (expert rules and RNN model) analyzes and abstracts high-level behaviors. Therefore, It also includes all L2 behavior pattern nodes (such as Process_Injection, Persistence_Mechanism) identified within the time window, as well as L2 edges connecting the temporal or causal relationships of these behavior patterns.

[0143] (c) L3 Threat Technology Mapping Layer Content: Further mapping the behavioral patterns identified by the L2 layer to the MITRE ATT&CK framework. Therefore, it also includes all L3 layer technology nodes (such as 'T1055') associated with L2 behavior within the window, as well as the logical relationship edges between these technology nodes.

[0144] In summary, the snapshot image It is not merely a collection of raw events, but a structured graph data that has undergone hierarchical abstraction and semantic enhancement. It comprehensively encapsulates a complete behavioral view from basic operations to advanced tactics within a specific time window (30 seconds), and serves as the basic data unit for subsequent analysis by detection models.

[0145] (2) Incremental graph update: For each new event batch, the system does not rebuild the entire graph, but only performs incremental updates on the graph. A stream processing job based on Apache Flink is used to maintain the DML-PG in an efficient in-memory graph structure (e.g., a hash-based adjacency list), supporting fast addition, deletion, and attribute updates of nodes.

[0146] a. New node and edge creation: For a newly arrived L1 event that is not in this graph set, the system creates a new L1 node and its causal relationship edge.

[0147] b. L2 / L3 Layer Update: When a new batch of L1 raw events flows in, the system will execute a deterministic layer update process to ensure the real-time performance and accuracy of the L2 behavior pattern layer and the L3 threat technology mapping layer. The specific steps of this process are as follows:

[0148] Step 1: L2 Behavioral Pattern Recognition and Judgment. The system first feeds newly incoming L1 event sequences into the L2 behavioral pattern recognition module defined in this invention. This module employs a hybrid analysis method, combining a set of pre-defined expert rules for matching deterministic behaviors (such as creating a specific service) with a pre-trained recurrent neural network (RNN) model for learning and recognizing complex, non-deterministic behavioral patterns (such as covert tunneling communication) from the event sequences. The module outputs a set of currently identified high-level behavioral pattern instances, which the system then processes one by one, performing different subsequent operations based on whether they already exist in the graph.

[0149] Step 2: Creation of the new L2 node. If a newly identified behavior pattern does not have a corresponding L2 node in the graph, the system determines it as a completely new behavior and performs a creation operation. This operation includes: creating a new L2 behavior pattern node in the graph (e.g., a new Process_Injection node); establishing dependency edges from all L1 event nodes constituting this behavior to the new L2 node; and finally, calculating and initializing the feature vector of the new L2 node by performing average pooling aggregation on the feature vectors of all related L1 nodes.

[0150] Step 3: Updating Existing L2 Nodes. If a newly identified behavioral pattern is determined to be a continuation of an existing L2 node (e.g., a persistent data theft behavior generates a new network connection event), the system will perform an update operation. This operation includes: locating the existing L2 node in the graph; and establishing new dependency edges between the newly generated L1 event node belonging to this behavior and this existing L2 node. The most crucial step is that the system must recalculate the feature vector of the L2 node, that is, by including the feature vector of the newly added L1 node in the aggregation range and performing average pooling again, thereby updating the features of the L2 node to reflect the complete, evolved behavioral picture.

[0151] Step 4: L3 Layer Synchronization Triggered by L2 Node Creation. When a brand new L2 node is created, the system immediately synchronizes and updates the L3 layer. Based on the behavior type of the L2 node, the system searches for its corresponding L3 technology node (e.g., 'T1055') using predefined mapping rules. If the L3 node does not exist in the graph, it is created first. Subsequently, the system establishes a mapping edge from the new L2 node to the L3 node and immediately updates the feature vector of the L3 node. This update is accomplished by re-aggregating the latest features of all its associated L2 nodes (including the newly created one).

[0152] Step 5: L3 Layer Synchronization Triggered by L2 Node Updates. When the feature vector of an existing L2 node is updated, the change must propagate up to the L3 layer. The system will locate all upper-layer L3 nodes connected to that L2 node. For each associated L3 node, the system must recalculate its feature vector because one of its aggregation inputs (i.e., the updated L2 node feature) has changed. This recalculation process is still accomplished by performing average pooling aggregation on the latest features of all L2 nodes associated with that L3 node.

[0153] c. Node / edge feature update: If the attributes of an existing node change (e.g., file size changes), its feature vector is updated synchronously.

[0154] (3) Expired data cleanup: The system maintains a sliding time window, and for data that has exceeded the preset retention time parameter, the system will clean up the expired data. (Default value is 1 hour) Old events and graph structures are asynchronously cleaned up to control the graph size and memory consumption. The cleanup operation only deletes nodes and edges outside the specified time window to ensure that the graph always reflects the latest system activity.

[0155] Step 3: Self-supervised pre-training of the Heterogeneous Spatiotemporal Fusion Source Tracing Transformer Model (H-STFT)

[0156] This invention addresses the problem of scarce APT attack samples by using unsupervised comparative learning, thereby improving the model's generalization ability to unknown attacks.

[0157] 3.1 H-STFT model encoder architecture:

[0158] The H-STFT model includes a graph encoder responsible for extracting robust feature representations from DML-PG. This encoder is based on a novel spatio-temporal decoupling and fusion architecture, consisting of multiple stacked spatio-Temporal Fusion Layers. Figure 3 This is a flowchart illustrating the self-supervised pre-training of the H-STFT model according to an embodiment of the present invention; as shown below. Figure 3 As shown.

[0159] (1) Input: The encoder input is a snapshot of a DML-PG graph. ,in It is a set of nodes. It is a set of edges. The input data specifically includes:

[0160] Node feature matrix ,in It is the number of nodes. It is the node feature dimension after semantic enhancement in section 2.2.

[0161] Time encoding matrix ,in It is the dimension of time encoding (the default value is 128).

[0162] (2) Time encoding layer: In order to incorporate the absolute temporal information of the event into the model, the system first encodes the original timestamp of each node in DML-PG. Encoding is performed. Position codes are generated using sine and cosine functions. The calculation formula is designed with reference to the standard Transformer:

[0163]

[0164] in This is used for dimensional indexing. Subsequently, the generated time-coded data will be... With the original features of the node By concatenating the data, we obtain the initial feature vector of the nodes that incorporates time information. As the input to the first layer of the encoder:

[0165]

[0166] (3) Spatiotemporal fusion layer: The core of the model consists of It consists of stacked spatiotemporal fusion layers (the default value is 3 layers). For the first... The layer takes the node embedding matrix of the previous layer as its input. The output is Each layer executes the following three core modules in sequence:

[0167] a. Spatial Structure Aggregation Module (based on Heterogeneous Graph Attention): This module is responsible for capturing local causal dependencies (i.e., "spatial" information) in DML-PG composed of different types of nodes and edges. For each central node... It aggregates its neighbors through the Heterogeneous Graph Attention (HGAT) mechanism. The information is obtained through a multi-head attention mechanism, where the weights of each attention head are calculated. It aggregates features and finally concatenates the outputs of all heads, including attention weights. The calculation takes into account both the types of nodes and edges:

[0168]

[0169] in, This represents the feature vector input from node i to the current computational layer t; It is with nodes Type-related learnable weight matrix, Is with the edge Type-related learnable weight matrix, It is the semantic feature vector of the edge.

[0170] b. Time-Series Dependency Modeling Module (Based on Transformer Self-Attention): After aggregating local spatial structure information, this module is responsible for capturing long-distance behavioral relationships (i.e., "temporal" information). It takes the spatially aggregated feature vectors of all nodes in the current graph snapshot. It is treated as a set and a standard multi-head self-attention mechanism is applied. This allows each node to pay attention to all other nodes in the graph, thus effectively learning global dependencies that span multiple event steps. Its computation follows a standard formula:

[0171]

[0172] The query matrix Key matrix Sum matrix All are derived from input features Obtained through independent linear transformations, It is the dimension of the key vector.

[0173] c. Feedforward Network and Module Integration: After the self-attention module, a position-aware feedforward network (FFN) is applied to perform a non-linear transformation on the features of each node:

[0174]

[0175] in, The input node feature vectors, Here are the weight matrix and bias vector for the first linear layer. Here are the weight matrix and bias vector for the second linear layer. for .

[0176] To ensure the stability of training and the effective transmission of information, residual connections and layer normalization were integrated after each of the above modules (spatial aggregation, temporal modeling, and feedforward network).

[0177] (4) Output: After After layer stacking, the H-STFT encoder ultimately produces each node in the snapshot. Output a high-order, robust embedding vector. ,in This is the final embedding dimension. These embedding vectors It contains rich information on APT attack patterns that integrates multi-layered semantics, external knowledge, and spatiotemporal dependencies, and can be directly used for subsequent self-supervised pre-training and downstream detection tasks.

[0178] 3.2 Graph Data Augmentation Strategies:

[0179] For DML-PG, the following four graph data augmentation methods are designed to generate positive sample pairs for contrastive learning:

[0180] (1) Node feature perturbation: Randomly select node feature matrix 15% of the elements are replaced with zero vectors to simulate missing or noisy data.

[0181] (2) Edge perturbation: Randomly delete 1% of the directed edges in DML-PG and randomly add 1% of the dummy edges to generate changes in the graph structure and simulate fluctuations in network behavior.

[0182] (3) Subgraph sampling: From the complete DML-PG, random walk sampling is performed based on the Metropolis-Hastings algorithm to generate two subgraph views with different topological structures but semantically related. and The sampling depth is 3.

[0183] (4) Time window jitter: When selecting a DML-PG snapshot, the starting point of the time window is slightly randomly offset. . From uniform distribution:

[0184]

[0185] in, The random time offset to be applied. For "to follow the distribution of..." For a continuous uniform distribution, The preset fixed time window size.

[0186] Samples are taken from them to generate graphs that differ slightly over time.

[0187] 3.3 Comparative Learning Objective Function:

[0188] The H-STFT encoder was pre-trained using the InfoNCE (Information Noise-Contrastive Estimation) loss function.

[0189] (1) Positive sample pair: the same snapshot of DML-PG Perform two different data augmentations (using the strategies described above) to obtain two views. and The H-STFT encoder encodes these two views and obtains the global graph representation vector through a global average pooling operation:

[0190]

[0191] These two vectors form a positive sample pair.

[0192] (2) Negative sample pairs: Within a batch, for a certain positive sample pair Others within the batch Each graph represents a vector that is considered a negative sample.

[0193] (3) Loss function: For a batch Positive sample pairs InfoNCE loss function Defined as:

[0194]

[0195] in It is cosine similarity. and Representing vectors respectively and The L2 norm (Euclidean length or modulus). This is the temperature parameter (the default value is 0.5). Indicates when index Not equal to It is 1 if it is true, otherwise it is 0.

[0196] 3.4 Pre-training process:

[0197] (1) Dataset: Use preset duration (The default value is 3 months) A massive amount of unlabeled DML-PG data collected from a normally functioning system. This dataset ensures that the model learns on a wide range of normal behavioral patterns.

[0198] (2) Training objective: Optimization The loss function enables the H-STFT encoder to learn robust feature representations capable of distinguishing normal system behavior patterns. Training employs the Adam optimizer with an initial learning rate of... A learning rate decay strategy (cosine annealing) is employed. The total number of training rounds is [number missing]. (The default value is 50 rounds).

[0199] (3) Output: A pre-trained H-STFT encoder that maps DML-PG snapshots to a high-dimensional feature space, where similar normal behavior graphs are represented as close together, while abnormal behavior graphs are represented as deviating from normal clusters.

[0200] Step 4: APT Attack Detection

[0201] This step utilizes a pre-trained and fine-tuned H-STFT model for real-time detection of APT attacks and generates concise and clear detection results.

[0202] 4.1 H-STFT model detector architecture:

[0203] Based on the H-STFT encoder pre-trained in step 3, a detection head is added to complete the APT attack detection task.

[0204] (1) Input: Real-time dynamically updated DML-PG snapshot .

[0205] (2) Graph encoder: The H-STFT encoder, pre-trained in step 3, is responsible for... All nodes are embedded into the feature space to obtain a set of node embedding vectors:

[0206]

[0207] (3) Graph-level feature aggregation: The embedding vectors of all nodes are aggregated through global average pooling to obtain a graph-level feature vector representing the entire graph snapshot. The aggregation operation is as follows:

[0208]

[0209] (4) Detector: A multilayer perceptron (MLP) classifier with two hidden layers, receiving graph-level feature vectors. As input, output the probability that the current graph snapshot contains an APT attack.

[0210] a. First hidden layer:

[0211]

[0212] b. Second hidden layer:

[0213]

[0214] c. Output layer:

[0215]

[0216] in , , It is a learnable weight matrix; , , It is a learnable bias vector; , This represents the output features of the first hidden layer and the second hidden layer. Preset hidden layer dimensions. , .

[0217] (5) Fine-tuning and training: The entire H-STFT detector was fine-tuned using supervised learning on a small amount of labeled APT attack and normal behavior DML-PG data. The binary cross-entropy loss function was used for training, with Adam as the optimizer and a learning rate of [missing information]. The training rounds are (The default value is 10 rounds).

[0218] 4.2 Output of test results:

[0219] The H-STFT model detector outputs concise and clear detection results in real time. All outputs are in JSON format to ensure consistency with standardized data formats.

[0220] (1) APT attack detection: The model outputs a probability value between 0 and 1. ;

[0221] in, This represents the raw predicted value output by the H-STFT detector for the current snapshot. This represents the probability that the current snapshot of the graph contains an APT attack.

[0222] like Exceeding the preset threshold (The default value is 0.75), then the current system behavior is judged to be subject to an APT attack.

[0223] (2) Abnormal scores: The value itself serves as the APT attack anomaly score for the current graph snapshot; a higher score indicates more suspicious system behavior.

[0224] (3) Suspicious Activity Subgraph Localization: When the model determines that an APT attack exists, the system uses the attention weight mechanism within H-STFT to backtrack and identify the L1 events, L2 behavioral patterns, or L3 tactical and technical nodes that contribute the most to the detection results, as well as their interconnected subgraphs. Specific information about these subgraphs is output as auxiliary information in JSON format, including:

[0225] a. detected_graph_snapshot_id: The unique ID of the DML-PG snapshot that triggered the alert.

[0226] b. suspicious_nodes: A list of nodes, each containing node_id, node_type, node_attributes (a summary of the original or enhanced features), and attention_weight (the node's contribution to the detection result).

[0227] c. suspicious_edges: A list of edges, each containing source_node_id, target_node_id, edge_type, edge_attributes (a summary of the original or enhanced features), and attention_weight (the edge's contribution to the detection result).

[0228] Step 5: Model Deployment and Application

[0229] This step describes the actual deployment architecture of the H-STFT detection model, ensuring that it can operate in real time and efficiently in a production environment and integrate with existing security systems.

[0230] 5.1 Model Deployment Architecture:

[0231] The H-STFT detection model is deployed on the distributed stream processing platform Apache Flink to process real-time data streams.

[0232] (1) Data Ingestion Layer: The standardized events collected in step 1 are transmitted and persisted through the Apache Kafka message queue. The Kafka cluster is configured with 3 replicas and 10 partitions.

[0233] (2) Graph Construction and Update Service: A dedicated Apache Flink job continuously reads the standardized event stream from Kafka and maintains and updates the in-memory DML-PG in real time according to the DML-PG construction logic in step 2. This service is responsible for generating DML-PG snapshots and publishing them back to the Kafka topic "dml-pg-snapshots" in JSON format for the detector to consume.

[0234] (3) Detector Service: Another Apache Flink job subscribes to DML-PG snapshots from the Kafka topic "dml-pg-snapshots" and loads the pre-trained and fine-tuned H-STFT model. This service performs the detection inference in step 4 for each received DML-PG snapshot, calculating... value.

[0235] (4) Hardware acceleration: H-STFT model inference runs on a GPU cluster, specifically using NVIDIA Tesla A100 GPU, and uses the TensorRT optimization library to accelerate model inference, so as to achieve real-time detection with low latency and high throughput.

[0236] 5.2 Real-time detection and alarm mechanism:

[0237] Once deployed, the system can continuously monitor and detect system events that come in in real time.

[0238] (1) Detection cycle: The detector service operates at the same frequency as the DML-PG snapshot generation (i.e. Perform the test.

[0239] (2) Alarm generation: When the detector outputs... Value exceeds preset threshold When this happens, the system immediately generates an APT attack alert event.

[0240] (3) Alarm content: Alarm events are encapsulated in a standardized JSON format and contain the following key information:

[0241] a. alert_id: The unique identifier for the alert, which is a UUID string.

[0242] b. detection_time: The Coordinated Universal Time (UTC) timestamp generated by the alarm, accurate to milliseconds, and is a Unix timestamp.

[0243] c. anomaly_score: The score of detected APT attack anomalies. , floating-point number.

[0244] d. detected_graph_snapshot_id: A unique string ID of the DML-PG snapshot that triggered the alert.

[0245] e. suspicious_subgraph_info: Detailed information of the suspicious activity subgraph located in step 4.2 (3), in JSON format.

[0246] f. attack_stage_likelihood: A string indicating the stage of an APT attack the detected attack may be in (e.g., “Initial Access”, “Execution”, “Persistence”).

[0247] (4) Alarm Distribution: Generated alarm events are published through a dedicated Kafka topic "security-alerts" and are subscribed to and received in real time by the Security Information and Event Management (SIEM) system or the Security Operations Center (SOC) platform. The SIEM / SOC system is responsible for further enriching, correlating, prioritizing, and manually responding to the alarms.

[0248] The above combination Figure 1 The APT attack detection method based on dynamic multi-layer semantic augmentation source graph provided in the embodiments of the present invention has been described in detail. Next, the APT attack detection system based on dynamic multi-layer semantic augmentation source graph provided in the embodiments of the present invention will be described in conjunction with the accompanying drawings.

[0249] Figure 4 This is a schematic diagram of the structure of an APT attack detection system based on a dynamic multi-layer semantically enhanced source graph, as shown in an embodiment of the present invention. Figure 4 The system described in this invention includes:

[0250] The data acquisition and standardization module is configured to acquire multi-source event log data and perform standardization processing.

[0251] The dynamic multi-layer semantic enhancement source graph module is configured to: construct a dynamic multi-layer semantic enhancement source graph by fusing features layer by layer, namely the original event layer, the behavior pattern layer, and the threat technology mapping layer; perform deep semantic enhancement on the nodes and edges in the dynamic multi-layer semantic enhancement source graph; maintain the dynamic multi-layer semantic enhancement source graph using an incremental update mechanism; capture attack behavior and extract semantic context; and construct a graph snapshot of the dynamic multi-layer semantic enhancement source graph.

[0252] The attack detection module is configured to: use a pre-trained H-STFT model to embed all nodes in the graph snapshot into the feature space to obtain a node embedding vector set; aggregate all node embedding vectors in the node embedding vector set to obtain a graph-level feature vector; input the graph-level feature vector into a multilayer perceptron classifier with two hidden layers to output the probability that the current graph snapshot is attacked by an APT attack; if the probability exceeds a preset threshold, the current system behavior is determined to be attacked by an APT attack.

[0253] In some embodiments, the data acquisition and standardization module is specifically configured to: standardize event data into a unified JSON format, including core fields such as event ID, timestamp, event type, source process information, target object information, and specific operations, ensuring data consistency and processability, and providing high-quality unified data input for subsequent graph construction.

[0254] In some embodiments, the dynamic multi-layer semantic enhancement source graph module is specifically configured to include an L1 raw event layer (directly composed of standardized events), an L2 behavior pattern layer (abstracting L1 events into advanced behavior patterns such as process injection and privilege escalation), and an L3 threat technology mapping layer (mapping L2 behavior patterns to tactics and techniques in the MITRE ATT&CK framework). This hierarchical structure can capture attack behaviors at different granularities. Deep semantic enhancement is performed on all graph nodes and edges. Semantic information of text features such as process names, command-line arguments, and file paths is embedded using a pre-trained natural language processing model, incorporating rich contextual features (parent process ID, file hash, IP geolocation, etc.). This is then fused with an external threat intelligence knowledge graph containing MITRE ATT&CK, CVE, IOCs entities and relationships. Knowledge graph embedding technology further enriches node features, providing a deep semantic context. DML-PG employs a fixed-time-window strategy to process real-time incoming events in batches, forming a series of graph snapshots. The system maintains and updates the graph structure in real time on the Apache Flink stream processing platform through an efficient incremental graph update mechanism, and periodically cleans up expired data to ensure the graph's real-time performance, timeliness, and scalability.

[0255] Furthermore, the system in this embodiment also includes a self-supervised pre-trained model of the Heterogeneous Spatio-Temporal Fusion Transformer model, which is configured to: design a Heterogeneous Spatio-Temporal Fusion Transformer (H-STFT) and pre-train it using self-supervised contrastive learning. The core innovation of this invention lies in the fact that the H-STFT model, through a novel spatio-temporal decoupling and fusion architecture, is specifically designed for deep analysis of complex attack patterns contained in Dynamic Multi-Layer Semantic Augmentation Source Graph (DML-PG), solving the problem of scarce APT attack samples and enhancing the model's generalization ability.

[0256] The encoder of this model consists of multiple stacked spatiotemporal fusion layers. In each layer, the model first uses a heterogeneous graph attention mechanism (HGAT) to accurately capture the local, structured causal dependencies between different types of nodes and edges (such as processes, files, and network connections) in the DML-PG, i.e., information in the "spatial" dimension. Subsequently, the model introduces a Transformer self-attention mechanism, treating events in the source graph as a time series, thereby capturing long-distance behavioral associations spanning multiple steps, i.e., information in the "temporal" dimension, and accurately integrating the timing of event occurrences through temporal encoding. This design of first aggregating local spatial structure and then modeling global temporal dependencies enables H-STFT to extract high-order feature representations from DML-PG that possess both causal structure and temporal continuity.

[0257] The attack detection module is specifically configured to add a detector to the pre-trained H-STFT encoder for real-time APT attack discrimination. The pre-trained H-STFT encoder encodes real-time DML-PG snapshots as node embeddings and aggregates them into graph-level feature vectors using global average pooling. This vector is then input into a multilayer perceptron (MLP) classifier, which outputs the probability that an APT attack exists in the current graph snapshot. The model is fine-tuned through supervised learning on a small amount of labeled APT attack and normal behavior DML-PG data to further improve detection accuracy. The detector outputs an APT attack anomaly score between 0 and 1. When the score exceeds a preset threshold, the system determines that an APT attack exists and generates an alarm in standardized JSON format. The alarm content includes a detailed alarm ID, time, anomaly score, the DML-PG snapshot ID that triggered the alarm, and detailed information about the suspicious activity subgraph located using the model's attention mechanism (including key nodes, edges, and their contribution weights to the detection results), greatly enhancing the interpretability and traceability of the detection results.

[0258] Furthermore, the system in this embodiment also includes a model deployment and application module, which is configured such that: the H-STFT detection model is deployed on the distributed stream processing platform Apache Flink; the standardized events collected in step 1 are transmitted via Apache Kafka; the graph construction and update service and the detector service both run as independent Flink jobs; model inference utilizes NVIDIA Tesla A100 GPU and TensorRT optimization library for hardware acceleration, ensuring low latency and high throughput. The system continuously monitors and detects real-time incoming system events. When an APT attack is detected, a standardized JSON format alarm event is immediately generated and published to a dedicated Kafka topic "security-alerts" for the Security Information and Event Management (SIEM) system to subscribe to and receive in real time. The H-STFT model periodically performs self-supervised pre-training using the latest unlabeled DML-PG data and collects a small number of novel APT attack samples for supervised fine-tuning to continuously adapt to new normal behavior patterns and the latest threats. The system continuously monitors model performance and updates the external knowledge graph based on threat intelligence to ensure that the model always has the latest threat context knowledge. It runs in real-time and efficiently in a production environment.

[0259] Through the above technical solution, the present invention can achieve early, accurate, and adaptive detection of APT attacks, significantly improving network security defense capabilities.

[0260] The APT attack detection system based on a dynamic multi-layer semantic augmentation source graph according to embodiments of the present invention can correspond to the execution of the method described in the embodiments of the present invention, and the above and other operations and / or functions of each module of the APT attack detection system based on a dynamic multi-layer semantic augmentation source graph are respectively for implementing Figure 1 For the sake of brevity, the corresponding processes of each method in the code will not be elaborated here.

[0261] See Figure 5The diagram shows the structure of a computer device, which includes a processor, a communication interface, and a computer-readable storage medium. The processor, communication interface, and computer-readable storage medium are connected via a bus or other means. The communication interface is used to receive and send data. The computer-readable storage medium can be stored in the computer device's memory. The computer-readable storage medium stores computer programs, including program instructions, and the processor executes the program instructions stored in the computer-readable storage medium. The processor (or CPU, Central Processing Unit) is the computing and control core of the computer device, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions to implement the corresponding steps in the embodiment of the APT attack detection method based on a dynamic multi-layer semantic enhancement source graph.

[0262] This embodiment provides a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the processing system of the computer device.

[0263] Furthermore, this storage space also contains one or more instructions suitable for loading and execution by the processor. These instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM memory or non-volatile memory, such as at least one disk storage device; optionally, it can also be at least one computer-readable storage medium located remotely from the aforementioned processor.

[0264] In one embodiment, the computer-readable storage medium stores one or more instructions; the processor loads and executes one or more instructions stored in the computer-readable storage medium to implement the corresponding steps in the above embodiment of the APT attack detection method based on dynamic multi-layer semantic enhancement source graph.

[0265] This embodiment provides a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the corresponding steps in the above embodiment of the APT attack detection method based on a dynamic multi-layer semantic enhancement source graph.

[0266] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0267] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0268] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0269] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0270] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0271] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An APT attack detection method based on a dynamic multi-layer semantically enhanced source graph, characterized in that, include: Acquire multi-source event log data and perform standardization processing; A dynamic multi-layer semantic augmentation source graph is constructed by sequentially fusing features from the original event layer, behavior pattern layer, and threat technology mapping layer. Deep semantic augmentation is performed on the nodes and edges in the dynamic multi-layer semantic augmentation source graph, and an incremental update mechanism is used to maintain the dynamic multi-layer semantic augmentation source graph. Attack behaviors are captured and semantic context is extracted. A graph snapshot of the dynamic multi-layer semantic augmentation source graph is constructed. The graph snapshot is an independent and complete instance of the dynamic multi-layer semantic augmentation source graph, which specifically contains and represents all system activities that occur within a specific time window. Its detailed composition includes: content of the original event layer, content of the behavior pattern layer, and content of the threat technology mapping layer. The method for constructing a dynamic, multi-layered semantically enhanced source map that sequentially fuses features from the original event layer, behavior pattern layer, and threat technology mapping layer includes: Each standardized system event data is treated as a graph node, and the causal relationships between events are treated as directed edges, thus constructing the graph structure of the original event layer; discrete features are one-hot encoded to obtain discrete feature vectors; preliminary semantic encoding is performed on text features to obtain semantic embedding vectors of text features; the discrete feature vectors are concatenated with the semantic embedding vectors of text features to obtain event node feature vectors. Based on a set of related original events in the graph structure of the original event layer, behavioral patterns are identified, the type of behavioral pattern is defined as node type, and the relationship between behavioral nodes is defined as edge type, thus constructing the graph structure of the behavioral pattern layer; the feature vector of each behavioral node is aggregated from the feature vectors of all the event nodes it contains. Behavioral patterns are associated with known attack tactics through a predefined set of mapping rules; a graph structure for the threat technology mapping layer is constructed based on the node and edge types defined by the attack tactics; the feature vector of each attack tactic node is aggregated from the feature vectors of all the behavioral nodes it contains; Based on the graph structures of the original event layer, the behavior pattern layer, and the threat technology mapping layer, a dynamic multi-layer semantically enhanced source tracing graph is constructed. Using a pre-trained H-STFT model, all nodes in the graph snapshot are embedded into the feature space to obtain a node embedding vector set. All node embedding vectors in the node embedding vector set are aggregated to obtain a graph-level feature vector. The graph-level feature vector is input into a multilayer perceptron classifier with two hidden layers to output the probability that the current graph snapshot is attacked by an APT. If the probability exceeds a preset threshold, the current system behavior is determined to be attacked by an APT.

2. The APT attack detection method based on dynamic multi-layer semantic enhancement source graph according to claim 1, characterized in that, The method for performing deep semantic enhancement on nodes and edges in a dynamic multi-layer semantic enhancement source graph includes: Based on the text fields contained in the node features of the graph structures of the original event layer, the behavior pattern layer, and the threat technology mapping layer, a semantic embedding representation is obtained; the discrete feature vector is concatenated with the semantic embedding representation to obtain the enhanced initial feature vector of the node. By integrating important contextual information about the event occurrence into the corresponding node features, introducing a threat intelligence knowledge graph, identifying the association between nodes in the dynamic multi-layer semantically enhanced tracing graph and entities in the threat intelligence knowledge graph, and injecting features, a fused feature is obtained.

3. The APT attack detection method based on dynamic multi-layer semantic enhancement source graph according to claim 2, characterized in that, The identification of the associations between nodes in the dynamic multi-layer semantically enhanced tracing graph and entities in the threat intelligence knowledge graph includes: For nodes in the threat technology mapping layer, a direct identifier matching mechanism is used to find the corresponding attack behavior entities; For nodes in the behavior pattern layer, an underlying event attribute matching mechanism is used to check the attributes of all event nodes of the behavior; based on the attributes, attack behavior entities in the threat intelligence knowledge graph are matched.

4. The APT attack detection method based on dynamic multi-layer semantic enhancement source graph according to claim 1, characterized in that, The method for maintaining a dynamic multi-layer semantic enhancement source graph using an incremental update mechanism includes: New node and edge creation: For newly arrived original event layer events that are not in this dynamic multi-layer semantically enhanced tracing graph, create new original event layer nodes and their causal relationship edges; When a new batch of raw events from the raw event layer flows in, a deterministic layered update process will be executed, including: behavior pattern identification and judgment in the behavior pattern layer, creation of new nodes in the behavior pattern layer; updating of existing nodes in the behavior pattern layer, synchronization of the threat technology mapping layer triggered by the creation of nodes in the behavior pattern layer, and synchronization of the threat technology mapping layer triggered by the updating of nodes in the behavior pattern layer. If the attributes of an existing node change, its feature vector is updated synchronously.

5. The APT attack detection method based on dynamic multi-layer semantic enhancement source graph according to claim 1, characterized in that, The pre-training process of the H-STFT model includes: A snapshot of the dynamic multi-layer semantically enhanced source graph is input into the encoder for temporal encoding to obtain temporal encoded features. Local spatial structure information is aggregated into the temporal encoded features to obtain spatiotemporal features, which are then enhanced. Contrastive learning was used to train the added spatiotemporal features, and a pre-trained H-STFT model was obtained after the termination condition was met.

6. An APT attack detection system based on a dynamic multi-layer semantically enhanced source graph, characterized in that, include: The data acquisition and standardization module is configured to acquire multi-source event log data and perform standardization processing. The Dynamic Multi-Layer Semantic Augmentation Source Graph module is configured to: construct a dynamic multi-layer semantic augmentation source graph by fusing features layer by layer, namely the original event layer, the behavior pattern layer, and the threat technology mapping layer; perform deep semantic augmentation on the nodes and edges in the dynamic multi-layer semantic augmentation source graph; maintain the dynamic multi-layer semantic augmentation source graph using an incremental update mechanism; capture attack behaviors and extract semantic context; and construct a graph snapshot of the dynamic multi-layer semantic augmentation source graph. The graph snapshot is an independent and complete instance of the dynamic multi-layer semantic augmentation source graph, specifically containing and representing all system activities that occur within a specific time window. Its detailed composition includes: the content of the original event layer, the content of the behavior pattern layer, and the content of the threat technology mapping layer. The method for constructing a dynamic, multi-layered semantically enhanced source map that sequentially fuses features from the original event layer, behavior pattern layer, and threat technology mapping layer includes: Each standardized system event data is treated as a graph node, and the causal relationships between events are treated as directed edges, thus constructing the graph structure of the original event layer; discrete features are one-hot encoded to obtain discrete feature vectors; preliminary semantic encoding is performed on text features to obtain semantic embedding vectors of text features; the discrete feature vectors are concatenated with the semantic embedding vectors of text features to obtain event node feature vectors. Based on a set of related original events in the graph structure of the original event layer, behavioral patterns are identified, the type of behavioral pattern is defined as node type, and the relationship between behavioral nodes is defined as edge type, thus constructing the graph structure of the behavioral pattern layer; the feature vector of each behavioral node is aggregated from the feature vectors of all the event nodes it contains. Behavioral patterns are associated with known attack tactics through a predefined set of mapping rules; a graph structure for the threat technology mapping layer is constructed based on the node and edge types defined by the attack tactics; the feature vector of each attack tactic node is aggregated from the feature vectors of all the behavioral nodes it contains; Based on the graph structures of the original event layer, the behavior pattern layer, and the threat technology mapping layer, a dynamic multi-layer semantically enhanced source tracing graph is constructed. The attack detection module is configured to: use a pre-trained H-STFT model to embed all nodes in the graph snapshot into the feature space to obtain a node embedding vector set; aggregate all node embedding vectors in the node embedding vector set to obtain a graph-level feature vector; input the graph-level feature vector into a multilayer perceptron classifier with two hidden layers to output the probability that the current graph snapshot is attacked by an APT attack; if the probability exceeds a preset threshold, the current system behavior is determined to be attacked by an APT attack.

7. A computer device, characterized in that, A processor, adapted to execute computer programs; A computer-readable storage medium storing a computer program, which, when executed by the processor, implements the steps of the APT attack detection method based on a dynamic multi-layer semantically enhanced source graph as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program adapted to be loaded by a processor and execute the steps in the APT attack detection method based on a dynamic multi-layer semantically enhanced source graph as described in any one of claims 1-5.

9. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the steps in the APT attack detection method based on a dynamic multi-layer semantically enhanced source graph as described in any one of claims 1-5.

Images