APT attack behavior identification method and system based on causal sequence embedding

Abstract

The invention provides an APT attack behavior identification method and system based on causal sequence embedding. The method comprises the following steps: generating a time sequence event stream sorted according to time for a multi-source system log; based on the generated time sequence event flow, constructing a directed causal traceability graph, extracting attack related sub-graphs through graph search, and abstractly combining nodes with isomorphic structures to obtain simplified attack sub-graphs; converting the simplified attack sub-graph into a triple sequence sorted according to time, and generating a time sequence attack event sequence; carrying out abstraction processing and sample balance on the time sequence attack event sequence, and inputting the time sequence attack event sequence into a Transform model for training to obtain an attack detection model; and predicting an input event sequence by using the attack detection model, and identifying an APT attack behavior. The method can improve the accuracy and interpretability of APT attack detection by fusing causal graph modeling and deep learning technologies, and is suitable for hidden attack behavior recognition tasks in a large-scale log environment.

Description

Technical Field

[0001] This invention relates to the field of security protection equipment technology, and in particular to an APT attack behavior identification method and system based on causal sequence embedding. Background Technology

[0002] Advanced Persistent Threats (APTs) are cyberattacks that involve long-term, covert, and multi-stage infiltration of specific targets. Their attack chains typically span months or even years, exhibiting high levels of stealth and persistence. Traditional APT attack detection methods primarily rely on anomaly detection techniques. This involves establishing a baseline of normal behavior through machine learning or statistical methods, comparing real-time collected logs, traffic, process relationships, and other data with this baseline, scoring deviations from the baseline, and identifying suspicious activity if the deviation exceeds a threshold.

[0003] However, APT attacks are often scattered across a large number of system logs, and existing technologies struggle to effectively link these discrete log entries into a complete attack chain in chronological order, leading to gaps in the tracing process. Secondly, in real-time detection scenarios, the amount of log data can reach millions, making it extremely difficult to accurately identify real attack behaviors. Furthermore, existing detection models largely rely on known attack characteristics and lack interpretability for zero-day vulnerabilities or unknown attack tactics, making it difficult for analysts to perform effective logical deductions and hypothesis verification based on model outputs.

[0004] In recent years, APT detection methods based on attribution graphs have gradually become a research hotspot. For example, the SLEUTH model parses commercial off-the-shelf (COTS) audit logs into a platform-independent memory dependency graph in real time, triggers alerts by combining label propagation strategies and lightweight detection rules, and generates a visual attack chain using bidirectional graph search and graph compression techniques. Although this method has made some progress in attack scenario reconstruction, it still faces many challenges: on the one hand, log data is massive and unstructured, making it difficult to extract effective information and construct accurate attribution graphs; on the other hand, the generated graph structure is large in scale, and the graph traversal process consumes a lot of computing resources, making it difficult to deploy efficiently in real production environments. In addition, the long-term latency of APT attacks makes deep learning models susceptible to "data poisoning," leading to drift in detection boundaries and persistently high false positive and false negative rates.

[0005] Therefore, existing hooks need to be improved to overcome the shortcomings of the existing technology. Summary of the Invention

[0006] To overcome the problems existing in related technologies, one of the objectives of this invention is to provide an APT attack behavior identification method based on causal sequence embedding. This APT attack behavior identification method based on causal sequence embedding can improve the accuracy of elevator machine room noise identification and judgment, thereby enabling timely detection of whether the elevator has experienced wire breakage, which helps to ensure the safe operation of the elevator.

[0007] A method for identifying APT attack behaviors based on causal sequence embedding includes: Preprocess multi-source system logs to generate time-series event streams ordered by time; Based on the generated time-series event stream, a directed causal origin graph is constructed. Attack-related subgraphs are extracted through graph search, and nodes with structural isomorphism are abstracted and merged to obtain a simplified attack subgraph. The simplified attack subgraph is converted into a time-sorted sequence of triples to generate a time-series attack event sequence. The sequence of temporal attack events is abstracted and balanced, and then fed into the Transformer model for training to obtain the attack detection model. An attack detection model is used to predict the input event sequence and identify APT attack behaviors.

[0008] In a preferred embodiment of the present invention, the preprocessing of multi-source system logs includes: Extract timestamps, process information, network connection details, and key file access fields from DNS logs, HTTP logs, and operating system audit logs from different sources, and parse them into a unified CSV format; Map discrete timestamps to globally continuous time-series identifiers; Each log record is labeled with a binary malicious tag to inject weak supervision signals.

[0009] In a preferred embodiment of the present invention, the step of constructing a directed causal origination graph based on the generated time-series event stream includes: Receive a standardized preprocessed time-series event stream, the event stream containing structured event records from multi-source system logs; Initialize a multidirected graph, and dynamically add nodes representing system entities and edges representing causal relationships between entities to the graph based on the event records in the event stream; Using a pre-defined malicious entity as a seed node, a graph search algorithm is executed in the multi-directed graph to extract an attack behavior subgraph containing the seed node and its causal related nodes. The attack behavior subgraph is simplified by abstracting and merging specified node types based on the principle of structural isomorphism to generate a simplified causal origin graph.

[0010] In a preferred embodiment of the present invention, the step of dynamically adding nodes representing system entities and edges representing causal relationships between entities to the graph based on event records in the event stream includes: Identify processes, files, domains, IP addresses, and sessions appearing in the logs as different types of nodes, and assign type and timestamp attributes to each node; Based on the operation type in the event log, directed edges with type and timestamp attributes are established between the corresponding nodes. The operation type includes at least one of the following: DNS resolution, Web request, process spawning, file read / write, and network connection.

[0011] In a preferred embodiment of the present invention, the step of performing a graph search algorithm in the multi-directed graph to extract an attack behavior subgraph containing the seed node and its causal association nodes includes: Use the seed nodes as the initial set; The set is iteratively expanded. In each iteration, the predecessor and successor nodes of all nodes in the set are added to the set until the set no longer expands. At this point, all nodes in the set and the edges connecting these nodes constitute the attack behavior subgraph. In the attack behavior subgraph, heuristic rules are applied to identify potential attack chain endpoints as candidate root nodes; the heuristic rules are used to filter out nodes of type process, whose process names contain a specific suffix and whose out-degree is zero.

[0012] In a preferred embodiment of the present invention, the abstract merging of specified node types based on the principle of structural isomorphism includes: Merge the first type of nodes, which are session nodes, under the condition that the session nodes have the same IP address, the same adjacency structure, and the same edge type; and merge the second type of nodes, which are file nodes, under the condition that the file nodes have an in-degree and an out-degree of 1, and that their predecessor and successor nodes are the same.

[0013] In a preferred embodiment of the present invention, the step of converting the simplified attack subgraph into a time-ordered sequence of triples to generate a temporal attack event sequence includes: Read the graph structure file of the attack subgraph and sort it in ascending order by the timestamp attribute of the edges; format each edge into a triple of "source node operation type target node" or "target node operation type source node" according to the active or passive attribute of the operation type; Output all triples as an ordered text sequence.

[0014] In a preferred embodiment of the present invention, the step of abstracting and balancing the sequence of temporal attack events and inputting it into a Transformer model for training to obtain an attack detection model includes: Obtain a sequence of temporal attack events derived from a causal graph, wherein the sequence is composed of multiple "entity-operation-entity" triples in chronological order; The sequence of time-series attack events is abstracted, and the specific entities in the sequence are mapped to abstract categories with behavioral semantics in order to reduce data complexity and improve the generalization ability of the model. To alleviate the class imbalance problem, sample balancing is performed on the abstracted sequence dataset. Using the balanced dataset, a sequence classification model based on the Transformer architecture is trained to obtain an attack detection model for recognizing APT attack behaviors.

[0015] In a preferred embodiment of the present invention, after predicting the input event sequence using an attack detection model and identifying APT attack behavior, the process includes: The system receives the prediction results output by the attack detection model, which are used to indicate whether the time-series event sequence to be detected is an APT attack; wherein the probability value of the time-series event sequence being determined to be malicious is... When the probability value exceeds a preset threshold, it is determined that an APT attack has occurred, and an alarm message is output.

[0016] A second objective of this invention is to provide an APT attack behavior identification system based on causal sequence embedding, for implementing the APT attack behavior identification method based on causal sequence embedding as described above.

[0017] The system includes: The log preprocessing module is used to standardize multi-source system logs and generate time-series event streams; The causal graph construction and simplification module is used to construct and simplify the directed causal origination graph based on the event flow to obtain the attack subgraph. A sequence generation module is used to convert the attack subgraph into a sequence of temporal attack events; The model training and detection module is used to train and predict the sequence using the Transformer model to achieve APT attack identification.

[0018] The beneficial effects of this invention are as follows: This invention provides a method and system for identifying APT attack behavior based on causal sequence embedding. The method includes: preprocessing multi-source system logs to generate a time-series event stream ordered by time; constructing a directed causal origination graph based on the generated event stream, extracting attack-related subgraphs through graph search, and abstracting and merging structurally isomorphic nodes to obtain a simplified attack subgraph; converting the simplified attack subgraph into a time-series triple sequence to generate a time-series attack event sequence; abstracting and balancing the time-series attack event sequence, and inputting it into a Transformer model for training to obtain an attack detection model; and using the attack detection model to predict the input event sequence and identify APT attack behavior. This method significantly improves detection accuracy through a dual-dimensional optimization of "causal modeling + temporal deep learning". On the one hand, causal graph construction accurately captures the logical dependencies between events through preset rules and time window constraints, eliminating the interference of pseudo-associations that are "temporally adjacent but causally unrelated." On the other hand, the multi-head self-attention mechanism of the Transformer model can simultaneously focus on the local key steps and global temporal features of the attack chain. The algorithm balances the sample distribution, effectively solving the problem of overfitting with small samples and reducing the false alarm rate of the system. In addition, the method breaks through the detection barrier of "time-dispersed and behavior-concealed" APT attacks through causal association modeling. Causal graph construction is not limited by short-term time. Through "abnormal event tracing + full-cycle causal association," attack steps across cycles can be linked into a complete attack chain. By capturing the causal association of "abnormal privilege escalation and access to sensitive resources," attack behaviors without clear malicious characteristics can be accurately identified.

[0019] This application also provides a system for implementing the causal sequence embedding-based APT attack behavior identification method described above. This system can efficiently and accurately identify APT attack chains from massive logs through the above method, thereby improving detection accuracy and interpretability. Attached Figure Description

[0020] Figure 1 This is a flowchart of an APT attack behavior identification method based on causal sequence embedding provided in an embodiment of the present invention; Figure 2 This is a flowchart illustrating how to obtain the simplified attack subgraph provided in an embodiment of the present invention; Figure 3 This is a logic diagram of the APT attack behavior identification method based on causal sequence embedding provided in the embodiments of the present invention. Detailed Implementation

[0021] Preferred embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While preferred embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that the invention will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

[0022] In recent years, APT detection methods based on attribution graphs have gradually become a research hotspot. For example, the SLEUTH model parses commercial off-the-shelf (COTS) audit logs into a platform-independent memory dependency graph in real time, triggers alarms by combining label propagation strategies and lightweight detection rules, and generates a visual attack chain using bidirectional graph search and graph compression techniques. Although this method has made some progress in attack scenario reconstruction, it still faces many challenges: on the one hand, log data is massive and unstructured, making it difficult to extract effective information and construct an accurate attribution graph; on the other hand, the generated graph structure is large in scale, and the graph traversal process consumes a lot of computing resources, making it difficult to deploy efficiently in real production environments. In addition, the long-term latency of APT attacks makes deep learning models susceptible to "data poisoning," leading to detection boundary drift and high false positive and false negative rates. Based on this, this application provides an APT attack behavior identification method based on causal sequence embedding.

[0023] Example 1 like Figures 1-3 As shown in the figure, this embodiment provides an APT attack behavior identification method based on causal sequence embedding, including: S100. Preprocess the multi-source system logs to generate a time-series event stream ordered by time. Specifically, the preprocessing of multi-source system logs includes: Extract timestamps, process information, network connection details, and key file access fields from DNS logs, HTTP logs, and operating system audit logs from different sources, and parse them into a unified CSV format; Map discrete timestamps to globally continuous time-series identifiers; Each log record is labeled with a binary malicious tag to inject weak supervision signals.

[0024] The specific process for this step is as follows: Parse raw DNS logs, HTTP logs, and Windows / Linux audit logs to extract key fields, including: timestamp, process PID, parent process PPID, process image name, source / destination IP address, port number, operation type (e.g., read, write, execute, connect), and object path (e.g., file path, domain name). Convert this information into a unified CSV format, with each field clearly labeled.

[0025] Timestamp mapping: Discrete timestamps from different systems and with varying formats are uniformly mapped to a cumulative number of seconds starting from 00:00:00 on January 1st of the current year, with an event sequence number and log type identifier (e.g., DNS_001, AUDIT_002) appended to the end. Here, DNS represents query / response logs from the Domain Name System server; AUDIT represents security audit logs from Windows or Linux operating systems; 001 represents the first DNS log entry within the current second, with sequence number 001; 002 represents the second AUDIT log entry within the current second, with sequence number 002. This forms a globally continuous and comparable time sequence identifier. For example, 2023-05-15 14:30:01 might be mapped to 11718001_AUDIT.

[0026] Injecting weak supervisory signals: The system reads a list file of malicious entities (such as malicious_labels.txt, which lists known malicious IPs, malicious file hashes, or malicious domains) generated from external threat intelligence or initial analysis. When generating the CSV event stream, the system checks whether the entities (such as process names, IPs, and file paths) in each record match this list. If a match is found, the record is marked with a 1 (malicious); otherwise, it is marked with a 0 (benign). This process injects crucial weak supervisory signals for subsequent training.

[0027] S200. Based on the generated time-series event stream, construct a directed causal origination graph, extract attack-related subgraphs through graph search, and abstract and merge structurally isomorphic nodes to obtain a simplified attack subgraph. Specifically, the construction of a directed causal origination graph based on the generated time-series event stream includes: S201. Receive a standardized preprocessed time-series event stream, the event stream containing structured event records from multi-source system logs; S202. Initialize a multidirected graph, and dynamically add nodes representing system entities and edges representing causal relationships between entities to the graph based on the event records in the event stream. In this step, processes, files, domain names, IP addresses, and sessions appearing in the logs are identified as different types of nodes, and each node is assigned a type and timestamp attribute; Based on the operation type in the event log, directed edges with type and timestamp attributes are established between the corresponding nodes. The operation type includes at least one of the following: DNS resolution, Web request, process spawning, file read / write, and network connection.

[0028] The specific steps are as follows: Initialize an empty multidirected graph G=(V,E). Traverse the time-series event stream generated in step S100, mapping each record to a node and directed edge in the graph. Identify processes, files, domain names, IP addresses, sessions, etc., appearing in the logs as different types of nodes, assigning each node a type and timestamp attribute. Based on the operation type in the event record, establish directed edges between the corresponding nodes. The edge types include, but are not limited to: DNS resolution (domain name → IP), Web request (Web object → domain name), process spawning (child process → parent process), file read / write (process...). Files), network connections (processes) Each edge also records its type and timestamp, such as IP address.

[0029] S203. Using a preset malicious entity as a seed node, execute a graph search algorithm in the multi-directed graph to extract an attack behavior subgraph containing the seed node and its causal related nodes. The specific steps are as follows: Use the seed nodes as the initial set; The set is iteratively expanded. In each iteration, the predecessor and successor nodes of all nodes in the set are added to the set until the set no longer expands. At this point, all nodes in the set and the edges connecting these nodes constitute the attack behavior subgraph. For example: Using a known malicious entity (such as a tagged malicious file virus.exe) as the seed node v_seed, and using this node as the initial set S0, perform breadth-first search (BFS) to expand the graph. The iterative process is as follows: S k+1 =S k ∪{pred(v)|v∈S k}∪{succ(v)|v∈S k}, that is, in each iteration, the predecessor and successor nodes of all nodes in the current set are added to the set, until the set no longer expands (S). k+1 =S k At this point, set S k All nodes and the edges connecting them constitute the attack behavior subgraph G_sub.

[0030] Applying heuristics in G_sub (v) Identify potential attack chain endpoints (candidate root nodes). This rule is defined as: (v):=(type(v)=process)∧('.exe'∈v)∧(out_degree(v)=0) is used to filter out executable process nodes without subsequent operations, which are often the final payload of the attack.

[0031] In the attack behavior subgraph, heuristic rules are applied to identify potential attack chain endpoints as candidate root nodes; the heuristic rules are used to filter out nodes of type process, whose process names contain a specific suffix and whose out-degree is zero.

[0032] S204. Simplify the attack behavior subgraph by abstracting and merging specified node types based on the principle of structural isomorphism to generate a simplified causal origin graph.

[0033] Specifically, the abstract merging of specified node types based on the structural isomorphism principle includes: Merge session nodes: Identify all session nodes and merge nodes with the same IP address, identical adjacency structure (same predecessor and successor nodes), and the same edge type into a single supernode.

[0034] Merge temporary file nodes: Identify all file nodes and merge those that satisfy the condition that both their in-degree and out-degree are 1, and that their predecessor and successor nodes are the same node. These types of nodes are typically used as temporary files in data channels.

[0035] After simplification, a simplified causal origin graph G_root_abstract is obtained, which retains the core logic chain of the attack while eliminating a large amount of redundant information.

[0036] S300. Convert the simplified attack subgraph into a time-sorted triple sequence to generate a time-series attack event sequence. This step specifically includes: Read the graph structure file of the attack subgraph and sort it in ascending order by the timestamp attribute of the edges; format each edge into a triple of "source node operation type target node" or "target node operation type source node" according to the active or passive attribute of the operation type; Output all triples as an ordered text sequence.

[0037] The specific implementation is as follows: Read the simplified graph structure file (e.g., DOT format) and sort it in ascending order by the timestamp attribute of the edges. Based on the semantics of the operation type, format each edge as a triple. For "active" operations such as `read` and `execute`, the format is "source node operation type target node"; for "passive" or "received" operations such as `bind`, the format is "target node operation type source node". Finally, output all triples in chronological order as an ordered text sequence file (e.g., `attack_sequence.txt`), which is a linear representation of the attack behavior.

[0038] S400. The sequence of time-series attack events is abstracted and balanced, and then input into the Transformer model for training to obtain the attack detection model. The specific steps are as follows: Obtain a sequence of temporal attack events derived from a causal graph, wherein the sequence is composed of multiple "entity-operation-entity" triples in chronological order; The sequence of temporal attack events is abstracted by mapping specific entities in the sequence to abstract categories with behavioral semantics, thereby reducing data complexity and improving the model's generalization ability. Semantic abstraction is also performed on the names of specific entities in the triple sequence. For example, the file path c:\users\john\malware.exe is mapped to user_process based on the keyword "users"; the IP address 192.168.1.100 is mapped to private_ip. This step narrows the vocabulary, highlights behavioral patterns, and improves the model's generalization ability to unknown variant attacks.

[0039] The abstracted sequence dataset undergoes sample balancing to alleviate class imbalance. A hierarchical resampling strategy is employed to address extreme class imbalances common in log data. For the majority of benign sequences, their string-based edit distance is calculated. If the similarity exceeds a preset threshold (e.g., 95%), they are considered redundant samples and removed, retaining only the core patterns. For the minority of malicious sequences, their numbers are expanded through cyclic replication until they are roughly equal to the number of benign sequences.

[0040] Using the balanced dataset, a sequence classification model based on the Transformer architecture is trained to obtain an attack detection model for recognizing APT attack behaviors.

[0041] Using a balanced dataset, a sequence classification model based on the Transformer architecture is trained. The model converts the input sequence into vectors through word embedding layers and positional encoding layers, captures global dependencies within the sequence using the self-attention mechanism of a multi-layer Transformer encoder, and finally outputs a malicious probability between 0 and 1 through global average pooling layers and fully connected layers. The model is trained end-to-end using a binary cross-entropy loss function and the Adam optimizer, and is ultimately saved as apt_detector.model.

[0042] S500 uses an attack detection model to predict the input event sequence and identify APT attack behaviors.

[0043] In this step, steps S100 to S300 are executed in real time on a new log stream to be analyzed, generating a sequence of time-series events to be detected. After performing the same abstraction process on this sequence, it is input into the pre-trained apt_detector.model.

[0044] Specifically, after using the attack detection model to predict the input event sequence and identify APT attack behavior, the process includes: The system receives the prediction results output by the attack detection model, which are used to indicate whether the time-series event sequence to be detected is an APT attack; wherein the probability value of the time-series event sequence being determined to be malicious is... When the probability value exceeds a preset threshold, it is determined that an APT attack has occurred, and an alarm message is output.

[0045] The model outputs a probability value P indicating that the sequence is malicious. The system presets a judgment threshold θ (e.g., θ=0.75). When P>θ, the system automatically determines that an APT attack has occurred and immediately triggers a visual alarm on the Security Operations Center (SOC) platform interface to notify security analysts to take emergency measures.

[0046] Example 2 This embodiment provides an APT attack behavior identification system based on causal sequence embedding, used to implement the APT attack behavior identification method based on causal sequence embedding as described above.

[0047] The system includes: The log preprocessing module is used to standardize multi-source system logs and generate time-series event streams; The causal graph construction and simplification module is used to construct and simplify the directed causal origination graph based on the event flow to obtain the attack subgraph. A sequence generation module is used to convert the attack subgraph into a sequence of temporal attack events; The model training and detection module is used to train and predict the sequence using the Transformer model to achieve APT attack identification.

[0048] The system deployment process is as follows: In a specific deployment within a large enterprise network, the system employs a distributed architecture, specifically including: Log collection layer: 50 log collection nodes are deployed across the network, processing more than 1TB of raw log data daily. Data processing layer: A cluster of 3 servers is used to execute causal graph construction and sequence generation tasks in parallel. Model service layer: Uses 2 GPU servers to provide model training and inference services. Presentation layer: Provides a unified access interface for security analysts through a web platform. The system works as follows: The log collection and preprocessing module continuously collects raw logs through log collectors deployed at various network nodes. After parsing, standardization, and annotation, it generates a unified time-series event stream, which is output to the message queue in CSV format. The causal graph construction and optimization module consumes the event stream from the message queue, constructs a causal origin graph in memory, and generates a simplified attack subgraph through subgraph extraction and graph simplification operations, which is persistently stored in DOT format.

[0049] The sequence generation and conversion module reads the DOT file, generates a triplet sequence in chronological order, and outputs it in text file format. The model training and detection module, in training mode, reads historical sequence data for model training; in detection mode, it performs abstract processing and model inference on real-time sequences, outputting attack probabilities. The visualization and alerting module triggers alerts based on probability thresholds and displays detailed attack chain analysis results through a web interface.

[0050] Unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of this application. It should also be understood that, for ease of description, the dimensions of the various parts shown in the drawings are not drawn to actual scale. Techniques, methods, and devices known to those skilled in the art may not be discussed in detail, but where appropriate, such techniques, methods, and devices should be considered part of the specification. In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limitations. Therefore, other examples of exemplary embodiments may have different values. It should be noted that similar reference numerals and letters in the following drawings denote similar items; therefore, once an item is defined in one drawing, it need not be further discussed in subsequent drawings. In the description of this application, it should be understood that the orientation or positional relationship indicated by directional terms such as "front, back, up, down, left, right", "horizontal, vertical, horizontal" and "top, bottom" is usually based on the orientation or positional relationship shown in the accompanying drawings, and is only for the convenience of describing this application and simplifying the description. Unless otherwise stated, these directional terms do not indicate or imply that the device or element referred to must have a specific orientation or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation on the scope of protection of this application; the directional terms "inner" and "outer" refer to the inner and outer contours relative to the outline of each component itself.

[0051] Furthermore, it should be noted that the use of terms such as "first" and "second" to define components is merely for the purpose of distinguishing the corresponding components. Unless otherwise stated, these terms have no special meaning and therefore should not be construed as limiting the scope of protection of this application. The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention can have various modifications and variations. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for identifying APT attack behavior based on causal sequence embedding, characterized in that, include: Generate a time-series event stream from multi-source system logs; Based on the generated time-series event stream, a directed causal origin graph is constructed. Attack-related subgraphs are extracted through graph search, and nodes with structural isomorphism are abstracted and merged to obtain a simplified attack subgraph. The simplified attack subgraph is converted into a time-sorted sequence of triples to generate a time-series attack event sequence. The sequence of temporal attack events is abstracted and balanced, and then fed into the Transformer model for training to obtain the attack detection model. An attack detection model is used to predict the input event sequence and identify APT attack behaviors.

2. The APT attack behavior identification method based on causal sequence embedding according to claim 1, characterized in that: Generating a time-series event stream from multi-source system logs also includes preprocessing the multi-source system logs. Specific preprocessing includes: Extract timestamps, process information, network connection details, and key file access fields from DNS logs, HTTP logs, and operating system audit logs from different sources, and parse them into a unified CSV format; Map discrete timestamps to globally continuous time-series identifiers; Each log record is labeled with a binary malicious tag to inject weak supervision signals.

3. The APT attack behavior identification method based on causal sequence embedding according to claim 1, characterized in that: The construction of a directed causal origin graph based on the generated time-series event stream includes: Receive a standardized preprocessed time-series event stream, the event stream containing structured event records from multi-source system logs; Initialize a multidirected graph, and dynamically add nodes representing system entities and edges representing causal relationships between entities to the graph based on the event records in the event stream; Using a pre-defined malicious entity as a seed node, a graph search algorithm is executed in the multi-directed graph to extract an attack behavior subgraph containing the seed node and its causal related nodes. The attack behavior subgraph is simplified by abstracting and merging specified node types based on the principle of structural isomorphism to generate a simplified causal origin graph.

4. The APT attack behavior identification method based on causal sequence embedding according to claim 3, characterized in that: The step of dynamically adding nodes representing system entities and edges representing causal relationships between entities to the graph based on event records in the event stream includes: Identify processes, files, domains, IP addresses, and sessions appearing in the logs as different types of nodes, and assign type and timestamp attributes to each node; Based on the operation type in the event log, directed edges with type and timestamp attributes are established between the corresponding nodes. The operation type includes at least one of the following: DNS resolution, Web request, process spawning, file read / write, and network connection.

5. The APT attack behavior identification method based on causal sequence embedding according to claim 3, characterized in that: The step of performing a graph search algorithm in the multi-directed graph to extract an attack behavior subgraph containing the seed node and its causally related nodes includes: Use the seed nodes as the initial set; The set is iteratively expanded. In each iteration, the predecessor and successor nodes of all nodes in the set are added to the set until the set no longer expands. At this point, all nodes in the set and the edges connecting these nodes constitute the attack behavior subgraph. In the attack behavior subgraph, heuristic rules are applied to identify potential attack chain endpoints as candidate root nodes; the heuristic rules are used to filter out nodes of type process, whose process names contain a specific suffix and whose out-degree is zero.

6. The APT attack behavior identification method based on causal sequence embedding according to any one of claims 3-5, characterized in that: The abstract merging of specified node types based on the structural isomorphism principle includes: Merge the first type of nodes, which are session nodes, under the condition that the session nodes have the same IP address, the same adjacency structure, and the same edge type; and / or merge the second type of nodes, which are file nodes, under the condition that the file nodes have an in-degree and an out-degree of 1, and that their predecessor and successor nodes are the same.

7. The APT attack behavior identification method based on causal sequence embedding according to any one of claims 1-3, characterized in that: The step of converting the simplified attack subgraph into a time-ordered sequence of triples to generate a time-series attack event sequence includes: Read the graph structure file of the attack subgraph and sort it in ascending order by the timestamp attribute of the edges; format each edge into a triple of "source node operation type target node" or "target node operation type source node" according to the active or passive attribute of the operation type; Output all triples as an ordered text sequence.

8. The APT attack behavior identification method based on causal sequence embedding according to any one of claims 1-3, characterized in that: The process of abstracting and balancing the sequence of temporal attack events, and then inputting it into the Transformer model for training, to obtain the attack detection model, includes: Obtain a sequence of temporal attack events derived from a causal graph, wherein the sequence is composed of multiple "entity-operation-entity" triples in chronological order; The sequence of time-series attack events is abstracted, and the specific entities in the sequence are mapped to abstract categories with behavioral semantics in order to reduce data complexity and improve the generalization ability of the model. To alleviate the class imbalance problem, sample balancing is performed on the abstracted sequence dataset. Using the balanced dataset, a sequence classification model based on the Transformer architecture is trained to obtain an attack detection model for recognizing APT attack behaviors.

9. The APT attack behavior identification method based on causal sequence embedding according to any one of claims 1-3, characterized in that: After using the attack detection model to predict the input event sequence and identify APT attack behavior, the process includes: The system receives the prediction results output by the attack detection model, which are used to indicate whether the time-series event sequence to be detected is an APT attack; wherein the probability value of the time-series event sequence being determined to be malicious is... When the probability value exceeds a preset threshold, it is determined that an APT attack has occurred, and an alarm message is output.

10. An APT attack behavior identification system based on causal sequence embedding, characterized in that: Used to implement the APT attack behavior identification method based on causal sequence embedding as described in any one of claims 1-9; The system includes: The log preprocessing module is used to standardize multi-source system logs and generate time-series event streams; The causal graph construction and simplification module is used to construct and simplify the directed causal origination graph based on the event flow to obtain the attack subgraph. A sequence generation module is used to convert the attack subgraph into a sequence of temporal attack events; The model training and detection module is used to train and predict the sequence using the Transformer model to achieve APT attack identification.

Images