Attack behavior analysis method based on attack mapping and path analysis

Abstract

The invention provides an attack behavior analysis method based on attack mapping and path analysis, which comprises the following steps: selecting a network security data set, designing a mapping prompt word, and performing fine tuning training on a large language model according to the network security data set and the mapping prompt word to obtain a mapping model; acquiring equipment alarm information, performing attack mapping to obtain a corresponding attack technology and strategy, and performing TTP classification to obtain an alarm classification result; acquiring honey point alarm features, and integrating an IP behavior sequence according to IP information corresponding to the honey point alarm features; according to the IP behavior sequence, evaluating the collaboration possibility between the attacked IPs; and designing an attack path analysis cue word by taking the IP behavior sequence as a context, and analyzing a possible attack path in the IP behavior sequence by utilizing a large language model. By applying the method, fine classification of attack behaviors can be realized, and meanwhile, path analysis is performed by combining attacker behavior pattern analysis and utilizing alarm data, so that predictability and response efficiency of potential threats are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to an attack behavior analysis method based on attack mapping and path analysis. BACKGROUND

[0002] In the field of network security, with the increasing complexity and concealment of attack means, traditional security protection measures based on rules and feature libraries gradually show their limitations. Especially in the face of complex network attacks such as advanced persistent threats, it is difficult to meet the needs of timely and accurate identification and response to threats by simply relying on the alarm information generated by security devices such as intrusion detection systems and firewalls.

[0003] Therefore, it is necessary to provide an analysis method capable of deeply understanding attack behavior to optimize the network security protection system. SUMMARY

[0004] The purpose of the present application is to provide an attack behavior analysis method based on attack mapping and path analysis to improve the predictability and response efficiency of potential threats.

[0005] In a first aspect, the attack behavior analysis method based on attack mapping and path analysis provided by the present application comprises: selecting a network security data set, designing a mapping prompt word for guiding a large language model to perform attack information mapping, and fine-tuning training a large language model to obtain a mapping model according to the network security data set and the mapping prompt word; obtaining device alarm information generated by a security device, using the mapping model to perform attack mapping on the device alarm information to obtain corresponding attack techniques and strategies, and performing TTP classification on the attack techniques and strategies to obtain alarm classification results; obtaining honeypot alarm information to perform alarm feature extraction to obtain honeypot alarm features, and integrating related device alarm information, honeypot alarm information and honeypot alarm features according to the IP information corresponding to the honeypot alarm features to form an IP behavior sequence; evaluating the collaboration possibility between attack IPs according to the IP behavior sequence; designing an attack path analysis prompt word using the IP behavior sequence as a context, and using a large language model to analyze possible attack paths in the IP behavior sequence, wherein the attack path analysis prompt word is used to guide the large language model to judge the possibility of the existence of an attack path in the IP behavior sequence according to the collaboration possibility between the attack IPs and the IP behavior sequence, and to list all possible attack paths according to the alarm classification results.

[0006] The attack behavior analysis method based on attack mapping and path analysis provided by the present application has the beneficial effect that the fine classification of attack behavior is realized by mapping of device alarm information. At the same time, the attacker behavior pattern analysis is performed in combination with the information obtained through honeypot technology, and the path analysis is performed using alarm data, so as to improve the predictability and response efficiency of potential threats.

[0007] In a possible embodiment, after obtaining the possible attack path, the analysis further includes: performing basic attribute analysis, behavior pattern analysis, attack skill analysis, risk level analysis and attack intention analysis on the attacker based on the device alarm information, the honeypot alarm information and the possible attack path in the IP behavior sequence to obtain an attacker behavior portrait; wherein the basic attribute analysis includes analyzing the technical type and active period of the attacker according to the device alarm information, the behavior pattern analysis includes analyzing the behavior pattern characteristics of the attacker according to the possible attack path in the IP behavior sequence, the attack skill analysis includes analyzing the attack ability of the attacker from the attack source, the attack target and the attack timing dimension according to the device alarm information and the honeypot alarm information, the risk level analysis includes evaluating the risk level of the attacker according to the basic attribute analysis result and the behavior pattern analysis result, and the attack intention analysis includes judging the attack intention of the attacker according to the basic attribute analysis result, the behavior pattern analysis result, the attack skill analysis result and the risk level analysis result.

[0008] In another possible embodiment, the fine-tuning training of the large language model based on the network security data set and the mapping prompt word to obtain the mapping model includes: inputting the network security data set into the large language model, and guiding the large language model to obtain a mapping result by using the mapping prompt word; calculating the loss value of the large language model by using the cross-entropy loss function based on the supervised learning setting according to the mapping result, and calculating the gradient of the to-be-adjusted parameters of the large language model by using the back propagation algorithm; and updating the parameters of the large language model according to the gradient of the to-be-adjusted parameters to obtain the mapping model.

[0009] In other possible embodiments, the honeypot alarm information is obtained to perform alarm feature extraction to obtain honeypot alarm features, including: obtaining the honeypot alarm information, and performing information extraction on the honeypot alarm information to obtain attack payload, attacker IP and attack frequency information; performing behavior pattern analysis on the attack payload, attacker IP and attack frequency information by using the large language model to extract honeypot alarm features, and the honeypot alarm features include the payload information of the attacker and the page access order on the honeypot, the attack method selection, the attack tool and the attack means.

[0010] The evaluation of the cooperation possibility between the attack IPs according to the IP behavior sequence includes: calculating the payload similarity and the target overlap degree between different IPs for evaluating the cooperation possibility between the attack IPs; wherein the calculation of the payload similarity includes: extracting attack payload features from the IP behavior sequence, converting the payload features into attack payload feature vectors, and calculating the cosine similarity of the attack payload feature vectors between different attack IPs to obtain the payload similarity; and the calculation of the target overlap degree includes: extracting attack target tuples from the IP behavior sequence, and calculating the target overlap degree according to the attack target tuples and the payload similarity, and the target overlap degree calculation satisfies the following formula: wherein, represents a victim set attacked by attack IP subject A, represents a victim set attacked by attack IP subject B, represents the load similarity between attack IP subject A and attack IP subject B.

[0011] The attack path analysis prompt word is also used to guide the large language model to infer a probability value corresponding to a possible attack path.

[0012] In a second aspect, the present application further provides an attack behavior analysis device based on attack mapping and path analysis, comprising: a model training unit configured to select a network security data set, design a mapping prompt word for guiding a large language model to perform attack information mapping, and fine-tune the large language model based on the network security data set and the mapping prompt word to obtain a mapping model; a classification unit configured to obtain device alarm information generated by a security device, perform attack mapping on the device alarm information by using the mapping model to obtain corresponding attack techniques and strategies, and perform TTP classification on the attack techniques and strategies to obtain an alarm classification result; an information integration unit configured to obtain honeypot alarm information, perform alarm feature extraction on the honeypot alarm information to obtain honeypot alarm features, and integrate related device alarm information, honeypot alarm information and honeypot alarm features according to corresponding IP information of the honeypot alarm features to form an IP behavior sequence; an evaluation unit configured to evaluate the cooperative possibility between attack IPs according to the IP behavior sequence; and an attack path analysis unit configured to take the IP behavior sequence as a context, design an attack path analysis prompt word, and analyze possible attack paths in the IP behavior sequence by using a large language model, wherein the attack path analysis prompt word is used to guide the large language model to judge the possibility of the existence of an attack path in the IP behavior sequence according to the IP behavior sequence and the cooperative possibility between attack IPs, and list all possible attack paths according to the alarm classification result.

[0013] In a third aspect, the present application further provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the attack behavior analysis method based on attack mapping and path analysis.

[0014] In a fourth aspect, the present application further provides an electronic device, comprising: a processor and a memory; the memory is configured to store a computer program; and the processor is configured to execute the computer program stored in the memory, so that the electronic device performs the attack behavior analysis method based on attack mapping and path analysis.

[0015] The beneficial effects of the above-mentioned second aspect to fourth aspect can be referred to the description of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0016] Figure 1A flowchart of an attack behavior analysis method based on attack mapping and path analysis is provided for an embodiment of the present application. Figure 2 A honey point alarm feature extraction flowchart is provided for an embodiment of the present application. Figure 3 A load similarity key feature diagram is provided for an embodiment of the present application. Figure 4 A path analysis prompt word design idea diagram is provided for an embodiment of the present application. Figure 5 An attack model structure diagram of attack behavior and attack ability portrait is provided for an embodiment of the present application. Figure 6a A training loss diagram of large language model fine-tuning training using a full-parameter fine-tuning method is provided for an embodiment of the present application. Figure 6b A validation loss diagram of large language model fine-tuning training using a full-parameter fine-tuning method is provided for an embodiment of the present application. Figure 7a A training loss diagram of large language model fine-tuning training using a low-rank adaptive parameter fine-tuning method is provided for an embodiment of the present application. Figure 7b A validation loss diagram of large language model fine-tuning training using a low-rank adaptive parameter fine-tuning method is provided for an embodiment of the present application. Figure 8 A simulation environment diagram of network topology is provided for an embodiment of the present application. Figure 9 A possible attack path and corresponding probability situation diagram is provided for an embodiment of the present application. Figure 10 A schematic diagram of an attack behavior analysis device based on attack mapping and path analysis is provided for an embodiment of the present application. Figure 11 An electronic device structure diagram is provided for an embodiment of the present application. DETAILED DESCRIPTION

[0017] In order to make the objects, technical solutions and advantages of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application. Unless otherwise defined, the technical terms or scientific terms used herein should be understood as the common meanings thereof by those of ordinary skill in the art to which the present application belongs. The words such as "comprise" and the like used herein mean that the elements or objects before the words encompass the elements or objects listed after the words and their equivalents, without excluding other elements or objects.

[0018] The present embodiment provides an attack behavior analysis method based on attack mapping and path analysis. Referring to Figure 1 The method comprises: S101: selecting a network security data set, designing a mapping prompt word for guiding a large language model to perform attack information mapping, and fine-tuning and training the large language model according to the network security data set and the mapping prompt word to obtain a mapping model.

[0019] In a possible embodiment, fine-tuning and training the large language model according to the network security data set and the mapping prompt word to obtain the mapping model comprises: inputting the network security data set into the large language model, and guiding the large language model to obtain a mapping result by using the mapping prompt word; calculating a loss value of the large language model by using a cross-entropy loss function based on a supervised learning setting according to the mapping result, and calculating a gradient of a to-be-adjusted parameter of the large language model by using a back propagation algorithm; and updating the parameter of the large language model according to the gradient of the to-be-adjusted parameter to obtain the mapping model.

[0020] In a possible embodiment, the network security data set is selected for training the large language model to enhance the understanding of the mapping model finally obtained for terms, concepts and expression methods in the network security field. The parameter updating method of the large language model comprises full-parameter fine-tuning updating and low-rank adapter parameter fine-tuning updating. When the full-parameter fine-tuning updating method is applied, end-to-end full-parameter fine-tuning is implemented, and gradient descent optimization is performed on all parameters of the large language model to realize parameter fine-tuning updating of the model. When the low-rank adapter parameter fine-tuning method is applied, the low-rank adapter parameters in the large language model are optimized to realize parameter fine-tuning updating of the model.

[0021] Full-parameter fine-tuning optimizes all parameters of the model to improve the overall capability of the model, while LoRA (Low-Rank Adaptation) fine-tuning method only optimizes the low-rank adapter parameters in the model to achieve effective performance improvement while maintaining low computational cost. In one possible embodiment, by synchronously implementing full-parameter fine-tuning method and low-rank adaptation fine-tuning method to update the parameters of the large language model, it is found through experimental comparison that, in the process of training the mapping model, the full-parameter fine-tuning method is better than the low-rank adaptation fine-tuning method.

[0022] In one specific embodiment, in order to better adapt to the training needs of the mapping model, the design of the mapping prompt includes the following requirements: (1) task description: first, clarify the problem to be solved, that is, map the input alarm information to the tactics and techniques of ATT&CK. (2) Question: Provide the alarm or security information text to the large language model, which is the direct information processed by the large language model. (3) Context: This requires the use of few-shot thinking skills to guide the large language model to analyze and judge by imitating the example content with specific examples. (4) Output format: Since the output needs to be formatted, the model needs to be specified to show the form of answering the question. In addition, this module only needs to map the results, so the large language model can be required to return the final result in the form of {“Tactic”: “”, “Techniques”: “”. In addition, when designing the mapping prompt, the identity can be set as a security analyst responsible for security operation. Through role-playing, the model can better understand the thinking mode of the security analyst when processing alarm information, thereby improving the accuracy of mapping.

[0023] Exemplarily, a Security-TTP-Mapping open source dataset is applied as a network security dataset, a large language model (Meta-Llama-3.1-8B) is fine-tuned and trained, and a method for parameter optimization of the large language model in the training stage to obtain a mapping model includes: selecting the Security-TTP-Mapping open source dataset as an initial dataset, preprocessing the initial dataset according to the input form requirement of the Meta-Llama-3.1-8B model to make the data format consistent with the input form of the model, so as to effectively support the subsequent model fine-tuning. The preprocessed dataset is used for fine-tuning of the Meta-Llama-3.1-8B model, and in the fine-tuning stage, end-to-end full parameter fine-tuning is implemented to optimize all parameters of the model by gradient descent, so as to further enhance the understanding and generalization ability of the model to the description text of security events. The specific implementation steps of fine-tuning are as follows: first, input the preprocessed data into the Meta-Llama-3.1-8B model to obtain the prediction result by forward propagation; then calculate the loss value according to the cross-entropy loss function based on supervised learning, and calculate the gradient of all model parameters by the back propagation algorithm; finally, update the model parameters by using the optimizer.

[0024] where the cross-entropy loss function is defined as: , represents the number of samples in the dataset, represents the sequence length of each sample, represents the sample corresponding to the true label of the category , represents the probability that the model predicts that the sample belongs to the category . The gradient of the loss function with respect to all model parameters in the back propagation algorithm satisfies the following formula: , represents the output of neuron , represents the weighted sum of the inputs of neuron , represents the weight from the previous neuron to the current neuron . Neuron is a basic computing unit in a neural network, which mainly functions to receive input signals from the previous layer, calculate the activation value by weighted sum, and then generate output through an activation function. In the gradient descent optimization process, the AdamW optimization algorithm is used to update the parameters by the following formula: , represents the model parameters, represents the learning rate, denotes the first moment estimation, i.e., the exponentially weighted average of the gradient, denotes the second moment estimation, i.e., the exponentially weighted average of the squared gradient, denotes a constant to avoid division by zero error in calculation. The AdamW optimization algorithm is based on gradient descent, and by introducing the first moment estimation and the second moment estimation, the parameter update is more stable and adaptive. In order to avoid falling into local optimum due to the sparsity of security event description text, the cosine annealing learning rate scheduling method is adopted, and the calculation of the learning rate satisfies the following formula: wherein, denotes the learning rate of the current round, denotes the minimum learning rate set initially, denotes the maximum learning rate set initially, denotes the current training step number, denotes the total training step number.

[0025] S102: Obtain device alarm information generated by a security device, perform attack mapping on the device alarm information by using a mapping model to obtain corresponding attack techniques and strategies, and perform TTP classification on the attack techniques and strategies to obtain an alarm classification result.

[0026] In a possible embodiment, the mapping model obtained after fine-tuning is applied to perform ATT&CK technique mapping. After inputting the device alarm information generated by the security device into the mapping model, the output obtained is the result of mapping and aligning the device alarm information with the ATT&CK framework, so as to accurately identify and match specific attack techniques and strategies. The mapping result is classified according to TTP (tactics, techniques and procedures), so as to realize fine-grained identification and classification of network attack behaviors.

[0027] The tactics and techniques obtained after performing attack mapping on the device alarm information are stored in a database, so as to facilitate further analysis based on historical alarm information in combination with the alarm information obtained from the honeypot.

[0028] S103: Obtain honeypot alarm information to perform alarm feature extraction to obtain honeypot alarm features, integrate related device alarm information, honeypot alarm information and honeypot alarm features according to IP information corresponding to the honeypot alarm features to form an IP behavior sequence.

[0029] In a possible embodiment, the obtaining of the honeypot alarm information for alarm feature extraction to obtain the honeypot alarm features includes: obtaining the honeypot alarm information, performing information extraction on the honeypot alarm information to obtain attack payload, attacker IP and attack frequency information; using a large language model to analyze the behavior mode of the attack payload, the attacker IP and the attack frequency information to extract honeypot alarm signs, and the honeypot alarm features include the payload information of the attacker and the page access order on the honeypot, the attack method selection, the attack tool and the attack means.

[0030] The honeypot can be deployed on the network periphery or in the intranet. Attack behavior data can be obtained from the honeypot, including attack tool and features, attacker IP, attack time and other information. The honeypot can record the behavior of the attacker, such as the specific details of attack means such as SQL injection, XSS attack, brute force cracking and file inclusion. Since the deployment position of the honeypot emphasizes concealment, the subject accessing the honeypot is usually a potential attacker. Therefore, the attack traffic generated in the honeypot access process can be preliminarily processed to extract key data such as attack payload, attacker IP address and attack frequency, and these data are provided to the large language model as the context of behavior mode analysis to perform more detailed analysis on the attacker behavior.

[0031] Although the honeypot cannot directly obtain the identity information of the attacker, it can record the IP address of the attacker, the attack time and other information to provide clues for subsequent traceability analysis. For example, referring to Figure 2 The process of extracting the honeypot alarm features from the information recorded by the honeypot includes: the honeypot performs real-time attack data collection to obtain honeypot alarm information, and performs attack behavior information extraction on the honeypot alarm information to obtain attack payload, attacker IP and attack frequency statistical information. Using a large language model to preliminarily analyze the attacker behavior information recorded by the honeypot can obtain the page access order of the attacker, the attack method selection, the attack tool record and the attack frequency. Through preliminary analysis, the behavior mode information of the attacker can be obtained. The page access order, the attack method selection, the attack tool and the attack means analyzed by the large language model are taken as the honeypot alarm features, and the honeypot alarm features and the corresponding attacker IP are stored in the honeypot alarm database.

[0032] Compared with other device alarm information, the honeypot alarm database stores the behavior mode analysis data of the honeypot visitor, which can provide more targeted support for further analysis of attack behavior. When performing path analysis, the honeypot alarm features and other high-value information can be used as the core basis for analysis.

[0033] In one possible embodiment, after obtaining the honeypot alert feature, the honeypot alert feature is combined with historical alert data for further analysis. The historical alert data designed herein includes honeypot alert information and device alert information of other security devices. Combining the honeypot alert feature with the historical alert data includes: collecting all associated historical alert data of each group of honeypot alert features corresponding to the attacker IP in the honeypot alert database, arranging the events recorded by the historical alert data in chronological order to form a connected behavior sequence, and the obtained behavior sequence is recorded as an IP behavior sequence.

[0034] S104: evaluating the coordination possibility between attack IPs according to the IP behavior sequence.

[0035] In one possible embodiment, considering that the attacker may have the ability of IP proxy pool and change IP for attack attempts, the coordination possibility between attack IPs is evaluated according to the IP behavior sequence.

[0036] In one specific embodiment, a two-dimensional similarity evaluation system is designed for evaluating the coordination possibility between attack IPs, and the coordination possibility between attack IPs is evaluated according to the IP behavior sequence, which includes calculating the load similarity and target overlap between different attack IPs for evaluating the coordination possibility between attack IPs.

[0037] The calculation of the load similarity includes extracting attack load features from the IP behavior sequence, converting the load features into attack load feature vectors, and calculating the cosine similarity of the attack load feature vectors between different IPs to obtain the load similarity; the calculation of the target overlap includes extracting attack target tuples from the IP behavior sequence, and calculating the target overlap according to the attack target tuples and the load similarity, which satisfies the following formula: wherein, represents a set of victims attacked by attack IP subject A, represents a set of victims attacked by attack IP subject B, represents the load similarity between attack IP subject A and attack IP subject B.

[0038] In one specific embodiment, referring to Figure 3The attack payload features extracted to calculate the similarity between different attacking IPs include key features such as protocol type, payload size, opcode, anomaly mode, and signature information. These extracted attack payload features are then converted into numerical form for subsequent mathematical processing. Specifically, converting the attack payload features into numerical form means converting them into binary vectors to obtain the attack payload feature vector. For continuous value features such as payload size, normalization is performed. For discrete features in the payload, such as protocol type, opcode, anomaly mode, and signature information, one-hot encoding is used to represent them, that is, each discrete feature is converted into a mutually exclusive binary vector representation. Each dimension of the binary vector corresponding to each discrete feature is independent, with only the position corresponding to the feature's category being 1, and the remaining positions being 0.

[0039] The cosine similarity of the attack payload feature vectors between different attack IPs is calculated based on the attack payload feature vectors to obtain the payload similarity. The calculation of the payload similarity satisfies the following formula: Where A and B represent two different attacking IP entities; This represents two attack payload feature vectors to be compared, with dimensions of... ; Represents the first element in the attack payload feature vector. The values ​​of each feature are measured for directional consistency through vector dot product operations; The vector magnitude is used for normalization. Payload similarity measures the similarity of attack techniques; the higher the payload similarity value, the more likely the attack patterns are related.

[0040] Building upon payload similarity, target overlap is introduced to construct a target system profile matrix, including the port service fingerprints, vulnerability features, and asset value weights of the attacked IPs. Cosine similarity is used to calculate the spatial distribution correlation of attack targets, identifying strategically targeted coordinated attacks. The target overlap is calculated according to the following formula: ,in, This represents the set of victims attacked by attacking IP subject A. This represents the set of victims attacked by attacking IP subject B. This indicates the payload similarity between attacking IP subject A and attacking IP subject B. Specifically, and The elements in the target overlap degree are attack target tuples, and each attack target tuple includes information <IP, Port>, where IP refers to the IP of the attack target, and Port refers to the port of the attack target. The target overlap degree measures the proportion of overlapping attack targets (IP+port) of two attack IPs. The higher the value of the target overlap degree, the more concentrated the attack targets.

[0041] S105: Taking the IP behavior sequence as the context, designing an attack path analysis prompt word, and using a large language model to analyze the possible attack path in the IP behavior sequence, wherein the attack path analysis prompt word is used to guide the large language model to determine the possibility of the existence of an attack path in the IP behavior sequence according to the collaborative possibility between the IP behavior sequence and the attack IP, and to infer all possible attack paths according to the alarm classification result.

[0042] In a possible embodiment, the attack path analysis prompt word is also used to guide the large language model to infer the probability value corresponding to the possible attack path.

[0043] In a possible embodiment, the IP behavior sequence is input into the large language model as the context, and the logical reasoning capability of the large language model is used to analyze the IP behavior sequence and infer the potential intention of the attacker. For example, when an attacker frequently attempts to access a specific type of sensitive file or service, it means that the attacker is looking for specific data, such as when an attacker accesses the / etc / passwd and / etc / shadow files, it means that the attacker is trying to find the hash value of the system user password.

[0044] Inputting the IP behavior sequence as the context requires designing an attack path analysis prompt word to guide the large language model to perform attack path analysis operations and output results. Exemplarily, an attack path analysis prompt word designed in combination with the results obtained by the mapping model is as shown in Figure 4 The design of the attack path analysis prompt word can be divided into four key dimensions: role playing, task decomposition, few-shot learning, and consistency constraints.

[0045] The role playing dimension sets a context benchmark for subsequent reasoning and generation by explicitly defining the identity of the large language model and the task target.

[0046] The task decomposition dimension refines high-level abstract tasks into specific operational steps, effectively reducing the complexity of the model processing tasks through step-by-step guidance, enabling it to output stable and reliable results under a clear structure. For example, the path analysis prompt word can be refined to guide the large language model to first determine whether there is a possibility of an attack path based on the IP behavior sequence, then list all possible attack paths according to the dependency relationship of each attack type in the ATT&CK matrix, and finally output the probability values of these attack paths through reasoning.

[0047] The few-shot learning strategy dimension provides guidance for large language models through input-output examples: when the input is a behavior sequence composed of alerts from a certain attacking IP, the model should output the path chain (such as "A→B→C") and its corresponding attack probability (such as "command execution mobile risk: 80%"). This approach aims to provide representative samples to guide the model to learn reasoning logic, enabling reasonable inference and generation even in situations with scarce samples.

[0048] The consistency constraint dimension proposes core requirements: first, the analysis process should be logically consistent to ensure that the reasoning chain is reasonable and complete; second, when key information is lacking, conclusions should not be generated to prevent false inferences; third, the probability assessment of all attack paths must be based on behavior sequence analysis and network topology to ensure that the assessment results are adequately supported.

[0049] The design idea of the path analysis prompt word in the above example is to start from the honeypot IP, build attack paths based on historical alert data, and gradually deduce subsequent attack steps based on the time sequence of alerts, IP changes, or technical associations. The logical relationship of ATT&CK technology is used to guide analysis, such as possible privilege escalation or lateral movement after initial access. Finally, the possibility of an attack path composed of certain alerts is quantified in the form of probability, with the core goal being to help users quickly understand the behavior sequence of attackers and provide decision support through probability assessment.

[0050] In a possible embodiment, the attack behavior analysis method based on attack mapping and path analysis further includes: performing basic attribute analysis, behavior pattern analysis, attack skill analysis, risk level analysis and attack intention analysis of the attacker based on the device alarm information, the honeypot alarm information and the possible attack path in the IP behavior sequence to obtain an attacker behavior portrait. The basic attribute analysis includes analyzing the technical type and active period of the attacker according to the device alarm information, the behavior pattern analysis includes analyzing the behavior pattern characteristics of the attacker according to the possible attack path in the IP behavior sequence, the attack skill analysis includes analyzing the attack ability of the attacker from the attack source, the attack target and the attack timing dimension according to the device alarm information and the honeypot alarm information, the risk level analysis includes evaluating the risk level of the attacker according to the basic attribute analysis result and the behavior pattern analysis result, and the attack intention analysis includes judging the attack intention of the attacker according to the basic attribute analysis result, the behavior pattern analysis result, the attack skill analysis result and the risk level analysis result.

[0051] Systematically analyzing the characteristics of the attacker and the attack behavior pattern can provide the security operator with an intuitive attack model of the attack behavior and attack ability portrait of the honeypot visitor. Referring to Figure 5 , the analysis dimensions of the attack model include: basic attribute analysis, behavior pattern analysis, attack skill analysis, risk level analysis and attack intention analysis.

[0052] Exemplarily, the basic attribute classification is performed based on the device alarm information, including the attack source IP address, the time window of attack occurrence, the network service type involved in the attack and the alarm category: through the aggregation data of the device alarm information, the most frequently accessed service type of the attacker and the time period of attack concentration are counted, so as to preliminarily define the technical type and the active period characteristics of the attacker.

[0053] The behavior pattern analysis is performed based on the historical sensitive behavior records of the honeypot visitor: based on the attack path analysis result based on the historical alarm data, the behavior preference, attack step and behavior complexity of the attacker are revealed. For example, by analyzing the selection frequency of tactics and techniques in the attack path, it can be determined that the attacker is more inclined to a specific penetration or privilege escalation method, thereby establishing the unique behavior pattern characteristics of the attacker.

[0054] The purpose of attack skill analysis is to more intuitively show the technical ability of the attacker in the attack process, and the analysis dimensions include attack source, attack target and attack timing: based on historical alarm data, according to the information of IP address attribution, geographical location, attack protocol and service type, autonomous system and the like, the complexity of the attack and the hiding degree of the attack source are evaluated; according to the target asset type of the attack target, the vulnerability utilization, the attack tool used and the attack content, the understanding degree of the attacker to the target environment and the technical attack depth are analyzed; according to the attack frequency, the attack duration, the data transmission rate, the data packet interval and the stability of the session interval, the action planning of the attacker and the technical control ability of the attack process are analyzed.

[0055] Risk level analysis is a comprehensive evaluation based on basic attribute analysis and behavior pattern analysis, mainly measuring the potential threat degree of the attacker to the network environment: with the help of a large language model, the complexity of the attacker's behavior pattern, the sensitivity of the assets involved in the attack, and the severity of the historical alarm events are analyzed, and the risk level of the attacker is output. The risk level is further divided into high, medium and low three levels, which provides a basis for security operation personnel in resource allocation and threat response decision-making.

[0056] Attack intent analysis is a higher-dimensional information extraction, which comprehensively analyzes the analysis results of basic attribute analysis, behavior pattern analysis, attack skill analysis and risk level analysis, and judges the attack intent of the attacker combined with asset-related information. The analysis of attack intent can help security operation personnel to carry out emergency disposal targetedly, and in addition, attack intent analysis is also helpful in the four honey framework, which uses the variable ability of the honey array to lead the attacker into a new attack scene, so that the attacker is completely trapped in the deception defense.

[0057] The attack behavior analysis method based on attack mapping and path analysis provided by the application provides a new idea and technical support for improving the detection and response ability of advanced threats in view of the urgent needs of attack behavior understanding and threat analysis in the field of network security: by realizing the semantic mapping from alarm information to MITRE ATT&CK framework, the classification accuracy and semantic understanding depth of attack behavior are significantly improved. Further, the honeypot technology is introduced as an active defense means, and the perception ability of unknown threats is enhanced by capturing the behavior trajectory and feature information of the attacker. The honeypot alarm information not only provides high-value intelligence input, but also provides key support for path analysis through linkage with device alarm information. The reasoning ability of the large language model is also used, and the potential behavior sequence of the attacker is reconstructed combined with the logical relationship of the time sequence and the ATT&CK framework, and the possibility of the attack path is quantified in the form of probability, which provides a scientific decision-making basis for security operation personnel.

[0058] The attack behavior analysis method based on attack mapping and path analysis adjusts the parameters of a large language model to adapt to specific tasks in the field of network security, enabling the extraction of key entities from alert information and their accurate mapping to tactical or technical items in the ATT&CK framework. This process not only enhances the model's understanding of network security terminology and context, but also provides a solid foundation for subsequent attack path analysis. Honeypots are introduced as part of the active defense mechanism, capturing attacker activity traces, including but not limited to attack tools, methods, and traffic alerts. These high-value intelligence provide important evidence for analyzing attacker behavior patterns. Based on the collected historical alert information, the reasoning ability of the large language model is used for path analysis to reveal the attacker's action trajectory and possible strategic goals throughout the attack lifecycle, and to optimize the network security protection system by complementing honeypot alerts and traditional security device alert information.

[0059] The application also provides a specific experimental example of an attack behavior method based on attack mapping and path analysis. The experimental environment is as follows: the experiment is performed on an Ubuntu 22.04 system, using a GTX 4090 graphics card with 24 GB of video memory and 64 GB of memory. The Python language and Meta-Llama-3.1-8B model are used. The specific experimental environment configuration information is shown in Table 1.

[0060] Table 1 Experimental configuration table

[0061]

[0062] In the experiment, a series of hyperparameter configurations are used to fine-tune the large language model. The experimental parameter information is shown in Table 2.

[0063] Table 2 Experimental parameter table

[0064]

[0065] The training was conducted for 3 epochs. This round was chosen considering the dataset size and efficient use of computational resources to optimize model performance without overfitting. A fixed learning rate of 0.00003 was used. This learning rate was determined in a series of pre-experiments and effectively balances convergence speed and stability. Each batch contained only 1 sample. Given the model and hardware limitations, such a setting, while sacrificing some parallelization advantages, ensures that the maximum sequence length can be processed. An automatic packing mechanism was used to maximize GPU memory utilization while maintaining the natural distribution of input data. The cosine annealing strategy was followed to dynamically adjust the learning rate, aiming to accelerate the convergence process and improve the performance of the final model. A learning rate warm-up phase of 3% was set to help the model transition more smoothly to the initial rapid learning phase, thereby reducing the risk of instability in the early stages of training.

[0066] The regularization coefficient was set to 0.01 to prevent overfitting and improve model generalization. The maximum sequence length for each input was set to 4096. This setting was made to accommodate the needs of long text processing while also considering the limitations of the model architecture. Model states were saved based on training steps to record important progress during training. Only the most recent checkpoint was retained among the number of checkpoints saved to save storage space. Validation was performed every 16 steps to monitor changes in model performance in a timely manner. Checkpoints were saved every 64 steps to ensure the safety of the training process and the feasibility of subsequent analysis.

[0067] The dataset used was Security-TTP-Mapping, which contains over 600 hierarchical categories, reflecting the complexity and diversity of attack patterns in the field of network security. Due to its security nature, the dataset contains text information about malware and other security aspects.

[0068] During the fine-tuning of large language models, Training Loss, Validation Token Accuracy, and Validation Loss are common evaluation metrics. Training Loss is the loss function value calculated on the training set, usually used to measure the model's fitting degree on the training data. For language models, the commonly used loss function is cross-entropy loss, whose formula is: where, is the number of samples in the training data, is the sequence length of each sample. is the next token predicted by the model Validation Loss is the loss function value calculated on the validation set, used to evaluate the model's generalization ability on unseen data. It is calculated in a similar way as TrainingLoss, based on cross-entropy loss: where is the number of samples in the validation set. ValidationToken Accuracy is the Token-level accuracy calculated on the validation set, measuring the proportion of Tokens predicted correctly by the model. Its formula is: where, is the number of samples in the validation set, is the sequence length of each sample, is the true Token, is the Token predicted by the model, is the indicator function.

[0069] First, to ensure the correctness of the large language model fine-tuning strategy selection, this experiment also uses two methods of full parameter fine-tuning and LoRA low-rank adaptation in efficient parameter fine-tuning for comparison, in order to select a better parameter fine-tuning method. The training loss and validation loss of full parameter fine-tuning are shown in Figure 6a and Figure 6b : In the training loss result, the curve from the initial value of about 7 rapidly decreases to about 2 or less, and stabilizes at around 100 steps, and then presents small random fluctuations, but overall remains stable. It shows that the model's learning process on the training set is normal, with rapid early decline and stable later period, indicating that the model effectively fits the training data. The validation set token accuracy rapidly rises from 0.4 to nearly 0.8, indicating that the model quickly learns and improves its prediction ability for the validation set tokens in the early training, showing that the model performs well on the validation set, with rapid early convergence and stable later period, indicating that the fine-tuning process is effective and the model has strong generalization ability on the task. The training loss and validation loss of LoRA low-rank adaptation parameter fine-tuning are shown in Figure 7a and Figure 7b : The training loss shows a sharp fluctuation, with the loss value fluctuating between 0.8 and 1.4, showing no obvious downward trend or convergence. Overall, it looks very unstable and lacks smooth convergence behavior.

[0070] Since the Security-TTP-Mapping used is essentially a small data set, it means that each batch contains fewer samples, and the variance of gradient estimation will increase significantly. In LoRA fine-tuning, only the parameters of the low-rank adaptation layer are updated, which usually accounts for a small part of the total parameters. This causes the gradient update to be too sensitive, resulting in a sharp fluctuation in the loss value.

[0071] In order to better evaluate the effectiveness of fine-tuning and prompt word scheme on ATT&CK mapping, the changes before and after using fine-tuning and prompt word engineering are compared and analyzed, and multiple small parameter models are used for result comparison. The experimental results are shown in Table 3.

[0072] Table 3 Experimental results table

[0073]

[0074] After using full parameter fine-tuning and prompt word engineering, the overall performance has been significantly improved, improving the model's judgment ability in the mapping task, achieving higher accuracy, and achieving better balance in positive class prediction, and also having excellent performance in F1-score score.

[0075] In order to verify the effectiveness of the attack model based on attack mapping and path analysis, the simulation environment of the network topology is built as shown in Figure 8 The defense process of this network topology can be divided into two levels. First, the attack perception stage from the external network. When the attacker enters the web server in the DMZ area for information collection, low-level attackers will be intercepted by regular security devices, while advanced attackers will obtain the authority of the web server even through 0day operations, without triggering the alarm of the security device. However, advanced attackers still need to collect information in the new attack stage, and service honeypots and system honeypots will be touched. At this time, the attack behavior has been perceived and recorded.

[0076] Second, the phishing event directly enters the internal network for advanced attackers. When they collect information in the internal network, system honeypots will be collected as high-value targets, and the attack behavior will also be perceived.

[0077] The value of honeypot alarm information not only lies in the perception of APT attacks. Most attacks faced by enterprise networks are still low-level attacks. For security operation personnel, how to effectively use honeypot alarms to deal with most low-level attacks is still a problem. This experiment also designs several attack paths, starting from different attacker ability assumptions, to verify the attack behavior and attacker model of the attack ability portrait of honeypot alarm backtracking.

[0078] The asset information of the small network is shown in Table 4. The attack paths of different levels of attackers are designed.

[0079] Table 4 Asset information table

[0080]

[0081] Low-level attackers mainly use automated tools to launch attacks, as shown in Table 5: After low-level attackers use old exploit scripts to obtain permissions, their ability to maintain permissions and move laterally is limited, and they cannot bypass the DMZ area restrictions to enter the office network, so they can only choose to obtain data on the server to maximize the effectiveness of the attack.

[0082] Table 5 Low-level attack path

[0083]

[0084] For medium-level attackers, they will have better performance in attack methods, post-intrusion backdoor residence, and post-cleanup, as shown in Table 6.

[0085] Table 6 Medium-level attack path

[0086]

[0087] High-level attackers have more sophisticated attack methods, not only attacking the DMZ area, but also conducting phishing attacks on individual hosts in the office area, as shown in Table 7.

[0088] Table 7 High-level attack path

[0089]

[0090] The above attack paths take into account different levels of attackers, and in the absence of honey points, real attack and defense experience combined with asset information are used to construct three attack paths with different ideas.

[0091] Taking low-level attackers as an example, due to their limited ability, they successfully obtained the permissions of a host in the attack path design, but their performance in lateral movement and residence was poor. In addition, after adding honey points, low-level attackers touched honey points during information collection and even used honey points as real targets for attacks. From the perspective of quantitative analysis, after adding attack mapping and path analysis, security operators can quickly learn about honey point alerts and regular security device alerts from visualized quantitative data, and respond in a timely manner. In addition, these attack behavior portraits can be handed over to large language models to generate corresponding attacker ability portraits, thereby realizing a complete attack model portrayal.

[0092] The deployed web honeypot and SSH honeypot successfully captured the complete attack chain of the attacker from the initial reconnaissance scan to the final data exfiltration. By analyzing the way the attacker interacts with the honeypot system, it can be accurately judged that the technical level of the attacker is "low-level attacker", and such attackers cannot effectively distinguish between honeypot and real system, and spend a lot of time on the honeypot, indicating that the honeypot system has high identification accuracy in attacker classification. Traditional security devices often face false alarm problems, while honeypot systems, due to their "bait" nature, any interaction with them is inherently highly suspicious. In this experiment, the honeypot system captured all real attack behaviors without false alarms, allowing the security team to focus limited response resources on real threats. At the same time, the high trustworthiness of the honeypot alert also provides cross-validation for the alerts of other security devices.

[0093] From the perspective of defense resource investment, the honeypot system showed a very high return on investment in this incident. Just by two honeypot nodes (Web and SSH), more than 50% of the attacker's attack activities were successfully attracted, greatly reducing the probability of attack on real systems, while obtaining complete attack technical intelligence, the honeypot system provides more economical and efficient security value.

[0094] The attack path probability graph is shown in Figure 9 , all paths have high probability in the "reconnaissance" stage, but as the attack deepens, the probability shows a clear differentiation, the SSH honeypot path maintains a high probability, successfully guiding the attacker to complete the entire attack chain, the real system path sharply decreases after the "execution" stage, indicating that the attacker's attention has been successfully diverted by the honeypot, the Web honeypot path is completely interrupted after the "privilege escalation" stage, showing that the attacker has turned to other targets. It should be noted that Figure 9 , the thickness of the line represents the intensity of interaction.

[0095] Referring to Figure 10 , the embodiment also provides an attack behavior analysis device based on attack mapping and path analysis, which is used to implement the above-mentioned method embodiment. The device comprises:

[0096] The model training unit 201 is configured to select a network security dataset, design a mapping prompt word for guiding a large language model to perform attack information mapping, and fine-tune the large language model according to the network security dataset and the mapping prompt word to obtain a mapping model.

[0097] The classification unit 202 is configured to obtain device alert information generated by a security device, perform attack mapping on the device alert information by using the mapping model to obtain corresponding attack techniques and strategies, and perform TTP classification on the attack techniques and strategies to obtain an alert classification result.

[0098] The information integration unit 203 is used to acquire honey spot alarm information, extract alarm features to obtain honey spot alarm features, and integrate relevant device alarm information, honey spot alarm information and honey spot alarm features to form an IP behavior sequence based on the IP information corresponding to the honey spot alarm features.

[0099] Evaluation unit 204 is used to evaluate the likelihood of collaboration between attacking IPs based on IP behavior sequences.

[0100] The attack path analysis unit 205 is used to design attack path analysis prompts with IP behavior sequences as context, and to analyze possible attack paths in the IP behavior sequences using a large language model. The attack path analysis prompts are used to guide the large language model to determine the probability of an attack path in the IP behavior sequence based on the possibility of collaboration between the IP behavior sequence and the attacking IP, and to infer all possible attack paths based on the alarm classification results.

[0101] All relevant content of each step involved in the above method embodiments can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0102] In other embodiments of this application, an electronic device is disclosed, such as... Figure 11 As shown, the electronic device 300 may include: one or more processors 301; a memory 302; a display 303; one or more application programs (not shown); and one or more computer programs 304. These devices can be connected via one or more communication buses 305. The one or more computer programs 304 are stored in the memory and configured to be executed by the one or more processors 301. The one or more computer programs 304 include instructions that can be used to perform actions such as... Figure 1 And the steps in the corresponding embodiments.

[0103] Through the above description of the embodiments, those skilled in the art will clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0104] In the embodiments of this application, the functional units can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0105] The integrated unit, if implemented in the form of a software function unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the embodiments of the present application essentially or in other words the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute all or part of the steps of the methods described in the embodiments of the present application. The aforementioned storage medium includes: flash memory, mobile hard disk, read-only memory, random access memory, magnetic disk or optical disk, and various media that can store program codes.

[0106] The above is only a specific implementation of the embodiments of the present application, but the protection scope of the embodiments of the present application is not limited thereto. Any change or replacement within the technical scope disclosed in the embodiments of the present application should be covered in the protection scope of the embodiments of the present application. Therefore, the protection scope of the embodiments of the present application should be subject to the protection scope of the claims.

Claims

1. An attack behavior analysis method based on attack mapping and path analysis, characterized in that, include: A network security dataset is selected, and mapping prompts are designed to guide a large language model to map attack information. The large language model is then fine-tuned and trained based on the network security dataset and the mapping prompts to obtain the mapping model. The system acquires device alarm information generated by security devices, uses the mapping model to perform attack mapping on the device alarm information to obtain corresponding attack techniques and strategies, and performs TTP classification on the attack techniques and strategies to obtain alarm classification results. Honey spot alarm information is obtained and alarm features are extracted to obtain honey spot alarm features. Based on the IP information corresponding to the honey spot alarm features, related device alarm information, honey spot alarm information and honey spot alarm features are integrated to form an IP behavior sequence. The likelihood of coordinated attacks between IPs is assessed based on the IP behavior sequence. Using the IP behavior sequence as context, attack path analysis prompts are designed, and a large language model is used to analyze possible attack paths in the IP behavior sequence. The attack path analysis prompts are used to guide the large language model to determine the probability of an attack path in the IP behavior sequence based on the possibility of collaboration between the IP behavior sequence and the attacking IP, and to infer all possible attack paths based on the alarm classification results.

2. The method according to claim 1, characterized in that, After analyzing the possible attack paths, the analysis also includes: Based on the device alarm information, the honeypot alarm information, and the possible attack paths in the IP behavior sequence, attacker basic attribute analysis, behavior pattern analysis, attack skill analysis, risk level analysis, and attack intent analysis are performed to obtain an attacker behavior profile. The basic attribute analysis includes analyzing the attacker's technical type and activity cycle based on the device alarm information; the behavior pattern analysis includes analyzing the attacker's behavior pattern characteristics based on possible attack paths in the IP behavior sequence; the attack skill analysis includes analyzing the attacker's attack capabilities from the dimensions of attack source, attack target, and attack timing based on the device alarm information and the honeypot alarm information; the risk level analysis includes assessing the attacker's risk level based on the results of the basic attribute analysis and the behavior pattern analysis; and the attack intent analysis includes determining the attacker's attack intent based on the results of the basic attribute analysis, the behavior pattern analysis, the attack skill analysis, and the risk level analysis.

3. The method according to claim 1, characterized in that, The mapping model is obtained by fine-tuning the large language model based on the cybersecurity dataset and the mapping prompt words, including: The network security dataset is input into a large language model, and the mapping prompt words are used to guide the large language model to obtain mapping results. Based on the mapping results, the loss value of the large language model is calculated by setting the cross-entropy loss function based on supervised learning, and the gradient of the loss function with respect to the parameters to be adjusted in the large language model is calculated by the backpropagation algorithm. The mapping model is obtained by updating the parameters of the large language model based on the gradient of the parameters to be adjusted.

4. The method according to claim 1, characterized in that, The honey spot alarm features obtained by acquiring honey spot alarm information and extracting alarm features include: Obtain honeypot alarm information, and extract information from the honeypot alarm information to obtain attack payload, attacker IP and attack frequency information; We use a large language model to analyze the behavioral patterns of attack payloads, attacker IPs, and attack frequency information to extract honeypot alarm characteristics. Honeypot alarm characteristics include attacker payload information, page access order on the honeypot, attack method selection, attack tools, and attack methods.

5. The method according to claim 1, characterized in that, Assessing the likelihood of coordinated attacks between IPs based on the IP behavior sequence includes: Calculating payload similarity and target overlap between different IPs is used to assess the likelihood of collaboration between attacking IPs; The calculation of payload similarity includes extracting attack payload features from the IP behavior sequence, converting the payload features into attack payload feature vectors, and calculating the cosine similarity of the attack payload feature vectors between different attacking IPs to obtain the payload similarity. The calculation of target overlap includes extracting attack target tuples from the IP behavior sequence, calculating target overlap based on the attack target tuples and the payload similarity, and the target overlap calculation satisfies the following formula: ,in, This represents the set of victims attacked by attacking IP subject A. This represents the set of victims attacked by attacking IP subject B. This indicates the payload similarity between attacking IP subject A and attacking IP subject B.

6. The method according to claim 1, characterized in that, The attack path analysis prompts are also used to guide the large language model to infer and output the probability values ​​corresponding to possible attack paths.

7. An attack behavior analysis device based on attack mapping and path analysis, characterized in that, The device includes: The model training unit is used to select a cybersecurity dataset, design mapping prompts to guide the large language model to map attack information, and fine-tune the large language model to obtain a mapping model based on the cybersecurity dataset and the mapping prompts. The classification unit is used to acquire device alarm information generated by security devices, use the mapping model to perform attack mapping on the device alarm information to obtain corresponding attack techniques and strategies, and perform TTP classification on the attack techniques and strategies to obtain alarm classification results. The information integration unit is used to acquire honey spot alarm information, extract alarm features to obtain honey spot alarm features, and integrate related device alarm information, honey spot alarm information and honey spot alarm features to form an IP behavior sequence based on the IP information corresponding to the honey spot alarm features. An evaluation unit is used to evaluate the likelihood of collaboration between attacking IPs based on the IP behavior sequence; The attack path analysis unit is used to design attack path analysis prompts using the IP behavior sequence as context, and to analyze possible attack paths in the IP behavior sequence using a large language model. The attack path analysis prompts are used to guide the large language model to determine the probability of an attack path in the IP behavior sequence based on the possibility of collaboration between the IP behavior sequence and the attacking IP, and to infer all possible attack paths based on the alarm classification results.

8. A computer-readable storage medium storing a computer program thereon, characterized in that, When the computer program is executed by the processor, it implements the attack behavior analysis method based on attack mapping and path analysis as described in any one of claims 1 to 6.

9. An electronic device, characterized in that, include: Processor and memory; The memory is used to store computer programs; The processor is used to execute the computer program stored in the memory, so that the electronic device performs the attack behavior analysis method based on attack mapping and path analysis as described in any one of claims 1 to 6.

Images