Highly hidden attack identification method and system based on relation state space

Abstract

The invention discloses a highly hidden attack identification method and system based on a relation state space, and relates to the technical field of network and system security, and the method comprises the steps: obtaining host audit data, and carrying out the preprocessing of the data, and obtaining a traceability graph event flow; performing partial extraction from the traceability graph event stream according to the memory upper limit to obtain an active sub-graph; based on the activity subgraph, semantic attributes of the traceability event are converted into word sequences, semantic vectors are obtained after embedding, and event input vectors are obtained after time vectors are spliced; inputting the projected event input vector into a loop state space model for processing, and updating to obtain a hidden state vector; and adopting a dual-channel detection head to detect a hidden state, obtaining an abnormal score based on a detection result, and identifying a high-hidden attack based on the abnormal score. The delay and resource occupation are further reduced without depending on large-scale graph convolution expansion, and the early discovery capability of behavior sequence dislocation / track crossing is improved.

Description

Technical Field

[0001] This invention relates to the field of network and system security technology, and in particular to a method and system for identifying highly covert attacks based on relational state space. Background Technology

[0002] The statements in this section are merely background information relating to this disclosure and do not necessarily constitute prior art.

[0003] In the field of host security, stealthy attack methods such as advanced persistent threats (APFs) are becoming increasingly rampant. They gradually infiltrate through a series of seemingly normal system activities, making traditional detection technologies based on signatures or single-event alerts ineffective. To reconstruct the full picture of an attack from complex system activities, source mapping technology has emerged.

[0004] Source graphs use processes, files, and network flows / modules as nodes, and system calls as directed edges (including timestamps and types) to record information flow relationships, facilitating threat discovery based on causal relationships. Threat detection based on source graphs formalizes the discovery of security threats as an anomaly detection problem on a graph structure. A representative work, THREATRACE, formalizes this problem as node-level anomaly detection, using GraphSAGE to learn "benign roles," judging anomalies based on the "predicted type vs. actual type" bias, and claims real-time deployment on long-running hosts and superior performance on public datasets compared to similar methods. Building upon THREATRACE, subsequent research, such as FLASH, has achieved further technological evolution. FLASH introduces Word2Vec semantic vectors and temporal order encoding at the feature level, and GNN context encoding and embedding retrieval database at the system level. It also proposes an Attack Evolution Graph (AEG) to compress scattered alarms according to causal chains and provides "selective traversal" to reduce GNN training latency and a default embedding verification threshold of Jaccard=1 for practical applications. At the same time, FLASH assumes that logs and embedding databases use tamper-resistant storage to ensure trustworthiness.

[0005] However, despite the aforementioned progress, existing source graph analysis techniques based on graph neural networks still suffer from a series of technical shortcomings: Existing methods heavily rely on large-scale offline / online subgraph neighborhood expansion and full node embedding maintenance, resulting in enormous computational and storage overhead, which limits real-time performance and scalability; existing methods are "anomaly detection" models, whose criteria depend on deviations from learned "benign roles." For new system behaviors or combinations of behaviors that were not present during training but are inherently benign, the model tends to classify them as anomalous, leading to additional false alarms; existing methods typically require the attack behavior to reach a certain level and form a sufficiently significant anomalous pattern in the graph before it can be detected. For highly covert, slow-moving attacks with slight "misalignments" or "deviations" in the behavioral sequence that have not yet triggered large-scale anomalous propagation, existing models lack sufficient sensitivity, making it difficult to identify and warn in the early stages of the attack chain. Summary of the Invention To overcome the shortcomings of the prior art, this invention provides a highly covert attack identification method and system based on relational state space. It aims to further reduce latency and resource consumption without relying on large-scale graph convolutional unrolling, while ensuring that the real-time performance and interpretability of nodes remain unchanged, and to improve the early detection capability of behavioral sequence misalignment / deviation.

[0006] To achieve the above objectives, one or more embodiments of the present invention provide the following technical solutions: In a first aspect, the present invention provides a highly covert attack identification method based on relational state space, comprising: Obtain host audit data, preprocess it, and obtain the source graph event stream; Based on the memory limit, a portion is extracted from the event stream of the source graph to obtain the activity subgraph; Based on the activity subgraph, the semantic attributes of its source events are transformed into word sequences, which are then embedded to obtain a semantic vector. After concatenating the time vector, the event input vector is obtained. The projected event input vector is fed into the cyclic state space model for processing, and the hidden state vector is updated. Before the update, the normalized process representation and neighborhood summary are matched with the cached content. If the match is consistent, the historical state of the current node is restored and the evolution continues. If the match is inconsistent, the hidden state vector is updated. The surprise level and uncertainty are obtained based on the hidden state vector. When both surprise level and uncertainty are less than the threshold, it is judged as a normal event and only local updates are performed. When surprise level or uncertainty is greater than or equal to the threshold, it is judged as an abnormal event, and sparse propagation is triggered to align the context for causal neighbors with a limited number of hops. A dual-channel detection head is used to detect hidden states, and anomaly scores are obtained based on the detection results. High-stealth attacks are then identified based on the anomaly scores.

[0007] A further technical solution is that the preprocessing includes normalization, enrichment, event mapping, and deduplication and merging.

[0008] In a further technical solution, the tracing graph event includes start and end graph nodes, event type, event direction, and evidence field, and the graph nodes include processes, files, sessions or network endpoints, and modules.

[0009] A further technical solution yields the following activity subgraph: Based on the judgment rules, active nodes, related nodes, and local edges are identified and retained from the source graph to obtain a preliminary active subgraph; The nodes or edges of the initial active subgraph are eliminated based on the memory limit to obtain the active subgraph.

[0010] A further technical solution employs a dual-layer storage strategy, storing the source graph event stream on disk and the activity subgraph in memory.

[0011] A further technical solution, based on the detection results, yields anomaly scores as follows: Perform type consistency detection based on the first detection head and output the type distribution; The next event is predicted based on the second detection head. The distribution of the next event is predicted from the hidden state, and the negative log-likelihood is taken to obtain the residual surprise. The anomaly score is obtained by fusing the type distribution and residual surprise.

[0012] A further technical solution is to trigger an alarm when the abnormal score is greater than or equal to the abnormal threshold. For the node that triggers the alarm, backtrack along the causal path within a limited number of hops, filter out key edges, and generate an attack state evolution graph.

[0013] Secondly, the present invention provides a highly covert attack identification system based on relational state space, comprising: The data acquisition module is configured to: acquire host audit data, preprocess it, and obtain a source graph event stream; The key extraction module is configured to extract a portion of the event stream from the source graph based on the memory limit to obtain the activity subgraph. The semantic embedding module is configured to: based on the activity subgraph, convert the semantic attributes of its source events into word sequences, embed them to obtain a semantic vector, and then concatenate the time vector to obtain the event input vector; The state update module is configured to: input the projected event input vector into the cyclic state space model for processing, and update the hidden state vector; before updating, match the normalized process representation and neighborhood summary with the cached content. If the match is consistent, restore the historical state of the current node and continue the evolution. If the match is inconsistent, update the hidden state vector; obtain the surprise level and uncertainty based on the hidden state vector. When both surprise level and uncertainty are less than the threshold, it is judged as a normal event, and normal events are only updated locally. When surprise level or uncertainty is greater than or equal to the threshold, it is judged as an abnormal event, and sparse propagation is triggered to align the context for causal neighbors with a limited number of hops. The anomaly detection module is configured to: use a dual-channel detection head to detect hidden states, obtain an anomaly score based on the detection results, and identify highly covert attacks based on the anomaly score.

[0014] Thirdly, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the highly covert attack identification method based on relational state space as described in the first aspect.

[0015] Fourthly, the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps in the highly covert attack identification method based on relational state space as described in the first aspect.

[0016] The above one or more technical solutions have the following beneficial effects: This invention introduces relational state space representation (cyclic state space model, R-SSM) and sparse causal propagation with surprise gating in the data form from host audit logs to traceability graphs, and combines versioned state recycling and dual-channel detectors to achieve real-time node-level anomaly detection.

[0017] This invention improves real-time performance and scalability by using event-level O(1) updates and sparse propagation to achieve better processing volume and latency per unit time compared to "continuous graph aggregation".

[0018] This invention complements the dual channels of role consistency and residual difference, and uses ASEG to connect mutation points in a causal chain, preserving a clear narrative and positioning, thereby improving robustness and interpretability.

[0019] This invention adopts the existing log-to-source graph pipeline and trusted storage assumptions, which can smoothly replace the original GNN backbone module and facilitate implementation and application. Attached Figure Description

[0020] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0021] Figure 1 This is a flowchart of a highly covert attack identification method based on relational state space according to an embodiment of the present invention; Figure 2 This is a model training diagram from an embodiment of the present invention; Figure 3 This is a summary flowchart of the high-coverage attack identification method based on relational state space according to an embodiment of the present invention. Detailed Implementation

[0022] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0023] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0024] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0025] Example 1 like Figure 1 As shown, this embodiment discloses a highly covert attack identification method based on relational state space, which includes the following steps: S1: Obtain host audit data, preprocess it, and obtain the source graph event stream; In this embodiment, host audit data (audit logs) is collected in a streaming manner by a collector, and a series of preprocessing operations are performed on the collected host audit data to obtain a traceability graph event stream.

[0026] Windows users can choose ETW / Sysmon or Security Log as the data collector, while Linux users can choose auditd (AUDIT_SYSCALL family) or eBPF / BCC programs (openat / execve / connect, etc.) as the data collector; OSQuery and container runtime (containerd, cri-o) events can also be accessed. This embodiment does not impose specific limitations.

[0027] The collector outputs uniform raw (JSON) records.

[0028] The unified raw records output by the data collector are preprocessed, including normalization, enrichment, event mapping, and deduplication and merging. Specifically: (1) Standardization Map data from different sources to a unified field pattern, for example: Sysmon ID=1 → event.type="PROC_CREATE"; audit SYSCALL=execve → also mapped to "PROC_EXEC".

[0029] (2) Enrichment Perform path normalization (case-sensitive / symbolic links / drive letters → absolute paths), hash calculation (delayed calculation possible), command-line template (mask constant parameters), and session / tenant labeling on the original records.

[0030] (3) Event mapping Following the "Subject-Verb-Object" paradigm, the original record is projected as a source event g = (u→v, type, dir, ts, attrs), where u and v are graph nodes (including process P, file F, session / network endpoint S, module M); type is the event type (see Table 1 below); dir is the direction (out = initiating; in = passive / inbound); and attrs are fields for preserving evidence (handle / file hash / quadruple / old name, etc.). In other words, the source graph nodes are processes (P), files (F), network endpoints / sessions (S), modules (M), etc., and their attributes (path, hash, command line, IP / port, etc.). Edges are system calls or events, including type (read / write / execute / load / connect / accept / rename, etc.), direction (e.g., P→F), and timestamp. To avoid symbol confusion, this embodiment uniformly uses g to represent event edge instances on the graph and e to represent event categories, i.e., e = type(g). The following... Equivalent to the input x(g) generated by the event edge g, where , .

[0031] Based on the causal semantics of system calls / kernel events, "who did what to whom" is mapped to directed edges, with the direction uniformly adopting behavior initiator → affected object; network inbound is identified by dir="in".

[0032] Table 1 Event Types and Edge Construction

[0033] The registry, pipes, DNS resolution, and other types can be expanded as needed without affecting subsequent R-SSM.

[0034] (4) Deduplication and merging For the same u→v, type, dir, merge the counts within a small time window Δt, and deduplicate the same semantic event across sources (such as ETW+DNS).

[0035] (5) Output After preprocessing, the source graph event stream is output as a Kafka / Pulsar Topic or gRPC stream for subsequent consumption by the in-memory activity subgraph and relational state space R-SSM (Circular State Space Model).

[0036] The above-mentioned collector, normalization, enrichment, event mapping, deduplication and merging, and output are used as sub-modules to form a data traceability generator, which can be deployed as a streaming service.

[0037] S2: Extract a portion from the event stream of the source graph based on the memory limit to obtain the activity subgraph; In this embodiment, extracting the activity subgraph from the source graph event flow specifically involves: (1) Based on the judgment rules, determine the active nodes, related nodes and local edges from the source graph and retain them to obtain the preliminary active subgraph.

[0038] Based on recent activity The activity score for each node is calculated based on the preset activity score threshold. (Exponential decay count), represented as:

[0039] in, The base of decay represents the time interval between the old fractions. Exponential decay occurs on top; This is the time window; now is the current timestamp (unit is the same as below, can be seconds); For nodes The most recent timestamp of being affected by the event; To preset the activity score threshold, The larger the value, the slower the decay.

[0040] Recent activity: High activity score: ; Fixed retention: (Alarm anchor point / critical system process / currently being tracked); if any one of these three conditions is met, the node is determined to be an active node and retained.

[0041] For each active node , retain its Jump to neighbor (neighbors are related nodes, default) However, for each direction, the Top-K (based on the most recent interaction time or interaction weight) Sort by default (K=50).

[0042] Edges whose endpoints are active and related nodes and whose current - last_edge_ts ≤ T_edge (default T_edge = T_active) are retained, where last_edge_ts(u,v) is the edge. <u → v>The timestamp of the most recent occurrence (reached by an event) is used, and T_edge is the edge's freshness window. If now - last_edge_ts(u,v) ≤ T_edge, then the edge is considered an active edge (by default, T_edge = T_active), and T_active is the node's recent active window; and an alert is issued for related edges (belonging to causal paths of ASEG) to be forcibly retained until the alert retention window (e.g., 1–2 hours). (2) Eliminate nodes or edges of the initial active subgraph based on the memory limit to obtain the active subgraph.

[0043] Set a memory limit. When the memory of the initial active subgraph exceeds the memory limit, first prune the relevant nodes of the super-large degree nodes to the Top-K. If it still exceeds the memory limit, eliminate them one by one according to priority from low to high. Before elimination, if necessary, store the eliminated nodes or edges to disk, or confirm that the eliminated nodes or edges are already in the full historical graph stored on disk.

[0044] Priority is represented as:

[0045] in, Represents a node Priority; For whether it is a fixed reserved node (such as an alarm anchor point / critical system process / currently being tracked session, etc.), the first item contributes 10 points when it is True; This is a normalization operator that normalizes the input linearly or min–max to the [0,1] interval. In this embodiment... Regarding the aforementioned "activity score" Perform normalization; This is the time interval since the last contact; The priority time constant (the decay time of the recency, e.g., 30–120 minutes) controls the exponential decay rate of the third term; The degree of node v (in the current active subgraph, given) (Number of active neighbors after jump and direction / Top-K filtering).

[0046] This invention employs a dual-layer storage strategy: the source graph event stream is stored on disk, retaining the full historical graph for easy tracing and cold start; the active subgraph extracted from the source graph event stream is stored in memory, retaining only active nodes, related nodes, and local edges for online detection or propagation. This strategy ensures traceability while maintaining scalability and low latency.

[0047] S3: Based on the activity subgraph, the semantic attributes of its source events are transformed into word sequences, which are then embedded to obtain a semantic vector. After concatenating the time vector, the event input vector is obtained. In this embodiment, the sourcing event e in the activity subgraph is normalized to: g = ( ), For event types, such as FILE_WRITE, PROC_EXEC, NET_CONNECT, As direction, For graph nodes, Evidence fields include process name, command line, executable path, file path, module name, proto / laddr / lport / raddr / rport, signature / hash, etc.

[0048] The semantic attributes of the source event are transformed into a sequence of words or sub-words, specifically: Different fields are treated with a field-aware word segmentation / subtotalization strategy and uniformly mapped to a token sequence. First, perform general preprocessing on the relevant data of the source tracing event, namely normalization, removal of leading and trailing whitespace, and replacement of volatile constants with placeholders; for process names, module names, and file names, segment them using a sub-word segmentation model (such as BPE / WordPiece), and additionally segment them according to camelCase, hyphen, and underscore; for command lines, parse them according to shell / argv, and template the variable constants (path, number, hash, IP, URL) into... <path> <num> <hash> <ip> <url>Then perform subtotalization; for the path (executable / file), segment by the delimiter [ / \\], and retain the last segment's filename and extension as an explicit token. For intermediate path segments, only the last LLL segment is taken (default L=3L=3L=3). Each segment is then subtotalized again, and insertions are made between segments. <pseg>; For network (IP / port / protocol), proto directly as a token (tcp / udp / icmp, etc.), port is bucketed (0-1023, 1024-49151, 49152-65535) + fine port (common 80 / 443 / 22, etc. separate token), IP is recommended to be classified, including private / public network, / 8 network segment, ASN / country (optional), or four octets are discretized into tokens respectively, or the complete IP can be hashed-bucketed to control the vocabulary; For type and direction, generate special tokens for TYPE=…, DIR=… (such as <TYPE_FILE_WRITE>, <DIR_OUT>).

[0049] Each token in the token sequence is looked up in the embedding matrix of the shared / per-field to obtain a vector , where is the token, and the semantic vector is obtained after light pooling . The embeddings of type TYPE and direction DIR are spliced with the pooling result (semantic vector) to enhance the semantic vector and obtain an enhanced semantic vector. The shared (shared) embedding uses the same vocabulary and embedding matrix for text type fields (such as subword tokens obtained by tokenizing process names, command lines, executable / file paths). Its role is to share semantics for the same token (such as "exe", "dll", "temp") appearing in different fields, with less parameters and better OOV generalization. The per-field (per-field) embedding establishes its own vocabulary and embedding matrix for fields that are discretely enumerated or semantically different. The embedding matrix is a trainable parameter matrix , and each row of the matrix is a vector representation of a token (or category / bucket). It is updated together with the model during training. Where |V| is the size of the vocabulary (or bucket table, category table), and d is the embedding dimension. The lookup is to take the integer id of a token as the row number, and get the row vector from the corresponding embedding matrix. Denoted as = , and the exact meaning of the vector is looked up in the embedding matrix.

[0050] Encode time and order to obtain a time vector, which includes relative time, absolute time, and intra-batch order. Relative time is the time difference from the last event on the same subject node (such as process u). The relative time difference Δt is first logarithmically bucketed to map continuous values into a limited number of bucket numbers (integers), and then the number is taken as a "discrete token" to look up the embedding vector in the time bucket embedding matrix Absolute time is embedded as discrete buckets of hour-of-day (0-23), day-of-week (0-6), etc. and added up, denoted as The position of micro-batch order pos is embedded to get order vector The relative time, absolute time and batch order are combined to get time vector, denoted as .

[0051] The semantic vector and the time vector are spliced to get event input vector, and the event input vector is projected to state dimension , denoted as: ,

[0052] wherein, is an activation function, which can be GELU / ReLU, and LN can be LayerNorm. The projected event input vector is input to a recurrent state space model.

[0053] Event input vector Examples: Linux read file: read(P:" / usr / bin / python3", args:"pip install", F:" / etc / resolv.conf")→ Tokenization / embedding + time / order encoding → ; Windows connection: connect(P:"svchost.exe", dst:"52.97.132.18:443", proto:TCP) → IP / port bucketing embedding + time / order encoding → .

[0054] S4: The projected event input vector is input to a recurrent state space model for processing, and a hidden state vector is obtained by updating. Before updating, the normalized process representation and neighborhood summary are matched with the cached content, and if the match is consistent, the history state of the current node is restored for continuous evolution, and if the match is inconsistent, the hidden state vector is updated. Based on the hidden state vector, the surprise degree and uncertainty are obtained, and when the surprise degree and uncertainty are less than the threshold, the event is judged as normal, and the normal event is only locally updated, and when the surprise degree or uncertainty is greater than or equal to the threshold, the event is judged as abnormal, and the sparse propagation alignment context is triggered for the causal neighbor within the limited hop count; In the embodiment, a relational state space representation (R-SSM) is used to replace the "graph convolution-based" aggregation paradigm, that is, a hidden state vector of each graph node (v) is maintained to evolve over time , it is not the original log, nor the plaintext feature, but the behavior memory (digital vector) inside the model that can be incrementally updated. Every time an event (such as read / exec / connect) arrives, the hidden state vector is updated according to the event type and event input vector, so that it always represents the "behavior state or context memory of this node at this moment". The invention makes judgments and triggers through the hidden state, and only a small amount of state is updated in the relevant node, thereby realizing low-latency online detection.

[0055] The projected event input vector is input into the recurrent state space model for state updating, specifically: The event e arriving at time t, i.e. event is represented as , wherein , is the subject / object node, is the event type (read / write / execute / load / connect / rename…), is the event input vector obtained through semantic-time encoding, and then the projected event input vector is obtained, which is input into the recurrent state space model for state updating.

[0056] State updating only updates the subject node (u) (and sparse propagation if necessary), which is represented as:

[0057] , wherein is a trainable linear operator (shareable / grouped) according to the event type, is a forgetting / noise term (hyperparameter or learnable), is the input vector of event e at time t (obtained by splicing semantic embedding and time / sequence encoding).

[0058] Intuition: (A) is responsible for retaining / decaying existing memory, and (B) is responsible for injecting current event semantics; Different (A, B) learns the different effects of "read / write / execute / connect" on the state.

[0059] The state update of the execution cost of event e at time t is:

[0060] , wherein is the trace graph node (process, file, session, module, etc.), is the hidden state of the node .

[0061] In this embodiment, by predicting the next event (such as the joint code of edge type / direction / coarse-grained object role) of the category, the hidden state Input a linear / MLP classifier to get the distribution over the discrete label set (such as the joint encoding of type x dir x role), denoted as:

[0062] The surprise and uncertainty of the event are calculated based on the updated hidden state, the surprise is denoted as , and the uncertainty (distribution entropy / variance) is denoted as . When both the surprise and the uncertainty are greater than a preset threshold, it indicates that the current event deviates from the expectation to a large extent, and a propagation (sparse propagation) is triggered to the 1-2 hop (propagation radius ) causal neighbors only at this time. When exceeds the threshold, a one-time propagation is performed from the current node u along the causal edge to the 1-hop (directly adjacent) or 2-hop (adjacent adjacent) nodes to correct the context. Under normal circumstances, no propagation is performed, and only O(1) local updates are performed. By default, h=1, but it can also be increased to h=2 according to the abnormal intensity / event type. That is, when the surprise and the uncertainty are both less than the threshold, it is judged to be a normal event, and only O(1) local updates are performed. Only when the surprise / uncertainty exceeds the threshold, a 1-2 hop propagation is triggered to avoid high latency and high memory caused by full graph expansion. The threshold can be a fixed threshold or an adaptive quantile, and it can also be set hierarchically according to node types.

[0063] When or , the gate is triggered, which is optimized by offline quantile or adaptive according to tenants / hosts.

[0064] Specifically, the sparse causal propagation of the surprise gate is as follows:

[0065] wherein is the surprise, indicates the deviation of the current event from the expectation, and the uncertainty is the entropy or variance of the prediction distribution.

[0066] The one-time propagation (only 1-2 hops, to correct the context; normal propagation is not performed) when the gate is triggered is as follows: (1) Take the neighbor set of and the two-hop ; (2) For each , do a local correction once with a smaller weight: wherein , can be Shared or separate one layer linear / gating; (3) Propagation rate limit: at most (R) neighbors per event, default (R≤5), propagation times limit per node per second; (4) Record "spread" flag for this event, no duplicate propagation.

[0067] When a real anomaly comes or the model is uncertain, align the direct context with a local diffusion, neither unfolding the whole graph nor quickly stabilizing the neighborhood representation.

[0068] In this embodiment, versioned state recovery: Cache (hv, version, time) with PNI unique key (normalized process name + command line template + executable signature / hash + path template) and neighborhood digest. Hit first with Jaccard to check neighborhood similarity ( ), and directly restore the state to continue evolution. State recovery: hit the cache with PNI key + neighborhood digest, Restore the historical state to inherit evolution.

[0069] PNI (Process Normalized Identity) unique key [PNI=exe template+cmdline template+signature / hash+path template] templating will replace variable constants (path segment / number / IP / hash) with placeholders to ensure that the same "program family" can be identified.

[0070] Neighborhood digest (Nbd Digest) is to compress the adjacency relationship in the recent time window into a set, which is realized by MinHash / SimHash or count Bloom-Filter to get a bitmap .

[0071] Cache items: .

[0072] Hit and similarity: Then directly restore And continue evolution; otherwise, create a new state. The cache is recycled with TTL+LRU. Specifically, use set similarity to determine whether the context is consistent, which is represented as:

[0073] In the offline phase, based on the validation set Parameter optimization: search In the candidate set, make the average state recovery latency minimum / overall F1 optimal under the constraint of "cache hit precision (Precision@Hit)≥ρ".

[0074] The equivalent objective can be written as

[0075] wherein, is the hit threshold, not fixed in advance, is the optimal threshold in the candidate set that optimizes the objective; argmax is the parameter that takes the maximum of the objective function (returns the parameter rather than the maximum value); is the F1 score obtained when the threshold is used on the validation set (val); s.t. is subject to, meaning "satisfy the following constraints", is the hit precision (Precision@Hit) on the validation set at threshold γ\gammaγ; TrueHit indicates that Jaccard ≥ γ and the context is indeed matched and recovered correctly, and FalseHit indicates that Jaccard ≥ γ but it is not actually a hit; is the minimum requirement for hit precision (threshold).

[0076] The optimization method can use grid search / Bayesian optimization; the optimal γ* is written into the configuration at the tenant / host granularity during deployment, and subsequent periodic review is triggered by drift monitoring.

[0077] In this embodiment, state updating and forgetting, training parameters include , and hyperparameters include forgetting strength, such as ; gating threshold, fusion weight, hit threshold, and ASEG depth.

[0078] Offline learning and threshold / depth joint optimization. The offline learning process is "pre-training → fine-tuning → threshold / depth joint optimization → deployment and monitoring". (1) Pre-training: initialize with next-event NLL minimization . (2) Fine-tuning: train the decoder with role / type cross-entropy ; do temperature scaling and probability calibration on to make the threshold transferable. (3) Threshold / depth joint optimization: multi-objective optimization is performed on on the validation set, and the objectives are

[0079] wherein, T is the alarm threshold, is the score fusion weight, is the gating threshold, γ is the cache hit threshold, h is the ASEG depth, and R is the upper limit of per-event propagation. The optimal set is obtained by using grid / Bayesian optimization (4) Deployment and review: The optimal parameters are issued, the drift and index fluctuation in operation are monitored, and periodic / event-driven re-optimization is triggered to maintain optimal effect.

[0080] S5: Hidden state detection is performed using a dual-channel detection head, an abnormal score is obtained based on the detection result, and a high-concealment attack is identified based on the abnormal score.

[0081] In this embodiment, the dual-channel detection head includes a first detection head and a second detection head.

[0082] The first detection head performs role consistency detection, and the role can be a process, a file, a module, etc. The hidden state vector of the node v is mapped into a probability distribution of "node role / type" (such as {Process, File, Socket / Session, Module, Registry…}). The role consistency is decoded to obtain a role (type) distribution, denoted as . Insufficient confidence is regarded as inconsistency, and is represented as: .

[0083] The second detection head outputs a next event prediction residual, which is predicted from the hidden state to obtain a next event distribution, and the residual surprise degree is obtained by taking the negative log-likelihood, and the residual surprise degree is output.

[0084] An abnormal score is obtained based on the role consistency and the residual surprise degree, and is represented as:

[0085] wherein is the abnormal score, and is a fusion weight. When the abnormal score is greater than or equal to an abnormal threshold , an alarm is triggered, and an attack state evolution graph ASEG is entered. , Both are hyperparameters, which can be configured according to the tenant / node type, and can be automatically optimized according to the offline ROC / PR or online quantile (such as 95%).

[0086] In this embodiment, the attack state evolution graph ASEG is anchored by the alarm node of "state mutation / high residual", and is backtracked to multiple d hops along the causal path to generate the ASEG, which focuses on the key causal chain. The attack state evolution graph only retains the "mutation / alarm" node and the key edge, significantly compresses the investigation range and enhances the interpretability.

[0087] ​When the anomaly score is greater than or equal to the anomaly threshold, an alarm is triggered. For the node triggering the alarm, the key edges are screened by backtracking along the causal path within a limited number of hops, and an attack state evolution graph is generated. The specific steps for generating the attack state evolution graph ASEG are as follows: Input the anchor node set triggering the alarm (satisfying the condition that the anomaly score is greater than or equal to the anomaly threshold), from each Start in the time window , go in the causal direction , at most (d) hops, with a default value of d = 2-3; Screen the edges, and only keep the alarm nodes, key edges (event type in the monitoring list), and limit the fan-out / fan-in to prevent explosion (at most N edges per layer); Compress the output, output ASEG JSON / DOT / PNG, and attach the event time, anomaly score, threshold, and primary cause explanation (difference between the top R most likely events from the second detection head and the actual event) of each edge.

[0088] Train the dual-channel detection head and optimize the threshold. The second detection head uses self-supervised pre-training to minimize , so the predicted distribution is the softmax output of the second detection head. The first detection head uses a small amount of supervised fine-tuning (role classification) with cross-entropy . Threshold optimization: select , , , on the validation set according to ROC / PR, or use online sliding window quantile adaptation (per node / per tenant).

[0089] Running constraints and default values: Propagation: only performed when triggered, R≤5, d≤2, triggered per second per node , within any 1-second rolling time window, the proportion of events that can trigger "sparse propagation / alarm" for a node v to the total number of events arriving in that second should not exceed ) Caching: hit threshold , TTL 1-3 days, LRU; immediately perform this update after recovery. Determining mutations : using or cosine distance + adaptive quantile threshold.

[0090] Calculation: all updates are vector-matrix operations with incremental complexity (O(1)).

[0091] Summary of the method reasoning process: loop: event arrival → )O(1) Update → (If the threshold is exceeded) Sparse propagation → Two-head scoring fusion → Alarm → Write / update state cache.

[0092] This invention proposes a real-time detection framework that combines relational state-space with sparse causal propagation. While maintaining the FLASH / THREATRACE data format and output target, it replaces the core modeling paradigm and upgrades "embedding recycling" to "state recycling." By replacing "frequent aggregation of the global GNN" with a node-local state machine, most events are updated in O(1) time. Small-step causal propagation is triggered only when the level of surprise / uncertainty increases; Upgrade the cache from "static embedding" to "versioned and evolvable node state", and reset it directly to an evolvable state after a hit check; An attack state evolution diagram is constructed with state mutation points as the core, which maintains interpretability while further compressing the investigation space.

[0093] In summary, this invention achieves the following innovations: (1) Relational state space representation substitutes graph convolution backbone Maintain a hidden state that can be updated online for each trace graph node; select a state transition operator (read / write / execute / load / connect / accept...) based on the event type / direction for one-step update; most events are updated locally in O(1) time, without the need for normalized neighborhood aggregation.

[0094] (2) Sparse causal propagation with "surprise / uncertainty" gating A correction propagation is triggered along the causal edge to the 1–2 hop neighbors only when the prediction residual or uncertainty of a node exceeds a threshold; the propagation is event-driven rather than periodic / batch-driven, which significantly reduces the cost of graph unfolding.

[0095] (3) Versioned "state reclamation" and hit verification Upgrade "embedded recycling" to state recycling: use the node's unique key (PNI template) + neighborhood summary as an index to cache {state, timestamp, version}; before reuse, perform a hit check using neighborhood similarity (such as Jaccard) or equivalence metric, and if it passes the check, directly restore the state to continue evolution (without needing to perform another graph forward pass).

[0096] (4) Dual-channel anomaly detection Role consistency: The distribution of the "proper role / type" of a node is obtained by decoding the state; if the confidence level is low, it is suspicious. Next event prediction residual: Predict the "next event" (type / object class / time interval) using the current state. The greater the deviation between the actual event and the prediction, the higher the anomaly score. An alarm was triggered after the scores from the two sources were weighted and merged.

[0097] (5) Attack state evolution graph (ASEG) based on "state mutation point" Using alarm nodes with high residuals / significant mutations as anchors, a simplified attack chain graph is constructed along the causal path, preserving interpretability while compressing the scope of investigation.

[0098] Example 2 This embodiment discloses a highly covert attack identification system based on relational state space, including: The data acquisition module is configured to: acquire host audit data, preprocess it, and obtain a source graph event stream; The key extraction module is configured to extract a portion of the event stream from the source graph based on the memory limit to obtain the activity subgraph. The semantic embedding module is configured to: based on the activity subgraph, convert the semantic attributes of its source events into word sequences, embed them to obtain a semantic vector, and then concatenate the time vector to obtain the event input vector; The state update module is configured to: input the projected event input vector into the cyclic state space model for processing, and update the hidden state vector; before updating, match the normalized process representation and neighborhood summary with the cached content. If the match is consistent, restore the historical state of the current node and continue the evolution. If the match is inconsistent, update the hidden state vector; obtain the surprise level and uncertainty based on the hidden state vector. When both surprise level and uncertainty are less than the threshold, it is judged as a normal event, and normal events are only updated locally. When surprise level or uncertainty is greater than or equal to the threshold, it is judged as an abnormal event, and sparse propagation is triggered to align the context for causal neighbors. The anomaly detection module is configured to: use a dual-channel detection head to detect hidden states, obtain an anomaly score based on the detection results, and identify highly covert attacks based on the anomaly score.

[0099] Example 3 The purpose of this embodiment is to provide a computing device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the method of Embodiment 1.

[0100] Example 4 The purpose of this embodiment is to provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the steps of the method of Embodiment 1.

[0101] The steps and methods involved in the apparatuses of Embodiments 3 and 4 above correspond to those in Embodiment 1. For specific implementation details, please refer to the relevant description section of Embodiment 1. The term "computer-readable storage medium" should be understood as a single medium or multiple media including one or more instruction sets; it should also be understood as including any medium capable of storing, encoding, or carrying an instruction set for execution by a processor and enabling the processor to perform any of the methods in this invention.

[0102] Those skilled in the art will understand that the modules or steps of the present invention described above can be implemented using general-purpose computer devices. Optionally, they can be implemented using computer-executable program code, thereby allowing them to be stored in a storage device for execution by a computer device, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. The present invention is not limited to any particular combination of hardware and software.

[0103] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0104] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.< / pseg> < / url> < / ip> < / hash> < / num> < / path>

Claims

1. A method for high-stealth attack identification based on a relationship state space, characterized in that, The method comprises the following steps: acquiring host audit data, preprocessing the host audit data to obtain a trace graph event stream; extracting part of the trace graph event stream according to an upper limit of memory to obtain an active subgraph; translating semantic attributes of trace events of the active subgraph into word sequences, embedding to obtain semantic vectors, and splicing time vectors to obtain event input vectors; inputting the projected event input vectors into a recurrent state space model for processing to update a hidden state vector; before updating, performing matching between a normalized process representation and a neighborhood summary and cache content, and if the matching is consistent, restoring a historical state of a current node to continue evolution, and if the matching is inconsistent, updating the hidden state vector; based on the hidden state vector, obtaining surprise degree and uncertainty, and if the surprise degree and the uncertainty are both less than a threshold value, judging that the event is a normal event, and only performing local updating, and if the surprise degree or the uncertainty is greater than or equal to the threshold value, judging that the event is an abnormal event, triggering sparse propagation to align context for a limited hop number of causal neighbors; detecting the hidden state using a double-channel detection head, obtaining an anomaly score based on the detection result, and identifying a high-concealment attack based on the anomaly score.

2. The relationship state space based high cover attack identification method of claim 1, wherein, The preprocessing comprises normalization, enrichment, event mapping and de-duplication and merging.

3. The relationship state space based high cover attack identification method of claim 1, wherein, The trace graph event comprises start and end graph nodes, event types, event directions and evidence fields, and the graph nodes comprise processes, files, session or network endpoints and modules.

4. The relationship state space based high cover attack identification method of claim 1, wherein, The active subgraph is obtained in the following manner: determining and retaining active nodes, related nodes and local edges from the trace graph according to a determination rule to obtain a preliminary active subgraph; eliminating nodes or edges of the preliminary active subgraph according to the upper limit of memory to obtain the active subgraph.

5. The relationship state space based high cover attack identification method of claim 1, wherein, A double-layer storage strategy is used, and the trace graph event stream is stored in a disk, and the active subgraph is stored in memory.

6. The relationship state space based high cover attack identification method of claim 1, wherein, The anomaly score is obtained based on the detection result in the following manner: type consistency detection is performed based on a first detection head to output a type distribution; next event prediction is performed based on a second detection head, a next event distribution is predicted from the hidden state, a negative log likelihood is taken to obtain residual surprise degree; the type distribution and the residual surprise degree are fused to obtain the anomaly score.

7. The relation state space based high cover attack identification method of claim 6, wherein, When the anomaly score is greater than or equal to an anomaly threshold value, an alarm is triggered, for a node triggering the alarm, a key edge is selected by backtracking along a causal path within a limited hop number, and an attack state evolution graph is generated.

8. A high-stealth attack identification system based on a relation state space, characterized in that, The method comprises the following steps: a data acquisition module configured to acquire host audit data, preprocess the host audit data to obtain a trace graph event stream; a key extraction module configured to extract part of the trace graph event stream according to an upper limit of memory to obtain an active subgraph; a semantic embedding module configured to translate semantic attributes of trace events of the active subgraph into word sequences, embed to obtain semantic vectors, and splice time vectors to obtain event input vectors; The state updating module is configured to input the projected event input vector into a recurrent state space model for processing to obtain a hidden state vector, before updating, the normalized process representation and the neighborhood summary are matched with the cached content, if the match is consistent, the history state of the current node is recovered for continuous evolution, if the match is inconsistent, the hidden state vector is updated, based on the hidden state vector, surprise and uncertainty are obtained, if both the surprise and the uncertainty are less than a threshold, the event is determined as a normal event, only local updating is performed, if the surprise or the uncertainty is greater than or equal to the threshold, the event is determined as an abnormal event, sparse propagation is triggered for the causal neighbors within a limited hop number to align the context; The anomaly recognition module is configured to detect the hidden state by using a double-channel detection head, obtain an anomaly score based on the detection result, and recognize a high-stealth attack based on the anomaly score.

9. A computer-readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the steps in the high-stealth attack recognition method based on a relational state space.

10. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the program to implement the steps in the high-stealth attack recognition method based on a relational state space.

Images