A method, system and device for real-time correlation of cross-layer security events and attack path tracing based on a unified entity graph

Abstract

The application discloses a kind of based on unified entity graph's cross-layer security event real-time association and attack path tracing method, system and equipment, method includes the following steps: step one, constructs and dynamically maintains unified entity graph;Step two, real-time event association based on graph calculation;Step three, two-way attack path automatic tracing;The application breaks data island through unified entity graph and cross-layer entity alignment fusion, forms the global entity view covering multiple levels, substantially improves the integrity and accuracy of attack cognition;Rely on streaming architecture to realize the real-time processing of data access, graph updating and event association, can capture cross-layer attack signs in time, significantly shorten average detection and response time;By automatic two-way tracing mechanism, automatically reconstruct attack chain, analyze potential lateral movement path, liberate artificial, reduce emergency response threshold and cost;By entity behavior association, identify abnormality, not dependent on fixed rule library, with the potential to resist unknown threats.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method, system, and device for real-time correlation of cross-layer security events and attack path tracing based on a unified entity graph. Background Technology

[0002] Currently, cybersecurity confrontations are becoming increasingly fierce, with sophisticated attacks such as Advanced Persistent Threats (APTs) becoming the main threat forms. These attacks are characterized by long durations and high stealth, and often employ a combination of lateral movement and vertical penetration strategies. The attack behavior spans multiple technical layers, covering the network layer, host layer, application layer, and cloud-native environments.

[0003] In existing security protection systems, while security information and incident management platforms can centrally collect massive amounts of logs, they primarily rely on pre-defined correlation rules. These rules are mostly based on experience and struggle to cover all attack scenarios, resulting in numerous isolated alerts when facing unknown attacks that cross layers and multiple stages. Security analysts must expend significant effort on manual correlation and attribution, greatly reducing response efficiency.

[0004] Some technical solutions attempt to introduce knowledge graphs to organize security data. However, these solutions generally have the following limitations: 1. Inconsistent data models: Independent models are often used for data from different sources such as network traffic, terminal logs, and cloud platform API call logs. This makes it difficult to effectively align and integrate cross-source entities such as IP addresses, hostnames, and user accounts, forming data silos; 2. Lack of cross-layer event correlation capabilities: Existing source tracing analysis is usually limited to a single dimension of the network layer or host layer, lacking cross-layer correlation capabilities. It often terminates after tracing to a certain IP, process, or file, requiring manual intervention for further tracing; 3. Insufficient real-time performance: Most graph construction processes use batch processing or near real-time methods, making it difficult to capture weak correlations between behaviors at the first moment when an attack occurs, missing the best response opportunity; 4. Limited correlation and source tracing capabilities: Existing graph analysis methods mostly focus on static entity relationship queries, lacking dedicated real-time correlation algorithms and automated attack path reconstruction mechanisms for dynamic, cross-layer attack behaviors. Summary of the Invention

[0005] The purpose of this invention is to provide a method, system, and device for real-time correlation of cross-layer security events and attack path tracing based on a unified entity graph, so as to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a method for real-time association and attack path tracing of cross-layer security events based on a unified entity graph, comprising the following steps: Step 1, constructing and dynamically maintaining a unified entity graph; Step 2, real-time event association based on graph computation; Step 3, automated tracing of bidirectional attack paths.

[0007] Step one above specifically includes the following steps:

[0008] 1.1 Construct a standardized cross-layer security ontology model. The standardized cross-layer security ontology model predefines the core entity types and relationship types of the graph.

[0009] 1.2 Multi-source heterogeneous security data is accessed in real time through multi-source data interfaces. The multi-source heterogeneous security data is parsed in real time using a stream processing engine. Based on a standardized cross-layer security ontology model, the parsed data is extracted and standardized into entity nodes and relation edges in the graph.

[0010] 1.3 Cross-layer entity alignment and fusion are performed based on time windows and confidence scores to obtain a unified entity map;

[0011] Step two above specifically includes the following steps:

[0012] 2.1 Real-time security alarms are broken down into network space entity nodes and relationship edges, and added to a unified entity graph, where key entity nodes are fused according to the method in step 1.3;

[0013] 2.2 When a new high-risk alarm is added to the unified entity graph, starting from the entity associated with the alarm, the graph is traversed in the direction of earlier time to find the preceding alarms that match the attack logic. The potential associated paths obtained by the traversal are scored. If the cumulative score of the path exceeds the preset threshold, the independent alarms on the path are determined to constitute a composite attack alarm.

[0014] Step three above specifically includes the following steps:

[0015] 3.1 The source tracing task is triggered when one of the following two situations occurs: a high-priority composite attack alarm is generated, or a compromised entity is manually designated;

[0016] 3.2 Perform bidirectional traversal and source tracing on the unified entity graph based on time and causal relationships.

[0017] Preferably, in step 1.1, the core entity types include: network layer entities, host layer entities, identity layer entities, and cloud-native entities; network layer entities include IP addresses, domain names, MAC addresses, network sessions, and web access requests; host layer entities include hosts, processes, files, registry entries, and scheduled tasks; identity layer entities include user accounts, user groups, and API keys; cloud-native entities include cloud host instances, containers, Kubernetes Pods, cloud storage buckets, and IAM roles; the relationship type is used to define the interaction behavior and attribution relationship between entities, and the relationship type is appended with a timestamp, duration, and data transfer volume.

[0018] Preferably, in step 1.2, the multi-source data interfaces include Kafka interface, Syslog interface, API interface, and file listening interface; the multi-source heterogeneous security data sources include terminal detection and response device logs, firewall logs, identity authentication system logs, Web application firewall logs, and cloud platform monitoring logs; and the stream processing engine is the Flink engine.

[0019] Preferably, step 1.3, cross-layer entity alignment and fusion, specifically includes the following steps:

[0020] 1.3.1 Entity Trigger: When a new cyberspace entity is created, a dynamic time window is opened centered on the entity and the current timestamp;

[0021] 1.3.2 Evidence Collection: Within the opened dynamic time window, collect all multi-source logs containing the entity attribute, including IP address, MAC address, and hostname;

[0022] 1.3.3 Confidence Score: Assign a confidence score to each chain of evidence;

[0023] 1.3.4 Fusion Decision: When the total score of entity fusion pointed to by multiple evidence chains exceeds a preset threshold, the corresponding independent entity nodes will be merged into a unified entity node with multi-dimensional attributes.

[0024] Preferably, in step 2.2, the path scoring is based on event severity, temporal proximity, and causal relationship between entities.

[0025] Preferably, in step 3.2, the bidirectional traversal tracing specifically involves: starting from the compromised entity and the time point of occurrence, traversing backwards along the relationships in the graph to trace the complete path from the attack entry point to the compromised point; and traversing forwards from the compromised entity to analyze the entity's permissions, access relationships, and connection relationships.

[0026] A real-time cross-layer security event correlation and attack path tracing system based on a unified entity graph includes a multi-source heterogeneous data access module, a standardization and entityization processing module, a cross-layer entity alignment and fusion module, a real-time event correlation module, a bidirectional attack path automated tracing module, and a result output and display module. The standardization and entityization processing module establishes data connections with the multi-source heterogeneous data access module and the cross-layer entity alignment and fusion module, respectively. The real-time event correlation module establishes data connections with the cross-layer entity alignment and fusion module and the bidirectional attack path automated tracing module, respectively. The bidirectional attack path automated tracing module establishes a data connection with the result output and display module.

[0027] Preferably, the multi-source heterogeneous data access module is used to receive multi-source heterogeneous security data through a distributed collector and protocol adapter, and send the raw data to a high-availability message queue for buffering and distribution; the standardization and entityization processing module is used to parse the raw data using a stream processing engine, and instantiate the parsing results into entity nodes and relation edges according to a preset standardized cross-layer security ontology model; the cross-layer entity alignment and fusion module is used to perform cross-layer entity alignment and fusion operations, merge scattered entity nodes to construct a unified entity graph; the real-time event association module is used to split security alarms into entity nodes and relation edges and add them to the unified entity graph, trigger a context-based local graph traversal, and perform path matching and scoring according to a preset attack behavior pattern library. If the path score reaches a set threshold, multiple independent events on the path are judged as composite attack events with inherent logical connections; the bidirectional attack path automated tracing module is used to perform bidirectional traversal of the unified entity graph after triggering the tracing task, reconstruct the attack path and analyze the risk impact surface; the result output and display module is used for human-computer interaction, which can render the attack path as a visual topology map and generate a structured attack investigation report.

[0028] A device for real-time correlation and attack path tracing of cross-layer security events based on a unified entity graph includes a memory body, a computer program, and a processor body. The memory body stores a computer program that can run on the processor body. When the processor body executes the computer program, it implements the above-mentioned method. The memory body can use a non-transitory computer-readable storage medium, specifically including a solid-state drive, a hard disk drive, a read-only memory, a random access memory, a smart memory card, a secure digital card, or a flash memory card. The computer program is a set of code that implements the above-mentioned method. The processor body uses a hardware unit with data processing and program execution capabilities, specifically including a central processing unit, a microprocessor, or a digital signal processor.

[0029] Compared with existing technologies, the beneficial effects of this invention are as follows: By unifying the entity graph and merging cross-layer entities, this invention breaks down data silos and forms a global entity view covering multiple levels, significantly improving the completeness and accuracy of attack cognition; relying on a streaming architecture to achieve real-time processing of data access, graph updates, and event correlation, it can promptly capture cross-layer attack signs and significantly shorten the average detection and response time; through an automated bidirectional tracing mechanism, it automatically reconstructs attack chains and analyzes potential lateral movement paths, freeing up manual labor and reducing the threshold and cost of emergency response; and by identifying anomalies through entity behavior correlation, it does not rely on a fixed rule base and has the potential to combat unknown threats. Attached Figure Description

[0030] Figure 1 This is a flowchart of the method of the present invention;

[0031] Figure 2 This is a system structure block diagram of the present invention;

[0032] Figure 3 This is a block diagram of the device structure of the present invention.

[0033] In the diagram: 1. Multi-source heterogeneous data access module; 2. Standardization and entityization processing module; 3. Cross-layer entity alignment and fusion module; 4. Real-time event association module; 5. Bidirectional attack path automated tracing module; 6. Result output and display module; 7. Memory body; 8. Computer program; 9. Processor body. Detailed Implementation

[0034] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0035] Please see the appendix Figure 1 The present invention provides an embodiment of a method for real-time association and attack path tracing of cross-layer security events based on a unified entity graph, comprising the following steps: Step 1, constructing and dynamically maintaining a unified entity graph; Step 2, real-time event association based on graph computation; Step 3, automated tracing of bidirectional attack paths.

[0036] Step one above specifically includes the following steps:

[0037] 1.1 A standardized cross-layer security ontology model is constructed. The standardized cross-layer security ontology model predefines the core entity types and relationship types of the graph. Among them, the core entity types include: network layer entities, host layer entities, identity layer entities, and cloud-native entities. Network layer entities include IP addresses, domain names, MAC addresses, network sessions, and web access requests. Host layer entities include hosts, processes, files, registry entries, and scheduled tasks. Identity layer entities include user accounts, user groups, and API keys. Cloud-native entities include cloud host instances, containers, Kubernetes Pods, cloud storage buckets, and IAM roles. Relationship types are used to define the interaction behavior and attribution relationships between entities, and the relationship types are appended with timestamps, durations, and data transfer volumes.

[0038] 1.2 Multi-source heterogeneous security data is accessed in real time through multi-source data interfaces. A stream processing engine is used to parse this data in real time, and based on a standardized cross-layer security ontology model, the parsed data is extracted and standardized into entity nodes and relational edges in a graph. The multi-source data interfaces include Kafka, Syslog, API, and file monitoring interfaces. The sources of the multi-source heterogeneous security data include terminal detection and response device logs, firewall logs, identity authentication system logs, web application firewall logs, and cloud platform monitoring logs. The stream processing engine is the Flink engine.

[0039] 1.3 Cross-layer entity alignment and fusion are performed based on time windows and confidence scores to obtain a unified entity map; the cross-layer entity alignment and fusion specifically includes the following steps:

[0040] 1.3.1 Entity Trigger: When a new cyberspace entity is created, a dynamic time window is opened centered on the entity and the current timestamp;

[0041] 1.3.2 Evidence Collection: Within the opened dynamic time window, collect all multi-source logs containing the entity attribute, including IP address, MAC address, and hostname;

[0042] 1.3.3 Confidence Score: Assign a confidence score to each chain of evidence;

[0043] 1.3.4 Fusion Decision: When the total score of entity fusion pointed to by multiple evidence chains exceeds a preset threshold, the corresponding independent entity nodes will be merged into a unified entity node with multi-dimensional attributes;

[0044] Step two above specifically includes the following steps:

[0045] 2.1 Real-time security alarms are broken down into network space entity nodes and relationship edges, and added to a unified entity graph, where key entity nodes are fused according to the method in step 1.3;

[0046] 2.2 When a new high-risk alarm is added to the unified entity graph, starting from the entity associated with the alarm, the graph is traversed in the direction of earlier time to find the preceding alarms that match the attack logic. Based on the severity of the event, temporal proximity, and causal relationship between entities, the potential associated paths obtained by the traversal are scored. If the cumulative score of the path exceeds the preset threshold, the independent alarms on the path are determined to constitute a composite attack alarm.

[0047] Step three above specifically includes the following steps:

[0048] 3.1 The source tracing task is triggered when one of the following two situations occurs: a high-priority composite attack alarm is generated, or a compromised entity is manually designated;

[0049] 3.2 Based on time and causal relationships, a bidirectional traversal and source tracing is performed on the unified entity graph. Specifically, starting from the compromised entity and the time point of occurrence, the graph is traversed backwards along the relationships to trace the complete path from the attack entry point to the compromise point; the compromised entity is traversed forwards to analyze the permissions, access relationships, and connection relationships possessed by the entity.

[0050] Please see the appendix Figure 2This invention provides an embodiment of a real-time cross-layer security event correlation and attack path tracing system based on a unified entity graph. The system includes a multi-source heterogeneous data access module 1, a standardization and entityization processing module 2, a cross-layer entity alignment and fusion module 3, a real-time event correlation module 4, a bidirectional attack path automated tracing module 5, and a result output and display module 6. The standardization and entityization processing module 2 establishes data connections with both the multi-source heterogeneous data access module 1 and the cross-layer entity alignment and fusion module 3. The real-time event correlation module 4 establishes data connections with both the cross-layer entity alignment and fusion module 3 and the bidirectional attack path automated tracing module 5. The bidirectional attack path automated tracing module 5 establishes a data connection with the result output and display module 6. The multi-source heterogeneous data access module 1 receives multi-source heterogeneous security data through a distributed collector and protocol adapter, and sends the raw data to a high-availability message queue for buffering and distribution. The standardization and entityization processing module 2... The system is designed to parse raw data using a stream processing engine and instantiate the parsing results into entity nodes and relational edges based on a pre-defined standardized cross-layer security ontology model. The cross-layer entity alignment and fusion module 3 performs cross-layer entity alignment and fusion operations, merging scattered entity nodes to construct a unified entity graph. The real-time event association module 4 breaks down security alarms into entity nodes and relational edges and adds them to the unified entity graph, triggering a context-based local graph traversal. It then performs path matching and scoring based on a pre-defined attack behavior pattern library. If the path score reaches a set threshold, multiple independent events on the path are identified as composite attack events with inherent logical connections. The bidirectional attack path automated tracing module 5 performs bidirectional traversal of the unified entity graph after triggering the tracing task, reconstructing the attack path and analyzing the risk impact surface. The result output and display module 6 provides human-computer interaction, rendering the attack path as a visual topology graph and generating a structured attack investigation report.

[0051] Please see the appendix Figure 3 The present invention provides an embodiment of a device for real-time correlation and attack path tracing of cross-layer security events based on a unified entity graph, comprising a memory body 7, a computer program 8, and a processor body 9. The memory body 7 stores the computer program 8, which can run on the processor body 9. When the processor body 9 executes the computer program 8, it implements the above-mentioned method. The memory body 7 may adopt a non-transitory computer-readable storage medium, specifically including a solid-state drive, a mechanical hard drive, a read-only memory, a random access memory, a smart memory card, a secure digital card, or a flash memory card. The computer program 8 is a set of codes that implement the above-mentioned method. The processor body 9 adopts a hardware unit with data processing and program execution capabilities, specifically including a central processing unit, a microprocessor, or a digital signal processor.

[0052] Based on the above, the advantages of this invention are as follows: When in use, by constructing and dynamically maintaining a unified entity graph, leveraging a standardized cross-layer security ontology model, and employing a cross-layer entity alignment and fusion mechanism based on time windows and confidence scores, it completely breaks down data silos in traditional security monitoring systems, forming a globally unified entity view covering the network layer, host layer, identity layer, and cloud-native environment, greatly improving the completeness and accuracy of attack cognition; simultaneously, relying on a streaming computing architecture to achieve real-time or near-real-time processing from multi-source heterogeneous data access and dynamic graph updates to event correlation, it can promptly capture traces of cross-layer attacks when attacks occur, significantly shortening the average detection time and average response time; furthermore, the automated bidirectional attack path tracing mechanism can automatically reconstruct the complete attack chain from the attack entry point to the compromise point and analyze potential lateral movement paths, reducing the threshold and time cost of emergency response; in addition, without relying on a fixed rule base, it discovers anomalies by analyzing the behavioral correlations between entities. Even when facing unknown attacks that exploit 0-day vulnerabilities or new techniques, as long as they form abnormal correlation paths on the graph, they can be identified, possessing the potential to combat unknown threats.

[0053] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. A method for real-time correlation and attack path tracing of cross-layer security events based on a unified entity graph, comprising the following steps: Step 1: Constructing and dynamically maintaining a unified entity graph; Step 2: Real-time event association based on graph computing; Step 3: Automated tracing of bidirectional attack paths; Its features include: Step one above specifically includes the following steps: Step 1.1 Construct a standardized cross-layer security ontology model. The standardized cross-layer security ontology model predefines the core entity types and relation types of the graph. Step 1.2 Access multi-source heterogeneous security data in real time through multi-source data interfaces, use a stream processing engine to parse the multi-source heterogeneous security data in real time, and extract and standardize the parsed data into entity nodes and relation edges in the graph based on the standardized cross-layer security ontology model. Step 1.3 Performs cross-layer entity alignment and fusion based on time windows and confidence scores to obtain a unified entity map; the cross-layer entity alignment and fusion specifically includes the following steps: Step 1.3.1 Entity Trigger: When a new cyberspace entity is created, a dynamic time window is opened centered on the entity and the current timestamp; Step 1.3.2 Evidence Collection: Within the opened dynamic time window, collect all multi-source logs containing the entity attribute, including IP address, MAC address, and hostname; Step 1.3.3 Confidence Score: Assign a confidence score to each chain of evidence; Step 1.3.4 Fusion Decision: When the total score of entity fusion pointed to by multiple evidence chains exceeds the preset threshold, the corresponding independent entity nodes will be merged into a unified entity node with multi-dimensional attributes; Step two above specifically includes the following steps: Step 2.1 Decompose the real-time security alarms into network space entity nodes and relationship edges, and add them to a unified entity graph, wherein key entity nodes are fused according to the method in Step 1.3; Step 2.2 When a new high-risk alarm is added to the unified entity graph, start from the entity associated with the alarm and traverse the graph in a time direction to find the preceding alarms that match the attack logic. Score the potential associated paths obtained by the traversal. If the cumulative score of the path exceeds the preset threshold, the independent alarms on the path are determined to constitute a composite attack alarm. Step three above specifically includes the following steps: Step 3.1 Trigger the source tracing task when one of the following two situations occurs: a high-priority composite attack alarm is generated, or a compromised entity is manually designated; Step 3.2 Perform bidirectional traversal tracing on the unified entity graph based on time and causal relationships. Specifically, bidirectional traversal tracing involves: starting from the compromised entity and the time point of occurrence, traversing backward along the relationships in the graph to trace the complete path from the attack entry point to the compromise point; and traversing forward from the compromised entity to analyze the permissions, access relationships, and connection relationships possessed by the entity.

2. The method for real-time correlation and attack path tracing of cross-layer security events based on a unified entity graph as described in claim 1, characterized in that: In step 1.1, the core entity types include: network layer entities, host layer entities, identity layer entities, and cloud-native entities; network layer entities include IP addresses, domain names, MAC addresses, network sessions, and web access requests; host layer entities include hosts, processes, files, registry entries, and scheduled tasks; identity layer entities include user accounts, user groups, and API keys; cloud-native entities include cloud host instances, containers, Kubernetes Pods, cloud storage buckets, and IAM roles; relationship types are used to define the interaction behavior and attribution relationships between entities, and the relationship types are appended with timestamps, durations, and data transfer volumes.

3. The method for real-time correlation and attack path tracing of cross-layer security events based on a unified entity graph as described in claim 1, characterized in that: In step 1.2, the multi-source data interfaces include Kafka interface, Syslog interface, API interface, and file listening interface; the multi-source heterogeneous security data sources include terminal detection and response device logs, firewall logs, identity authentication system logs, web application firewall logs, and cloud platform monitoring logs; the stream processing engine is the Flink engine.

4. The method for real-time correlation and attack path tracing of cross-layer security events based on a unified entity graph as described in claim 1, characterized in that: In step 2.2, the path scoring is based on factors including event severity, temporal proximity, and causal relationships between entities.

5. A real-time cross-layer security event correlation and attack path tracing system based on a unified entity graph, comprising a multi-source heterogeneous data access module (1), a standardization and entityization processing module (2), a cross-layer entity alignment and fusion module (3), a real-time event correlation module (4), a bidirectional attack path automated tracing module (5), and a result output and display module (6), characterized in that: The standardization and entityization processing module (2) establishes data connections with the multi-source heterogeneous data access module (1) and the cross-layer entity alignment and fusion module (3) respectively. The real-time event association module (4) establishes data connections with the cross-layer entity alignment and fusion module (3) and the bidirectional attack path automated tracing module (5) respectively. The bidirectional attack path automated tracing module (5) establishes data connections with the result output and display module (6). The multi-source heterogeneous data access module (1), the standardization and entityization processing module (2), the cross-layer entity alignment and fusion module (3), the real-time event association module (4), the bidirectional attack path automated tracing module (5), and the result output and display module (6) are used to implement the method described in any one of claims 1 to 4.

6. A device for real-time correlation and attack path tracing of cross-layer security events based on a unified entity graph, comprising a memory body (7), a computer program (8), and a processor body (9), characterized in that: The memory body (7) stores a computer program (8) that can run on the processor body (9). When the processor body (9) executes the computer program (8), it implements the method as described in any one of claims 1 to 4. The memory body (7) may be a non-transitory computer-readable storage medium, specifically including solid-state drives, hard disk drives, read-only memory, random access memory, smart memory cards, secure digital cards, and flash memory cards. The computer program (8) is a set of codes that implement the above method. The processor body (9) adopts a hardware unit with data processing and program execution capabilities, specifically including a central processing unit, a microprocessor, and a digital signal processor.

Images