An apt organization infrastructure hunting method based on ioc recursive expansion
By constructing a recursive extension method for IOC, the problems of insufficient automation and accuracy in detecting APT organization infrastructure in existing technologies are solved, realizing automated extension and efficient detection from single-point IOC to the organization level.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- 北京国御网络安全技术有限公司
- Filing Date
- 2025-10-23
- Publication Date
- 2026-05-15
AI Technical Summary
Existing technologies for detecting and tracking advanced persistent threat (APT) organization infrastructure suffer from high reliance on human intervention, insufficient scalability, lack of a holistic perspective, low automation, and unstable accuracy, making it difficult to achieve a complete infrastructure view from a single point of indices (IOCs) to the organization level.
A method based on IOC recursive extension is constructed, including seed IOC standardization processing, multiple extension operators, feature extraction and risk scoring, graph construction and closed-loop iteration, to achieve automated extension and overall view from single-point IOC to organization-level APT infrastructure.
It improves the efficiency and completeness of IOC discovery, reduces the false positive rate, and enables automated, continuous, and interpretable detection of APT infrastructure.
Smart Images
Figure CN121173578B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, specifically to an APT organization infrastructure hunting method based on IOC recursive extension. Background Technology
[0002] With the continuous development of informatization and networking, cyberattacks are showing trends towards organization, long-term nature, and stealth. Advanced Persistent Threats (APTs), as a typical example, are usually carried out by attack organizations with abundant resources and professional capabilities. They are characterized by long-term infiltration, continuous penetration, and distributed control. Their attacks not only rely on malicious code and vulnerability exploitation but also depend on infrastructure such as command and control servers, proxy nodes, malicious domains, and dynamic IP addresses to maintain the attack chain. In existing cybersecurity defense practices, Indicators of Compromise (IOCs) are an important means of threat detection and tracking. IOCs often include information such as IP addresses, domain names, URLs, file hashes, certificate fingerprints, and registered email addresses. By matching IOCs with logs, traffic, and assets, potential attack behaviors can be discovered. However, the detection capability of a single IOC is limited, making it difficult to reveal the complete attack chain and all the infrastructure used by the attack organization.
[0003] In existing technologies, threat detection and tracking are generally carried out using IOCs in the following ways: importing IOC blacklists into security devices and security operations platforms for real-time or offline comparison, collecting and distributing IOCs through threat intelligence platforms, using graph databases to build relationships between IOCs for analysis and visualization, and using algorithms to identify and supplement detection of suspicious domains and IPs.
[0004] While existing methods have improved threat detection capabilities to some extent, they still have the following shortcomings: 1. Reliance on manual intervention: A large number of IOCs need to be manually merged, verified, and evaluated, which is inefficient and prone to omissions; 2. Insufficient scalability: Most methods can only perform one-time horizontal expansion and lack vertical recursive capabilities, making it difficult to mine more related IOCs layer by layer; 3. Lack of a holistic perspective: Most methods remain at the level of a single IOC or a small range of correlations, failing to form an organizational-level overall infrastructure view; 4. Insufficient automation: Some methods rely on complex models, have a low degree of engineering, and are difficult to deploy on a large scale in enterprise environments; 5. Unstable accuracy: Large-scale expansion can easily introduce low-confidence IOCs, resulting in a high false positive rate and affecting the credibility of the detection results. Summary of the Invention
[0005] The purpose of this invention is to provide an APT organization infrastructure hunting method based on IOC recursive extension, so as to solve the problems mentioned in the background art.
[0006] To achieve the above objectives, this invention provides the following technical solution: an APT organization infrastructure hunting method based on IOC recursive expansion, comprising the following steps: Step 1, model construction; Step 2, seed IOC standardization processing; Step 3, IOC recursive expansion; Step 4, feature extraction and risk scoring; Step 5, map construction; Step 6, risk classification and processing; Step 7, closed-loop iteration;
[0007] In step one above, a method model is constructed, which includes a seed input module, an IOC collection and recursive expansion module, a preprocessing and priority scheduling module, a feature extraction and risk scoring module, a graph construction and analysis module, a threshold classification and intelligence writing-back module, and a system management and auditing module.
[0008] In step two above, the seed input module receives the seed IOC, performs format standardization and deduplication on the seed IOC, and generates a standardized seed IOC list.
[0009] In step three above, the preprocessing and priority scheduling module performs preliminary credibility scoring and priority calculation on the seed IOCs in the standardized seed IOC list. The IOC collection and recursive expansion module triggers the expansion operator to perform expansion operations on the seed IOC with the highest priority, generating candidate IOCs with attached metadata. The preprocessing and priority scheduling module normalizes, merges duplicates, performs preliminary credibility scoring and priority calculation on the candidate IOCs. The IOC collection and recursive expansion module triggers the expansion operator to perform expansion operations on the candidate IOC with the highest priority. The process of recursively triggering the expansion operator to perform expansion operations on the candidate IOCs according to priority is repeated until the termination condition is met.
[0010] In step four above, the feature extraction and risk scoring module extracts standardized feature vectors from the candidate IOCs obtained in each round of expansion operations in step three, calculates the initial risk score of the candidate IOCs, and then uses a correction strategy to adjust the initial risk score to generate the final risk score.
[0011] In step five above, an IOC graph is constructed, with nodes representing IOCs and edges representing the relationships between nodes. Both nodes and edges have attributes. The candidate IOCs and score increments obtained from each round of expansion operations are written into the IOC graph, and duplicate nodes and edges are merged and evidence is accumulated.
[0012] In step six above, candidate IOCs are classified into high-risk, medium-risk, and low-risk IOCs based on the final risk score and the preset risk score threshold. High-risk IOCs are synchronized to an external platform via an interface, along with complete metadata and evidence chains. Medium-risk IOCs are pushed to the manual review process, and low-risk IOCs are retained in the IOC map. The external platforms include: threat intelligence platforms, security information and event management systems, and security orchestration automation and response systems.
[0013] In step seven above, the confirmed high-risk IOCs are included in a new set of seed IOCs, forming a closed-loop iteration.
[0014] Preferably, in step two, the seed IOC includes a domain name, IP address, URL, file hash, certificate fingerprint, and registered email address.
[0015] Preferably, in step three, the extended operators include passive DNS operators, certificate operators, registration information operators, sample backtracking operators, network traffic operators, and C2 behavior analysis operators. The extended operation of the passive DNS operator specifically involves: obtaining the historical IP addresses of the domain name and reverse-checking other domain names under the same resolution relationship from the IP addresses; the extended operation of the certificate operator specifically involves: querying domain names and IP addresses using the same certificate fingerprint based on TLS and SSL certificate fingerprints; the extended operation of the registration information operator specifically involves: extending the associated registered domain names based on WHOIS information, registered email, registered phone number, and registered organization; the extended operation of the sample backtracking operator specifically involves: extracting the domain name, IP address, and URL of communication from malicious sample behavior logs; the extended operation of the network traffic operator specifically involves: extracting IOCs from traffic logs and tracing their association; the extended operation of the C2 behavior analysis operator specifically involves: identifying potential C2 addresses and returning associated IOCs based on known C2 behavior patterns, communication characteristics, and traffic fingerprints.
[0016] Preferably, in step three, the metadata includes source operator identifier, evidence identifier, timestamp, and preliminary confidence level.
[0017] Preferably, in step three, the termination condition is specifically: the current recursion level is greater than or equal to the maximum recursion level, and the number of new IOCs in the current round is less than the threshold for new IOCs per round.
[0018] Preferably, in step three, the priority calculation formula is as follows:
[0019] in For the first The priority of each candidate IOC For the first Preliminary credibility scores for each candidate IOC. For its weight, For the first The credibility of the source of each candidate IOC For its weight, For the first Information gain of each candidate IOC Assign weights to them.
[0020] Preferably, in step four, the standardized feature vector includes lifecycle features, structural syntax features, correlation features, behavioral features, and hosting environment features; lifecycle features include first active time, most recent active time, and duration; structural syntax features include domain name length, character pattern, and URL path features; correlation features include the degree, centrality, and distance from high-risk IOCs in the graph; behavioral features include sample communication patterns, request frequency, and C2 interaction features; and hosting environment features include the autonomous system number to which the IP belongs, geographical attributes, cloud service provider attributes, and WHOIS information.
[0021] Preferably, in step four, the initial risk score is calculated using the following formula:
[0022]
[0023] in For the first Initial risk scores for each candidate IOC, It can be linearly normalized to a predetermined interval. The number of feature dimensions, For the first The weights of each feature For the first The first candidate IOC 1 eigenvalue, Assign weights to them.
[0024] Preferably, in step four, the correction strategy includes whitelist attenuation correction, evidence chain enhancement correction, and context association correction. The expression for whitelist attenuation correction is:
[0025]
[0026] in The risk score is the result of the whitelist revision. For the initial risk score, For configurable correction factors, This is a configurable correction function.
[0027] Preferably, in step five, the relationships include the resolution relationship between domain name and IP address, the relationship between domain name and certificate issuance, the relationship between domain name and registration information, and the communication relationship between IOCs; the attributes include the final risk score, metadata, and timestamp; the IOC graph supports analysis functions, historical versions, and audit rollback; the analysis functions include path search, suspicious propagation chain query, sub-network identification, and sub-graph extraction.
[0028] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention relies on multiple types of expansion operators to construct a recursive expansion mechanism that combines horizontal and vertical expansion, realizing automated expansion from single-point IOCs to organization-level APT infrastructure, thus improving the efficiency and completeness of IOC discovery; at the same time, by combining multi-dimensional feature extraction and interpretable risk scoring mechanisms, the expanded IOCs are quantitatively evaluated to ensure the reliability and controllability of the expansion results, effectively reducing the false positive rate; furthermore, by combining organization-level map construction and closed-loop iteration mechanisms, the automation, sustainability, and evolution of IOC hunting are achieved. Attached Figure Description
[0029] Figure 1 This is a flowchart of the steps of the present invention;
[0030] Figure 2 This is a flowchart of the method of the present invention;
[0031] Figure 3 This is a schematic diagram of the IOC recursive expansion control of the present invention;
[0032] Figure 4 This is a flowchart of the risk scoring and correction process for the present invention. Detailed Implementation
[0033] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0034] Please see the appendix Figure 1 -Appendix Figure 4 The present invention provides an embodiment of an APT organization infrastructure hunting method based on IOC recursive expansion, comprising the following steps: Step 1, model construction; Step 2, seed IOC standardization processing; Step 3, IOC recursive expansion; Step 4, feature extraction and risk scoring; Step 5, map construction; Step 6, risk classification and processing; Step 7, closed-loop iteration.
[0035] In step one above, a method model is constructed, which includes a seed input module, an IOC collection and recursive expansion module, a preprocessing and priority scheduling module, a feature extraction and risk scoring module, a graph construction and analysis module, a threshold classification and intelligence writing-back module, and a system management and auditing module.
[0036] In step two above, the seed input module receives seed IOCs, performs format standardization and deduplication on the seed IOCs, and generates a standardized seed IOC list; the seed IOCs include domain name, IP address, URL, file hash, certificate fingerprint, and registered email address;
[0037] In step three above, the preprocessing and priority scheduling module performs preliminary credibility scoring and priority calculation on the seed IOCs in the standardized seed IOC list. The IOC collection and recursive expansion module triggers the expansion operator to perform expansion operations on the highest priority seed IOC, generating candidate IOCs with accompanying metadata. The preprocessing and priority scheduling module normalizes, merges duplicates, performs preliminary credibility scoring and priority calculation on the candidate IOCs. The IOC collection and recursive expansion module triggers the expansion operator to perform expansion operations on the highest priority candidate IOC, repeating the process of recursively triggering expansion operators to perform expansion operations on candidate IOCs according to priority until the termination condition is met. The expansion operators include passive DNS operators, certificate operators, registration information operators, sample backtracking operators, network traffic operators, and C2 behavior analysis operators. The specific expansion operation of the passive DNS operator is: obtaining the historical IP address of the domain name and performing a reverse lookup from the IP address. Other domains under the same resolution relationship; the certificate operator's extended operation is: based on TLS and SSL certificate fingerprints, query domains and IP addresses using the same certificate fingerprint; the registration information operator's extended operation is: based on WHOIS information, registered email, registered phone number, and registered organization, extend the associated registered domains; the sample backtracking operator's extended operation is: extract the communication domain name, IP, and URL from malicious sample behavior logs; the network traffic operator's extended operation is: extract IOCs from traffic logs and trace the associations; the C2 behavior analysis operator's extended operation is: based on known C2 behavior patterns, communication characteristics, and traffic fingerprints, identify potential C2 addresses and return associated IOCs; metadata includes source operator identifier, evidence identifier, timestamp, and preliminary confidence level; the termination condition is: current recursion level ≥ maximum recursion level, current round new IOC count < new IOC threshold per round; the priority calculation formula is as follows:
[0038]
[0039] in For the first The priority of each candidate IOC For the first Preliminary credibility scores for each candidate IOC. For its weight, For the first The credibility of the source of each candidate IOC For its weight, For the first Information gain of each candidate IOC Its weight;
[0040] In step four above, the feature extraction and risk scoring module extracts standardized feature vectors from the candidate IOCs obtained in each round of expansion operations in step three, calculates the initial risk score for each candidate IOC, and then adjusts the initial risk score using a correction strategy to generate the final risk score. The standardized feature vectors include lifecycle features, structural syntax features, correlation features, behavioral features, and hosting environment features. Lifecycle features include first active time, most recent active time, and duration. Structural syntax features include domain name length, character pattern, and URL path features. Correlation features include the degree, centrality, and distance to high-risk IOCs in the graph. Behavioral features include sample communication patterns, request frequency, and C2 interaction features. Hosting environment features include the Autonomous System ID (ASID) of the IP address, geographical attributes, cloud service provider attributes, and WHOIS information. The formula for calculating the initial risk score is as follows:
[0041]
[0042] in For the first Initial risk scores for each candidate IOC, It can be linearly normalized to a predetermined interval. The number of feature dimensions, For the first The weights of each feature For the first The first candidate IOC 1 eigenvalue, The weights are assigned to them; the correction strategies include whitelist decay correction, evidence chain enhancement correction, and context association correction. The expression for whitelist decay correction is:
[0043]
[0044] in The risk score is the result of the whitelist revision. For the initial risk score, For configurable correction factors, This is a configurable correction function;
[0045] In step five above, an IOC graph is constructed, with nodes representing IOCs and edges representing the relationships between nodes. Both nodes and edges have attributes. The candidate IOCs and scoring results obtained in each round of expansion operations are written into the IOC graph, and duplicate nodes and edges are merged and evidence is accumulated. The relationships include the resolution relationship between domain names and IPs, the relationship between domain names and certificate issuance, the relationship between domain names and registration information, and the communication relationship between IOCs. The attributes include the final risk score, metadata, and timestamp. The IOC graph supports analysis functions, historical versions, and audit rollback. The analysis functions include path search, suspicious propagation chain query, subnetwork identification, and subgraph extraction.
[0046] In step six above, candidate IOCs are classified into high-risk, medium-risk, and low-risk IOCs based on the final risk score and the preset risk score threshold. High-risk IOCs are synchronized to an external platform via an interface, along with complete metadata and evidence chains. Medium-risk IOCs are pushed to the manual review process, and low-risk IOCs are retained in the IOC map. The external platforms include: threat intelligence platforms, security information and event management systems, and security orchestration automation and response systems.
[0047] In step seven above, the confirmed high-risk IOCs are included in a new set of seed IOCs, forming a closed-loop iteration.
[0048] Based on the above, the advantages of this invention are as follows: When in use, it constructs a recursive expansion mechanism that combines horizontal and vertical expansion through multiple reusable expansion operators, which can automatically mine more related IOCs layer by layer from a single seed IOC, greatly reducing manual intervention and solving the problems of manual dependence and insufficient expansion; relying on graph modeling, it structures the expanded IOCs and their relationships to form an organization-level IOC graph, providing a complete overall perspective of the infrastructure and making up for the lack of a global view in existing technologies; it achieves full-process automation through modular design, from seed IOC standardization, candidate IOC preprocessing and priority scheduling, to feature extraction and risk scoring, threshold classification and intelligence writing back, with a high degree of engineering and can be deployed on a large scale in enterprise environments, solving the problems of automation and implementation; at the same time, through a feature-based and evidence chain-based scoring and screening mechanism, it effectively controls noise and false positives in the expansion process, ensuring the credibility and interpretability of IOC results, and can use confirmed high-risk IOCs as new seeds to start the next round of expansion, forming an automated closed loop and continuously improving threat hunting capabilities.
[0049] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.
Claims
1. A method for hunting APT organization infrastructure based on IOC recursive extension, comprising the following steps: Step 1: Build the model; Step 2: Standardize the seed IOC. Step 3, IOC recursive expansion; Step 4, feature extraction and risk scoring; Step 5, map construction; Step 6, risk classification and processing; Step 7, closed-loop iteration; characterized by: In step one above, a method model is constructed, which includes a seed input module, an IOC collection and recursive expansion module, a preprocessing and priority scheduling module, a feature extraction and risk scoring module, a graph construction and analysis module, a threshold classification and intelligence writing-back module, and a system management and auditing module. In step two above, the seed input module receives the seed IOC, performs format standardization and deduplication on the seed IOC, and generates a standardized seed IOC list. In step three above, the preprocessing and priority scheduling module performs preliminary credibility scoring and priority calculation on the seed IOCs in the standardized seed IOC list. The IOC collection and recursive expansion module triggers the expansion operator to perform expansion operations on the highest priority seed IOC, generating candidate IOCs with accompanying metadata. The preprocessing and priority scheduling module normalizes, merges duplicates, performs preliminary credibility scoring, and calculates priority on the candidate IOCs. The IOC collection and recursive expansion module triggers the expansion operator to perform expansion operations on the highest priority candidate IOC. This process of recursively triggering expansion operators to perform expansion operations on candidate IOCs according to priority is repeated until the termination condition is met. The priority calculation formula is as follows: in For the first The priority of each candidate IOC For the first Preliminary credibility scores for each candidate IOC. For its weight, For the first The credibility of the source of each candidate IOC For its weight, For the first Information gain of each candidate IOC Its weight; In step four above, the feature extraction and risk scoring module extracts standardized feature vectors from the candidate IOCs obtained in each round of expansion operations in step three, calculates the initial risk score for each candidate IOC, and then adjusts the initial risk score using correction strategies to generate the final risk score. The correction strategies include whitelist decay correction, evidence chain enhancement correction, and context association correction. The expression for whitelist decay correction is: in The risk score is the result of the whitelist revision. For the initial risk score, For configurable correction factors, This is a configurable correction function; In step five above, an IOC graph is constructed, with nodes representing IOCs and edges representing the relationships between nodes. Both nodes and edges have attributes. The candidate IOCs and score increments obtained from each round of expansion operations are written into the IOC graph, and duplicate nodes and edges are merged and evidence is accumulated. In step six above, candidate IOCs are classified into high-risk, medium-risk, and low-risk IOCs based on the final risk score and the preset risk score threshold. High-risk IOCs are synchronized to an external platform via an interface, along with complete metadata and evidence chains. Medium-risk IOCs are pushed to the manual review process, and low-risk IOCs are retained in the IOC map. The external platforms include: threat intelligence platforms, security information and event management systems, and security orchestration automation and response systems. In step seven above, the confirmed high-risk IOCs are included in a new set of seed IOCs, forming a closed-loop iteration.
2. The APT organization infrastructure hunting method based on IOC recursive extension according to claim 1, characterized in that: In step two, the seed IOC includes the domain name, IP address, URL, file hash, certificate fingerprint, and registered email address.
3. The APT organization infrastructure hunting method based on IOC recursive extension according to claim 1, characterized in that: In step three, the extended operators include passive DNS operators, certificate operators, registration information operators, sample backtracking operators, network traffic operators, and C2 behavior analysis operators. The extended operation of the passive DNS operator specifically involves obtaining the historical IP addresses of a domain name and reverse-checking other domain names under the same resolution relationship from those IP addresses. The extended operation of the certificate operator specifically involves querying domain names and IP addresses using the same certificate fingerprint based on TLS and SSL certificate fingerprints. The extended operation of the registration information operator specifically involves extending the associated registered domain names based on WHOIS information, registered email, registered phone number, and registered organization. The extended operation of the sample backtracking operator specifically involves extracting the domain name, IP address, and URL of communication from malicious sample behavior logs. The extended operation of the network traffic operator specifically involves extracting IOCs from traffic logs and tracing their association. The extended operation of the C2 behavior analysis operator specifically involves identifying potential C2 addresses and returning associated IOCs based on known C2 behavior patterns, communication characteristics, and traffic fingerprints.
4. The APT organization infrastructure hunting method based on IOC recursive extension according to claim 1, characterized in that: In step three, the metadata includes source operator identifier, evidence identifier, timestamp, and preliminary confidence level.
5. The APT organization infrastructure hunting method based on IOC recursive extension according to claim 1, characterized in that: In step three, the termination condition is specifically: the current recursion level is greater than or equal to the maximum recursion level, or the number of new IOCs in the current round is less than the threshold for new IOCs per round.
6. The APT organization infrastructure hunting method based on IOC recursive extension according to claim 1, characterized in that: In step four, the standardized feature vector includes lifecycle features, structural and syntactic features, correlation features, behavioral features, and hosting environment features; lifecycle features include first active time, most recent active time, and duration; structural and syntactic features include domain name length, character pattern, and URL path features; correlation features include the degree, centrality, and distance of the IOC in the graph to high-risk IOCs; Behavioral characteristics include sample communication patterns, request frequency, and C2 interaction characteristics; hosting environment characteristics include the autonomous system number to which the IP belongs, geographical attributes, cloud service provider attributes, and WHOIS information.
7. The APT organization infrastructure hunting method based on IOC recursive extension according to claim 1, characterized in that: In step four, the initial risk score is calculated using the following formula: in For the first Initial risk scores for each candidate IOC, It can be linearly normalized to a predetermined interval. The number of feature dimensions, For the first The weights of each feature For the first The first candidate IOC 1 eigenvalue, Assign weights to them.
8. The APT organization infrastructure hunting method based on IOC recursive extension according to claim 1, characterized in that: In step five, the relationships include the resolution relationship between domain names and IP addresses, the relationship between domain names and certificate issuance, the relationship between domain names and registration information, and the communication relationship between IOCs; the attributes include the final risk score, metadata, and timestamps. The IOC graph supports analysis functions, historical versions, and audit rollback. The analysis functions include path search, suspicious propagation chain query, sub-network identification, and sub-graph extraction.