An information system APT attack process tracing method, system and medium

Abstract

The application relates to the technical field of attack traceability data security, in particular to an information system APT attack process tracing method and system and a medium. The method comprises the following steps: acquiring log information of an information system, converting the log information into a traceability graph, identifying each community in the traceability graph, calculating community structure singularity of each community, clustering the community structure singularity of all communities, acquiring abnormal behavior significance of each community according to deviation and outlying conditions of the community structure singularity of each community in the cluster, identifying each abnormal community, obtaining behavior credit of each node in each abnormal community in combination with abnormal conditions of difference degrees of out-degree and in-degree of each node in each abnormal community, identifying abnormal nodes under APT network attack, and tracing paths under APT network attack by using an STP steiner tree algorithm. The application can improve the accuracy of APT attack process tracing.

Description

Technical Field

[0001] This application relates to the field of attack attribution data security technology, specifically to a method, system, and medium for tracing the APT attack process of an information system. Background Technology

[0002] Advanced Persistent Threat (APT) attacks are a new type of cyberattack. Due to their strong stealth, persistence, and destructiveness, APT attacks differ from conventional single-type attacks. Currently, traditional APT defenses tend to focus on detecting the malicious intent of the attack or identifying its family type, primarily relying on passive defense. They lack comprehensive and in-depth analysis of the APT attack process, making APT defense a significant challenge in the cybersecurity field.

[0003] In existing technologies, a source map is constructed using system log information from an information system. The Louvain community discovery algorithm is used to extract the communities of all nodes in the source map. Based on the node distribution characteristics of each community, anomalous nodes under APT attacks are identified. Then, the Steiner Tree Problem (STP) algorithm is used to trace the path of the APT attack based on the source map and its anomalous nodes, thus completing the tracing of the APT attack process in the information system. However, because the structural information of anomalous nodes under APT attacks is quite complex, existing technologies, which identify anomalous nodes based on the node distribution characteristics of each community, do not fully explore the anomalous structural and behavioral information of each community. This results in the inability to accurately identify anomalous nodes under APT attacks, thus affecting the accuracy of tracing the APT attack process. Summary of the Invention

[0004] To address the aforementioned technical problems, the purpose of this application is to provide a method, system, and medium for tracing the APT attack process in an information system. The specific technical solution adopted is as follows:

[0005] In a first aspect, embodiments of this application provide a method for tracing the APT attack process of an information system, comprising the following steps:

[0006] Obtain log information from the information system and convert it into a source map;

[0007] The community discovery algorithm identifies each community in the source map and analyzes the differences in out-degree and in-degree of different nodes within each community to obtain the community structure singularity of each community. The community structure singularity of all communities is clustered, and the deviation and outlier of the community structure singularity of each community within the cluster are analyzed to obtain the salience of abnormal behavior of each community. The abnormal communities are identified by threshold segmentation.

[0008] Based on the salience of the abnormal behavior of each abnormal community, and combined with the abnormality of the difference between the out-degree and in-degree of each node in each abnormal community, the behavioral credibility of each node in each abnormal community is obtained.

[0009] By clustering the behavioral distrust scores of nodes within abnormal communities to identify abnormal nodes under APT network attacks, and using the STP Steiner tree algorithm to trace the path under APT network attacks, the APT network attack path tracing results are obtained.

[0010] Preferably, the method for obtaining the singularity of each community structure is as follows:

[0011] In the formula, Let be the community structure singularity of the i-th community. Let be the number of nodes in the i-th community. and Let be the out-degrees of the j-th and (j-1)-th nodes within the i-th community, respectively. and Let be the in-degrees of the j-th and (j-1)-th nodes in the i-th community, respectively. Then, the adjacency list of the source graph is extracted, and the out-degree and in-degree of each node in each community are calculated using the adjacency list.

[0012] Preferably, the method for obtaining the salience of abnormal behavior in each community is as follows:

[0013] In the formula, Let be the significance of the anomalous behavior of the k-th community within the s-th cluster. Let be the absolute difference between the community structure singularity of the k-th community within the s-th cluster and the mean community structure singularity of all communities within the s-th cluster. Let S be the community structure singularity of the k-th community within the s-th cluster. Let be the local density of the k-th community within the s-th cluster. To avoid constants with a denominator of zero.

[0014] Preferably, after performing density peak clustering on the community structure singularity of all communities in the source map, the local density of each community within each cluster is obtained.

[0015] Preferably, a threshold segmentation is performed on the anomalous behavior significance of all communities within all clusters, and communities with anomalous behavior significance higher than the segmentation threshold are identified as anomalous communities in the source graph.

[0016] Preferably, the method for obtaining the behavioral credibility score of each node within each abnormal community is as follows:

[0017] In the formula, Let be the behavioral distrust score of the c-th node within the z-th anomalous community. Let be the saliency of the aberrant behavior of the z-th aberrant community. Here is the range normalization function. Let be the absolute difference between the out-degree and in-degree of the c-th node within the z-th anomalous community. Let be the local outlier of the c-th node within the z-th anomalous community.

[0018] Preferably, the absolute difference between the out-degree and in-degree of each node in each anomalous community is recorded as the first difference of each node. Anomaly detection is performed on the first difference of all nodes in each anomalous community to obtain the local outlier factor of each node in each anomalous community.

[0019] Preferably, after clustering the behavioral distrust scores of all nodes in the abnormal community, the nodes in the cluster corresponding to the highest mean behavioral distrust score are regarded as abnormal nodes under APT network attacks.

[0020] Secondly, embodiments of this application also provide an information system APT attack process tracing system, including a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, it implements the steps of any of the above-described information system APT attack process tracing methods.

[0021] Thirdly, embodiments of this application also provide an information system APT attack process tracing medium, wherein the medium stores a computer program, and when the computer program is executed by a processor, it implements any one of the above-described information system APT attack process tracing methods.

[0022] As can be seen from the above, the method, system, and medium for tracing the APT attack process of an information system provided in this application have at least the following beneficial effects:

[0023] This application measures and analyzes the singularity of each community structure in the source map, which more clearly reveals the singularity characteristics of the community structure under data leakage or attacker intrusion. Then, based on the singularity of the community structure and fully considering the outlier characteristics of the community structure singularity, it accurately measures the significance of the abnormal behavior characteristics of each community in the source map, which more fully reflects the abnormal behavior of information flow within the community, thereby improving the accuracy of abnormal node identification under APT network attacks.

[0024] This application accurately measures the dishonesty characteristics of system call behavior or information flow behavior under APT network attacks by fully considering the salience of abnormal behavior characteristics within abnormal communities and combining the degree of abnormality of nodes appearing within abnormal communities. This is beneficial for more accurate identification of abnormal nodes under APT network attacks in abnormal communities.

[0025] This application uses the behavioral credibility of nodes within anomaly communities for clustering, which more accurately identifies anomalous nodes under APT network attacks. It also employs the STP Steiner tree algorithm to trace the paths of anomalous nodes under APT network attacks, enabling a more comprehensive and in-depth tracing of the APT network attack process. This avoids the problem of poor accuracy in identifying anomalous nodes under APT network attacks, which affects the accuracy of tracing the APT attack process. Attached Figure Description

[0026] To more clearly illustrate the technical solutions and advantages in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0027] Figure 1 A flowchart illustrating the steps of an APT attack process tracing method for an information system provided in this application. Detailed Implementation

[0028] To further illustrate the technical means and effects adopted by this application to achieve the intended purpose of the invention, the following, in conjunction with the accompanying drawings and preferred embodiments, details the specific implementation, structure, features, and effects of an information system APT attack process tracing method, system, and medium proposed according to this application. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics in one or more embodiments can be combined in any suitable form.

[0029] Unless otherwise specified and limited, terms such as “comprising,” “including,” or any other variations thereof are intended to cover a non-exclusive inclusion, such that a circuit structure, article, or device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such an article or device. Without further limitation, an element defined by the phrase “comprising one…” does not exclude the presence of other identical elements in the article or device that includes said element. Furthermore, the term “and / or” as used herein includes any and all combinations of one or more of the associated listed items. All technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0030] The following description, in conjunction with the accompanying drawings, details the specific scheme of the information system APT attack process tracing method, system, and media provided in this application.

[0031] Please see Figure 1 The document illustrates a flowchart of a method for tracing the APT attack process of an information system according to an embodiment of this application, including the following steps:

[0032] Step 1: Obtain the log information from the information system and convert the log information into a source map.

[0033] To more accurately trace the APT attack process, it is necessary to fully explore the abnormal structural and behavioral information of various communities to improve the accuracy of abnormal node identification under APT network attacks. First, the CamFlow tool is used to collect log information from the enterprise information system, and the collected log information is stored on the server's storage medium to ensure the security and integrity of the system log information. The log information includes system activities, events, and information flows to reflect the behavioral patterns and information flow of the enterprise information system. The storage medium can be the server's internal storage unit or external storage device. The internal storage unit includes the server's hard drive or memory, and the external storage device includes a plug-in hard drive or a USB flash drive. In this embodiment, the storage medium used is the server's hard drive.

[0034] Furthermore, preferably, in this embodiment, a log transformation algorithm is used to unify the format of the system log information, and the unified format system log information is converted into a source graph. The nodes inside the source graph represent system entities and system activities. Entities include processes, files, etc., and the edges represent the direction of system calls or information flow. That is, the source graph is a directed acyclic graph. The log transformation algorithm and the construction of the source graph are well-known technologies, and the specific process will not be described in detail.

[0035] Step 2: Identify each community in the source graph using a community discovery algorithm, and analyze the out-degree and in-degree differences of different nodes within each community to obtain the community structure singularity of each community. Cluster the community structure singularity of all communities, analyze the deviation and outlier situation of the community structure singularity of each community within the cluster, obtain the salience of abnormal behavior of each community, and identify each abnormal community through threshold segmentation.

[0036] Furthermore, in order to analyze the abnormal behavior of different community nodes in the source map and thus more accurately identify abnormal nodes under APT network attacks, the communities in the source map will first be extracted and identified. In this embodiment, preferably, the transformed source map is used as the input of the Louvain community discovery algorithm. The Louvain community discovery algorithm is used to obtain each community in the source map. Each community contains multiple nodes. The Louvain community discovery algorithm is a well-known technology, and the specific process will not be described in detail.

[0037] Generally, the structural information of anomalous nodes under APT attacks exhibits complex and diverse characteristics. However, current technologies do not fully exploit the anomalous structural and behavioral information of various communities, resulting in poor accuracy in identifying anomalous nodes under APT attacks and affecting the accuracy of tracing the APT attack process. Therefore, it is necessary to fully exploit the anomalous structural and behavioral information of various communities to improve the accuracy of identifying anomalous nodes under APT attacks.

[0038] To analyze the abnormal structural information of each community, we extracted the adjacency list from the source graph and calculated the out-degree and in-degree of each node within each community using the adjacency list. The calculation of out-degree and in-degree is a well-known technique, and the specific process will not be elaborated here. Normally, the out-degree and in-degree of different nodes within a community are relatively similar, indicating that the information flow between different nodes in the community is relatively stable. However, if there are significant differences in the out-degree and in-degree of different nodes within a community, it indicates that the information flow behavior within the community is abnormal and the community structure is highly unusual. Therefore, the community has a high probability of experiencing abnormal behavior such as data leakage or attacker intrusion.

[0039] Based on the above analysis, the community structure singularity of each community is calculated:

[0040] In the formula, Let be the community structure singularity of the i-th community. Let be the number of nodes in the i-th community. and Let be the out-degrees of the j-th and (j-1)-th nodes within the i-th community, respectively. and Let be the in-degrees of the j-th and (j-1)-th nodes within the i-th community, respectively.

[0041] Among them, community structure singularity reflects the degree of singularity of each community structure in the source graph. The greater the community structure singularity, the greater the difference in out-degree and in-degree between different nodes in the community, and the more it reflects the abnormal behavior of the community. In this case, the information flow in the community is more likely to have abnormal behavior such as data leakage or attacker intrusion.

[0042] Generally, communities with normal information flow exhibit relatively low structural singularity, primarily concentrated in groups with low structural singularity. Conversely, communities with abnormal information flow exhibit higher structural singularity, displaying significant outlier characteristics. Therefore, a higher degree of structural singularity in a community, coupled with its strong outlier characteristics, indicates a greater likelihood of abnormal behavior under APT attacks, more clearly reflecting abnormal information flow within the community.

[0043] Therefore, in order to more accurately measure the significance of the abnormal behavior characteristics of each community, the community structural singularity of all communities in the source map is used as the input of the Density Peaks Clustering (DPC) algorithm. The preset cutoff distance in the algorithm is 12. The DPC algorithm is used to perform cluster analysis on all communities in the source map to obtain the local density of each cluster and each community within each cluster. The smaller the local density, the more prominent the outlier characteristics reflecting the structural singularity of the community. The DPC algorithm is a well-known technology, and the specific process will not be described in detail.

[0044] Based on the above analysis, the significance of anomalous behavior for each community within each cluster is calculated:

[0045] In the formula, Let be the significance of the anomalous behavior of the k-th community within the s-th cluster. Let be the absolute difference between the community structure singularity of the k-th community within the s-th cluster and the mean community structure singularity of all communities within the s-th cluster. Let S be the community structure singularity of the k-th community within the s-th cluster. Let be the local density of the k-th community within the s-th cluster. To avoid constants with a denominator of zero, a value within a small range (0.01, 0.1) is set, which has a negligible impact on the calculation results. In this embodiment, the value is 0.05.

[0046] Among them, the significance of abnormal behavior reflects the significance of the abnormal behavior characteristics of each community in the source map. The greater the significance of abnormal behavior, the worse the concentration of community structural singularity within the cluster in which the community is located. The more prominent the outlier characteristics of the community structural singularity corresponding to the community, the higher the significance of the abnormal behavior characteristics of the community under APT network attack, and the more fully it can reflect the abnormal behavior of information flow within the community.

[0047] Furthermore, in order to accurately identify abnormal communities in the source map and thus more accurately identify abnormal nodes under APT network attacks, preferably, in this embodiment, the significance of abnormal behavior of all communities within all clusters is used as a segmentation threshold. Each community with an abnormal behavior significance higher than the segmentation threshold is regarded as an abnormal community in the source map. Nodes in abnormal communities are more likely to be subjected to APT network attacks, causing the community to exhibit abnormal behavior.

[0048] Step 3: Based on the salience of the abnormal behavior of each abnormal community, and combined with the abnormality of the difference between the out-degree and in-degree of each node in each abnormal community, obtain the behavioral credibility of each node in each abnormal community.

[0049] Generally, if the absolute difference between the in-degree and out-degree of a node in an abnormal community is large, it indicates that the node is more likely to engage in abnormal communication behavior. For example, in the initial intrusion of an APT attack, there is a high probability of abnormal communication behavior initiated by a single node to multiple nodes, which is usually an attack initiated by the attacker. In data leakage, there is a high probability of abnormal communication behavior initiated by multiple nodes to a single node, which is usually an attacker stealing information and data from multiple nodes or multiple attackers attacking a single node simultaneously.

[0050] Therefore, the absolute difference between the out-degree and in-degree of each node within each anomalous community is calculated and denoted as the first difference for each node. The larger the first difference, the greater the anomalous difference between the out-degree and in-degree of that node, and the more likely that node is to exhibit anomalous communication behavior. Simultaneously, to more accurately measure the anomalous level of nodes within each anomalous community, the first difference of all nodes within each anomalous community is used as input to the LOF anomaly detection algorithm. The algorithm presets a neighborhood parameter of 12. The LOF anomaly detection algorithm calculates the local outlier factor of each node within each anomalous community. The larger the local outlier factor, the greater the degree of anomalousness of that node within the community. The LOF anomaly detection algorithm is a well-known technique, and its specific process will not be elaborated further.

[0051] Meanwhile, since the significance of abnormal behavior characteristics of different abnormal communities varies, if the abnormal behavior characteristics of an abnormal community to which a node belongs are more significant, a larger weight coefficient should be assigned when measuring the abnormality level of that node, so as to more accurately measure the abnormality level of nodes within the abnormal community.

[0052] Therefore, the behavioral credibility of each node within each anomalous community in the source graph is calculated:

[0053] In the formula, Let be the behavioral distrust score of the c-th node within the z-th anomalous community. Let be the saliency of the aberrant behavior of the z-th aberrant community. Here is the range normalization function. Let be the absolute difference between the out-degree and in-degree of the c-th node within the z-th anomalous community. Let be the local outlier of the c-th node within the z-th anomalous community.

[0054] Among them, the behavioral dishonesty score reflects the dishonesty characteristics of system call behavior or information flow behavior under APT network attack. The higher the behavioral dishonesty score, the more it indicates abnormal communication behavior of the node under APT network attack. The more significant the dishonesty characteristics of system call behavior or information flow behavior under APT network attack, the more likely it is to pose a serious threat to the security of enterprise information systems. Therefore, it is necessary to accurately trace the APT attack path of the node so that effective defense against APT attack paths can be carried out in the future.

[0055] Step 4: Cluster the behavioral distrust scores of nodes within the abnormal community to identify abnormal nodes under APT network attacks, and use the STP Steiner tree algorithm to trace the path under APT network attacks to obtain the APT network attack path tracing results.

[0056] In order to accurately identify abnormal nodes under APT network attacks and trace the APT attack process of information systems, the behavioral credibility of all nodes in all abnormal communities is used as the input of the clustering algorithm. The clustering algorithm can be K-means clustering or CURE hierarchical clustering algorithm (Clustering Using Representative). In this embodiment, K-means clustering is used to cluster all nodes in all abnormal communities. The preset number of clusters is 2. K-means clustering is used to obtain two clusters composed of nodes. K-means clustering is a well-known technology, and the specific process will not be described in detail.

[0057] Furthermore, the mean behavioral distrust score of all nodes within each cluster is used to identify each node in the cluster with the highest mean behavioral distrust score as an anomalous node under the APT network attack. The nodes corresponding to the anomalous nodes under the APT network attack are then marked in the source tracing graph. The marked source tracing graph is used as the input to the Steiner Tree Problem (STP) algorithm. The STP Steiner Tree Problem is used to trace the path under the APT network attack to obtain the path tracing result under the APT network attack, i.e., the APT attack process tracing result. The STP Steiner Tree Problem is a well-known technology, and its specific process will not be described in detail.

[0058] The APT attack process tracing system includes an information collection module, a source graph construction module, a community behavior identification module, a behavior breach analysis module, and a path tracing module. The information collection module uses the CamFlow tool to collect system log information from the enterprise information system and stores it on the server's hard drive. The source graph construction module uses a log transformation algorithm to standardize the system log information and converts it into a source graph. The community behavior identification module uses the Louvain community discovery algorithm to extract each community from the source graph and measures the significance of abnormal behavior in each community. The behavior breach analysis module measures the breach characteristics of system call behavior or information flow behavior under APT network attacks. The path tracing module identifies abnormal nodes under APT network attacks and uses the STP Steiner tree algorithm to trace the path under APT network attacks, obtaining the path tracing results.

[0059] Based on the same inventive concept as the above method, this application embodiment also provides an information system APT attack process tracing system, including a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, it implements the steps of any one of the above-described information system APT attack process tracing methods.

[0060] Meanwhile, this application also provides an information system APT attack process tracing medium, the medium storing a computer program, which, when executed by a processor, implements any one of the above-described information system APT attack process tracing methods.

[0061] It is understood that the order of the embodiments described above is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. Furthermore, the above description focuses on specific embodiments of this specification. Additionally, the processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired results. In some implementations, multitasking and parallel processing are possible or may be advantageous.

[0062] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0063] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Any equivalent structural or procedural transformations made based on the description and drawings of this application, or direct or indirect applications in other related technical fields, are similarly included within the protection scope of this application.

Claims

1. An information system APT attack flow tracing method, characterized in that, The method comprises the following steps: obtaining log information of an information system and converting the log information into a traceability graph; identifying each community in the traceability graph through a community discovery algorithm, analyzing the out-degree difference and the in-degree difference of different nodes in each community, obtaining community structure singularity of each community, clustering the community structure singularity of all communities, analyzing the deviation and outlying of the community structure singularity of each community in the clustering cluster, obtaining abnormal behavior significance of each community, and identifying each abnormal community through threshold segmentation; obtaining behavior distrust degree of each node in each abnormal community according to the abnormal behavior significance of each abnormal community and combining the abnormal situation of the out-degree and in-degree difference of each node in each abnormal community; identifying abnormal nodes under APT network attack by clustering the behavior distrust degree of the nodes in the abnormal community, and obtaining APT network attack path tracing results by using STP Steiner tree algorithm to trace the path under APT network attack. The method for obtaining the community structure singularity of each community comprises the following steps: wherein, is the community structure singularity of the i-th community, is the number of nodes in the i-th community, and are the out-degree of the j-th and j-1-th node in the i-th community, respectively, and are the in-degree of the j-th and j-1-th node in the i-th community, respectively, wherein the adjacency list of the provenance graph is extracted, and the out-degree and in-degree of each node in each community are counted through the adjacency list. The method for obtaining the abnormal behavior significance of each community comprises the following steps: wherein, is the abnormal behavior saliency of the kth community within the s th cluster, is the absolute difference between the community structure strangeness of the kth community within the s th cluster and the mean of the community structure strangeness of all communities within the s th cluster, is the community structure strangeness of the kth community within the s th cluster, is the local density of the kth community within the s th cluster, is a constant to avoid the denominator taking zero value; The method for obtaining the behavior distrust degree of each node in each abnormal community comprises the following steps: ; wherein, is the behavior distrust degree of the cth node in the zth abnormal community, is the abnormal behavior salience of the zth abnormal community, is the range normalization function, is the absolute difference between the out-degree and the in-degree of the cth node in the zth abnormal community, is the local outlier factor of the cth node in the zth abnormal community.

2. The information system APT attack flow tracing method of claim 1, wherein, After density peak clustering of the community structure singularity of all communities in the traceability graph, the local density of each community in each clustering cluster is obtained.

3. The information system APT attack flow tracing method of claim 1, wherein, Threshold segmentation is performed on the abnormal behavior significance of all communities in all clustering clusters, and the community with abnormal behavior significance higher than the segmentation threshold is regarded as an abnormal community in the traceability graph.

4. The information system APT attack flow tracing method of claim 1, wherein, The absolute difference between the out-degree and the in-degree of each node in each abnormal community is recorded as the first difference value of each node, and the first difference value of all nodes in each abnormal community is detected for abnormality to obtain the local outlier factor of each node in each abnormal community.

5. The information system APT attack procedure tracing method of claim 1, wherein, After clustering the behavior distrust degree of all nodes in the abnormal community, the nodes in the clustering cluster corresponding to the maximum behavior distrust degree are regarded as abnormal nodes under APT network attack.

6. An information system APT attack procedure tracing system comprising a memory, a processor and a computer program stored in the memory and running on the processor, characterized in that, The processor executes the computer program to realize the steps of the information system APT attack flow tracing method according to any one of claims 1-5.

7. A computer-readable storage medium having stored thereon a computer program, characterized in that The computer program is executed by the processor to realize the information system APT attack flow tracing method according to any one of claims 1-5.

Images