An attack behavior analysis method based on attack mapping and path analysis

Abstract

The application provides an attack behavior analysis method based on attack mapping and path analysis, comprising: selecting a network security data set, designing a mapping prompt word, and fine-tuning and training a large language model according to the network security data set and the mapping prompt word to obtain a mapping model; obtaining device alarm information and performing attack mapping to obtain corresponding attack techniques and strategies, and performing TTP classification to obtain alarm classification results; obtaining a honeypot alarm feature, integrating an IP behavior sequence according to corresponding IP information of the honeypot alarm feature; evaluating the cooperation possibility between attack IPs according to the IP behavior sequence; taking the IP behavior sequence as a context, designing an attack path analysis prompt word, and analyzing possible attack paths in the IP behavior sequence by using a large language model. The method can realize fine classification of attack behaviors, and can also analyze attacker behavior patterns, perform path analysis by using alarm data, and improve the predictability and response efficiency of potential threats.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an attack behavior analysis method based on attack mapping and path analysis. Background Technology

[0002] In the field of cybersecurity, as attack methods become increasingly sophisticated and covert, traditional rule-based and signature-based security measures are gradually revealing their limitations. Especially when facing complex cyberattacks such as advanced persistent threats, relying solely on alerts generated by intrusion detection systems, firewalls, and other security devices is insufficient to meet the need for timely and accurate threat identification and response.

[0003] Therefore, it is necessary to provide an analytical method that can deeply understand attack behavior in order to optimize network security protection systems. Summary of the Invention

[0004] The purpose of this invention is to provide an attack behavior analysis method based on attack mapping and path analysis, so as to improve the predictability and response efficiency of potential threats.

[0005] In a first aspect, the attack behavior analysis method based on attack mapping and path analysis provided by this invention includes: selecting a network security dataset, designing mapping prompts to guide a large language model to map attack information, fine-tuning and training the large language model based on the network security dataset and the mapping prompts to obtain a mapping model; acquiring device alarm information generated by security devices, using the mapping model to perform attack mapping on the device alarm information to obtain corresponding attack techniques and strategies, and performing TTP classification on the attack techniques and strategies to obtain alarm classification results; acquiring honeypot alarm information and extracting alarm features to obtain honeypot alarm features, integrating relevant device alarm information, honeypot alarm information, and honeypot alarm features based on the IP information corresponding to the honeypot alarm features to form an IP behavior sequence; evaluating the possibility of collaboration between attacking IPs based on the IP behavior sequence; using the IP behavior sequence as context, designing attack path analysis prompts, and using the large language model to analyze possible attack paths in the IP behavior sequence, wherein the attack path analysis prompts are used to guide the large language model to determine the possibility of attack paths in the IP behavior sequence based on the possibility of collaboration between the IP behavior sequence and the attacking IPs, and to list all possible attack paths based on the alarm classification results.

[0006] The beneficial effects of the attack behavior analysis method based on attack mapping and path analysis provided by this invention are as follows: It achieves refined classification of attack behaviors by mapping device alarm information. Simultaneously, it combines information obtained through honeypot technology to analyze attacker behavior patterns and utilizes alarm data for path analysis, thereby improving the predictability and response efficiency to potential threats.

[0007] In one possible embodiment, after analyzing the possible attack paths, the method further includes: based on device alarm information, honeypot alarm information, and possible attack paths in the IP behavior sequence, performing attacker basic attribute analysis, behavior pattern analysis, attack skill analysis, risk level analysis, and attack intent analysis to obtain an attacker behavior profile; wherein, the basic attribute analysis includes analyzing the attacker's technical type and activity cycle based on the device alarm information; the behavior pattern analysis includes analyzing the attacker's behavior pattern characteristics based on possible attack paths in the IP behavior sequence; the attack skill analysis includes analyzing the attacker's attack capabilities from the dimensions of attack source, attack target, and attack timing based on device alarm information and honeypot alarm information; the risk level analysis includes assessing the attacker's risk level based on the results of the basic attribute analysis and behavior pattern analysis; and the attack intent analysis includes determining the attacker's attack intent based on the results of the basic attribute analysis, behavior pattern analysis, attack skill analysis, and risk level analysis.

[0008] In another possible embodiment, fine-tuning the large language model to obtain the mapping model based on the cybersecurity dataset and the mapping prompts includes: inputting the cybersecurity dataset into the large language model, using the mapping prompts to guide the large language model to obtain the mapping result; calculating the loss value of the large language model based on the mapping result using a cross-entropy loss function set by supervised learning, calculating the gradient of the loss function with respect to the parameters to be adjusted in the large language model using the backpropagation algorithm; and updating the parameters of the large language model based on the gradient of the parameters to be adjusted to obtain the mapping model.

[0009] In other possible embodiments, obtaining honeypot alarm information and extracting alarm features to obtain honeypot alarm features includes: obtaining honeypot alarm information, extracting information from the honeypot alarm information to obtain attack payload, attacker IP and attack frequency information; using a large language model to perform behavioral pattern analysis on the attack payload, attacker IP and attack frequency information to extract honeypot alarm characteristics, including attacker payload information and page access order on the honeypot, attack method selection, attack tools and attack methods.

[0010] Assessing the likelihood of collaboration between attacking IPs based on the IP behavior sequence includes: calculating payload similarity and target overlap between different IPs to evaluate the likelihood of collaboration between attacking IPs; wherein, the calculation of payload similarity includes extracting attack payload features from the IP behavior sequence, converting the payload features into attack payload feature vectors, and calculating the cosine similarity of the attack payload feature vectors between different attacking IPs to obtain the payload similarity; the calculation of target overlap includes extracting attack target tuples from the IP behavior sequence, and calculating the target overlap based on the attack target tuples and the payload similarity, wherein the target overlap calculation satisfies the following formula: ,in, This represents the set of victims attacked by attacking IP subject A. This represents the set of victims attacked by attacking IP subject B. This indicates the payload similarity between attacking IP subject A and attacking IP subject B.

[0011] Attack path analysis prompts are also used to guide large language models to infer and output probability values ​​corresponding to possible attack paths.

[0012] Secondly, this invention also provides an attack behavior analysis device based on attack mapping and path analysis, comprising: a model training unit, used to select a network security dataset, design mapping prompts to guide a large language model to perform attack information mapping, and fine-tune and train the large language model according to the network security dataset and the mapping prompts to obtain a mapping model; a classification unit, used to acquire device alarm information generated by security devices, use the mapping model to perform attack mapping on the device alarm information to obtain corresponding attack techniques and strategies, and perform TTP classification on the attack techniques and strategies to obtain alarm classification results; and an information integration unit, used to acquire honeypot alarm information and extract alarm features to obtain honeypots. The system comprises: an alarm feature unit, an evaluation unit, and an attack path analysis unit. The first unit uses the IP behavior sequence as context to design attack path analysis prompts and employs a large language model to analyze possible attack paths within the IP behavior sequence. The second unit includes: an alarm feature feature unit, which integrates relevant device alarm information, honeypot alarm information, and honeypot alarm features to form an IP behavior sequence; an evaluation unit, which assesses the likelihood of collaboration between attacking IPs based on the IP behavior sequence; and an attack path analysis unit, which uses the IP behavior sequence as context to design attack path analysis prompts and employs a large language model to analyze possible attack paths within the IP behavior sequence. The attack path analysis prompts guide the large language model to determine the probability of an attack path within the IP behavior sequence based on the collaboration probability between the IP behavior sequence and the attacking IPs, and to list all possible attack paths based on the alarm classification results.

[0013] Thirdly, the present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the above-described attack behavior analysis method based on attack mapping and path analysis.

[0014] Fourthly, the present invention also provides an electronic device, comprising: a processor and a memory; the memory being used to store a computer program; the processor being used to execute the computer program stored in the memory, so that the electronic device performs the above-described attack behavior analysis method based on attack mapping and path analysis.

[0015] For the beneficial effects of the second to fourth aspects mentioned above, please refer to the description of the first aspect mentioned above. Attached Figure Description

[0016] Figure 1A flowchart illustrating an attack behavior analysis method based on attack mapping and path analysis provided in an embodiment of the present invention;

[0017] Figure 2 This is a schematic diagram of a honey spot alarm feature extraction process provided in an embodiment of the present invention;

[0018] Figure 3 This is a schematic diagram of key features for load similarity provided in an embodiment of the present invention;

[0019] Figure 4 This is a schematic diagram illustrating a path analysis prompt word design concept provided by an embodiment of the present invention;

[0020] Figure 5 This is a schematic diagram of an attack model structure for profiling attack behavior and attack capabilities, provided in an embodiment of the present invention.

[0021] Figure 6a This is a schematic diagram of the training loss for fine-tuning a large language model using a full-parameter fine-tuning method, as provided in an embodiment of the present invention.

[0022] Figure 6b This is a schematic diagram illustrating the verification loss of a large language model fine-tuning training method using a full-parameter fine-tuning approach, as provided in an embodiment of the present invention.

[0023] Figure 7a This is a schematic diagram of the training loss for fine-tuning a large language model using a low-rank adaptation parameter fine-tuning method, as provided in an embodiment of the present invention.

[0024] Figure 7b A schematic diagram illustrating the verification loss for fine-tuning training of a large language model using a low-rank adaptation parameter fine-tuning method, provided as an embodiment of the present invention.

[0025] Figure 8 A schematic diagram of a network topology simulation environment provided in an embodiment of the present invention;

[0026] Figure 9 This is a schematic diagram illustrating a possible attack path and its corresponding probability, provided by an embodiment of the present invention.

[0027] Figure 10 A schematic diagram of an attack behavior analysis device based on attack mapping and path analysis provided in an embodiment of the present invention;

[0028] Figure 11 This is a schematic diagram of an electronic device structure provided in an embodiment of the present invention. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions in the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without inventive effort are within the scope of protection of this invention. Unless otherwise defined, the technical or scientific terms used herein should have the ordinary meaning understood by those skilled in the art. The terms "comprising" and similar expressions used herein mean that the element or object preceding the word covers the element or object listed following the word and its equivalents, but do not exclude other elements or objects.

[0030] This embodiment provides an attack behavior analysis method based on attack mapping and path analysis. See also... Figure 1 The method includes:

[0031] S101: Select a cybersecurity dataset, design mapping prompts to guide the large language model in mapping attack information, and fine-tune the large language model based on the cybersecurity dataset and the mapping prompts to obtain the mapping model.

[0032] In one possible embodiment, fine-tuning the large language model to obtain a mapping model based on a cybersecurity dataset and mapping prompts includes: inputting the cybersecurity dataset into the large language model, using mapping prompts to guide the large language model to obtain mapping results; calculating the loss value of the large language model based on the mapping results using a cross-entropy loss function set by supervised learning, calculating the gradient of the loss function with respect to the parameters to be adjusted in the large language model using a backpropagation algorithm; and updating the parameters of the large language model based on the gradient of the parameters to be adjusted to obtain the mapping model.

[0033] In one possible embodiment, selecting a cybersecurity dataset for training the large language model aims to enhance the final mapping model's understanding of cybersecurity terminology, concepts, and expressions. The parameter update methods for the large language model include full-parameter fine-tuning and low-rank adaptation. When applying the full-parameter fine-tuning method, end-to-end full-parameter fine-tuning is performed, optimizing all parameters of the large language model using gradient descent. When applying the low-rank adaptation method, the low-rank adapter parameters in the large language model are optimized to achieve parameter fine-tuning.

[0034] Full-parameter fine-tuning optimizes all parameters of the model to achieve an overall improvement in model capability; while LoRA (Low-Rank Adaptation) fine-tuning only optimizes the low-rank adapter parameters in the model, aiming to achieve effective performance improvement while maintaining lower computational cost. In one possible implementation, experiments comparing the simultaneous implementation of full-parameter fine-tuning and low-rank adaptation fine-tuning to update the parameters of a large language model revealed that, during the training of the mapping model, the full-parameter fine-tuning method outperforms the low-rank adaptation fine-tuning method.

[0035] In a specific embodiment, in order to better adapt to the training needs of the mapping model, the design of the mapping prompts includes the following requirements: (1) Task description: First, clarify the problem to be solved, that is, map the input alarm information to the tactics and techniques of ATT&CK. (2) Problem: Provide the alarm or security information text to the large language model, which is the direct information that the large language model needs to process. (3) Context: Here, the technique of few-shot thinking is required, and specific examples are used to guide the large language model to imitate the example content for analysis and judgment. (4) Output format: Since formatted output is required, the display format of the model's answer to the question needs to be specified here. In addition, this module only needs the mapping result, so the large language model can be required to return the final result directly in the form of {"Tactic":"","Techniques":"}. In addition, when designing the mapping prompts, the identity can be set as a security analyst responsible for security operations. Through role-playing, the model can better understand the thinking mode of security analysts when processing alarm information, thereby improving the accuracy of mapping.

[0036] For example, a method for fine-tuning a large language model (Meta-Llama-3.1-8B) using the Security-TTP-Mapping open-source dataset as a cybersecurity dataset, and applying a full-parameter fine-tuning method during the training phase to optimize the parameters of the large language model to obtain the mapping model, specifically includes: selecting the Security-TTP-Mapping open-source dataset as the initial dataset; preprocessing the initial dataset according to the input format requirements of the Meta-Llama-3.1-8B model to ensure that the data format matches the model's input format, thereby effectively supporting subsequent model fine-tuning; using the preprocessed dataset in the fine-tuning phase of the Meta-Llama-3.1-8B model; and implementing end-to-end full-parameter fine-tuning to optimize all model parameters using gradient descent to further enhance the model's understanding and generalization ability of security event description text. The specific steps for fine-tuning are as follows: First, input the preprocessed data into the Meta-Llama-3.1-8B model and perform forward propagation to obtain the prediction results; then, calculate the loss value based on the cross-entropy loss function set by supervised learning, and calculate the gradient of the loss function with respect to all model parameters through the backpropagation algorithm; finally, use the optimizer to update the model parameters.

[0037] The cross-entropy loss function is defined as follows: , Indicates the number of samples in the dataset. This represents the sequence length of each sample. Indicates sample Real labels for corresponding categories , Indicates the model predicts samples Category The probability of . In the backpropagation algorithm, the gradient of the loss function with respect to all model parameters satisfies the following formula: , Represents neurons The output, Represents neurons The input weighted sum, Indicates the neurons from the previous layer To the current neuron The weights of neurons. The input signal is a fundamental computational unit in a neural network. Its main function is to receive input signals from the previous layer, calculate activation values ​​through weighted summation, and then generate the output using an activation function. During gradient descent optimization, the AdamW optimization algorithm is used, updating the parameters using the following formula: , Indicates model parameters, Indicates the learning rate. This represents the first-order moment estimate, i.e., the exponentially weighted average of the gradient. This represents the second-order moment estimate, which is the exponentially weighted average of the squared gradients. This represents a constant used to avoid division by zero errors during computation. The AdamW optimization algorithm, building upon gradient descent, introduces first-order and second-order moment estimates to make parameter updates smoother and more adaptive. To avoid getting trapped in local optima due to the sparsity of security event description text, a cosine annealing learning rate scheduling method is used. The learning rate is calculated according to the following formula: ,in, This represents the learning rate in the current round. This represents the initial minimum learning rate. This represents the initially set maximum learning rate. Indicates the current training step count. This represents the total number of training steps.

[0038] S102: Obtain device alarm information generated by security devices, use a mapping model to perform attack mapping on the device alarm information to obtain corresponding attack techniques and strategies, and perform TTP classification on the attack techniques and strategies to obtain alarm classification results.

[0039] In one possible implementation, the fine-tuned mapping model is applied to perform ATT&CK technology mapping. The output of the mapping model, after inputting device alarm information generated by security devices, is the result of mapping and aligning the device alarm information with the ATT&CK framework, thereby accurately identifying and matching specific attack techniques and strategies. The mapping results are then classified according to TTP (Tactics, Techniques, and Procedures) to achieve fine-grained identification and classification of network attack behaviors.

[0040] After attack mapping is completed on device alarm information, the tactics and techniques obtained will be stored in the database to facilitate further analysis based on historical alarm information in combination with alarm information obtained from honeypots.

[0041] S103: Obtain honey spot alarm information and extract alarm features to obtain honey spot alarm features. Based on the IP information corresponding to the honey spot alarm features, integrate the relevant device alarm information, honey spot alarm information and honey spot alarm features to form an IP behavior sequence.

[0042] In one possible embodiment, obtaining honeypot alarm information and extracting alarm features to obtain honeypot alarm features includes: obtaining honeypot alarm information, extracting information from the honeypot alarm information to obtain attack payload, attacker IP, and attack frequency information; using a large language model to perform behavioral pattern analysis on the attack payload, attacker IP, and attack frequency information to extract honeypot alarm characteristics. The honeypot alarm features include attacker payload information, page access order on the honeypot, attack method selection, attack tools, and attack methods.

[0043] Honeypots can be deployed on the network perimeter or within the internal network. They can acquire attack behavior data, including attack tools and characteristics, attacker IP addresses, and attack times. Honeypots can record attacker behavior, such as the specific details of attack methods like SQL injection, XSS attacks, brute-force attacks, and file inclusion. Because honeypot deployments emphasize concealment, those accessing them are typically potential attackers. Therefore, attack traffic generated during honeypot access can undergo preliminary processing to extract key data such as attack payloads, attacker IP addresses, and attack frequencies. This data is then provided to a large language model as context for behavioral pattern analysis, enabling a more detailed analysis of attacker behavior.

[0044] While honeypots cannot directly obtain the attacker's identity information, they can record information such as the attacker's IP address and the attack time, providing clues for subsequent attribution analysis. For example, see... Figure 2 The process of extracting honeypot alert features from information recorded by honeypots includes: real-time attack data collection to obtain honeypot alert information; extraction of attack behavior information from the honeypot alert information to obtain attack payload, attacker IP, and attack frequency statistics; preliminary analysis using a large language model based on the attacker behavior information recorded by the honeypot to obtain information such as the attacker's page access order, attack method selection, attack tool records, and attack frequency; and further analysis of the information obtained from the preliminary analysis to obtain attacker behavior patterns. The page access order, attack method selection, attack tools, and attack methods obtained through the large language model analysis are used as honeypot alert features, and these features are stored in the honeypot alert database along with the corresponding attacker IPs.

[0045] Compared with alarm information from other devices, the honeypot alarm database stores behavioral pattern analysis data of honeypot visitors, which can provide more targeted support for further analysis of attack behavior. When performing path analysis, high-value information such as honeypot alarm characteristics can serve as the core basis for analysis.

[0046] In one possible embodiment, after obtaining the honeypot alarm features, the honeypot alarm features are combined with historical alarm data for further analysis. The historical alarm data designed here includes honeypot alarm information and device alarm information from other security devices. Combining the honeypot alarm features with historical alarm data includes: for each set of honeypot alarm features corresponding to an attacker IP in the honeypot alarm database, collecting all associated historical alarm data, arranging the events recorded in the historical alarm data in chronological order to form a related behavioral sequence, and the resulting behavioral sequence is denoted as the IP behavioral sequence.

[0047] S104: Assess the likelihood of collaboration between attacking IPs based on IP behavior sequences.

[0048] In one possible implementation, considering that attackers may have the ability to use IP proxy pools and change IPs to attempt attacks, the possibility of coordination between attacking IPs is assessed based on the IP behavior sequence.

[0049] In one specific embodiment, a two-dimensional similarity evaluation system is designed to assess the possibility of collaboration between attacking IPs. The assessment of the possibility of collaboration between attacking IPs based on the IP behavior sequence includes calculating the payload similarity and target overlap between different attacking IPs to assess the possibility of collaboration between attacking IPs.

[0050] The calculation of payload similarity includes extracting attack payload features from the IP behavior sequence, converting the payload features into attack payload feature vectors, and calculating the cosine similarity of the attack payload feature vectors between different IPs to obtain the payload similarity. The calculation of target overlap includes extracting attack target tuples from the IP behavior sequence, and calculating the target overlap based on the attack target tuples and the payload similarity. The target overlap calculation satisfies the following formula: ,in, This represents the set of victims attacked by attacking IP subject A. This represents the set of victims attacked by attacking IP subject B. This indicates the payload similarity between attacking IP subject A and attacking IP subject B.

[0051] In one specific embodiment, see Figure 3The attack payload features extracted to calculate the similarity between different attacking IPs include key features such as protocol type, payload size, opcode, anomaly mode, and signature information. These extracted attack payload features are then converted into numerical form for subsequent mathematical processing. Specifically, converting the attack payload features into numerical form means converting them into binary vectors to obtain the attack payload feature vector. For continuous value features such as payload size, normalization is performed. For discrete features in the payload, such as protocol type, opcode, anomaly mode, and signature information, one-hot encoding is used to represent them, that is, each discrete feature is converted into a mutually exclusive binary vector representation. Each dimension of the binary vector corresponding to each discrete feature is independent, with only the position corresponding to the feature's category being 1, and the remaining positions being 0.

[0052] The cosine similarity of the attack payload feature vectors between different attack IPs is calculated based on the attack payload feature vectors to obtain the payload similarity. The calculation of the payload similarity satisfies the following formula: Where A and B represent two different attacking IP entities; This represents two attack payload feature vectors to be compared, with dimensions of... ; Represents the first element in the attack payload feature vector. The values ​​of each feature are measured for directional consistency through vector dot product operations; The magnitude of the vector is used for normalization. Payload similarity measures the similarity of attack techniques; the higher the payload similarity value, the more likely the attack patterns are related.

[0053] Building upon payload similarity, target overlap is introduced to construct a target system profile matrix, including the port service fingerprints, vulnerability features, and asset value weights of the attacked IPs. Cosine similarity is used to calculate the spatial distribution correlation of attack targets, identifying strategically targeted coordinated attacks. The target overlap is calculated according to the following formula: ,in, This represents the set of victims attacked by attacking IP subject A. This represents the set of victims attacked by attacking IP subject B. This indicates the payload similarity between attacking IP subject A and attacking IP subject B. Specifically, and The elements in the array are attack target tuples, and each attack target tuple contains the following information:<IP,Port> Here, IP refers to the IP address of the target, and Port refers to the port number of the target. Target overlap measures the proportion of overlap between the target (IP + port) of two attacking IPs. The higher the target overlap value, the more concentrated the attack targets.

[0054] S105: Using IP behavior sequences as context, design attack path analysis prompts and use a large language model to analyze possible attack paths in the IP behavior sequences. The attack path analysis prompts are used to guide the large language model to determine the probability of an attack path in the IP behavior sequence based on the possibility of collaboration between the IP behavior sequence and the attacking IP, and to infer all possible attack paths based on the alarm classification results.

[0055] In one possible embodiment, attack path analysis prompts are also used to guide the large language model to infer and output probability values ​​corresponding to possible attack paths.

[0056] In one possible implementation, IP behavior sequences are input as context into a large language model. The logical reasoning capabilities of the large language model are then used to analyze the IP behavior sequences and infer the attacker's potential intentions. For example, when an attacker frequently attempts to access specific types of sensitive files or services, it means that the attacker is looking for specific data. For instance, when an attacker accesses the / etc / passwd and / etc / shadow files, it indicates that the attacker is trying to find the hash values ​​of system user passwords.

[0057] Using IP behavior sequences as contextual input requires designing attack path analysis prompts to guide the large language model in performing attack path analysis and outputting results. For example, one type of attack path analysis prompt designed based on results obtained from a mapping model is as follows: Figure 4 As shown, the design of attack path analysis prompts can be broken down into four key dimensions: role playing, task decomposition, few-shot learning, and consistency constraints.

[0058] The role-playing dimension sets a contextual baseline for subsequent reasoning and generation by clearly defining the identity and task objectives of the large language model.

[0059] Task decomposition breaks down high-level abstract tasks into specific operational steps. By guiding the model step by step, it effectively reduces the complexity of task processing, enabling it to output stable and reliable results with a clear structure. For example, path analysis prompts can be used to refine the task by guiding the large language model to first determine the possibility of an attack path based on the IP behavior sequence, then list all possible attack paths based on the dependencies of each attack type in the ATT&CK matrix, and finally output the probability values ​​of these attack paths through inference.

[0060] The few-shot learning strategy dimension guides the large language model through input and output examples: when the input is a sequence of behaviors consisting of alerts corresponding to an attacking IP, the model should output a path chain (e.g., "A→B→C") and its corresponding attack probability (e.g., "Command execution movement risk: 80%"). This approach aims to guide the model to learn reasoning logic by providing representative samples, enabling reasonable inference and generation even in scenarios with scarce samples.

[0061] The consistency constraint dimension proposes the following core requirements: First, the analysis process should be logically self-consistent to ensure that the reasoning chain is reasonable and complete; second, conclusions should be avoided when key information is lacking to prevent false inferences; third, the probability assessment of all attack paths must be based on behavioral sequence analysis and network topology to ensure that the assessment results are based on sufficient evidence.

[0062] The path analysis hints described in the above example are designed based on honeypot IPs, constructing attack paths using historical alert data. Subsequent attack steps are deduced step-by-step based on the time sequence of alerts, IP changes, or technical correlations. The logical relationships of ATT&CK techniques are used to guide the analysis; for example, initial access may be followed by privilege escalation or lateral movement. Finally, the probability of certain alerts forming an attack path is quantified in probabilistic form. The core objective is to help users quickly understand the attacker's behavioral sequence and provide decision support through probability assessment.

[0063] In one possible embodiment, the attack behavior analysis method based on attack mapping and path analysis further includes: performing attacker behavior profile analysis, based on device alarm information, honeypot alarm information, and possible attack paths in the IP behavior sequence, to analyze the attacker's basic attributes, behavior patterns, attack skills, risk levels, and attack intent. Specifically, the basic attribute analysis includes analyzing the attacker's technical type and activity cycle based on device alarm information; the behavior pattern analysis includes analyzing the attacker's behavioral pattern characteristics based on possible attack paths in the IP behavior sequence; the attack skills analysis includes analyzing the attacker's attack capabilities from the dimensions of attack source, attack target, and attack timing based on device alarm information and honeypot alarm information; the risk level analysis includes assessing the attacker's risk level based on the results of the basic attribute analysis and behavior pattern analysis; and the attack intent analysis includes determining the attacker's attack intent based on the results of the basic attribute analysis, behavior pattern analysis, attack skills analysis, and risk level analysis.

[0064] Systematically analyzing attacker characteristics and attack behavior patterns provides security operations personnel with an intuitive attack model that profiles the attack behavior and capabilities of visitors to honeypots. See also Figure 5 The attack model analysis dimensions include: basic attribute analysis, behavior pattern analysis, attack skill analysis, risk level analysis, and attack intent analysis.

[0065] For example, the basic attribute classification is based on device alarm information, including the attack source IP address, the time window of the attack, the type of network service involved in the attack, and the alarm category: by aggregating the device alarm information, the types of services most frequently accessed by attackers and the time periods in which attacks occur are statistically analyzed, thereby initially defining the attacker's technical type and active cycle characteristics.

[0066] Behavioral pattern analysis is based on the historical sensitive behavior records of honeypot visitors: It leverages attack path analysis results based on historical alert data to reveal attackers' behavioral preferences, attack steps, and behavioral complexity. For example, by analyzing the frequency of tactical and technical choices within the attack path, it can determine whether attackers prefer specific penetration or privilege escalation methods, thereby establishing unique behavioral pattern characteristics of the attackers.

[0067] The purpose of attack skill analysis is to more intuitively demonstrate the attacker's technical capabilities during the attack process. The analysis dimensions include attack source, attack target, and attack sequence: based on historical alert data, the complexity of the attack and the degree of concealment of the attack source are assessed according to information such as IP address attribution, geographical location, attack protocol and service type, and autonomous system; based on the target asset type, vulnerability exploitation, attack tools used, and attack content, the attacker's understanding of the target environment and the depth of the technical attack are analyzed; based on the stability of attack frequency, attack duration, data transmission rate, packet interval, and session interval, the attacker's action planning and technical control over the attack process are analyzed.

[0068] Risk level analysis is a comprehensive evaluation based on basic attribute analysis and behavioral pattern analysis. It primarily measures the potential threat level of attackers to the network environment. Using large language models, it analyzes the complexity of attacker behavior patterns, the sensitivity of assets involved in the attack, and the severity of historical alert events to output the attacker's risk level. The risk level is further subdivided into high, medium, and low tiers, providing a basis for security operations personnel in resource allocation and threat response decisions.

[0069] Attack intent analysis is a higher-level information extraction process. It integrates the results of basic attribute analysis, behavioral pattern analysis, attack skill analysis, and risk level analysis, along with asset-related information, to determine the attacker's intent. Attack intent analysis helps security operations personnel to conduct targeted emergency response. Furthermore, within the framework of the four honeypots (honeypots, honeypots, and honeypots), it helps to leverage the adaptability of honeypots to guide attackers into new attack scenarios, completely trapping them in a deceptive defense.

[0070] This invention provides an attack behavior analysis method based on attack mapping and path analysis. Addressing the urgent need for attack behavior understanding and threat analysis in the cybersecurity field, it offers new ideas and technical support for improving the detection and response capabilities of advanced threats. By realizing semantic mapping from alert information to the MITRE ATT&CK framework, it significantly improves the classification accuracy and semantic understanding depth of attack behaviors. Furthermore, it introduces honeypot technology as a proactive defense measure, enhancing the ability to perceive unknown threats by capturing the attacker's behavioral trajectory and characteristic information. Honeypot alert information not only provides high-value intelligence input but also provides crucial support for path analysis through linkage with device alert information. It also utilizes the reasoning capabilities of large language models, combining time series and the logical relationship of the ATT&CK framework to reconstruct the attacker's potential behavioral sequences and quantify the probability of attack paths in probabilistic form, providing security operations personnel with a scientific basis for decision-making.

[0071] Attack behavior analysis methods based on attack mapping and path analysis fine-tune the parameters of a large language model to adapt it to specific tasks in the cybersecurity field. This allows for the extraction of key entities from alert information and precise mapping to tactical or technical entries within the ATT&CK framework. This process not only enhances the model's understanding of cybersecurity terminology and context but also provides a solid foundation for subsequent attack path analysis. Honeypots are introduced as part of a proactive defense mechanism, capturing attacker activity traces, including but not limited to attack tools, methods, and traffic alerts, by deploying honeypots both inside and outside the network. This high-value intelligence provides crucial evidence for analyzing attacker behavior patterns. Based on collected historical alert information, the reasoning capabilities of the large language model are used for path analysis, revealing the attacker's action trajectory and potential strategic objectives throughout the attack lifecycle. This also achieves complementarity between honeypot alerts and traditional security device alerts, thereby optimizing the cybersecurity protection system.

[0072] This invention also provides a specific experimental example of an attack behavior method based on attack mapping and path analysis. The experimental environment was conducted on an Ubuntu 22.04 system, using a GTX 4090 graphics card with 24 GB of video memory and 64 GB of RAM, and using the Python language and the Meta-Llama-3.1-8B model. The specific experimental environment configuration information is shown in Table 1 below.

[0073] Table 1 Experimental Configuration Table

[0074]

[0075] In the experiment, a series of hyperparameter configurations were used to fine-tune the large language model. The experimental parameter information is shown in Table 2 below.

[0076] Table 2 Experimental Parameter Table

[0077]

[0078] Training lasted for 3 epochs. This epoch was chosen to optimize model performance without overfitting, considering the dataset size and efficient use of computational resources. A fixed learning rate of 0.00003 was used. This learning rate was determined through a series of pre-experiments and effectively balances convergence speed and stability. Each batch contained only one sample. Given model and hardware limitations, this setup, while sacrificing some parallelization advantages, ensured that the maximum sequence length could be processed. An automatic batching mechanism was employed to maximize GPU memory utilization while maintaining the natural distribution of the input data. A cosine annealing strategy was followed to dynamically adjust the learning rate, aiming to accelerate the convergence process and improve the final model's performance. A 3% learning rate warm-up phase was implemented to help the model transition more smoothly to the initial fast learning phase, thereby reducing the risk of instability in the early stages of training.

[0079] The regularization coefficient is set to 0.01 to prevent overfitting and improve the model's generalization ability. The maximum sequence length for each input is set to 4096. This setting is to accommodate the needs of long text processing while also taking into account the limitations of the model architecture. The model state is saved based on the training step to record important progress during training. Only the most recent checkpoint is retained in the saved checkpoint count to save storage space. Validation is performed every 16 steps to monitor changes in model performance in a timely manner. A checkpoint is saved every 64 steps to ensure the safety of the training process and the feasibility of subsequent analysis.

[0080] The dataset used is Security-TTP-Mapping, which contains over 600 hierarchical categories, reflecting the complexity and diversity of attack patterns in the cybersecurity field. Due to its security nature, the dataset includes textual information about malware and other security aspects.

[0081] In the fine-tuning of large language models, Training Loss, Validation Token Accuracy, and Validation Loss are common evaluation metrics. Training Loss is the loss function value calculated on the training set and is typically used to measure how well the model fits the training data. For language models, the commonly used loss function is cross-entropy loss, and its formula is: ,in, It is the number of samples in the training data. It is the sequence length of each sample. It is the next token predicted by the model. The probability of... Validation Loss is the loss function value calculated on the validation set, used to evaluate the model's ability to generalize to unseen data. Its calculation method is similar to Training Loss, also based on cross-entropy loss: ,in This is the number of samples in the validation set. Validation Token Accuracy is the token-level accuracy calculated on the validation set, used to measure the proportion of tokens correctly predicted by the model. Its formula is: ,in, That is the number of samples in the validation set. It is the sequence length of each sample. It is a real token. It is a token predicted by the model. It is an indicator function.

[0082] Firstly, to ensure the correctness of the fine-tuning strategy selection for the large language model, this experiment also compared two methods: full-parameter fine-tuning and LoRA low-rank fitting, a highly efficient parameter fine-tuning method, to select the one with better performance. The training and validation losses of full-parameter fine-tuning are as follows: Figure 6a and Figure 6b As shown: In the training loss results, the curve rapidly decreased from an initial value of approximately 7 to below 2, stabilizing around 2 after 100 steps, and then exhibiting small random fluctuations, but remaining generally stable. This indicates that the model's learning process on the training set was normal, with a rapid decrease in the early stages and stabilization in the later stages, indicating that the model effectively fitted the training data. The validation set token accuracy rapidly increased from 0.4 to nearly 0.8, indicating that the model quickly learned and improved its prediction ability for validation set tokens in the early stages of training, showing good performance on the validation set. The early rapid convergence and later stabilization indicate that the fine-tuning process was effective, and the model has strong generalization ability on the task. The training loss and validation loss for LoRA low-rank fitting parameter fine-tuning are shown below. Figure 7a and Figure 7b As shown, the training loss fluctuates wildly, oscillating between 0.8 and 1.4 without any clear downward trend or convergence. Overall, it appears very unstable and lacks smooth convergence behavior.

[0083] Because the Security-TTP-Mapping used is essentially a small dataset, each batch contains few samples, significantly increasing the variance of gradient estimates. In LoRA fine-tuning, since only the parameters of the low-rank adaptation layers are updated, which typically represent a small portion of the total parameters, gradient updates become overly sensitive, causing drastic fluctuations in the loss value.

[0084] In addition, to better evaluate the effectiveness of the fine-tuning and prompting scheme on ATT&CK mapping, we compared and analyzed the changes before and after using the fine-tuning and prompting scheme, and used multiple small-parameter models to compare the results. The experimental results are shown in Table 3 below.

[0085] Table 3 Experimental Results

[0086]

[0087] After using full parameter fine-tuning and prompt word engineering, the overall performance was significantly improved, enhancing the model's judgment ability in mapping tasks, achieving higher accuracy, and achieving a better balance in positive class prediction, as well as excellent performance in F1-score.

[0088] To verify the effectiveness of the attack model based on attack mapping and path analysis, a network topology simulation environment was built, such as... Figure 8 As shown. The defense process for this network topology can be divided into two levels. The first is the attack detection stage from the external network. When an attacker enters the web server targeting the DMZ zone to collect information, low-level attackers will be intercepted by conventional security devices. Even if a high-level attacker obtains access to the web server through zero-day operations and does not trigger an alarm from the security device, the high-level attacker still needs to collect information in the new attack stage. Service honeypots and system honeypots will be touched. At this time, the attack behavior has been detected and recorded.

[0089] Secondly, for advanced attackers who directly enter the internal network, such as those involved in phishing incidents in the office area, system honeypots will be collected as high-value targets when they are collecting internal network information, and their attack behavior will also be detected.

[0090] The value of honeypot alerts lies not only in their ability to detect APT attacks. Most attacks faced by enterprise networks remain low- to medium-level attacks, and for security operations personnel, effectively utilizing honeypot alerts to handle these attacks remains a challenge. This experiment also designed several attack paths, starting from different attacker capability assumptions, to verify the attacker model derived from the attack behavior traced by honeypot alerts and the attacker capability profile.

[0091] The asset information of the small network is shown in Table 4 below, and attack paths are designed for attackers of different levels.

[0092] Table 4 Asset Information Table

[0093]

[0094] Low-level attackers primarily launch attacks using automated tools, as shown in Table 5 below. For low-level attackers, after gaining privileges using old exploit scripts, their privilege maintenance and lateral movement capabilities are limited. They cannot bypass DMZ restrictions to enter the office network, so they can only choose to obtain data from the server to maximize the attack effect.

[0095] Table 5 Low-level attack paths

[0096]

[0097] For intermediate-level attackers, they will perform better in attack methods, backdoor persistence after intrusion, and post-intrusion cleanup, as shown in Table 6 below.

[0098] Table 6 Horizontal Attack Paths

[0099]

[0100] Advanced attackers employ a wider range of tactics, targeting not only the DMZ zone but also personal computers in office areas with phishing attacks, as detailed in Table 7 below.

[0101] Table 7 High-level attack paths

[0102]

[0103] The above attack paths were designed with the different skill levels of attackers in mind. Without adding honeypots, three different attack paths were constructed based on real attack and defense experience and asset information.

[0104] Taking a low-level attacker as an example, due to limited capabilities, although they may successfully gain access to a host during the attack path design, their lateral movement and persistence are poor. Furthermore, with the addition of honeypots, low-level attackers sometimes inadvertently access honeypots during the information gathering phase, or even use honeypots as real targets in their attacks. From a quantitative analysis perspective, after incorporating attack mapping and path analysis, security operations personnel can quickly obtain information on honeypot alerts and regular security device alerts from visualized quantitative data, enabling timely incident response. Moreover, these attack behavior profiles can be used by large language models to generate corresponding attacker capability profiles, thus achieving a complete attack model characterization.

[0105] The deployed web and SSH honeypots successfully captured the entire attack chain from initial reconnaissance scanning to final data leakage. Analysis of the attacker's interaction with the honeypot system accurately identified them as "low-level attackers." These attackers cannot effectively distinguish between honeypots and real systems, spending significant time on the honeypots, demonstrating the honeypot system's high accuracy in attacker classification. Traditional security devices often face false alarms, but due to the "honey bait" nature of the honeypot system, any interaction with it is inherently highly suspicious. In this experiment, all alerts captured by the honeypot system were genuine attack behaviors, with no false alarms, allowing the security team to focus limited response resources on real threats. Furthermore, the high trust level of the honeypot alerts provided cross-validation for alerts from other security devices.

[0106] From the perspective of defense resource investment, the honeypoint system demonstrated an extremely high return on investment in this incident. Using only two honeypoint nodes (Web and SSH), it successfully attracted over 50% of the attackers' activity, significantly reducing the probability of attacking the real system while simultaneously acquiring complete attack intelligence. The honeypoint system provided more cost-effective and efficient security value.

[0107] Attack path probability graph as follows Figure 9 As shown, all paths have a high probability during the "reconnaissance" phase, but the probability diverges significantly as the attack progresses. The SSH honeypot path maintains a high probability, successfully guiding the attacker to complete the entire attack chain. The real system path drops sharply after the "execution" phase, indicating that the attacker's attention has been successfully diverted by the honeypot. The Web honeypot path completely breaks down after the "privilege escalation" phase, showing that the attacker has shifted to other targets. It should be noted that... Figure 9 The thickness of the lines reflects the intensity of the interaction.

[0108] See Figure 10 This embodiment also provides an attack behavior analysis device based on attack mapping and path analysis, which is used to implement the above method embodiment. The device includes:

[0109] The model training unit 201 is used to select a cybersecurity dataset, design mapping prompts to guide the large language model to map attack information, and fine-tune the large language model to obtain a mapping model based on the cybersecurity dataset and the mapping prompts.

[0110] The classification unit 202 is used to obtain device alarm information generated by security devices, use a mapping model to perform attack mapping on the device alarm information to obtain corresponding attack techniques and strategies, and perform TTP classification on the attack techniques and strategies to obtain alarm classification results.

[0111] The information integration unit 203 is used to acquire honey spot alarm information, extract alarm features to obtain honey spot alarm features, and integrate relevant device alarm information, honey spot alarm information and honey spot alarm features to form an IP behavior sequence based on the IP information corresponding to the honey spot alarm features.

[0112] Evaluation unit 204 is used to evaluate the likelihood of collaboration between attacking IPs based on IP behavior sequences.

[0113] The attack path analysis unit 205 is used to design attack path analysis prompts with IP behavior sequences as context, and to analyze possible attack paths in the IP behavior sequences using a large language model. The attack path analysis prompts are used to guide the large language model to determine the probability of an attack path in the IP behavior sequence based on the possibility of collaboration between the IP behavior sequence and the attacking IP, and to infer all possible attack paths based on the alarm classification results.

[0114] All relevant content of each step involved in the above method embodiments can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0115] In other embodiments of this application, an electronic device is disclosed, such as... Figure 11 As shown, the electronic device 300 may include: one or more processors 301; a memory 302; a display 303; one or more application programs (not shown); and one or more computer programs 304. These devices can be connected via one or more communication buses 305. The one or more computer programs 304 are stored in the memory and configured to be executed by the one or more processors 301. The one or more computer programs 304 include instructions that can be used to perform actions such as... Figure 1 And the various steps in the corresponding embodiments.

[0116] Through the above description of the embodiments, those skilled in the art will clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0117] In the embodiments of this application, the functional units can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0118] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, essentially, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as flash memory, portable hard disk, read-only memory, random access memory, magnetic disk, or optical disk.

[0119] The above description is merely a specific implementation of the embodiments of this application, but the protection scope of the embodiments of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the embodiments of this application should be covered within the protection scope of the embodiments of this application. Therefore, the protection scope of the embodiments of this application should be determined by the protection scope of the claims.

Claims

1. An attack behavior analysis method based on attack mapping and path analysis, characterized in that, include: A network security dataset is selected, and mapping prompts are designed to guide a large language model to map attack information. The large language model is then fine-tuned and trained based on the network security dataset and the mapping prompts to obtain the mapping model. The system acquires device alarm information generated by security devices, uses the mapping model to perform attack mapping on the device alarm information to obtain corresponding attack techniques and strategies, and performs TTP classification on the attack techniques and strategies to obtain alarm classification results. Honey spot alarm information is obtained and alarm features are extracted to obtain honey spot alarm features. Based on the IP information corresponding to the honey spot alarm features, related device alarm information, honey spot alarm information and honey spot alarm features are integrated to form an IP behavior sequence. Assessing the likelihood of collaboration between attacking IPs based on the IP behavior sequence includes: calculating the payload similarity and target overlap between different IPs to assess the likelihood of collaboration between attacking IPs; wherein, the calculation of payload similarity includes extracting attack payload features from the IP behavior sequence, converting the payload features into attack payload feature vectors, and calculating the cosine similarity of the attack payload feature vectors between different attacking IPs to obtain the payload similarity; the calculation of target overlap includes extracting attack target tuples from the IP behavior sequence, calculating the target overlap based on the attack target tuples and the payload similarity, and the target overlap calculation satisfies the following formula: , where represents the set of victims attacked by attacking IP subject A, represents the set of victims attacked by attacking IP subject B, and represents the payload similarity between attacking IP subject A and attacking IP subject B; Using the IP behavior sequence as context, attack path analysis prompts are designed, and a large language model is used to analyze possible attack paths in the IP behavior sequence. The attack path analysis prompts are used to guide the large language model to determine the probability of an attack path in the IP behavior sequence based on the possibility of collaboration between the IP behavior sequence and the attacking IP, and to infer all possible attack paths based on the alarm classification results.

2. The method according to claim 1, characterized in that, After analyzing the possible attack paths, the analysis also includes: Based on the device alarm information, the honeypot alarm information, and the possible attack paths in the IP behavior sequence, attacker basic attribute analysis, behavior pattern analysis, attack skill analysis, risk level analysis, and attack intent analysis are performed to obtain an attacker behavior profile. The basic attribute analysis includes analyzing the attacker's technical type and activity cycle based on the device alarm information; the behavior pattern analysis includes analyzing the attacker's behavior pattern characteristics based on possible attack paths in the IP behavior sequence; the attack skill analysis includes analyzing the attacker's attack capabilities from the dimensions of attack source, attack target, and attack timing based on the device alarm information and the honeypot alarm information; the risk level analysis includes assessing the attacker's risk level based on the results of the basic attribute analysis and the behavior pattern analysis; and the attack intent analysis includes determining the attacker's attack intent based on the results of the basic attribute analysis, the behavior pattern analysis, the attack skill analysis, and the risk level analysis.

3. The method according to claim 1, characterized in that, The mapping model is obtained by fine-tuning the large language model based on the cybersecurity dataset and the mapping prompt words, including: The network security dataset is input into a large language model, and the mapping prompt words are used to guide the large language model to obtain mapping results. Based on the mapping results, the loss value of the large language model is calculated by setting the cross-entropy loss function based on supervised learning, and the gradient of the loss function with respect to the parameters to be adjusted in the large language model is calculated by the backpropagation algorithm. The mapping model is obtained by updating the parameters of the large language model based on the gradient of the parameters to be adjusted.

4. The method according to claim 1, characterized in that, The honey spot alarm features obtained by acquiring honey spot alarm information and extracting alarm features include: Obtain honeypot alarm information, and extract information from the honeypot alarm information to obtain attack payload, attacker IP and attack frequency information; We use a large language model to analyze the behavioral patterns of attack payloads, attacker IPs, and attack frequency information to extract honeypot alarm characteristics. Honeypot alarm characteristics include attacker payload information, page access order on the honeypot, attack method selection, attack tools, and attack methods.

5. The method according to claim 1, characterized in that, The attack path analysis prompts are also used to guide the large language model to infer and output the probability values ​​corresponding to possible attack paths.

6. An attack behavior analysis device based on attack mapping and path analysis, characterized in that, The device includes: The model training unit is used to select a cybersecurity dataset, design mapping prompts to guide the large language model to map attack information, and fine-tune the large language model to obtain a mapping model based on the cybersecurity dataset and the mapping prompts. The classification unit is used to acquire device alarm information generated by security devices, use the mapping model to perform attack mapping on the device alarm information to obtain corresponding attack techniques and strategies, and perform TTP classification on the attack techniques and strategies to obtain alarm classification results. The information integration unit is used to acquire honey spot alarm information, extract alarm features to obtain honey spot alarm features, and integrate related device alarm information, honey spot alarm information and honey spot alarm features to form an IP behavior sequence based on the IP information corresponding to the honey spot alarm features. An evaluation unit is used to evaluate the possibility of collaboration between attacking IPs based on the IP behavior sequence, including: calculating the payload similarity and target overlap between different IPs to evaluate the possibility of collaboration between attacking IPs; wherein, the calculation of payload similarity includes extracting attack payload features from the IP behavior sequence, converting the payload features into attack payload feature vectors, and calculating the cosine similarity of the attack payload feature vectors between different attacking IPs to obtain the payload similarity; the calculation of target overlap includes extracting attack target tuples from the IP behavior sequence, calculating the target overlap based on the attack target tuples and the payload similarity, and the target overlap calculation satisfies the following formula: , where represents the set of victims attacked by attacking IP subject A, represents the set of victims attacked by attacking IP subject B, and represents the payload similarity between attacking IP subject A and attacking IP subject B; The attack path analysis unit is used to design attack path analysis prompts using the IP behavior sequence as context, and to analyze possible attack paths in the IP behavior sequence using a large language model. The attack path analysis prompts are used to guide the large language model to determine the probability of an attack path in the IP behavior sequence based on the possibility of collaboration between the IP behavior sequence and the attacking IP, and to infer all possible attack paths based on the alarm classification results.

7. A computer-readable storage medium storing a computer program thereon, characterized in that, When the computer program is executed by the processor, it implements the attack behavior analysis method based on attack mapping and path analysis as described in any one of claims 1 to 5.

8. An electronic device, characterized in that, include: Processor and memory; The memory is used to store computer programs; The processor is used to execute the computer program stored in the memory, so that the electronic device performs the attack behavior analysis method based on attack mapping and path analysis as described in any one of claims 1 to 5.

Images