Advanced persistent threat analysis method, device, equipment, medium and product

Abstract

The invention relates to the technical field of network security, and provides an advanced persistent threat analysis method and device, equipment, a medium and a product, and the method comprises the steps: screening daily granularity network traffic information of target equipment based on a clustering algorithm, and determining abnormal network traffic information; and inputting the abnormal network traffic information to a first analysis model to obtain a first analysis result output by the first analysis model, and inputting the historical abnormal network traffic information to a second analysis model at a preset time point to obtain a second analysis result output by the first analysis model. The abnormal network flow information is screened out through the clustering algorithm, then the abnormal network flow information is analyzed based on the first analysis model, monitoring of the current network flow information is achieved, and the abnormal network flow information and the historical abnormal network flow information are analyzed based on the second analysis model at the preset time point. And long-term monitoring of advanced persistent threats is realized.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, specifically to a method, apparatus, device, medium, and product for analyzing advanced persistent threats. Background Technology

[0002] Advanced persistent threats can be broadly categorized into five stages: intelligence gathering, attack and intrusion, establishment of command and control channels, lateral expansion, and data theft. Most of these stages can lead to abnormal network traffic.

[0003] Existing Advanced Persistent Threat (APT) analysis techniques build judgment models by learning and training on training sample sets to determine the existence of APTs, but they can only be trained and predicted using current network traffic data. However, APTs are long-term, covert attack patterns. If individual vulnerabilities remain undiscovered, hidden malicious software or scripts can evade system detection, leading to insufficient identification and prediction of APTs. Summary of the Invention

[0004] This application provides a method, apparatus, device, medium, and product for analyzing advanced persistent threats, which solves the shortcomings of existing technologies that can only train and predict based on current network traffic data, easily leading to insufficient identification and prediction of advanced persistent threats.

[0005] In a first aspect, embodiments of this application provide a method for analyzing advanced persistent threats, including: Clustering algorithms are used to filter daily-level network traffic information of target devices to identify abnormal network traffic information; The abnormal network traffic information is input into the first analysis model to obtain the first analysis result output by the first analysis model. At a preset time point, the historical abnormal network traffic information is input into the second analysis model to obtain the second analysis result output by the first analysis model. Both the first analysis result and the second analysis result are used to characterize whether there is an advanced persistent threat. The training methods for the first analysis model and the second analysis model are different.

[0006] As an example, the first analysis model and the second analysis model are determined based on the following method: Based on the attack chain pattern of advanced persistent threats, the attack characteristics of the advanced persistent threats are determined, and a network traffic list corresponding to the attack characteristics is constructed. Based on the aforementioned network traffic list, a linear regression model and objective function are constructed; The linear regression model is trained based on the first gradient descent algorithm and the objective function to obtain the first analytical model; The linear regression model is trained based on the second gradient descent algorithm and the objective function to obtain the second analytical model; Wherein, the number of samples used by the first gradient descent algorithm in each iteration is less than the number of samples used by the second gradient descent algorithm in each iteration.

[0007] As one embodiment, after obtaining the analysis results output by the analysis model, the method further includes: If the analysis results indicate the existence of an advanced persistent threat, determine the target network traffic information corresponding to the advanced persistent threat; Based on the target network traffic information, target log information is determined to enable threat tracing and attack chain analysis.

[0008] As one embodiment, the step of filtering daily-level network traffic information of the target device based on a clustering algorithm to determine abnormal network traffic information includes: Based on the clustering algorithm, the daily granular network traffic information of the target device is clustered to obtain network traffic information with at least one type of network traffic characteristics. Based on the network traffic security boundaries corresponding to various network traffic characteristics, network traffic information exceeding the network traffic security boundaries is regarded as abnormal network traffic information.

[0009] As an example, the network traffic security boundary is determined based on the following method: Based on historical daily-level network traffic information, the historical cluster centers, historical clustering objective functions, and historical cluster center update functions for various network traffic characteristics are determined. Based on the historical cluster centers, the historical clustering objective function, and the historical cluster center update function, the network traffic security boundaries for various network traffic characteristics are determined.

[0010] As one embodiment, it also includes: Based on the abnormal network traffic information and the first / second analysis results, an advanced persistent threat defense library is constructed.

[0011] Secondly, embodiments of this application provide an analysis apparatus for advanced persistent threats, comprising: The determination module is used to filter daily-level network traffic information of target devices based on clustering algorithms to identify abnormal network traffic information; The analysis module is used to input the abnormal network traffic information into the first analysis model to obtain the first analysis result output by the first analysis model, and to input the historical abnormal network traffic information into the second analysis model at a preset time point to obtain the second analysis result output by the first analysis model. Both the first analysis result and the second analysis result are used to characterize whether there is an advanced persistent threat. The training methods for the first analysis model and the second analysis model are different.

[0012] Thirdly, embodiments of this application provide an electronic device, including a processor and a memory storing a computer program, wherein the processor executes the program to implement the steps of the advanced persistent threat analysis method described in the first or second aspect.

[0013] Fourthly, embodiments of this application provide a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the advanced persistent threat analysis method described in the first or second aspect.

[0014] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the advanced persistent threat analysis method described in the first aspect.

[0015] The methods, apparatus, devices, media, and products for analyzing advanced persistent threats (APS) provided in this application embodiment filter daily-granular network traffic information of target devices based on clustering algorithms to identify abnormal network traffic information. The abnormal network traffic information is input into a first analysis model to obtain a first analysis result output by the first analysis model. Historical abnormal network traffic information is input into a second analysis model at preset time points to obtain a second analysis result output by the first analysis model. Both the first and second analysis results are used to characterize the existence of APS. The training methods for the first and second analysis models are different. This application uses a clustering algorithm to filter abnormal network traffic information, then analyzes the abnormal network traffic information based on the first analysis model to achieve monitoring of current network traffic information. Furthermore, it analyzes historical abnormal network traffic information based on the second analysis model at preset time points to achieve long-term monitoring of APS. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a flowchart illustrating the advanced persistent threat analysis method provided in the embodiments of this application.

[0018] Figure 2 This is a schematic diagram of the structure of the advanced persistent threat analysis device provided in the embodiments of this application.

[0019] Figure 3 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0021] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of the same class, not limited in number; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0022] When a user is under an advanced persistent threat (APT), abnormal network traffic will occur if network operations are performed during the attack / intrusion phase, such as establishing command and control channels, lateral movement, or data theft. For example, during the attack / intrusion phase, downloading attack programs via email or a webpage will cause a short-term increase in network traffic.

[0023] During the research process, the inventors of this application discovered that most existing advanced persistent threat analysis technologies can only analyze and predict current abnormal network traffic data. If individual vulnerabilities are not discovered, hidden malicious software or scripts will be difficult to detect, evading system detection and leading to the risk of advanced persistent threats.

[0024] Therefore, this application provides a method, apparatus, device, medium, and product for analyzing advanced persistent threats, which can effectively predict and determine whether long-term advanced persistent threats exist.

[0025] Reference Figure 1 This application provides an analysis method for advanced persistent threats, which may include steps S110-S120.

[0026] Step S110: Based on the clustering algorithm, the daily granular network traffic information of the target device is filtered to determine abnormal network traffic information.

[0027] This application does not limit the type of target device, which may include physical devices and virtual devices, such as computers, servers, virtual machines, etc.

[0028] Optionally, daily granular network traffic information is used to characterize the network traffic generated by the target device each day, including information on various network traffic characteristics, including but not limited to network packet size, timestamp, traffic transmission speed, port number, transmission protocol, source / destination address, data encryption, and access traffic. Correspondingly, network traffic information includes network packet size, timestamp of each network packet, and traffic transmission speed value.

[0029] Optionally, filtering the daily granular network traffic information of the target device based on clustering algorithms includes clustering the daily granular network traffic information based on the category of network traffic characteristics, and filtering out network traffic information that exceeds the security boundary of the category of network traffic characteristics as abnormal network traffic information.

[0030] Optionally, this application records abnormal network traffic information for the day and saves abnormal network traffic information from previous days as historical abnormal network traffic information for long-term monitoring and tracing.

[0031] Step S120: Input the abnormal network traffic information into the first analysis model to obtain the first analysis result output by the first analysis model, and input the historical abnormal network traffic information into the second analysis model at a preset time point to obtain the second analysis result output by the first analysis model. Both the first analysis result and the second analysis result are used to characterize whether an advanced persistent threat exists.

[0032] The training methods for the first analysis model and the second analysis model are different.

[0033] Optionally, both the first and second analysis models are trained on machine learning models using network traffic information samples. The network traffic information samples include network traffic corresponding to various attack characteristics of advanced persistent threats, which helps the first and second analysis models establish the relationship between the network traffic corresponding to the attack characteristics and the network attacks of advanced persistent threats.

[0034] Furthermore, the first analysis model reduces the number of samples traversed during iterative training, thereby reducing iteration time and minimizing the impact on operating efficiency. The second analysis model traverses all samples during iterative training to prevent deviations in the final analysis results due to minor errors, thus improving the accuracy of the model analysis.

[0035] Furthermore, the first and second analysis models use different gradient descent algorithms during iterative training. The first analysis model uses a gradient descent algorithm that iterates through fewer samples than the second analysis model.

[0036] Optionally, this application does not limit the setting of preset time points; it only needs to achieve periodic comprehensive detection and analysis of the target device. It should be understood that this application can achieve daily monitoring and fixed-time comprehensive detection of advanced persistent threats (APS) on the target device. Abnormal network traffic information of the target device is stored long-term. A full detection mode is initiated at fixed times, retrieving the stored historical abnormal network traffic information and inputting it into a second analysis model for comprehensive APS detection and prediction. Each abnormal network traffic piece of information is tracked, and APS is predicted and determined, thereby effectively compensating for the shortcomings of existing technologies in determining and predicting long-term APS.

[0037] Understandably, this application uses a clustering algorithm to filter out abnormal network traffic information, then analyzes the abnormal network traffic information based on a first analysis model to monitor current network traffic information, and analyzes historical abnormal network traffic information based on a second analysis model at preset time points to achieve long-term monitoring of advanced persistent threats.

[0038] As one embodiment, the step of filtering daily-level network traffic information of the target device based on a clustering algorithm to determine abnormal network traffic information includes: Based on the clustering algorithm, the daily granular network traffic information of the target device is clustered to obtain network traffic information with at least one type of network traffic characteristics. Based on the network traffic security boundaries corresponding to various network traffic characteristics, network traffic information exceeding the network traffic security boundaries is regarded as abnormal network traffic information.

[0039] Optionally, before clustering the daily granular network traffic information of the target device based on the clustering algorithm, the daily granular network traffic information is quantified and standardized to obtain standardized network traffic data corresponding to various network traffic characteristics, so as to improve the accuracy of clustering and analysis.

[0040] Optionally, this application calculates the distance from real-time network traffic data points to the centroid of their respective clusters based on a clustering algorithm, and filters out abnormal network traffic information outside the boundary by determining whether the distance exceeds the network traffic security boundary.

[0041] Optionally, this application does not limit the clustering algorithm. The embodiments of this application use the K-means clustering algorithm as an example for illustration. The k value of the K-means clustering model is determined based on the number of network traffic features. The clustering objective function is constructed with the goal of minimizing the sum of squared errors between the samples in each cluster and the cluster center. A cluster center update function is constructed based on the clustering objective function. The cluster center update function is used to recalculate the center position of each cluster in each iteration. By continuously moving the cluster center to the average position of the points in the cluster, the sum of squared distances between the samples in the cluster and the cluster center (i.e., the objective function) is gradually minimized, thereby optimizing the clustering effect until the algorithm converges.

[0042] Furthermore, the clustering objective function expression is as follows: ; in, For the first The distance from each data point to the cluster center The number of resulting clusters, A set of characteristics for each network traffic. For the first Data on network traffic characteristics For the first Cluster centers.

[0043] Furthermore, the cluster center update function expression is as follows: ; in, For the updated number Cluster centers.

[0044] Understandably, this application uses the K-means clustering model to filter out changes in network traffic characteristics caused by advanced persistent threat (APS) attacks and marks them as anomalous network traffic information. This enables comprehensive capture of anomalous network traffic information, effectively avoiding the impact of intruders not taking action for a short period after the initial intrusion on APS detection. It also preserves the anomalous network traffic information generated by the attack, providing data support for long-term multidimensional network data correlation analysis.

[0045] As an example, the network traffic security boundary is determined based on the following method: Based on historical daily-level network traffic information, the historical cluster centers, historical clustering objective functions, and historical cluster center update functions for various network traffic characteristics are determined. Based on the historical cluster centers, the historical clustering objective function, and the historical cluster center update function, the network traffic security boundaries for various network traffic characteristics are determined.

[0046] Optionally, the historical cluster centers, historical clustering objective functions, and historical cluster center update functions can refer to the steps for determining the cluster centers, clustering objective functions, and cluster center update functions in the above embodiments, and will not be repeated here.

[0047] Optionally, determining the network traffic security boundary for various network traffic characteristics based on the historical cluster centers, the historical clustering objective function, and the historical cluster center update function specifically refers to clustering historical daily-level network traffic information based on the historical cluster centers, the historical clustering objective function, and the historical cluster center update function, and determining the network traffic security boundary based on the clustering results. If the historical daily-level network traffic information does not contain data related to advanced persistent threats, all historical daily-level network traffic information is within the network traffic security boundary.

[0048] Understandably, this application constructs network traffic security boundaries through clustering algorithms, which is beneficial for filtering out abnormal network traffic information.

[0049] As an example, the first analysis model and the second analysis model are determined based on the following method: Based on the attack chain pattern of advanced persistent threats, the attack characteristics of the advanced persistent threats are determined, and a network traffic list corresponding to the attack characteristics is constructed. Based on the aforementioned network traffic list, a linear regression model and objective function are constructed; The linear regression model is trained based on the first gradient descent algorithm and the objective function to obtain the first analytical model; The linear regression model is trained based on the second gradient descent algorithm and the objective function to obtain the second analytical model; Wherein, the number of samples used by the first gradient descent algorithm in each iteration is less than the number of samples used by the second gradient descent algorithm in each iteration.

[0050] Optionally, based on the attack chain pattern of advanced persistent threats (such as the MITRE ATT&CK framework), the extraction of attack signatures should target the key behaviors at each stage: in the initial access stage, analyze the abnormal email headers or vulnerability exploitation characteristics of spear-phishing emails (such as Log4j JNDI injection); in the lateral movement stage, monitor abnormal SMB / RDP connections and the characteristics of internal network scanning tools; in the data penetration stage, detect abnormal traffic (such as data transmission outside of working hours) or DNS tunnel characteristics (long domain names, high-frequency requests).

[0051] Furthermore, the changes in network traffic characteristics corresponding to attack signatures are analyzed, and the content of attack signatures is quantified and standardized in order to establish a network traffic list of attack signatures.

[0052] Optionally, the expression for the linear regression model is as follows: ; in, In the first Predicting attack results based on network traffic characteristics. For the error constant term, For the first Parameters of network traffic that are attack signatures. For the first One attack signature item for network traffic; This represents the number of groups of network traffic sample data for attack characteristics.

[0053] The objective function expression is: ; in, To predict the relationship between attack results and actual results based on attack characteristics and network traffic patterns. The number of groups of network traffic sample data for attack characteristics. In the first The attack signature item is network traffic. Predict attack results using sample data. For the first Group attack signature network traffic sample data.

[0054] Optionally, the linear regression model is trained based on the first gradient descent algorithm / second gradient descent algorithm and the objective function, and the parameter update equation expression of the linear regression model is determined as follows: ; in, For the first Update parameters for network traffic of each attack signature item. The step size.

[0055] Optionally, the expressions for the first gradient descent algorithm and the second gradient descent algorithm are the same, the difference being the number of samples used.

[0056] Understandably, this application analyzes the attack chain patterns of advanced persistent threats. By extracting attack feature network traffic, the relationship between attack feature network traffic and successful attacks can be effectively established. In particular, for routine predictions, the mini-batch gradient descent algorithm is used, which can reduce the number of samples traversed, reduce the algorithm's iteration time, and minimize the impact on system efficiency. For fixed-time full detection mode, without considering the algorithm's iteration time and system efficiency, the gradient descent algorithm requires traversing all sample data to prevent deviations in the final result due to minor errors. The difference between the mini-batch gradient descent algorithm and the gradient descent algorithm lies in the setting of values.

[0057] As one embodiment, after obtaining the analysis results output by the analysis model, the method further includes: If the analysis results indicate the existence of an advanced persistent threat, determine the target network traffic information corresponding to the advanced persistent threat; Based on the target network traffic information, target log information is determined to enable threat tracing and attack chain analysis.

[0058] Optionally, by analyzing the model's results and the parameter values ​​of attack signature network traffic, parameter values ​​with significant changes can be filtered out to find the corresponding attack signature network traffic information. Combined with the specific information of abnormal network traffic recorded by the clustering algorithm, the corresponding network traffic logs, system logs, file receiving logs, and other network traffic information can be found to determine the abnormal time and abnormal operation, thereby promptly addressing the risks of advanced persistent threats.

[0059] Furthermore, the analysis model is a machine learning model. When traffic anomalies are confirmed, the threat levels and nature of different types of traffic anomalies may be completely different. Clustering algorithms can only point out that a certain traffic behavior deviates from the normal pattern, but cannot explain which specific attack the anomaly corresponds to. By analyzing the parameter values ​​in the machine learning model, the abstract anomaly can be concretized into one or more specific attack patterns. The magnitude of the parameter value changes directly reflects the weight or confidence of the corresponding attack feature in this threat assessment. By filtering out parameter values ​​with significant changes, the core evidence that can most prove the occurrence of the attack can be accurately located from massive network data. APT attacks are a multi-stage process. By analyzing multiple significantly changing parameter values, the attack features corresponding to the parameter values ​​can be linked together, thereby reconstructing the attacker's complete attack chain and understanding their attack intent and path.

[0060] It is understood that, when the analysis results indicate the existence of an advanced persistent threat, this application determines the target network traffic information corresponding to the advanced persistent threat in order to achieve threat tracing and attack chain analysis, and can track and process abnormal network traffic information that triggers early warning.

[0061] As an example, the method for analyzing advanced persistent threats provided in this application further includes the following steps: Based on the abnormal network traffic information and the first / second analysis results, an advanced persistent threat defense library is constructed.

[0062] Optionally, the Advanced Persistent Threat Defense Library is used to record, organize, and analyze historical and daily network traffic data. It can also create daily visualization charts based on network traffic data, and may include the following steps: Based on standardized test data of virtual machines and network traffic characteristic data, a daily visualization chart of changes was created, and all network traffic characteristic data was recorded. Based on the clustering results, a visual chart showing the changes in daily network traffic characteristics was created, and all abnormal network traffic information was recorded. Advanced persistent threat prediction is performed on the abnormal network traffic information detected daily by the analysis model. The prediction results and parameter matrix of the analysis model are recorded and listed in a table. Based on the newly discovered advanced persistent threat attack chain patterns, the attack characteristics and related parameters of network traffic features and machine learning algorithm models are updated; Based on the Advanced Persistent Threat (APPT) defense library, a fixed-time full detection mode is established. By importing all historical abnormal network traffic information into the analysis model, comprehensive APPT detection and prediction are performed to detect the existence of long-term APPT threats, and the prediction results and related parameters are recorded.

[0063] Optionally, the daily visualization chart is a comparative diagram of standard data and actual data. By comparing the two in the same chart (for example, plotting two curves with time on the horizontal axis and key traffic characteristics on the vertical axis), the deviation and trend of real network behavior from the gold standard baseline can be intuitively reflected, thereby helping security personnel to quickly detect abnormal fluctuations.

[0064] Optionally, the visualization chart is directly related to the clustering results, and its core purpose is to intuitively display the abnormal information in the clustering results.

[0065] Optionally, the abnormal network traffic information filtered by the clustering algorithm every day can be used as input and directly fed into the pre-trained analysis machine learning model. The analysis machine learning model will run automatically and output a prediction result (e.g., "APT threat exists" or "APT threat does not exist") and a parameter matrix (reflecting the contribution of different attack characteristics to this prediction). The prediction result and parameter matrix automatically output by the model will be directly recorded in the database and displayed in the form of tables for subsequent auditing, tracing and model optimization.

[0066] Understandably, this application establishes an advanced persistent threat (APS) defense database, which enables long-term APS detection through comprehensive APS detection and prediction.

[0067] The advanced persistent threat analysis apparatus provided in the embodiments of this application will be described below. The advanced persistent threat analysis apparatus described below and the advanced persistent threat analysis method described above can be referred to in correspondence.

[0068] Reference Figure 2 This application provides an analysis apparatus for advanced persistent threats, comprising: The determination module 210 is used to filter the daily granular network traffic information of the target device based on the clustering algorithm to determine abnormal network traffic information; Analysis module 220 is used to input the abnormal network traffic information into a first analysis model to obtain a first analysis result output by the first analysis model, and input historical abnormal network traffic information into a second analysis model at a preset time point to obtain a second analysis result output by the first analysis model. Both the first analysis result and the second analysis result are used to characterize whether an advanced persistent threat exists. The training methods for the first analysis model and the second analysis model are different.

[0069] As an example, the first analysis model and the second analysis model are determined based on the following method: Based on the attack chain pattern of advanced persistent threats, the attack characteristics of the advanced persistent threats are determined, and a network traffic list corresponding to the attack characteristics is constructed. Based on the aforementioned network traffic list, a linear regression model and objective function are constructed; The linear regression model is trained based on the first gradient descent algorithm and the objective function to obtain the first analytical model; The linear regression model is trained based on the second gradient descent algorithm and the objective function to obtain the second analytical model; Wherein, the number of samples used by the first gradient descent algorithm in each iteration is less than the number of samples used by the second gradient descent algorithm in each iteration.

[0070] As one embodiment, it also includes: The tracing module is used to determine the target network traffic information corresponding to the advanced persistent threat when the analysis results indicate the existence of such a threat; and to determine the target log information based on the target network traffic information to achieve threat tracing and attack chain analysis.

[0071] As one embodiment, the determining module 210 is further configured to: Based on the clustering algorithm, the daily granular network traffic information of the target device is clustered to obtain network traffic information with at least one type of network traffic characteristics. Based on the network traffic security boundaries corresponding to various network traffic characteristics, network traffic information exceeding the network traffic security boundaries is regarded as abnormal network traffic information.

[0072] As an example, the network traffic security boundary is determined based on the following method: Based on historical daily-level network traffic information, the historical cluster centers, historical clustering objective functions, and historical cluster center update functions for various network traffic characteristics are determined. Based on the historical cluster centers, the historical clustering objective function, and the historical cluster center update function, the network traffic security boundaries for various network traffic characteristics are determined.

[0073] As one embodiment, it also includes: A construction module is used to build an advanced persistent threat defense library based on the abnormal network traffic information and the first analysis result / second analysis result.

[0074] Figure 3 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 3 As shown, the electronic device may include: a processor 310, a communication interface 320, a memory 330, and a communication bus 340, wherein the processor 310, the communication interface 320, and the memory 330 communicate with each other via the communication bus 340. The processor 310 can call computer programs in the memory 330 to execute steps of advanced persistent threat analysis methods, including: Clustering algorithms are used to filter daily-level network traffic information of target devices to identify abnormal network traffic information; The abnormal network traffic information is input into the first analysis model to obtain the first analysis result output by the first analysis model. At a preset time point, the historical abnormal network traffic information is input into the second analysis model to obtain the second analysis result output by the first analysis model. Both the first analysis result and the second analysis result are used to characterize whether there is an advanced persistent threat. The training methods for the first analysis model and the second analysis model are different.

[0075] Furthermore, the logical instructions in the aforementioned memory 330 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0076] On the other hand, this application also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can perform the steps of the advanced persistent threat analysis method provided in the above embodiments, including: Clustering algorithms are used to filter daily-level network traffic information of target devices to identify abnormal network traffic information; The abnormal network traffic information is input into the first analysis model to obtain the first analysis result output by the first analysis model. At a preset time point, the historical abnormal network traffic information is input into the second analysis model to obtain the second analysis result output by the first analysis model. Both the first analysis result and the second analysis result are used to characterize whether there is an advanced persistent threat. The training methods for the first analysis model and the second analysis model are different.

[0077] On the other hand, embodiments of this application also provide a processor-readable storage medium storing a computer program for causing a processor to perform the steps of the methods provided in the above embodiments, including: Clustering algorithms are used to filter daily-level network traffic information of target devices to identify abnormal network traffic information; The abnormal network traffic information is input into the first analysis model to obtain the first analysis result output by the first analysis model. At a preset time point, the historical abnormal network traffic information is input into the second analysis model to obtain the second analysis result output by the first analysis model. Both the first analysis result and the second analysis result are used to characterize whether there is an advanced persistent threat. The training methods for the first analysis model and the second analysis model are different.

[0078] The processor-readable storage medium can be any available medium or data storage device that the processor can access, including but not limited to magnetic memory (e.g., floppy disk, hard disk, magnetic tape, magneto-optical disk (MO)), optical memory (e.g., CD, DVD, BD, HVD), and semiconductor memory (e.g., ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)).

[0079] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0080] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0081] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for analyzing advanced persistent threats, characterized in that, include: Clustering algorithms are used to filter daily-level network traffic information of target devices to identify abnormal network traffic information; The abnormal network traffic information is input into the first analysis model to obtain the first analysis result output by the first analysis model. At a preset time point, the historical abnormal network traffic information is input into the second analysis model to obtain the second analysis result output by the first analysis model. Both the first analysis result and the second analysis result are used to characterize whether there is an advanced persistent threat. The training methods for the first analysis model and the second analysis model are different.

2. The method for analyzing advanced persistent threats according to claim 1, characterized in that, The first analysis model and the second analysis model were determined based on the following methods: Based on the attack chain pattern of advanced persistent threats, the attack characteristics of the advanced persistent threats are determined, and a network traffic list corresponding to the attack characteristics is constructed. Based on the aforementioned network traffic list, a linear regression model and objective function are constructed; The linear regression model is trained based on the first gradient descent algorithm and the objective function to obtain the first analytical model; The linear regression model is trained based on the second gradient descent algorithm and the objective function to obtain the second analytical model; Wherein, the number of samples used by the first gradient descent algorithm in each iteration is less than the number of samples used by the second gradient descent algorithm in each iteration.

3. The method for analyzing advanced persistent threats according to claim 2, characterized in that, After obtaining the analysis results output by the analysis model, the method further includes: If the analysis results indicate the existence of an advanced persistent threat, determine the target network traffic information corresponding to the advanced persistent threat; Based on the target network traffic information, target log information is determined to enable threat tracing and attack chain analysis.

4. The method for analyzing advanced persistent threats according to claim 1, characterized in that, The process of filtering daily-level network traffic information of target devices based on clustering algorithms to identify abnormal network traffic information includes: Based on the clustering algorithm, the daily granular network traffic information of the target device is clustered to obtain network traffic information with at least one type of network traffic characteristics. Based on the network traffic security boundaries corresponding to various network traffic characteristics, network traffic information exceeding the network traffic security boundaries is regarded as abnormal network traffic information.

5. The method for analyzing advanced persistent threats according to claim 4, characterized in that, The network traffic security boundary is determined based on the following method: Based on historical daily-level network traffic information, the historical cluster centers, historical clustering objective functions, and historical cluster center update functions for various network traffic characteristics are determined. Based on the historical cluster centers, the historical clustering objective function, and the historical cluster center update function, the network traffic security boundaries for various network traffic characteristics are determined.

6. The method for analyzing advanced persistent threats according to any one of claims 1-3, characterized in that, Also includes: Based on the abnormal network traffic information and the first / second analysis results, an advanced persistent threat defense library is constructed.

7. An analysis device for advanced persistent threats, characterized in that, include: The determination module is used to filter daily-granular network traffic information of target devices based on clustering algorithms to identify abnormal network traffic information; The analysis module is used to input the abnormal network traffic information into the first analysis model to obtain the first analysis result output by the first analysis model, and to input the historical abnormal network traffic information into the second analysis model at a preset time point to obtain the second analysis result output by the first analysis model. Both the first analysis result and the second analysis result are used to characterize whether there is an advanced persistent threat. The training methods for the first analysis model and the second analysis model are different.

8. An electronic device comprising a processor and a memory storing a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the advanced persistent threat analysis method according to any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the advanced persistent threat analysis method as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the advanced persistent threat analysis method according to any one of claims 1 to 6.

Images