Cross-space attack path tracing method and system based on space-time fingerprints

Abstract

The invention discloses a cross-space attack path tracing method and system based on space-time fingerprints, and relates to the technical field of network security. The method comprises the following steps: determining space-time fingerprint characteristics according to a timestamp, a source IP address and geographic coordinate data of a network attack event; carrying out relevance measurement through space-time fingerprint characteristics, and determining a cross-physical space first-class fingerprint relevance graph and a cross-network space second-class fingerprint relevance graph; and based on the cross-physical-space first-class fingerprint association map and the cross-network-space second-class fingerprint association map, using an attack path reasoning model based on a causal discovery algorithm in combination with an attack behavior knowledge base to determine a traceability path. The technical problem that the cross-space network attack path is difficult to accurately identify and trace in the prior art is solved, and the technical effects of realizing high-precision association and causal tracing of the attack behavior cross-physical space and network space based on the space-time fingerprint information and improving the accuracy and integrity of attack path reconstruction are achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a cross-space attack path tracing method and system based on space-time fingerprints. BACKGROUND

[0002] Under the background of the current network security situation becoming increasingly complex, network attack behaviors present the characteristics of strong concealment, various means and path crossing domains, especially in distributed systems, Internet of Things, cloud computing and other environments, attack behaviors often cross multiple physical locations and network spaces, bringing severe challenges to traditional attack tracing methods. Existing tracing technologies mostly rely on IP tracking, log auditing, traffic backtracking and other methods, which are often limited to static analysis of single-dimensional data, and are difficult to effectively cope with the dynamic evolution characteristics of attack behaviors in time, space and behavior dimensions, resulting in poor accuracy and limited coverage of the tracing results, making it difficult to meet the security protection needs of key systems and infrastructure. SUMMARY

[0003] The present application provides a cross-space attack path tracing method and system based on space-time fingerprints, which solves the technical problem of being difficult to accurately identify and trace cross-space network attack paths in the prior art.

[0004] In a first aspect, the present application provides a cross-space attack path tracing method based on space-time fingerprints, which comprises: According to the timestamp, source IP address and geographic coordinate data of the network attack event, the space-time fingerprint feature is determined; the correlation of the space-time fingerprint feature is measured to determine a class of fingerprint correlation graph across physical space and a class of fingerprint correlation graph across network space; based on the class of fingerprint correlation graph across physical space and the class of fingerprint correlation graph across network space, the attack path reasoning model based on the causal discovery algorithm is used in combination with the attack behavior knowledge base to determine the tracing path.

[0005] In a second aspect, the present application provides a cross-space attack path tracing system based on space-time fingerprints, which comprises: The feature determination module determines the space-time fingerprint feature according to the timestamp, source IP address and geographic coordinate data of the network attack event; the correlation graph construction module measures the correlation of the space-time fingerprint feature to determine a class of fingerprint correlation graph across physical space and a class of fingerprint correlation graph across network space; the tracing path determination module determines the tracing path based on the class of fingerprint correlation graph across physical space and the class of fingerprint correlation graph across network space in combination with the attack behavior knowledge base using the attack path reasoning model based on the causal discovery algorithm.

[0006] One or more technical solutions provided in the present application have at least the following technical effects or advantages: Firstly, according to the timestamp, source IP address and geographic coordinate data of the network attack event, the space-time fingerprint feature is determined. Then, the correlation measurement is carried out through the space-time fingerprint feature to determine the first type of fingerprint correlation graph across the physical space and the second type of fingerprint correlation graph across the network space. Finally, based on the first type of fingerprint correlation graph across the physical space and the second type of fingerprint correlation graph across the network space, the attack path reasoning model based on the causal discovery algorithm is used in combination with the attack behavior knowledge base to determine the tracing path. The technical problem that the existing technology is difficult to accurately identify and trace the attack path across the space network is solved, and the technical effects of realizing high-precision correlation and causal tracing of attack behavior across the physical space and network space based on space-time fingerprint information, and improving the accuracy and completeness of attack path reconstruction are achieved. BRIEF DESCRIPTION OF DRAWINGS

[0007] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0008] Figure 1 A space-time fingerprint-based cross-space attack path tracing method flowchart provided by the embodiment of the present application; Figure 2 A space-time fingerprint-based cross-space attack path tracing system structure diagram provided by the embodiment of the present application.

[0009] Explanation of reference signs: feature determination module 11, correlation graph construction module 12, and tracing path determination module 13. DETAILED DESCRIPTION

[0010] The present application provides a space-time fingerprint-based cross-space attack path tracing method and system, which solves the technical problem that the existing technology is difficult to accurately identify and trace the attack path across the space network.

[0011] The technical solutions in the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0012] It is to be understood that the terms "including", "comprising", "having" and "with" are meant to be interpreted inclusively and non-exclusively, that is, "including" means including but not limited to, "comprising" means comprising but not limited to, and "with" means including, but not limited to.

[0013] Embodiment one, as shown in the application provides a cross-space attack path tracing method based on space-time fingerprint, wherein the method comprises: Figure 1 According to the timestamp, source IP address and geographic coordinate data of the network attack event, the space-time fingerprint feature is determined.

[0014] For each network attack event, its corresponding timestamp, source IP address and geographic coordinate data are obtained as basic information for constructing the space-time fingerprint feature. The timestamp is used to represent the occurrence time of the attack behavior, usually represented by UTC standard time; the source IP address is used to identify the network node initiating the attack; and the geographic coordinate data is obtained by IP address resolution, GPS positioning, network node home database, etc., representing the physical location of the attack source.

[0015] Further, according to the timestamp, source IP address and geographic coordinate data of the network attack event, the space-time fingerprint feature is determined, comprising: The attack payload feature code and the target device hardware fingerprint are introduced as supplementary features; the timestamp, source IP address and geographic coordinate data of the network attack event are combined with the supplementary features to determine the space-time fingerprint feature.

[0016] On the basis of constructing the basic triple feature based on the timestamp, source IP address and geographic coordinate data of the network attack event, the attack payload feature code and the target device hardware fingerprint are introduced as supplementary features. The attack payload feature code is used to identify the data characteristics carried by the attack behavior, such as malicious instruction fragments, specific protocol field offset features, or specific payload hash values, etc.; the target device hardware fingerprint can be obtained by device MAC address, CPU serial number, firmware version, or specific response behavior mode, etc., to represent the physical properties of the attacked device.

[0017] ​The above supplementary features are fused with the original feature triplets (timestamp, source IP address, geographic coordinates) to form an initial feature set. Subsequently, feature screening is performed according to the importance, stability and attack behavior correlation of the features. Feature screening can use statistical learning methods such as information gain, mutual information score, principal component analysis (PCA), or filter redundant or invalid features based on pre-set rules. Finally, through the above fusion and screening process, a spatiotemporal fingerprint feature set containing time, space, behavior content and target attribute is constructed, which has the ability to distinguish attack behavior and correlation analysis across events and spaces.

[0018] Further, in combination with the supplementary features, the spatiotemporal fingerprint features are determined by feature screening, including: According to the supplementary features, fixed-length feature values are generated by hash processing, and are concatenated with the original feature values to obtain a multi-dimensional feature set; the multi-dimensional feature set is used for feature screening to obtain the spatiotemporal fingerprint features.

[0019] To improve the representation ability of spatiotemporal fingerprint features in correlation analysis, the introduced supplementary features (including attack payload feature code and target device hardware fingerprint) are uniformly hashed to generate fixed-length feature values. Specifically, SHA-256, MD5, or SipHash security hash algorithm can be used to process the original data content of the supplementary features to ensure that the generated results have fixed length and collision resistance while maintaining feature difference. Then, the hash-processed supplementary feature values are concatenated with the original spatiotemporal basic feature values (such as standardized timestamp, IP address encoding, geographic coordinate vector) to construct a uniform format multi-dimensional feature set. This feature set integrates the time dimension, spatial location, network identity, payload behavior features and target hardware attributes of the attack, and has strong description ability and uniqueness.

[0020] Through feature screening processing on the multi-dimensional feature set, redundant information is removed and modeling efficiency is improved. Feature screening can use filtering methods (such as variance threshold, chi-square test, mutual information measure), or based on embedded models (such as random forest, L1 regularization regression) to sort feature importance, and retain key features that have significant contribution to attack behavior identification and path correlation. The final selected feature set is the spatiotemporal fingerprint feature used as input for subsequent construction of cross-space attack graph and reasoning model, which has high stability, strong discrimination and good cross-scene adaptability.

[0021] The spatiotemporal fingerprint features are used to measure correlation to determine a class of fingerprint correlation graph across physical space and a class of fingerprint correlation graph across network space.

[0022] Based on the spatiotemporal fingerprint feature set, correlation is measured from two dimensions of physical space and network space respectively, and corresponding cross-space fingerprint correlation graphs are constructed. Among them, the first type of fingerprint correlation graph across the physical space is used to represent the connection between attack nodes with potential attack paths or behavior continuity between different physical locations, and the second type of fingerprint correlation graph across the network space is used to capture the logical connection or communication association of attack events existing in the network topology.

[0023] Further, the first type of fingerprint correlation graph across the physical space is determined by measuring the correlation based on the spatiotemporal fingerprint features, comprising: The product of the geographical spatial distance and the time interval is taken as the physical correlation quantification index; and the spatiotemporal fingerprint features are measured once for correlation using the physical correlation quantification index.

[0024] Specifically, when constructing the first type of fingerprint correlation graph, the spatiotemporal fingerprints of any two attack events are measured once for correlation using the physical correlation quantification index, which can be represented by the product of the geographical spatial distance and the time interval. The geographical spatial distance can be calculated by the GPS coordinates or the IP attribution distance, and the time interval is calculated based on the standardized timestamp. The smaller the measurement value is, the more likely it is that the two events are dominated by the same attack entity or there is a physical migration path in the physical space. Based on the physical correlation quantification index, a pre-defined physical correlation threshold is set, and the sample pairs with a physical correlation degree lower than the threshold in all attack event pairs are selected as the effective edge connections in the graph. The nodes in the graph correspond to each attack event, and the edge weight between the nodes is the physical correlation measurement value. The first type of fingerprint correlation graph constructed finally is used to represent the potential propagation path and behavior correlation of attack behavior in the physical space dimension.

[0025] Further, the second type of fingerprint correlation graph across the network space is determined by measuring the correlation based on the spatiotemporal fingerprint features, comprising: The network correlation quantification index is configured based on the IP address topology relationship and the port interaction frequency; and the spatiotemporal fingerprint features are measured twice for correlation using the network correlation quantification index.

[0026] When constructing the second type of fingerprint correlation graph, the source IP address and port behavior information in the spatiotemporal fingerprint features of the attack events are used for secondary correlation measurement in the network dimension.

[0027] First, the network identification features corresponding to each attack event are extracted, including the source IP address, the target IP address, the source port, the target port, the communication protocol type, the session frequency, etc., and the network correlation quantification index is configured based on the IP address topology relationship and the port interaction frequency.

[0028] IP address topology relationship: subnet division and routing relationship analysis are performed on the source IP and target IP addresses to determine whether they belong to the same subnet, whether they are in the known upstream / downstream relationship path, or whether there is a history record of belonging to the same autonomous system (AS). Such topology can be assisted by BGP routing table, network topology diagram or threat intelligence library for auxiliary analysis, forming a logical adjacency metric item.

[0029] Port interaction frequency: the communication port usage frequency between the source and target and its behavior pattern (such as connection success rate, response delay, abnormal handshake) are counted, and the historical behavior database is used to evaluate whether the frequency is significantly higher than the normal level, or whether it is similar to the known attack behavior pattern (such as scanning, brute force cracking, vulnerability exploitation, etc.).

[0030] The above two types of indicators are combined by weighting or fusion to form a comprehensive network correlation quantitative indicator, and the network behavior characteristics of any two groups of attack events are associated with the degree of correlation score, and the logical correlation strength in the network space is obtained. Subsequently, according to the set network correlation threshold, the attack event pairs with network correlation degree higher than the threshold are screened out, and the graph connection relationship is established. Each node in the graph represents an attack event with complete time and space characteristics, and the edge between the nodes represents a logical connection with strong correlation in the network path or communication behavior level. The graph is a two-fingerprint correlation graph, which is used to represent the propagation trend, jump path and behavior chain of attack behavior in the network space dimension.

[0031] Based on the one-fingerprint correlation graph across the physical space, the two-fingerprint correlation graph across the network space, and the attack behavior knowledge base, an attack path reasoning model based on causal discovery algorithm is used to determine the tracing path.

[0032] Based on the constructed cross-physical space one-class fingerprint correlation graph and cross-network space two-class fingerprint correlation graph, combined with the pre-established attack behavior knowledge base, an attack path reasoning model based on causal discovery algorithm is used to determine the attack path of network attack. Specifically, first, through the cross-space mapping relationship, the abnormal state nodes of physical devices in the physical space correlation graph are associated with the network attack event nodes in the network space correlation graph, forming the input variable set of causal reasoning. Second, the attack tactics, techniques and procedures (TTPs) information in the attack behavior knowledge base is used to extract and label the behavior semantics of the associated nodes, assisting the causal discovery algorithm to identify the potential causal dependence relationship. Then, based on the causal discovery algorithm (such as Granger causality test, Bayesian network structure learning, constraint-based causal discovery method, etc.), the causal structure of the input variable set is mined to identify the causal direction and dependence strength between nodes, and to reveal the causal chain and propagation path of attack behavior. Finally, according to the mined causal dependence relationship, the attack path tracing graph is constructed and output, the attack starting point, propagation path and relay node are determined, and the comprehensive attack path reconstruction and accurate tracing of cross-physical space and network space are realized.

[0033] Further, based on the cross-physical space one-class fingerprint correlation graph, the cross-network space two-class fingerprint correlation graph, and the attack behavior knowledge base, the attack path reasoning model based on causal discovery algorithm is used to determine the tracing path, including: Through the cross-space mapping relationship, the abnormal state nodes of physical devices in the one-class fingerprint correlation graph are associated with the network attack nodes in the two-class fingerprint correlation graph, as the input variable set of the causal discovery algorithm; the attack path reasoning model based on causal discovery algorithm is used to mine the causal dependence relationship, and the tracing path is generated.

[0034] First, the cross-space mapping relationship is established to associate and align the abnormal state nodes of physical devices in the one-class fingerprint correlation graph with the network attack nodes in the two-class fingerprint correlation graph. The cross-space mapping relationship comprehensively considers the timestamp consistency, geographical location proximity, IP address mapping and semantic similarity of attack behavior characteristics of the nodes, realizes the effective correspondence of the nodes in the physical space and the network space, and thus forms the input variable set required by the causal discovery algorithm. Subsequently, the tactics, techniques and procedures (TTPs) information in the attack behavior knowledge base is used to perform semantic labeling and feature enhancement on the input variables, assisting the causal discovery algorithm to identify the potential causal relationship. The causal discovery algorithm used includes but is not limited to Bayesian network structure learning, Granger causality test and constraint-based causal reasoning method, which analyzes the dependence structure between the input variables to mine the causal direction and strength between the nodes. Finally, based on the mined causal dependence relationship, the tracing path graph reflecting the attack behavior evolution path of cross-physical space and network space is generated.

[0035] Further, it also includes: According to the nodes of the first type of fingerprint correlation graph and the nodes of the second type of fingerprint correlation graph, extract attack tactic semantic features; based on a historical attack case library, combine the attack tactic semantic features to establish a cross-space mapping relationship.

[0036] First, for the first type of fingerprint correlation graph nodes across the physical space and the second type of fingerprint correlation graph nodes across the network space, their corresponding attack tactic semantic features are extracted respectively. Attack tactic semantic features cover the tactics, techniques and procedures (TTPs) adopted by attackers, such as attack method categories (such as phishing, horizontal movement, privilege escalation), vulnerability types used, attack tool features, and attack behavior patterns. Attack tactic semantic features can be based on log information, behavior indicators and security event descriptions associated with nodes, and can be achieved through natural language processing, feature encoding and pattern matching techniques.

[0037] Second, based on the extracted attack tactic semantic features, the known attack paths, behavior patterns and corresponding TTPs information accumulated in the historical attack case library are combined to establish a cross-space mapping relationship between the physical space nodes and the network space nodes. The cross-space mapping relationship is constructed through semantic similarity calculation, pattern matching and machine learning methods to ensure that attack events in the physical and network spaces can be accurately associated, thereby providing high-quality input data for the causal reasoning model.

[0038] In summary, the embodiments of the present application have at least the following technical effects: First, according to the timestamp, source IP address and geographic coordinate data of the network attack event, the spatiotemporal fingerprint feature is determined. Then, the correlation is measured by the spatiotemporal fingerprint feature to determine the first type of fingerprint correlation graph across the physical space and the second type of fingerprint correlation graph across the network space. Finally, based on the first type of fingerprint correlation graph across the physical space and the second type of fingerprint correlation graph across the network space, the attack path reasoning model based on causal discovery algorithm is used in combination with the attack behavior knowledge base to determine the tracing path. The technical problem of being difficult to accurately identify and trace the cross-space network attack path in the prior art is solved, and the technical effects of achieving high-precision correlation and causal tracing of attack behavior across the physical space and the network space based on spatiotemporal fingerprint information, and improving the accuracy and completeness of attack path reconstruction are achieved.

[0039] Embodiment two, based on the same inventive concept as the cross-space attack path tracing method based on spatiotemporal fingerprint in the foregoing embodiments, as Figure 2 shown, the present application provides a cross-space attack path tracing system based on spatiotemporal fingerprint, wherein the system comprises: The feature determination module 11 determines a space-time fingerprint feature according to the timestamp, source IP address and geographic coordinate data of the network attack event; the correlation graph construction module 12 determines a first type of fingerprint correlation graph across a physical space and a second type of fingerprint correlation graph across a network space by performing correlation measurement on the space-time fingerprint feature; and the traceability path determination module 13 determines a traceability path by using an attack path reasoning model based on a causal discovery algorithm in combination with an attack behavior knowledge base based on the first type of fingerprint correlation graph across the physical space and the second type of fingerprint correlation graph across the network space.

[0040] Further, the correlation graph construction module 12 is configured to perform the following method: The product of the geographic spatial distance and the time interval is taken as a physical correlation quantitative index, and the space-time fingerprint feature is subjected to primary correlation measurement using the physical correlation quantitative index.

[0041] Further, the correlation graph construction module 12 is configured to perform the following method: A network correlation quantitative index is configured based on the IP address topology relationship and the port interaction frequency, and the space-time fingerprint feature is subjected to secondary correlation measurement using the network correlation quantitative index.

[0042] Further, the feature determination module 11 is configured to perform the following method: Attack payload feature codes and target device hardware fingerprints are introduced as supplementary features, and the space-time fingerprint feature is determined by performing feature screening on the timestamp, source IP address and geographic coordinate data of the network attack event in combination with the supplementary features.

[0043] Further, the feature determination module 11 is configured to perform the following method: The supplementary features are subjected to hash processing to generate fixed-length feature values, which are concatenated with original feature values to obtain a multi-dimensional feature set, and the space-time fingerprint feature is obtained by performing feature screening using the multi-dimensional feature set.

[0044] Further, the traceability path determination module 13 is configured to perform the following method: The physical device abnormal state nodes in the first type of fingerprint correlation graph and the network attack nodes in the second type of fingerprint correlation graph are associated and aligned as an input variable set of a causal discovery algorithm through a cross-space mapping relationship, and the traceability path is generated by using an attack path reasoning model based on a causal discovery algorithm to mine causal dependency relationships.

[0045] Further, the traceability path determination module 13 is configured to perform the following method: According to the nodes of the first type of fingerprint correlation graph and the nodes of the second type of fingerprint correlation graph, attack tactic semantic features are extracted; and based on a historical attack case library, a cross-space mapping relationship is established in combination with the attack tactic semantic features.

[0046] It should be noted that the above sequence of the embodiments of the present application is only for description, and does not represent the advantages and disadvantages of the embodiments. The above describes a specific embodiment of the present application. The processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multi-task processing and parallel processing are possible or can be advantageous.

[0047] The above only describes the preferred embodiments of the present application and does not limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

[0048] The specification and drawings are merely exemplary of the present application, and any and all modifications, variations, combinations or equivalents that fall within the scope of the present application are considered to be covered by the present application. Obviously, those skilled in the art can make various modifications and variations to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application belong to the scope of the present application and its equivalent technology, the present application is intended to include these modifications and variations.

Claims

1. A method for tracing cross-spatial attack paths based on spatiotemporal fingerprinting, characterized in that, The method includes: Based on the timestamps, source IP addresses, and geographic coordinates of the network attack events, spatiotemporal fingerprint characteristics are determined. By measuring the correlation through the spatiotemporal fingerprint features, a first-class fingerprint correlation map across physical space and a second-class fingerprint correlation map across cyberspace are determined. Based on the cross-physical space fingerprint association map and the cross-cyberspace fingerprint association map, combined with the attack behavior knowledge base, an attack path inference model based on causal discovery algorithm is used to determine the source tracing path.

2. The method as described in claim 1, characterized in that, By performing correlation measurement on the spatiotemporal fingerprint features, a type of fingerprint association map across physical spaces is determined, the method comprising: The product of geographic spatial distance and time interval is used as a metric for physical association. The spatiotemporal fingerprint features are measured using the physical correlation metric.

3. The method as described in claim 2, characterized in that, The method involves measuring the correlation of spatiotemporal fingerprint features to determine a cross-network space binary fingerprint association map, the method comprising: Configure network association metrics based on IP address topology and port interaction frequency; The spatiotemporal fingerprint features are subjected to a secondary correlation measurement using the network correlation metric.

4. The method as described in claim 1, characterized in that, The method for determining spatiotemporal fingerprint features based on the timestamp, source IP address, and geographic coordinates of a network attack event includes: Attack payload signatures and target device hardware fingerprints are introduced as supplementary features; Based on the timestamp, source IP address, and geographic coordinates of the network attack event, and combined with the supplementary features, feature filtering is performed to determine the spatiotemporal fingerprint features.

5. The method as described in claim 4, characterized in that, The method for determining spatiotemporal fingerprint features by combining the supplementary features with feature filtering includes: Based on the supplementary features, hash processing is performed to generate fixed-length feature values, which are then concatenated with the original feature values ​​to obtain a multi-dimensional feature set. The spatiotemporal fingerprint features are obtained by using the multi-dimensional feature set for feature filtering.

6. The method as described in claim 1, characterized in that, Based on cross-physical space type 1 fingerprint association maps and cross-cyberspace type 2 fingerprint association maps, combined with an attack behavior knowledge base, an attack path inference model based on causal discovery algorithm is used to determine the source tracing path. The method includes: By using cross-spatial mapping relationships, the abnormal physical device state nodes in the first type of fingerprint association map are associated and aligned with the network attack nodes in the second type of fingerprint association map, which serve as the input variable set for the causal discovery algorithm. An attack path inference model based on a causal discovery algorithm is used to mine causal dependencies and generate the source tracing path.

7. The method as described in claim 6, characterized in that, The method further includes: Based on the nodes of the first type of fingerprint association graph and the nodes of the second type of fingerprint association graph, extract attack tactical semantic features; Based on a historical attack case database and combined with the semantic features of the attack tactics, a cross-space mapping relationship is established.

8. A cross-space attack path tracing system based on spatiotemporal fingerprinting, characterized in that, The system is used to implement the cross-space attack path tracing method based on spatiotemporal fingerprinting as described in any one of claims 1-7, the system comprising: Feature determination module: Determines spatiotemporal fingerprint features based on the timestamp, source IP address, and geographic coordinate data of the network attack event; Association graph construction module: Based on the spatiotemporal fingerprint features, the association is measured to determine the first-class fingerprint association graph across physical space and the second-class fingerprint association graph across network space; Source tracing path determination module: Based on the cross-physical space type 1 fingerprint association map and the cross-network space type 2 fingerprint association map, combined with the attack behavior knowledge base, an attack path inference model based on causal discovery algorithm is used to determine the source tracing path.

Images