A real-time APT attack dynamic detection method based on traceability graph matching

Abstract

The application discloses a kind of real-time APT attack dynamic detection methods based on traceability graph matching, to solve the technical problem that APT attack is not easy to be identified, belong to computer information security technical field.The application includes the following steps: step one, by traceability graph generator component, the data collected is modeled as traceability graph and stored in data storage component, according to existing threat intelligence to generate query graph;Step two, data storage component maintains a dynamic sub-traceability graph in memory, receives data from hard disk in streaming, and data storage component inputs the dynamic sub-traceability graph to threat detection component;Step three, threat detection component calculates graph matching on the input sub-traceability graph and query graph, and transmits the result to alarm and tracking component;Step four, alarm and tracking component receives graph matching result and updates posterior probability for measuring whether there is an anomaly.

Description

Technical Field

[0001] This invention belongs to the field of computer information security technology, and specifically relates to a real-time dynamic detection method for APT attacks based on source graph matching. Background Technology

[0002] APT (Advanced Persistent Threat) is a type of attack that targets a specific group, operating covertly and gradually infiltrating the network. Attackers typically use various methods, such as malware, social engineering, or vulnerability exploitation, to silently infiltrate and control the target network. Unlike traditional attack models, APT attacks are highly stealthy and targeted; attackers usually utilize multiple techniques to continuously collect sensitive information or disrupt system operations. Due to their long latency and complex attack methods, APTs pose a far greater threat than ordinary malicious attacks. When an APT attack's Indicator of Compromise (IOC) is detected and published, enterprise security analysts need to check whether their systems have been targeted by that APT attack. Therefore, timely and accurate APT threat detection is crucial; it not only helps enterprises identify potential attack behaviors but also prevents further escalation of attacks, reducing the risk of data breaches and system damage.

[0003] Currently, to address the threat detection problem, many studies focus on graph-matching-based solutions. These solutions construct source graphs from kernel audit logs, extract malicious behaviors (such as information flow and causal dependencies) to build query graphs, and use these query graphs as robust metrics for searching. This models the threat detection problem as a graph matching problem—searching for a sub-source graph within a large source graph that contains connections similar to those specified in the query graph. The Poirot system introduces the concept of influence scores, prioritizing information flows that are costly for attackers to mitigate evasion attacks. It also proposes an approximation function and a novel similarity metric to evaluate the degree of matching between the query graph and the source graph.

[0004] The Poirot system performs well in graph matching tasks, but its limitation lies in its applicability only to static source graphs. It is a rigid graph matching computation with poor scalability, failing to meet the dynamic needs of real-time host monitoring in practical scenarios. The THREATRACE system proposes a real-time detection system for anomalous nodes, employing streaming input for dynamic monitoring and possessing stronger scalability. However, it lacks consideration for the correlation between detection results at different times, cannot accumulate detection results, and cannot effectively cope with the dispersed nature of APT attacks. Summary of the Invention

[0005] The purpose of this invention is to provide a real-time dynamic detection method for APT attacks based on source graph matching, in order to solve the technical problem that APT attacks are not easy to identify.

[0006] This invention is achieved using the following technical solution:

[0007] A real-time dynamic detection method for APT attacks based on source graph matching includes the following steps:

[0008] Step 1: Model the collected data into a source map using the source map generator component and store it in the data storage component; then generate a query map based on the existing threat intelligence.

[0009] The source map generator component is as follows:

[0010] First, kernel audit logs are extracted in real time from the host that needs to perform threat detection, and then a system-wide traceability graph with time sequence is constructed using the external tool Camflow.

[0011] Step 2: The data storage component maintains a dynamic sub-source graph in memory and streams data from the hard drive. The data storage component then inputs the dynamic sub-source graph into the threat detection component.

[0012] The data storage component is as follows:

[0013] A dynamic sub-source graph with a limited size is maintained in memory, with a maximum of 5000 edges. It consists of active nodes, related nodes, and the edges between these nodes. Active nodes are defined as nodes streamed from the disk for detection, and related nodes are nodes within two hops of the active nodes. Whenever the size of the sub-source graph meets the requirement of 5000 edges, it is immediately output to the subsequent threat detection component.

[0014] Step 3: The threat detection component performs graph matching calculations on the input sub-source graph and query graph and transmits the results to the alert and tracing component;

[0015] Step 4: The alarm and tracking component receives the graph matching results and updates the posterior probability that an anomaly exists.

[0016] In actual operation, the host system first models the log data using the source graph generator component to generate a unified source graph. Based on existing threat intelligence, a query graph is then generated. The generated source graph and query graph are subsequently stored in the data storage component, which also dynamically maintains a sub-source graph in memory with a limited size. The threat detection component performs graph matching calculations between the sub-source graph and the query graph. The alerting and tracing component dynamically reflects the likelihood of the host system being in an abnormal state based on the graph matching results.

[0017] More preferably, the threat detection component is specifically as follows:

[0018] The threat detection component receives the sub-source graph from the data storage component and performs graph matching calculations with the query graph. The specific graph matching calculations are as follows:

[0019] First, based on the entity type of the node, candidate nodes are searched in the sub-source graph for each node in the query graph;

[0020] A node is a system entity in the kernel audit log. Each system entity has an entity type that identifies the category of the entity in the system, such as process, file, socket, IP address, etc.

[0021] Then, starting from the node with the fewest candidate nodes in the query graph, a forward and backward traversal search is performed in the sub-source graph. In the sub-source graph, it is checked whether it can be connected to candidate nodes of other nodes in the query graph. During the traversal, As the traversal limit; after traversal, for a certain edge in the query graph, there may be multiple choices in the sub-source graph. In order to select the optimal alignment relationship for each node in the query graph from the candidate nodes, the optimal alignment relationship is selected for each node in the query graph in turn by a fixed function, and then the optimal alignment subgraph is generated and its graph alignment score is calculated. ;

[0022] The formula for calculating influence score is as follows:

[0023]

[0024] In the above formula, and They are all nodes in the source graph; Indicates the starting point is The destination is A directed path; Representing a path Influence score; Representing a path The minimum number of common ancestors of all nodes; express The maximum value;

[0025] The contribution of each candidate node in the sub-source graph is calculated using the following formula:

[0026]

[0027] In the above formula, Indicates querying nodes in the graph Nodes in the source graph There is an alignment relationship, that is to say yes A candidate node; Indicates the calculation of nodes in the query graph Candidate nodes in the source graph Maximum contribution value; Indicates querying nodes in the graph All outgoing edges from the starting point target node A set; This indicates a query for all pointers in the graph. Incoming edges of a node starting node A set; It is an indicator function with a value of 0 or 1, indicating that a node in the graph is being queried. Is it fixed as a node in the source graph? If the value is fixed, it is 1; otherwise, it is 0. and These represent paths in the source graph. and path Influence score yes Candidate nodes in the source graph Indicates when node When the fixation is completed The optimal candidate node in the source graph; and These represent paths in the source graph. and path Influence score yes Candidate nodes in the source graph Indicates when node When not fixed In the source graph, candidate nodes are considered; the formula aims to calculate the maximum contribution value of a candidate node, and the main body consists of two summation parts. The first summation focuses on the node... The edge sent out, the second summation focuses on the node entering. The edges; each summation term contains two parts: the first part calculates the influence score of edges with fixed nodes, and the second part calculates the influence score of edges without fixed nodes and selects the maximum value.

[0028] This calculation method evaluates a candidate node's contribution to the optimal alignment subgraph by calculating the sum of the influence scores of the outgoing and incoming edges that match the query graph in the source graph.

[0029] In order to find an alignment object for each node of the query graph in the sub-source graph, we first select nodes in the sub-source graph that are of the same type as nodes in the query graph as alignment candidates for that query node, and define them as candidate nodes.

[0030] A fixed function method is applied to calculate the contribution value of each candidate node in the sub-source graph and select the node with the largest contribution value to be fixed as the final alignment relationship.

[0031] A fixed function selects the optimal node from the set of candidate nodes in the sub-source graph for a given node in the query graph. The specific method is: first, according to the formula... Calculate the contribution value of each candidate node, and then select the candidate node with the highest contribution value and fix it as the final alignment result. Here, "optimal" means that the candidate node is more likely to satisfy the subsequent overall graph alignment relationship, thus resulting in a higher final graph alignment score.

[0032] The formula for calculating the alignment score is as follows:

[0033] ;

[0034] In the above formula, The graph alignment score represents the graph alignment result of the t-th graph. Represents a query graph The number of edges in the middle; Represents a query graph One of the paths ,in and Both queries involve nodes in the graph; This represents a path in the sub-source graph, which is a path in the query graph. The alignment path in the graph alignment result; This indicates the path The influence score is calculated by summing the influence scores of all aligned paths in the graph alignment result and dividing by the number of edges in the query graph. This result measures the degree of alignment between the query graph and the graph alignment result.

[0035] More preferably, the alarm and tracking component is specifically as follows:

[0036] First, based on normal historical samples, corresponding to the null hypothesis. And historical samples of abnormal attacks, corresponding alternative hypotheses ,use Fit the likelihood function to each distribution. and The probability distribution model; where, This represents the probability density of graph alignment scores generated when the host system is in a normal state; while This represents the probability density of the score generated when the host system is under attack; an initial prior probability is set. and As initialization and initial log-likelihood ratio:

[0037]

[0038] In the above formula, This represents the initial log-likelihood ratio; This indicates the initial probability of the anomaly existing; This represents the initial probability under normal circumstances.

[0039] Subsequently, the alerting and tracking component sequentially obtains the graph alignment score for each aligned subgraph from the threat detection component, and then calculates the conditional probability value of the graph alignment score under different assumptions based on a preset distribution function. and Then, the log-likelihood ratio of the alignment score of the graph is calculated according to the following formula:

[0040]

[0041] In the above formula, Indicates the alignment score based on the current graph. The calculated log-likelihood ratio; express In abnormal hypothesis The likelihood value below; express Under normal assumptions The likelihood value below;

[0042] Then, the values ​​of the log-likelihood ratios of the aligned fractions of the graph are accumulated to the total log-likelihood ratio using the following formula. middle:

[0043]

[0044] In the above formula, This represents the total log-likelihood ratio; This represents the initial log-likelihood ratio; Indicates the alignment score based on the current graph. The calculated log-likelihood ratio;

[0045] Finally, based on the total log-likelihood ratio This can be converted into a real-time posterior probability using the following formula:

[0046]

[0047]

[0048] This represents the natural exponential function, i.e.:

[0049]

[0050] In the above formula, This represents the total log-likelihood ratio; Indicates to pass Calculated likelihood ratio; This represents the posterior probability, specifically the alignment score of a series of observed graphs. Under these conditions, the current host system is in an abnormal state. The probability of;

[0051] Repeat the above steps: calculate the log-likelihood ratio and update the posterior probability for each matched image alignment score; dynamically update the posterior probability and compare it with a threshold; trigger an alarm immediately if the threshold is exceeded. Regarding threshold setting, the formula... middle This represents the maximum number of different entry points that an attacker is willing to independently exploit, according to the formula. The method for calculating influence score in China reveals that the influence score threshold is... The reciprocal of;

[0052] The graph alignment score is calculated by averaging all influence scores, so the influence score threshold is used as the threshold for the graph alignment score. After that, Substitute again The probability distribution model transforms the graph alignment score threshold into a threshold representing the posterior probability of whether the current state is abnormal. .

[0053] This method first uses external tools to model the log data in the host into a source graph—a labeled, categorized, and directed graph—which is then stored on disk. A dynamic sub-source graph is maintained in memory to stream data from the disk. During the detection phase, the source graph is retrieved in real time from the sub-source graph maintained in memory and matched with the query graph using a directed graph matching algorithm. For graph matching, candidate node filtering, influence scores, forward and backward expansion search, and multi-round traversal mechanisms are employed to find the optimal aligned sub-graph and calculate its graph alignment score. Subsequently, each graph alignment score is converted into a log-likelihood ratio—an accumulative and quantifiable statistical evidence—and a Bayesian update method is introduced to dynamically update the posterior probability of the system being in an anomalous state in the presence of new evidence. The posterior probability value is monitored in real time, and an alarm is triggered when it exceeds a preset threshold. During real-time monitoring of the host, this invention can instantly capture APT attack behavior trajectories and dynamically accumulate attack traces generated at different times, effectively solving the challenges of strong concealment and high real-time requirements in APT attack detection. This method can issue timely alerts before an attack is completed, thereby significantly improving the real-time performance, accuracy, and robustness of detection.

[0054] This invention optimizes the graph matching calculation of the Poirot system, combines the streaming input method of the THREATRACE system, and transforms the graph alignment score results at different times into the ingress log-likelihood ratio. The aim is to use each optimal aligned subgraph as evidence of "whether the current situation is abnormal", and accumulate each piece of evidence. Then, a Bayesian update method is introduced to update the probability of "whether the current situation is abnormal" in real time. Finally, the anomaly detection problem is abstracted into the posterior probability estimation of "whether the current situation is abnormal". Attached Figure Description

[0055] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0056] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0057] Figure 1 This is a flowchart illustrating the invention. Detailed Implementation

[0058] To better understand the above-mentioned objectives, features, and advantages of the present invention, the solutions of the present invention will be further described below. It should be noted that, unless otherwise specified, the embodiments of the present invention and the features thereof can be combined with each other.

[0059] Many specific details are set forth in the following description in order to provide a full understanding of the invention, but the invention may also be practiced in other ways different from those described herein; obviously, the embodiments in the specification are only some embodiments of the invention, and not all embodiments.

[0060] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0061] Example 1

[0062] A real-time dynamic detection method for APT attacks based on source graph matching includes the following steps:

[0063] Step 1: Model the collected data into a source map using the source map generator component and store it in the data storage component; then generate a query map based on the existing threat intelligence.

[0064] The source map generator component is as follows:

[0065] First, kernel audit logs are extracted in real time from the host that needs threat detection, and then a system-wide traceability graph with time sequence is constructed using the external tool Camflow.

[0066] The source graph generator component transforms the log data to be analyzed into a source graph. Like many other source-based threat detection methods, we use the external tool Camflow to construct a time-series source graph for the entire system.

[0067] Step 2: The data storage component maintains a dynamic sub-source graph in memory and streams data from the hard drive. The data storage component then inputs the dynamic sub-source graph into the threat detection component.

[0068] The data storage component is as follows:

[0069] A dynamic sub-source graph with a limited size is maintained in memory, with a maximum of 5000 edges. It consists of active nodes, related nodes, and the edges between these nodes. Active nodes are defined as nodes streamed from the disk for detection, and related nodes are nodes within two hops of the active nodes. Whenever the size of the sub-source graph meets the requirement of 5000 edges, it is immediately output to the subsequent threat detection component.

[0070] The data storage component is designed to allocate the source graph generated by the previous component to disk and memory for subsequent use. Simultaneously, a sub-source graph is maintained in memory, consisting of active nodes, related nodes, and the edges between them.

[0071] Step 3: The threat detection component performs graph matching calculations on the input sub-source graph and query graph and transmits the results to the alert and tracing component;

[0072] The threat detection component is as follows:

[0073] The threat detection component receives the sub-source graph from the data storage component and performs graph matching calculations with the query graph. The specific graph matching calculations are as follows:

[0074] First, based on the entity type of the node, candidate nodes are searched in the sub-source graph for each node in the query graph;

[0075] Then, starting from the node with the fewest candidate nodes in the query graph, a forward and backward traversal search is performed in the sub-source graph. In the sub-source graph, it is checked whether it can be connected to candidate nodes of other nodes in the query graph. During the traversal, As the limit of traversal, As the limit of traversal, the search complexity can be significantly reduced. After traversal, for a certain edge in the query graph, there may be multiple choices in the sub-source graph. In order to select the optimal alignment relationship for each node in the query graph from the candidate nodes, the optimal alignment relationship is selected for each node in the query graph in turn by a fixed function, and then the optimal alignment subgraph is generated and its graph alignment score is calculated. ;

[0076] The formula for calculating influence score is as follows:

[0077]

[0078] In the above formula, and They are all nodes in the source graph; Indicates the starting point is The destination is A directed path; Representing a path Influence score; Representing a path The minimum number of common ancestors of all nodes; express The maximum value;

[0079] The contribution of each candidate node in the sub-source graph is calculated using the following formula:

[0080]

[0081] In the above formula, Indicates querying nodes in the graph Nodes in the source graph There is an alignment relationship, that is to say yes A candidate node; Indicates the calculation of nodes in the query graph Candidate nodes in the source graph Maximum contribution value; Indicates querying nodes in the graph All outgoing edges from the starting point target node A set; This indicates a query for all pointers in the graph. Incoming edges of a node starting node A set; It is an indicator function with a value of 0 or 1, indicating that a node in the graph is being queried. Is it fixed as a node in the source graph? If the value is fixed, it is 1; otherwise, it is 0. and These represent paths in the source graph. and path Influence score yes Candidate nodes in the source graph Indicates when node When the fixation is completed The optimal candidate node in the source graph; and These represent paths in the source graph. and path Influence score yes Candidate nodes in the source graph Indicates when node When not fixed In the source graph, candidate nodes are considered; the formula aims to calculate the maximum contribution value of a candidate node, and the main body consists of two summation parts. The first summation focuses on the node... The edge sent out, the second summation focuses on the node entering. The edges; each summation term contains two parts: the first part calculates the influence score of edges with fixed nodes, and the second part calculates the influence score of edges without fixed nodes and selects the maximum value.

[0082] The formula for calculating the alignment score is as follows:

[0083] ;

[0084] In the above formula, The graph alignment score represents the graph alignment result of the t-th graph. Represents a query graph The number of sides in the middle; Represents a query graph One of the paths ,in and Both queries involve nodes in the graph; This represents a path in the sub-source graph, which is a path in the query graph. The alignment path in the image alignment result; This indicates the path The influence score is calculated by summing the influence scores of all aligned paths in the graph alignment result and dividing by the number of edges in the query graph. This result measures the degree of alignment between the query graph and the graph alignment result.

[0085] The threat detection component uses the sub-source graph input from the previous component as the target source graph and performs matching queries with the query graph through the graph matching calculation of this invention, aiming to find the optimal aligned sub-graph in the source graph for each query graph.

[0086] Step 4: The alarm and tracking component receives the graph matching results and updates the posterior probability that an anomaly exists.

[0087] The alarm and tracking components are as follows:

[0088] First, based on normal historical samples, corresponding to the null hypothesis. And historical samples of abnormal attacks, corresponding alternative hypotheses ,use Fit the likelihood function to each distribution. and The probability distribution model; where, This represents the probability density of graph alignment scores generated when the host system is in a normal state; while This represents the probability density of the score generated when the host system is under attack; an initial prior probability is set. and As initialization and initial log-likelihood ratio:

[0089]

[0090] In the above formula, This represents the initial log-likelihood ratio; This indicates the initial probability of the anomaly existing; This represents the initial probability under normal circumstances;

[0091] Subsequently, the alerting and tracking component sequentially obtains the graph alignment score for each aligned subgraph from the threat detection component, and then calculates the conditional probability value of the graph alignment score under different assumptions based on a preset distribution function. and Then, the log-likelihood ratio of the alignment score of the graph is calculated according to the following formula:

[0092]

[0093] In the above formula, Indicates the alignment score based on the current graph. The calculated log-likelihood ratio; express In abnormal hypothesis The likelihood value below; express Under normal assumptions The likelihood value below;

[0094] Then, the values ​​of the log-likelihood ratios of the aligned fractions of the graph are accumulated to the total log-likelihood ratio using the following formula. middle:

[0095]

[0096] In the above formula, This represents the total log-likelihood ratio; This represents the initial log-likelihood ratio; Indicates the alignment score based on the current graph. The calculated log-likelihood ratio;

[0097] Finally, based on the total log-likelihood ratio This can be converted into a real-time posterior probability using the following formula:

[0098]

[0099]

[0100] This represents the natural exponential function, i.e.:

[0101]

[0102] In the above formula, This represents the total log-likelihood ratio; Indicates to pass Calculated likelihood ratio; This represents the posterior probability, specifically the alignment score of a series of observed graphs. Under these conditions, the current host system is in an abnormal state. The probability of;

[0103] Repeat the above steps: calculate the log-likelihood ratio and update the posterior probability for each matched image alignment score; dynamically update the posterior probability and compare it with a threshold; trigger an alarm immediately if the threshold is exceeded. Regarding threshold setting, the formula... middle This represents the maximum number of different entry points that an attacker is willing to independently exploit, according to the formula. The method for calculating influence score in China reveals that the influence score threshold is... The reciprocal of;

[0104] The graph alignment score is calculated by averaging all influence scores, so the influence score threshold is used as the threshold for the graph alignment score. After that, Substitute again The probability distribution model transforms the graph alignment score threshold into a threshold representing the posterior probability of whether the current state is abnormal. .

[0105] The alerting and tracking component receives the best-aligned subgraphs from the previous component. For each best-aligned subgraph, it first calculates its graph alignment score, then calculates the log-likelihood ratio, and then updates the posterior probability.

[0106] The working principle is as follows:

[0107] In actual operation, the host system first models the log data using the source graph generator component to generate a unified source graph. Based on existing threat intelligence, a query graph is generated. The generated source graph and query graph are then stored in the data storage component, which simultaneously maintains a limited-size sub-source graph in memory. This sub-source graph consists of active nodes and related nodes within their two-hop range and is updated in real-time with the streaming input. Once the sub-source graph accumulates to a certain size, it enters the threat detection component, where it performs graph matching calculations with the query graph to find the optimal aligned sub-graph and calculate its graph alignment score. Upon entering the alerting and source tracing component, the graph alignment score is further mapped to anomaly probability, and the log-likelihood ratio of the graph alignment score is calculated to represent the relative support of the current observed evidence under the anomaly and normal assumptions. The log-likelihood ratio is then accumulated into the existing results to form the total log-likelihood ratio. Subsequently, a Bayesian update mechanism is used to transform the total log-likelihood ratio into a real-time posterior probability, thereby dynamically reflecting the possibility of the system being in an abnormal state and achieving real-time detection and assessment of potential APT threats.

[0108] Secondly, regarding graph matching, the host system streams the source graph from the in-memory maintained sub-source graph as input. First, it searches for candidate nodes in the sub-source graph for each node in the query graph, prioritizing the node with the fewest candidate nodes as the seed node and the starting point for graph traversal. Then, it performs forward and backward expansion searches from the candidate nodes of the seed node to explore whether connections can be made to other candidate nodes, combining traversal limits and multi-round traversal mechanisms to improve search efficiency. Finally, a fixed function progressively selects the optimal candidate alignment nodes for each node in the query graph, generating the optimal alignment subgraph and calculating its graph alignment score.

[0109] Specifically, it is divided into the following three stages:

[0110] I. Preparation Stage

[0111] (1) In order to convert the graph alignment score into the probability of being judged as an attack, based on normal historical samples (corresponding to the null hypothesis) ) and historical samples of abnormal attacks (corresponding to alternative hypotheses) ),use Fit the likelihood function to each distribution. and The probability distribution model. Among them, This indicates that the system generates graph alignment scores under normal conditions. The probability density; and This indicates that the system is under attack and is generating scores. The probability density of these two distributions together forms the basis of the attack discrimination likelihood based on Bayesian inference.

[0112] (2) In the initial detection phase, considering the low baseline probability of an attack occurring, the prior probability is set as follows: , As an initial setting, and the initial log-likelihood ratio is calculated.

[0113] II. Graph Matching Stage

[0114] The source graph is streamed from the in-memory maintained sub-source graph as input, and graph matching calculations are performed between the sub-source graph and the query graph, referencing the graph matching calculations in the Poirot system, to find the optimal aligned sub-graph and calculate its graph alignment score. The specific algorithm flow is as follows:

[0115] (1) For each node in the query graph, match all candidate nodes in the sub-source graph according to its entity type and store them in the candidate node set.

[0116] (2) Because the sub-source graph is large, in order to facilitate graph traversal, we choose the node with the fewest candidate nodes in the query graph as the starting point and use it as the entry point for graph traversal.

[0117] (3) Starting from the starting point, perform an extended search in the sub-source graph, traversing all candidate nodes of the starting point in the sub-source graph, and performing a series of graph traversal operations from these candidate nodes to see if it is possible to reach the candidate nodes of other nodes in the query graph found in step (1) in the sub-source graph. In order to deal with the problem of the huge size of the sub-source graph and the scattered distribution of the aligned nodes, we use the threshold of the influence score as the limit of the graph traversal.

[0118] (4) Generate the final optimal alignment subgraph. After performing the traversal in step (3), we will identify a new set of candidate alignment nodes for each node in the query graph. For example, an edge in the query graph may correspond to multiple paths in the sub-source graph, so some candidate nodes in the sub-source graph may have the same node connected by different paths. The number of alignment combinations that these candidate nodes can form in the alignment subgraph may be very large. In order to complete the search more efficiently, a fixed function is used to evaluate the maximum contribution of each candidate node to the final graph alignment score, so as to iteratively select the optimal candidate node for each node in the query graph and fix it, and finally generate the optimal alignment subgraph and calculate the graph alignment score. .

[0119] III. Alarm Phase

[0120] (1) Graph alignment score for each arrival alarm and tracking component First, based on the preset distribution function, the conditional probability values ​​under different hypotheses are calculated, that is, under the anomalous hypothesis. The likelihood value below and under normal assumptions The likelihood value below Then, the log-likelihood ratio of this observational evidence is calculated, and the results are summed into the total log-likelihood ratio. middle.

[0121] (2) Using the updated total log-likelihood ratio This is then converted into a real-time posterior probability.

[0122] (3) Repeat steps (1) to (3) above for each sub-source map of the alarm and tracking component, continuously update the posterior probability value, and trigger the alarm mechanism immediately once the posterior probability exceeds the preset alarm threshold.

[0123] In the context of today's rapid development of network technology, APT attacks, as a significant form of cybersecurity threat, are highly covert and dangerous. APT attacks are often carried out through long-term infiltration and multi-stage penetration, with highly concentrated targets and clear strategic value. During their infiltration, attackers continuously steal sensitive information, monitor system operations, and even manipulate critical resources; their attack chains are complex and difficult to detect. APT attacks can not only lead to the leakage of core data and intellectual property, but also jeopardize the normal operation of critical infrastructure, posing a serious threat to corporate interests, social stability, and national security.

[0124] Real-time APT attack dynamic detection technology based on source graph matching can solve this type of problem. This invention optimizes the Poirot graph matching calculation and combines it with the streaming input method in the THREATRACE system to achieve on-the-fly reception and processing, thereby achieving the goal of real-time monitoring of the host. By converting the graph alignment scores at different times into log-likelihood ratios, each alignment result becomes quantifiable evidence and is gradually accumulated to maintain cross-time correlation. After each accumulation of the total log-likelihood ratio, a Bayesian update method is introduced to dynamically correct the posterior probability of the system being in an abnormal state, thereby abstracting the anomaly detection problem into a probability estimate of "whether it is currently abnormal".

[0125] The specific explanation is as follows:

[0126] (1) Source graph and query graph modeling: This is a modeling method where, in order to perform graph matching computation, the kernel audit logs of the host system are modeled as a source graph, and the Indicators of Computation (IOCs) and their relationships are extracted from CTI (Cyber ​​Threat Intelligence) related to known attacks and modeled as a query graph. Source graphs and query graphs are labeled, typed, and directed graphs used in graph matching computation. In the graph, nodes represent system entities (such as files and processes), and edges represent the information flow and causal relationships between them. Through this unified modeling approach, the host system can use graph matching computation to search for the optimal alignment subgraph similar to the query graph in the source graph, thereby discovering potential attack behaviors.

[0127] (2) Alignment metrics: Influence score, used to measure the probability of an attacker generating a certain information flow and to represent the degree of edge matching in graph matching algorithms, which can effectively combat evasion attacks; Graph alignment score, which represents the average influence score of all edges in the optimal alignment subgraph, used to characterize the overall alignment degree; Fixed function, which evaluates and selects the candidate node with the largest contribution among multiple candidate nodes, thereby gradually narrowing the search space and improving matching efficiency.

[0128] (3) Log-likelihood ratio: The log-likelihood ratio is a statistic used to transform scores into evidence values ​​that can be used for statistical inference, aiming to quantify evidence. Specifically, it compares a certain score under the normal assumption... and abnormal assumptions The probability density function is used to determine the contribution of each observation score to supporting the "abnormal" hypothesis. The log-likelihood ratio (LLR) quantifies the degree of anomalousness, provides a statistically significant criterion, and can be combined with methods such as Bayesian updates to dynamically improve detection accuracy. Furthermore, cumulative LLR can progressively aggregate evidence from multiple observations, thereby improving the robustness of the detection.

[0129] (4) Bayesian Update: Bayesian update is an inference method based on Bayes' theorem, used to dynamically correct the existing prior probability distribution when new observation data arrives, thereby obtaining a more accurate posterior probability. During the detection process, we continuously update the posterior probability of the system being in an attack state based on Bayesian inference. This method provides probabilistic results, which are easy to combine with other statistical indicators, can naturally integrate multiple pieces of evidence, and help improve the scientific nature of decision-making.

[0130] The application of these security technologies helps enhance the effectiveness of APT attack detection. By applying influence scores, graph alignment scores, and selection functions, the efficiency and accuracy of graph matching calculations are effectively improved. The introduction of a streaming input mechanism enables on-demand processing, maintaining real-time response even in large-scale, complex data environments. Combining log-likelihood ratios to quantify optimally aligned subgraphs into accumulative evidence and using Bayesian updates to dynamically correct anomaly probabilities, real-time detection and probabilistic assessment of potential APT threats are achieved. This invention enables real-time monitoring and dynamic analysis of host systems, correlating evidence across attack chains over time and issuing timely warnings, thereby significantly improving the accuracy of APT attack detection and system security.

[0131] Streaming input refers to a mechanism where data is not fed into the system all at once, but rather continuously and segmentedly enters and is processed like a flowing stream. During real-time detection, the sub-source graph in memory continuously extracts nodes and edges from the larger source graph as needed. Whenever the size of the sub-source graph reaches a set threshold, this batch of incremental sub-source graphs is used as input for subsequent threat detection components. This segmented input method essentially embodies the "streaming" principle.

[0132] The above description is merely a specific embodiment of the present invention, enabling those skilled in the art to understand or implement the present invention. Although detailed descriptions have been provided with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments, and they should all be covered within the protection scope of the claims.

Claims

1. A real-time dynamic detection method for APT attacks based on source graph matching, characterized in that: Includes the following steps: Step 1: Model the collected data into a source map using the source map generator component and store it in the data storage component; then generate a query map based on the existing threat intelligence. The source map generator component is as follows: First, kernel audit logs are extracted in real time from the host that needs to perform threat detection, and then a system-wide traceability diagram with time sequence is constructed using the external tool Camflow. Step 2: The data storage component maintains a dynamic sub-source graph in memory and streams data from the hard drive. The data storage component then inputs the dynamic sub-source graph into the threat detection component. The data storage component is as follows: A dynamic sub-source graph with a limited size is maintained in memory, with a maximum of 5000 edges. It consists of active nodes, related nodes, and the edges between these nodes. Active nodes are defined as nodes that are streamed from the disk for detection, and related nodes are nodes within two hops of the active nodes. Whenever the size of the sub-source graph meets the requirement of 5000 edges, it is immediately output to the subsequent threat detection component. The threat detection component is as follows: The threat detection component receives the sub-source graph from the data storage component and performs graph matching calculations with the query graph. The specific graph matching calculations are as follows: First, based on the entity type of the node, candidate nodes are searched in the sub-source graph for each node in the query graph; Then, starting from the node with the fewest candidate nodes in the query graph, a forward and backward traversal search is performed in the sub-source graph. In the sub-source graph, it is checked whether it can be connected to candidate nodes of other nodes in the query graph. During the traversal, As the traversal limit; after traversal, for a certain edge in the query graph, there may be multiple choices in the sub-source graph. In order to select the optimal alignment relationship for each node in the query graph from the candidate nodes, the optimal alignment relationship is selected for each node in the query graph in turn by a fixed function, and then the optimal alignment subgraph is generated and its graph alignment score is calculated. ; The formula for calculating influence score is as follows: ； In the above formula, and They are all nodes in the source graph; Indicates the starting point is The destination is A directed path; Representing a path Influence score; Representing a path The minimum number of common ancestors of all nodes; express The maximum value; The contribution of each candidate node in the sub-source graph is calculated using the following formula: ； In the above formula, Indicates querying nodes in the graph Nodes in the source graph There is an alignment relationship, that is to say yes A candidate node; Indicates the calculation of nodes in the query graph Candidate nodes in the source graph Maximum contribution value; Indicates querying nodes in the graph All outgoing edges from the starting point target node A set; This indicates a query for all pointers in the graph. Incoming edges of a node starting node A set; It is an indicator function with a value of 0 or 1, indicating that a node in the graph is being queried. Is it fixed as a node in the source graph? If the value is fixed, it is 1; otherwise, it is 0. and These represent paths in the source graph. and path Influence score yes Candidate nodes in the source graph Indicates when node When the fixation is completed The optimal candidate node in the source graph; and These represent paths in the source graph. and path Influence score yes Candidate nodes in the source graph Indicates when node When not fixed Candidate nodes in the source graph; The formula for calculating the alignment score is as follows: ； In the above formula, The graph alignment score represents the graph alignment result of the t-th graph. Represents a query graph The number of edges in the middle; Represents a query graph One of the paths ,in and Both queries involve nodes in the graph; This represents a path in the sub-source graph, which is a path in the query graph. The alignment path in the graph alignment result; This indicates the path Influence score; The formula calculates the graph alignment score by summing the influence scores of all aligned paths in the graph alignment result and dividing by the number of edges in the query graph. This score measures the degree of alignment between the query graph and the graph alignment result. Step 3: The threat detection component performs graph matching calculations on the input sub-source graph and query graph and transmits the results to the alert and tracing component; Step 4: The alarm and tracking component receives the graph matching results and updates the posterior probability that an anomaly exists.

2. The real-time APT attack dynamic detection method based on source graph matching according to claim 1, characterized in that: The alarm and tracking components are as follows: First, based on normal historical samples, corresponding to the null hypothesis. And historical samples of abnormal attacks, corresponding alternative hypotheses ,use Fit the likelihood function to each distribution. and The probability distribution model; where, This represents the probability density of graph alignment scores generated when the host system is in a normal state; while This represents the probability density of the graph alignment score generated when the host system is under attack; an initial prior probability is set. and As initialization and initial log-likelihood ratio: ； In the above formula, This represents the initial log-likelihood ratio; This indicates the initial probability of the anomaly existing; This represents the initial probability under normal circumstances; Subsequently, the alerting and tracking component sequentially obtains the graph alignment score for each aligned subgraph from the threat detection component, and then calculates the conditional probability value of the graph alignment score under different assumptions based on a preset distribution function. and Then, the log-likelihood ratio of the alignment score of the graph is calculated according to the following formula: ； In the above formula, Indicates the alignment score based on the current graph. The calculated log-likelihood ratio; express In abnormal hypothesis The likelihood value below; express Under normal assumptions The likelihood value below; Then, the values ​​of the log-likelihood ratios of the aligned fractions of the graph are accumulated to the total log-likelihood ratio using the following formula. middle: ； In the above formula, This represents the total log-likelihood ratio; This represents the initial log-likelihood ratio; Indicates the alignment score based on the current graph. The calculated log-likelihood ratio; Finally, based on the total log-likelihood ratio This can be converted into a real-time posterior probability using the following formula: ； ； This represents the natural exponential function, i.e.: ； In the above formula, This represents the total log-likelihood ratio; Indicates to pass Calculated likelihood ratio; This represents the posterior probability, specifically the alignment score of a series of observed graphs. Under these conditions, the current host system is in an abnormal state. The probability of; Repeat the above steps: calculate the log-likelihood ratio and update the posterior probability for each matched image alignment score; dynamically update the posterior probability and compare it with a threshold; trigger an alarm immediately if the threshold is exceeded. Regarding threshold setting, the formula... middle This represents the maximum number of different entry points that an attacker is willing to independently exploit, according to the formula. The method for calculating influence score in China reveals that the influence score threshold is... The reciprocal of; The graph alignment score is calculated by averaging all influence scores, so the influence score threshold is used as the threshold for the graph alignment score. After that, Substitute again The probability distribution model transforms the graph alignment score threshold into a threshold representing the posterior probability of whether the current state is abnormal. .

Images