Abnormal sensing method and system for APT threat

Abstract

The invention discloses an anomaly perception method and system for APT threat, and belongs to the technical field of network information security, and the method comprises the steps: mining alarm associated information in a layered manner from the log data of machine room networking and a network flow, and constructing a traceability graph; performing virus sensing on all node layers of the traceability graph, and identifying suspicious nodes, abnormal nodes and healthy nodes; specifically, first-layer anomaly recognition based on static analysis is carried out on all nodes, abnormal nodes are preliminarily recognized, second-layer anomaly recognition based on dynamic analysis and atlas analysis is carried out on preliminarily recognized non-abnormal nodes, and potential risk nodes, healthy nodes and abnormal nodes are recognized; third-layer anomaly recognition based on a classification model is carried out on the potential risk nodes, and final classification of the potential risk nodes is output; and according to the identified node type, self-adaptively sending a response measure. According to the invention, the threat discovery capability can be improved, and the precision, stability and expandability of anomaly perception can be improved.

Description

Technical Field

[0001] This invention belongs to the field of network information security technology, specifically relating to an anomaly detection method and system for APT threats. Background Technology

[0002] In the digital age, data security has become a global focus, especially against the backdrop of rapid development in information technology. With the widespread application of cloud computing and the Internet of Things (IoT), the amount of user-generated data has increased dramatically, leading to frequent data breaches. Traditional security tools struggle to effectively detect and defend against Advanced Persistent Threats (APTs) because these attacks are typically characterized by long durations, high stealth, and low frequency. Many existing defense methods rely on pre-designed rules and expert experience, primarily focusing on observable characteristics of attack behavior, neglecting the complex relationships formed throughout the persistent attack lifecycle. They often fail to automatically extract normal or abnormal features from the data, making it extremely difficult to combat APT attacks. In the modern network environment, facing constantly evolving network threats, intrusion detection systems based on attribution are demonstrating great potential. However, as the complexity of attribution maps increases, timely and accurate detection of anomalous behavior becomes more difficult, potentially leading to higher false positive rates. Summary of the Invention

[0003] This invention addresses the shortcomings of existing technologies by providing an anomaly detection method and system for APT threats, which can improve threat detection capabilities and enhance the accuracy, stability, and scalability of anomaly detection.

[0004] This invention provides the following technical solution: Firstly, an anomaly detection method for APT threats is provided, including: Step S1: Extract alarm correlation information from the log data and network flow of the data center network in layers, and construct a source tracing diagram; Step S2: Perform virus sensing on all nodes of the source tracing graph in layers to identify suspicious nodes, abnormal nodes, and healthy nodes. Specifically, perform a first-level anomaly identification based on static analysis on all nodes to initially identify abnormal nodes. Then, perform a second-level anomaly identification based on dynamic analysis and graph analysis on the initially identified non-abnormal nodes to identify potential risk nodes, healthy nodes, and abnormal nodes. Finally, perform a third-level anomaly identification based on a classification model on potential risk nodes to output the final classification of potential risk nodes. Step S3: Based on the identified node types, adaptively issue response measures.

[0005] Optionally, step S1 specifically includes: Collect system kernel logs, network traffic data, and cloud platform logs from the data center network, and then parse and standardize them; Based on predefined rules, the original events and alarm events of the data center network are quickly associated by matching unique identifiers. For original events and alarm events that are not directly associated by unique identifiers, deep links are made according to causal and temporal relationships through sequence models. Define nodes and edges, and starting from any alarm event, expand the graph forward and backward to obtain the source graph of the alarm event.

[0006] Optionally, in step S2, a virtual sandbox is used for dynamic analysis, and the classification model for the third-layer anomaly detection is a DNN classification model. The specific steps for the third-layer anomaly detection are as follows: For potential risk nodes, dynamic features and graph features from dynamic analysis and graph analysis in the second-layer anomaly identification are extracted, and after feature encoding, they are concatenated into a regular feature vector. Meta-feature vectors from graph analysis and dynamic analysis in the second-layer anomaly identification are also extracted. The meta-feature vector and the regular feature vector are concatenated and input into the trained DNN classification model, which outputs the threat score of potential risk nodes. Based on the preset threshold range, the potential risk nodes are finally classified into abnormal nodes, healthy nodes, and suspicious nodes.

[0007] Optionally, the dynamic features include: file operations, process operations, registry operations, network activity, system API calls, file write entropy, network connection frequency, and number of processes created; The graph features include: entity type, creation time, edge type, path features, and neighbor features of potential risk nodes; The meta-features include: sandbox runtime, network traffic bytes, total number of behavioral events captured by the sandbox, whether the sandbox environment is hidden, source tracing path length, and the proportion of abnormal nodes among adjacent nodes.

[0008] Optionally, in step S2, the first layer of anomaly identification specifically includes: The file hash values ​​of all nodes are obtained and compared with a known malicious hash database. If a match is found, the node is directly marked as an abnormal node; otherwise, a second layer of anomaly identification is performed.

[0009] Optionally, in step S2, the dynamic analysis of the second layer specifically includes: The executable content of the initially identified non-abnormal nodes is placed in a virtualization sandbox for execution, and their dynamic characteristics are monitored. If obvious malicious behavior is found, it is marked as an abnormal node; if suspicious behavior is found, it is marked as a potential risk node; if there is no suspicious or abnormal behavior, it is marked as a healthy node. The second layer of spectral analysis specifically includes: The detection of initially identified non-abnormal nodes involves checking their parent processes, child processes, accessed files, and network addresses for suspicion, as well as determining whether the initially identified non-abnormal nodes are located on known attack paths. If any suspicious items are found, the node is considered a potential risk node; otherwise, it is considered a healthy node. Nodes whose classifications are inconsistent in dynamic analysis and spectral analysis are marked as potential risk nodes.

[0010] Optionally, step S3 specifically includes: Enhance security by performing privacy computations on healthy nodes, physically isolate abnormal nodes, softly isolate suspicious nodes, and find neighboring healthy nodes of suspicious nodes. At the same time, update the security policies of suspicious nodes using the security policies of neighboring healthy nodes.

[0011] Secondly, an anomaly detection system for APT threats is provided, including: The source map construction module extracts alarm correlation information from the log data and network flow of the data center network in layers and constructs a source map; The anomaly detection module performs virus detection on all nodes in the source tracing graph in layers, identifying suspicious nodes, abnormal nodes, and healthy nodes. Specifically, it performs a first-level anomaly identification based on static analysis on all nodes to initially identify abnormal nodes, and performs a second-level anomaly identification based on dynamic analysis and graph analysis on the initially identified non-abnormal nodes to identify potential risk nodes, healthy nodes, and abnormal nodes. Finally, it performs a third-level anomaly identification based on a classification model on potential risk nodes, outputting the final classification of potential risk nodes. The adaptive response module adaptively issues response measures based on the identified node type.

[0012] Thirdly, a computer device is provided, including a processor and a memory; wherein the processor executes a computer program stored in the memory to implement the steps of the anomaly detection method for APT threats as described in any one of the first aspects.

[0013] Fourthly, a computer-readable storage medium is provided for storing a computer program; when executed by a processor, the computer program implements the steps of the anomaly detection method for APT threats as described in any one of the first aspects.

[0014] Compared with the prior art, the beneficial effects of the present invention are: (1) This application performs virus perception on all nodes of the source map in layers to identify suspicious nodes, abnormal nodes and healthy nodes; the first layer of anomaly identification adopts static analysis, which is very fast and greatly reduces the average detection time and computational resource consumption; the layered anomaly identification can greatly save operating costs, and at the same time, the layered anomaly identification can avoid false alarms and provide cross-validation, so that the final node classification is more accurate and the threat detection capability is improved. Moreover, if the identification of a certain layer fails, the other layers can still work, improving the stability and scalability of anomaly perception.

[0015] (2) Nodes are divided into three categories: suspicious nodes, abnormal nodes and healthy nodes. Preventive measures are taken for suspicious nodes, such as updating security policies, instead of directly isolating them. This can avoid misjudging and isolating nodes that are benign but have slightly unusual behavior, thus improving system availability. In addition, early intervention for suspicious nodes can strengthen their security policies before they may evolve into a real threat, thus achieving proactive defense. Attached Figure Description

[0016] Figure 1 This is a flowchart of the anomaly detection method for APT threats according to the present invention; Figure 2 This is a structural block diagram of the anomaly detection system for APT threats according to the present invention. Detailed Implementation

[0017] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention and should not be used to limit the scope of protection of the present invention. It should be noted that the term "comprising" and any variations thereof in the specification, claims and the above-mentioned drawings of the present invention are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products or devices.

[0018] Example 1 like Figure 1 As shown, an anomaly detection method for APT threats includes the following steps: Step S1: Extract alarm correlation information layer by layer from the log data and network flow of the data center network, and construct a source tracing diagram. Step S1 specifically includes: S11: Collect system kernel logs, network traffic data, and cloud platform logs for data center networking, and then parse and standardize them.

[0019] System kernel logs are collected using a data acquisition tool installed on the terminal. Network traffic data is obtained through network switch port mirroring (SPAN) or network splitters; network traffic data includes metadata and full packet data. Metadata uses protocols such as NetFlow, sFlow, and IPFIX to record the five-tuple, timestamp, number of packets, and number of bytes of communication; the five-tuple includes source IP, source port, destination IP, destination port, and protocol; full packet data captures complete packets and can be analyzed using deep packet inspection (DPI) to analyze application layer content, such as HTTP headers, DNS queries, and TLS certificates. Cloud platform logs are used to record management operations of cloud resources.

[0020] Parsing and standardization can be performed using existing tools, such as SIEM or NTA.

[0021] S12: Based on predefined rules, the original events and alarm events of the data center network are quickly associated by matching unique identifiers. For original events and alarm events that are not directly associated by unique identifiers, they are linked according to causal and temporal relationships through sequence models.

[0022] First-level association: Based on predefined association rules, automatic matching is performed using unique identifiers in the logs, such as PID, file path, IP port, etc.

[0023] The second layer of association: For original events and alarm events that are not directly related, association is made through sequence models. Sequence models are optional, such as hidden Markov models or long short-term memory networks.

[0024] S13: Define nodes and edges, and expand the graph forward and backward from any alarm event to obtain the source graph of the alarm event.

[0025] Nodes include entities such as processes, files, network sockets, users, and hosts, while edges include derived, written, and connected edges. Graph diffusion forward and backward allows for tracing back to the root cause and tracking the impact, thus revealing the complete attack chain.

[0026] Step S2: Perform virus sensing on all nodes of the source tracing graph in layers to identify suspicious nodes, abnormal nodes, and healthy nodes. Specifically, perform a first-level anomaly identification based on static analysis on all nodes to initially identify abnormal nodes, and perform a second-level anomaly identification based on dynamic analysis and graph analysis on the initially identified non-abnormal nodes to identify potential risk nodes, healthy nodes, and abnormal nodes. Perform a third-level anomaly identification based on a classification model on potential risk nodes to output the final classification of potential risk nodes.

[0027] I. First-level anomaly detection S2.1: Obtain the file hash values ​​of all nodes and compare them with a known malicious hash database. If a match is found, mark the node as an abnormal node; otherwise, perform a second layer of anomaly identification. The malicious hash database can include a local virus database and a cloud-based threat intelligence platform.

[0028] II. Second-level anomaly detection This includes dynamic analysis and spectral analysis. Specifically, S2.2: Dynamic analysis of the second layer includes: The executable content of the initially identified non-abnormal nodes is placed in a virtualization sandbox for execution, and their dynamic characteristics are monitored. If obvious malicious behavior is found, it is marked as an abnormal node; if suspicious behavior is found, it is marked as a potential risk node; if there is no suspicious or abnormal behavior, it is marked as a healthy node. Executable content on non-abnormal nodes includes executable files, documents, and scripts. Monitoring the dynamic characteristics of non-abnormal nodes includes process creation, file operations, registry modifications, network connections, and API calls. Clearly malicious behavior includes actions such as releasing malicious payloads, attempting to connect to a C&C server, and encrypting files. Suspicious behavior mainly consists of strange but harmless actions, such as using highly sophisticated obfuscation techniques to evade analysis, attempting to disable protection services, and injecting code into legitimate processes. Monitoring is implemented using existing technologies such as ETW subscriptions.

[0029] S2.3: Second-level spectral analysis, specifically including: The detection process checks whether the parent process, child process, accessed files, and network address of the initially identified non-abnormal nodes are suspicious, and determines whether the initially identified non-abnormal nodes are located on known attack paths. If there are suspicious items, they are potential risk nodes; otherwise, they are healthy nodes.

[0030] S2.4: Nodes whose classifications are inconsistent in dynamic analysis and spectral analysis are marked as potential risk nodes.

[0031] III. Third-level anomaly detection S2.5: For potential risk nodes, extract the dynamic features and graph features from the dynamic analysis and graph analysis in the second-layer anomaly identification, encode the features and concatenate them into a regular feature vector, and extract the meta-feature vectors from the graph analysis and dynamic analysis in the second-layer anomaly identification.

[0032] S2.6: The meta-feature vector and the regular feature vector are concatenated and input into the trained DNN classification model, and the threat score of the potential risk node is output. According to the preset threshold range, the potential risk node is finally classified into abnormal node, healthy node and suspicious node.

[0033] Dynamic features include: file operations, process operations, registry operations, network activity, system API calls, file write entropy, network connection frequency, and number of processes created; graph features include: entity type, creation time, edge type, path features, and neighbor features of potential risk nodes; meta-features include: sandbox runtime, number of bytes of network traffic, total number of behavioral events captured by the sandbox, whether the sandbox environment is concealed, source tracing path length, and the proportion of abnormal nodes among neighboring nodes.

[0034] The introduction of meta-features is to determine the reliability of the dynamic analysis and graph analysis in the second layer. During the learning process, the DNN classification model will see both regular feature vectors and meta-feature vectors, and thus adaptively and dynamically weight the dynamic features and graph features, thereby adjusting the degree of dependence on the dynamic features and graph features.

[0035] Dynamic features are primarily used to describe the series of activities of potential risk nodes during sandbox operation, while graph features are mainly used to describe the location, structure, and relationships of nodes in the global source graph. Dynamic and graph features are quantified and standardized to generate regular feature vectors. Dynamic features are extracted from the behavioral sequences using a CNN, while graph features can be processed using a GNN algorithm.

[0036] Step S3: Based on the identified node types, adaptively issue response measures.

[0037] Specifically, privacy computation is performed on healthy nodes to enhance security, abnormal nodes are physically isolated, suspicious nodes are softly isolated, and neighboring healthy nodes of suspicious nodes are searched. At the same time, the security policies of neighboring healthy nodes are used to update the security policies of suspicious nodes.

[0038] By employing a three-category classification and gray-scale processing approach, restrictive measures are taken against suspicious nodes rather than complete isolation, maximizing business continuity and enabling precise responses to reduce false positives. Furthermore, this application intervenes in suspicious nodes in advance, strengthening their security strategies before they may evolve into a real threat, thus achieving proactive defense. For healthy nodes, privacy-preserving computation, such as federated learning, is used, enabling perfect protection of data privacy and security while utilizing data for analysis and collaboration.

[0039] Finding neighboring healthy nodes of suspicious nodes can be achieved using existing technologies, such as fireworks explosion optimization algorithms or graph traversal algorithms.

[0040] Example 2 like Figure 2 As shown, an anomaly detection system for APT threats includes: The source map construction module extracts alarm correlation information from the log data and network flow of the data center network in layers and constructs a source map; The anomaly detection module performs virus detection on all nodes in the source tracing graph in layers, identifying suspicious nodes, abnormal nodes, and healthy nodes. Specifically, it performs a first-level anomaly identification based on static analysis on all nodes to initially identify abnormal nodes, and performs a second-level anomaly identification based on dynamic analysis and graph analysis on the initially identified non-abnormal nodes to identify potential risk nodes, healthy nodes, and abnormal nodes. Finally, it performs a third-level anomaly identification based on a classification model on potential risk nodes, outputting the final classification of potential risk nodes. The adaptive response module adaptively issues response measures based on the identified node type.

[0041] Example 3 The present invention provides a computer device, including a processor and a memory; wherein, when the processor executes a computer program stored in the memory, it implements the steps of the above-described anomaly detection method for APT threats.

[0042] For a more detailed explanation of the above method, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0043] Example 4 The present invention provides a computer-readable storage medium for storing a computer program; when the computer program is executed by a processor, it implements the steps of the above-described anomaly detection method for APT threats.

[0044] For a more detailed explanation of the above method, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0045] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. The systems, devices, and storage media disclosed in the embodiments are described simply because they correspond to the methods disclosed in the embodiments; relevant details can be found in the method section.

[0046] Those skilled in the art will clearly understand that the techniques in the embodiments of the present invention can be implemented using software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solutions in the embodiments of the present invention, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or certain parts of the embodiments of the present invention.

[0047] The above are merely preferred embodiments of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should be considered within the scope of protection of the present invention.

Claims

1. An anomaly perception method for APT threats, characterized in that, The method comprises the following steps: Step S1, hierarchical mining of alarm association information from log data and network flow of the computer room network, and constructing a traceability graph; Step S2, virus perception of all nodes of the traceability graph in layers, identifying suspicious nodes, abnormal nodes and healthy nodes; specifically, first layer abnormality identification based on static analysis is performed on all nodes to preliminarily identify abnormal nodes, and second layer abnormality identification based on dynamic analysis and graph analysis is performed on the preliminarily identified non-abnormal nodes to identify potential risk nodes, healthy nodes and abnormal nodes; Third layer abnormality identification based on a classification model is performed on the potential risk nodes to output the final classification of the potential risk nodes; Step S3, adaptive response measures are taken according to the identified node types.

2. The method for anomaly perception against APT threats according to claim 1, characterized in that, Step S1 specifically comprises: Collecting system kernel logs, network traffic data and cloud platform logs of the computer room network, and performing parsing and standardization; Based on predefined rules, the original events and alarm events of the computer room network are quickly associated by matching unique identifiers, and for original events and alarm events without direct unique identifier association, deep linking is performed according to causal relationship and time sequence relationship through a sequence model; Defining nodes and edges, taking any alarm event as a starting point, and performing graph diffusion forward and backward to obtain a traceability graph of the alarm event.

3. The method for anomaly perception against APT threats according to claim 1, wherein, In step S2, a virtual sandbox is used for dynamic analysis, the classification model of the third layer abnormality identification is a DNN classification model, and the specific steps of the third layer abnormality identification are as follows: For potential risk nodes, extract the dynamic features and graph features of dynamic analysis and graph analysis in the second layer abnormality identification, encode the features to splice into a conventional feature vector, and extract the meta-feature vector of graph analysis and dynamic analysis in the second layer abnormality identification; Splice the meta-feature vector and the conventional feature vector, input them into the trained DNN classification model, and output the threat score of the potential risk node, and according to a preset threshold range, finally classify the potential risk node into an abnormal node, a healthy node and a suspicious node.

4. The method for anomaly perception against APT threats according to claim 3, characterized in that, The dynamic features include file operations, process operations, registry operations, network activities, system API calls, file write entropy values, network connection frequencies and the number of created processes; The graph features include entity types, creation times, edge types, path features and neighbor features of the potential risk nodes; The meta-features include sandbox running time, network traffic byte number, total number of behavior events captured by the sandbox, whether the sandbox environment is hidden, traceability path length and proportion of abnormal nodes in adjacent nodes.

5. The method for anomaly perception against APT threats according to claim 1, wherein, In step S2, the first layer abnormality identification specifically comprises: Obtain the file hash value of all nodes and compare it with a known malicious hash library, if a match is found, mark it as an abnormal node, otherwise, perform second layer abnormality identification.

6. The method for anomaly perception against APT threats according to claim 1, wherein, In step S2, the dynamic analysis of the second layer specifically comprises: Put the executable content of the preliminarily identified non-abnormal node into a virtual sandbox to run, monitor its dynamic features, if obvious malicious behavior is found, mark it as an abnormal node, if suspicious behavior is found, mark it as a potential risk node, if there is no suspicious and abnormal behavior, mark it as a healthy node; The graph analysis of the second layer specifically comprises: The preliminary identified non-anomalous node is detected to determine whether its parent process, child process, accessed file and network address are suspicious, and whether the preliminary identified non-anomalous node is located on a known attack path, if there is a suspicious item, the preliminary identified non-anomalous node is a potential risk node, otherwise, the preliminary identified non-anomalous node is a healthy node; For the nodes with inconsistent classification in dynamic analysis and graph analysis, the nodes are marked as potential risk nodes.

7. The method for anomaly perception against APT threats according to claim 1, wherein, The step S3 specifically comprises: The healthy nodes are subjected to privacy calculation to enhance security, the abnormal nodes are subjected to physical isolation, the suspicious nodes are subjected to soft isolation, and the adjacent healthy nodes of the suspicious nodes are searched, and the security strategy of the suspicious nodes is updated using the security strategy of the adjacent healthy nodes.

8. An anomaly perception system against APT threats, characterized in that, It comprises: A traceability graph construction module, which is used to mine alarm association information from log data and network flow of a computer room network in layers and construct a traceability graph; An anomaly perception module, which is used to perform virus perception on all nodes of the traceability graph in layers to identify suspicious nodes, abnormal nodes and healthy nodes; specifically, first layer anomaly identification based on static analysis is performed on all nodes to preliminarily identify abnormal nodes, and second layer anomaly identification based on dynamic analysis and graph analysis is performed on the preliminarily identified non-anomalous nodes to identify potential risk nodes, healthy nodes and abnormal nodes; Third layer anomaly identification based on a classification model is performed on the potential risk nodes to output the final classification of the potential risk nodes; An adaptive response module, which is used to adaptively issue response measures according to the identified node categories.

9. A computer device, comprising: The computer program is stored in the memory and is executed by the processor to realize the steps of the anomaly perception method for APT threats according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer program is stored in the memory and is executed by the processor to realize the steps of the anomaly perception method for APT threats according to any one of claims 1-7.

Images