Attack event processing method and device, electronic equipment, storage medium and program

Abstract

The embodiment of the invention discloses an attack event processing method and device, electronic equipment, a storage medium and a program, and the method comprises the steps: obtaining event triggering operation associated data of a target triggering event in a target system in real time; performing broad-spectrum detection on the event triggering operation associated data through an attack event broad-spectrum mapping model to generate broad-spectrum attack detection associated data; performing intention reasoning on the broad-spectrum attack detection associated data through an attack event dynamic evolution engine to obtain a to-be-verified attack intention hypothesis of the target trigger event; and determining an attack event dynamic evolution strategy matched with the to-be-verified attack intention hypothesis, and performing attack detection on current real-time operation associated data of the target trigger event through the attack event dynamic evolution strategy. According to the technical scheme of the embodiment of the invention, the monitoring efficiency and detection precision of the attack event can be improved, and the response efficiency of the attack event is improved.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of computer information security, and in particular to an attack event processing method and device, electronic equipment, storage medium and program. BACKGROUND

[0002] With the continuous innovation of Internet technology, the current IT (Information Technology) environment is becoming more and more complex, and the detection and response efficiency of attack events is also becoming higher and higher.

[0003] At present, the detection of attack events mostly adopts static rules, which cannot adapt to the evolution of attack methods. For the same batch of data, the analysis depth cannot be automatically switched, resulting in either an alarm storm or missing key threats. Especially for multi-stage attacks such as "incubation-detection-damage", the traditional attack event detection method can only detect scattered fragments and cannot detect complete attack chains, and the attack defense capability is low. SUMMARY

[0004] Embodiments of the present application provide an attack event processing method, device, electronic equipment, storage medium and program, which can improve the monitoring efficiency and detection accuracy of attack events, and further improve the response efficiency of attack events.

[0005] According to an aspect of the present application, an attack event processing method is provided, comprising:

[0006] real-time acquisition of event trigger operation associated data of a target trigger event in a target system;

[0007] performing broad-spectrum detection on the event trigger operation associated data through an attack event broad-spectrum mapping model to generate broad-spectrum attack detection associated data;

[0008] performing intent reasoning on the broad-spectrum attack detection associated data through an attack event dynamic evolution engine to obtain a to-be-verified attack intent hypothesis of the target trigger event;

[0009] determining an attack event dynamic evolution strategy matched with the to-be-verified attack intent hypothesis, and performing attack detection on current real-time operation associated data of the target trigger event through the attack event dynamic evolution strategy.

[0010] According to another aspect of the present application, an attack event processing device is provided, comprising:

[0011] an event trigger operation associated data acquisition module configured to acquire event trigger operation associated data of a target trigger event in a target system in real time;

[0012] The event correlation data broad spectrum detection module is configured to perform broad spectrum detection on the event trigger operation correlation data by using an attack event broad spectrum mapping model, and generate broad spectrum attack detection correlation data.

[0013] The event attack intention reasoning module is configured to perform intention reasoning on the broad spectrum attack detection correlation data by using an attack event dynamic evolution engine, and obtain a to-be-verified attack intention hypothesis of the target trigger event.

[0014] The event operation correlation data attack detection module is configured to determine an attack event dynamic evolution strategy matched with the to-be-verified attack intention hypothesis, and perform attack detection on current real-time operation correlation data of the target trigger event by using the attack event dynamic evolution strategy.

[0015] According to another aspect of the present application, an electronic device is provided, which comprises:

[0016] at least one processor; and

[0017] a memory connected to the at least one processor in communication; wherein

[0018] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform the attack event processing method according to any one of the embodiments of the present application.

[0019] According to another aspect of the present application, a computer readable storage medium is provided, which stores computer instructions for enabling a processor to perform the attack event processing method according to any one of the embodiments of the present application when executed by the processor.

[0020] According to another aspect of the present application, a computer program product is also provided, which comprises a computer program for enabling a processor to perform the attack event processing method according to any one of the embodiments of the present application when executed by the processor.

[0021] The embodiments of the present application obtain event trigger operation correlation data of a target trigger event in a target system in real time, perform broad spectrum detection on the event trigger operation correlation data by using an attack event broad spectrum mapping model, and generate broad spectrum attack detection correlation data. Further, intention reasoning is performed on the broad spectrum attack detection correlation data by using an attack event dynamic evolution engine, a to-be-verified attack intention hypothesis of the target trigger event is obtained, and attack detection is performed on current real-time operation correlation data of the target trigger event by using an attack event dynamic evolution strategy matched with the to-be-verified attack intention hypothesis, so as to solve the problems of low detection efficiency and precision of existing attack events, improve the monitoring efficiency and detection precision of attack events, and further improve the response efficiency of attack events.

[0022] It is to be understood that the details set forth herein do not limit the scope of the embodiments of the application to the specific embodiments described. Rather, the scope of the embodiments of the application is to be defined by the appended claims. BRIEF DESCRIPTION OF DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort based on these drawings.

[0024] Figure 1 is a flow chart of an attack event processing method provided by the first embodiment of the present application;

[0025] Figure 2 is a flow chart of an attack event processing method provided by the second embodiment of the present application;

[0026] Figure 3 is a schematic diagram of an attack event processing device provided by the third embodiment of the present application;

[0027] Figure 4 is a structural schematic diagram of an electronic device provided by the fourth embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to make the technical personnel in the art better understand the present application scheme, the following will combine the drawings in the embodiments of the present application, the technical solutions in the embodiments of the present application are described clearly and completely, obviously, the described embodiments are only some embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without any creative effort should belong to the scope of protection of the present application.

[0029] It should be noted that the terms "comprising" and "having" and any variations thereof are intended to cover not exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0030] Embodiment one

[0031] Figure 1This is a flowchart of an attack event processing method provided in Embodiment 1 of the present invention. This embodiment is applicable to situations where attack events are broadly detected using an attack event broad-spectrum mapping model, and then further detected using an attack event dynamic evolution engine. This method can be executed by an attack event processing device, which can be implemented in software and / or hardware, and is generally integrated into an electronic device. This electronic device can be a terminal device or a server device, as long as it can execute the attack event processing method. The present invention does not limit the specific type of electronic device. Accordingly, as... Figure 1 As shown, the method includes the following operations:

[0032] S110. Real-time acquisition of event triggering operation association data of target triggering events in the target system.

[0033] The target system can be any type of platform system, such as a log system, cloud platform system, or database system, as long as it has the requirement to detect attack chains. This embodiment of the invention does not limit the type of target system. The target triggering event can be any event capable of initiating an attack event tracing and detection process. The event triggering operation association data can be the association data of the operational behaviors involved in the target triggering event within the target system.

[0034] When real-time detection of attack events on a target system is required, an attack event processing system can pre-define events with early-stage attack characteristics as trigger events based on the type of the target system and the types of attack events it may be involved in, and then perform real-time detection of these trigger events. It is understandable that the type of trigger event may differ depending on the type of target system. For example, for a log system, trigger events could be abnormal login events or abnormal IP connection events. For a database system, trigger events could be unauthorized queries or modifications to data tables.

[0035] Once the attack event processing system detects that a target trigger event has been triggered on the target system, it indicates that abnormal information of early attack characteristics has been captured. At this time, the attack event processing system can obtain the event type, event content, and other related data associated with the target trigger event in the target system in real time. This data is used as the event trigger operation association data for subsequent automated detection and analysis of the attack chain.

[0036] S120. Broad-spectrum detection is performed on the event-triggered operation-related data using the attack event broad-spectrum mapping model to generate broad-spectrum attack detection-related data.

[0037] The attack event broad-spectrum mapping model can be a model used for broad-spectrum detection of event-triggered operation-related data. The broad-spectrum attack detection-related data can be the relevant data obtained by performing broad-spectrum detection of event-triggered operation-related data using the attack event broad-spectrum mapping model.

[0038] Before conducting real-time monitoring of attack events on the target system, a broad-spectrum mapping model rule base can be constructed to store broad-spectrum mapping models for multiple different types of attack events. Each broad-spectrum mapping model for an attack event can be associated with one or more attack chain stages corresponding to the attack event, simulating each attack link in the attack chain corresponding to the attack event.

[0039] Accordingly, when the attack event processing system detects a target triggering event in the target system, it matches the event triggering operation association data of the target triggering event with the broad-spectrum mapping model of each attack event to perform broad-spectrum detection on the event triggering operation association data through the broad-spectrum mapping model of the attack event. Once the event triggering operation association data of the target triggering event matches the description data or rules of one attack chain stage of a certain attack event broad-spectrum mapping model, it can be determined that the target triggering event has a preliminary attack threat signal. At this time, broad-spectrum attack detection association data of the target triggering event can be generated based on the broad-spectrum detection results. For example, the broad-spectrum attack detection association data may include, but is not limited to, the label of the target triggering event, the label of the hit attack chain stage, and context information. Among them, the context information may include, but is not limited to, entity, time, and other context information.

[0040] S130. The attack intent hypothesis of the target triggering event is obtained by performing intent reasoning on the broad spectrum attack detection association data through the attack event dynamic evolution engine.

[0041] The attack event dynamic evolution engine can be used to infer subsequent attack behaviors associated with target-triggered events. The attack intent hypothesis to be verified can be an intent hypothesis obtained by inferring the attack behaviors of the target-triggered events.

[0042] After the attack event processing system obtains the broad-spectrum attack detection correlation data of the target triggering event, it can send it to the internal attack event dynamic evolution engine. The engine then uses this data to infer the intent of possible subsequent attack behaviors following the target triggering event, thus deriving a hypothesis of the attack intent to be verified for the target triggering event. It is understood that a single target triggering event can yield at least one hypothesis of the attack intent to be verified.

[0043] S140. Determine the dynamic evolution strategy of the attack event that matches the attack intent hypothesis to be verified, and perform attack detection on the current real-time operation association data of the target triggering event through the dynamic evolution strategy of the attack event.

[0044] The dynamic evolution strategy for attack events can be a strategy for refined anomaly detection of the associated data and behaviors of the target-triggered event. The current real-time operation-related data can be the data associated with the relevant operational behaviors of the target-triggered event in the target system, which may include the type of operation behavior and the objects involved in the operation behavior, etc.

[0045] After determining the attack intent hypothesis to be verified corresponding to the target triggering event, the attack event dynamic evolution engine can intelligently select and execute one or more refined attack event detection strategies based on broad-spectrum attack detection correlation data for each hypothesis. These strategies serve as the attack event dynamic evolution strategies matching the attack intent hypothesis. Furthermore, the attack event dynamic evolution engine can perform attack detection on the current real-time operation correlation data of the target triggering event based on the attack event dynamic evolution strategies matching the attack intent hypothesis, thereby achieving dynamic strategy evolution based on the attack chain context.

[0046] Optionally, the attack event dynamic evolution strategy can perform attack detection on the current real-time operation-related data of the target triggering event from multiple dimensions. For example, it can perform positive detection and / or negative detection and verification on the attack intent hypothesis to be verified for the target triggering event, thereby determining the attack chain detection result corresponding to the target triggering event.

[0047] This invention acquires event-triggered operation association data of target-triggered events in the target system in real time, and performs broad-spectrum detection on this data using an attack event broad-spectrum mapping model to generate broad-spectrum attack detection association data. Furthermore, an attack event dynamic evolution engine performs intent reasoning on the broad-spectrum attack detection association data to obtain a hypothesis of attack intent to be verified for the target-triggered event. After determining the attack event dynamic evolution strategy that matches the hypothesis of attack intent to be verified, the attack event dynamic evolution strategy is used to perform attack detection on the current real-time operation association data of the target-triggered event. This solves the problems of low efficiency and accuracy in existing attack event detection methods, improves the monitoring efficiency and detection accuracy of attack events, and thus improves the response efficiency of attack events.

[0048] Example 2

[0049] Figure 2This is a flowchart of an attack event handling method provided in Embodiment 2 of the present invention. This embodiment is based on the above embodiment and is further specified. In this embodiment, various specific optional implementation methods are given, including real-time acquisition of event triggering operation association data of target triggering events in the target system, broad-spectrum detection of event triggering operation association data, intent reasoning of broad-spectrum attack detection association data, and attack detection of current real-time operation association data of target triggering events. Correspondingly, as... Figure 2 As shown, the method in this embodiment may include:

[0050] S210. Acquire the multimodal raw log data of the target triggering event in real time, and convert the multimodal raw log data into target structured field data.

[0051] The multimodal raw log data can be raw log data in various data formats generated in the target system by the target-triggered event. The target structured field data can be field data with a unified data structure.

[0052] The IT environments of enterprises and institutions are complex, and the log formats generated by their target systems vary widely, such as Windows' EVTX (Event Log XML), Linux's Syslog, and application-specific JSON (JavaScript Object Notation) or custom-formatted logs. Traditional log data processing tools either rely on fixed parsers, resulting in lagging support for new applications, or require significant manpower for custom development, leading to high data access costs, low efficiency, and even the loss of critical information due to parsing errors. Even when log data is collected, logs from different sources lack a unified semantic description. For example, AccountName (username) in Windows logs and svn.user (username) in SVN (Subversion, a popular version control system) logs, although both refer to users, cannot be automatically understood by the system as equivalent, resulting in data silos and semantic gaps, which in turn make cross-source correlation analysis extremely difficult.

[0053] In this embodiment of the invention, to break down data barriers from the data source, the bottlenecks in data collection and parsing can be addressed first. Specifically, during the data collection phase, a lightweight collection agent can be deployed in the attack event processing system to collect multimodal raw log data from different terminals, servers, and network devices in real time through various protocols such as Syslog, WinRM (Windows Remote Management, a Microsoft implementation of the WS-Management protocol), API (Application Programming Interface), and file monitoring. The attack event processing system can also be configured with an adaptive parsing engine, which has a built-in extensible parser rule base. When a new log type is received, the adaptive parsing engine will automatically identify its format: if the multimodal raw log data matches a known format, such as JSON, XML (Extensible Markup Language), or CSV (Comma-Separated Values), the corresponding parser will be automatically loaded to convert the multimodal raw log data into target structured field data with a unified data structure. If the multimodal raw log data includes data in unknown formats, the adaptive parsing engine can provide interactive field annotation tools or use machine learning-based pattern recognition algorithms to automatically learn the log structure of the multimodal raw log data and generate new parsing templates, achieving rapid adaptation to new data sources. The parsed multimodal raw log data is converted into structured key-value pairs to obtain the target structured field data.

[0054] S220. Map the target structured field data to the target preset standard entity to obtain the event trigger operation associated data.

[0055] The preset standard entity can be a standard entity pre-configured for fields with the same semantics. The target preset standard entity can be the preset standard entity corresponding to the target structured field data.

[0056] The attack event handling system can also be configured with an abstract, data source-independent unified security event model. This model includes pre-defined standard entities such as User, Host, IP address, Process, and File. Through an entity mapping and alignment configuration, the system can map the target structured field data transformed from multimodal raw log data to their corresponding pre-defined standard entities. For example, windows_log.AccountName maps to User.name, svn_log.svn.user maps to User.name, windows_log.Source_Network_Address maps to IP.address, and svn_log.svn.clientip maps to IP.address. Through entity mapping, the system breaks down data silos at the logical level, laying a semantic foundation for subsequent cross-source attack event correlation analysis.

[0057] S230. Perform broad-spectrum detection on the event triggering operation association data using the attack event broad-spectrum mapping model, and generate the attack event label of the target triggering event based on the target attack event broad-spectrum mapping model matched with the event triggering operation association data.

[0058] Among them, the target attack event broad spectrum mapping model can be the attack event broad spectrum mapping model that hits the event-triggered operation associated data.

[0059] S240. Obtain the context association data of the target triggering event, and use the attack event tag and context association data of the target triggering event as the broad-spectrum attack detection association data of the target triggering event.

[0060] Specifically, the attack event processing system matches event-triggered operation association data with standard entities with broad-spectrum mapping models for each attack event to determine the target attack event broad-spectrum mapping model that the target trigger event matches. Based on the model type of the target attack event broad-spectrum mapping model, it generates an attack event label for the target trigger event, clarifying the attack chain type that the target trigger event may involve. Simultaneously, it can also acquire in real-time association data such as entities, time, and operational behavior context involved in the target trigger event, serving as contextual association data for the target trigger event. Furthermore, the attack event label and contextual association data of the target trigger event can be used as broad-spectrum attack detection association data for the target trigger event.

[0061] In a specific example, suppose the attack event handling system detects a target triggering event: a high-privilege account logging in via the network outside of working hours (Logon_Type=3). The event triggering operation association data of this target triggering event is mapped to the "reconnaissance / exploitation" stage of a broad-spectrum mapping model for a certain target attack event. Then, the attack event label generated by the broad-spectrum mapping model for this target triggering event is: Kill_Chain_Stage: "Reconnaissance / Initial Access". This attack event label is a network attack stage identifier used to describe a specific step in the attack lifecycle, thereby generating an initial threat signal.

[0062] In another specific example, suppose the attack event handling system detects a target-triggered event: a server process initiates an abnormal connection to an unknown IP. The event triggering operation associated data of this target-triggered event is mapped to the "command and control" phase of a broad-spectrum mapping model for a specific target attack event. Then, the attack event label generated by the broad-spectrum mapping model for this target-triggered event is: Kill_Chain_Stage: "Command&Control" This attack event label represents a key stage in the network kill chain model, referring to the process by which an attacker establishes a remote communication channel to continuously control the infected device after successfully infiltrating the target system, thereby generating an initial threat signal.

[0063] Once the attack event processing system generates an attack event tag for the target-triggered event, it obtains all associated data on its entities, time, and context, and passes them together to the attack event dynamic evolution engine.

[0064] S250. The attack event dynamic evolution engine performs intent reasoning on the broad spectrum attack detection association data to obtain the attack intent hypothesis to be verified for the target triggering event.

[0065] In an optional embodiment of the present invention, the step of performing intent reasoning on the broad-spectrum attack detection association data through the attack event dynamic evolution engine to obtain the attack intent hypothesis to be verified for the target triggering event may include: parsing the broad-spectrum attack detection association data through the attack event dynamic evolution engine to determine the system operation permissions and / or abnormal association events triggered by the target triggering event; and performing intent reasoning based on the system operation permissions and / or abnormal association events triggered by the target triggering event to obtain the attack intent hypothesis to be verified.

[0066] Accordingly, the attack event handling system uses an attack event dynamic evolution engine to parse the attack event tags and contextual data of the target-triggered event. Based on the parsing results, it determines the system operation permissions triggered by the target-triggered event and / or its subsequent abnormal associated events. For example, system operation permissions may include, but are not limited to, system access permissions, data download permissions, and data modification permissions. Abnormal associated events can be the target-triggered event itself. These events can be a series of actions subsequently performed by the event triggerer of the target-triggered event, such as accessing a file server or database, creating an account, modifying configurations, viewing logs, and checking device status. The attack event handling system can perform intent reasoning based on the system operation permissions triggered by the target-triggered event and / or abnormal associated events, thereby inferring at least one attack intent hypothesis to be verified.

[0067] S260. Determine the attack event dynamic evolution strategy that matches the attack intent hypothesis to be verified, and perform positive evidence detection on the current real-time operation association data of the target triggering event through the attack event dynamic evolution strategy to determine the hit result of the attack intent hypothesis to be verified, and obtain the positive attack detection result.

[0068] Among them, positive evidence detection can be used to detect evidence in the forward evolution process of the hypothesis of attack intent to be verified. The result of positive attack detection is the result obtained through positive evidence detection.

[0069] S270. Using the attack event dynamic evolution strategy, perform negative evidence detection on the current real-time operation-related data of the target triggering event, determine the exclusion result of the attack intent hypothesis to be verified, and obtain the negative attack detection result.

[0070] Negative evidence detection involves detecting evidence of the negative evolution of the hypothesis regarding the attack intent to be verified. The result of negative attack detection is the result obtained through negative evidence detection.

[0071] In this embodiment of the invention, the attack event processing system can adopt a two-way verification dynamic evolution strategy for attack events based on the attack intent hypothesis to be verified. Based on the "scientific hypothesis and verification" of the attacker's stage and possible intent, it achieves accurate in-depth analysis through cross-verification of positive and negative evidence, effectively reduces false alarms, and further improves the accuracy of attack detection.

[0072] In an optional embodiment of the present invention, if the attack intent to be verified is assumed to be a data theft intent, then positive evidence detection is performed on the current real-time operation association data of the target triggering event using the attack event dynamic evolution strategy to determine the hit result of the attack intent to be verified. This can include: statistically analyzing the file access association information of the attacker to be verified based on all application operation behaviors of the attacker to be verified within a subsequent time window; if the file access association information of the attacker to be verified is determined to be non-standard file access information, then the current real-time operation association data of the target triggering event is determined to hit the data theft intent hypothesis. Here, the attacker to be verified can be the object that triggered the target triggering event. The file access association information can be related information such as the amount and type of data accessed.

[0073] If the attack intent to be verified is assumed to be a data theft intent, then the current real-time operation-related data of the target triggering event is subjected to negative evidence detection through the attack event dynamic evolution strategy to determine the exclusion result of the attack intent to be verified. This may include: determining the behavior type of all application operation behaviors of the attacker to be confirmed in the subsequent time window, and if it is determined that the behavior type of all application operation behaviors of the attacker to be confirmed in the subsequent time window is a safe operation behavior type, then the current real-time operation-related data of the target triggering event is used to exclude the data theft intent.

[0074] If the attack intent to be verified is a privilege escalation intent hypothesis, then the current real-time operation association data of the target triggering event is subjected to positive evidence detection through the attack event dynamic evolution strategy to determine the hit result of the attack intent hypothesis to be verified. This may include: determining the behavior type of all privilege-related operations of the attacker to be confirmed in the subsequent time window, and if it is determined that the behavior type of all privilege-related operations of the attacker to be confirmed in the subsequent time window includes the privilege change operation behavior type, then determining that the current real-time operation association data of the target triggering event hits the privilege escalation intent hypothesis.

[0075] If the attack intent to be verified is assumed to be a privilege escalation intent, then negative evidence detection is performed on the current real-time operation association data of the target triggering event through the attack event dynamic evolution strategy to determine the exclusion result of the attack intent to be verified. This may include: determining the behavior type of all privilege-related operations of the attacker to be confirmed in the subsequent time window, and if it is determined that the behavior type of all privilege-related operations of the attacker to be confirmed in the subsequent time window is within the authorized operation type, then the current real-time operation association data of the target triggering event is determined to exclude the privilege escalation intent hypothesis.

[0076] If the attack intent to be verified is a targeted destructive intent, then the current real-time operation association data of the target triggering event is subjected to positive evidence detection through the attack event dynamic evolution strategy to determine the hit result of the attack intent to be verified. This may include: determining the behavior type of all application operation behaviors of the attacker to be confirmed in the subsequent time window, and if it is determined that the application operation behaviors of the attacker to be confirmed in the subsequent time window include targeted destructive behaviors, determining that the current real-time operation association data of the target triggering event hits the targeted destructive intent hypothesis.

[0077] If the attack intent to be verified is a targeted destructive intent, then the current real-time operation association data of the target triggering event is subjected to negative evidence detection through the attack event dynamic evolution strategy to determine the exclusion result of the attack intent to be verified. This may include: determining the behavior type of all application operation behaviors of the attacker to be confirmed in the subsequent time window, and if it is determined that all application operation behaviors of the attacker to be confirmed in the subsequent time window are non-targeted destructive behaviors, then the current real-time operation association data of the target triggering event is used to exclude the targeted destructive intent.

[0078] In a specific example, suppose in attack detection scenario A, the attack event dynamic evolution engine receives broad-spectrum attack detection correlation data with the attack event tag "Kill_Chain_Stage: "Reconnaissance / Initial Access" for a target-triggered event (such as nighttime administrator login). For this broad-spectrum attack detection correlation data, the attack event dynamic evolution engine first performs intent reasoning to obtain the attack intent hypothesis to be verified for this target-triggered event. Specifically, the attack event dynamic evolution engine parses and determines that the attacker has obtained initial access to the target system, and their next possible operational intent is to conduct internal probing, data theft, or privilege escalation. The attack event dynamic evolution engine can use these as the attack intent hypothesis to be verified.

[0079] Furthermore, the attack event dynamic evolution engine begins to execute evolution actions to verify and eliminate intent. The attack event dynamic evolution engine can automatically load attack event dynamic evolution strategies corresponding to these attack intent hypotheses to be verified, and innovatively introduces a "negative evidence" detection mechanism into the attack event dynamic evolution strategies.

[0080] For example, in response to the hypothesis of a data theft attack intent to be verified, the attack event dynamic evolution engine loads a "data theft behavior verification" strategy. When performing positive evidence detection, this strategy deeply correlates all application operations of the suspected attacker within a subsequent time window, such as SVN, database, and file sharing applications, to statistically analyze file access volume and type. If it is found that the suspected attacker has downloaded a large number of core code files, then positive evidence is obtained for the data theft attack intent hypothesis. Simultaneously, the "data theft behavior verification" strategy checks whether the suspected attacker has accessed any file servers, databases, or code repositories. If, within a reasonable observation period (e.g., 1 hour), the suspected attacker shows absolutely no such access behavior, then strong "negative evidence" is captured. This evidence is used to rule out the "data theft" attack intent hypothesis.

[0081] For example, regarding the unverified attack intent hypothesis of privilege escalation, the attack event dynamic evolution engine can load the "privilege escalation behavior detection" strategy in parallel. That is, multiple unverified attack intent hypotheses triggered by the same target can execute their inference evolution process in parallel. When performing positive evidence detection, the "privilege escalation behavior detection" strategy checks whether the attacker to be confirmed has created new accounts, modified sensitive configurations, or abused tokens. If the attacker is found to have engaged in such behavior, positive evidence is obtained for the unverified attack intent hypothesis of privilege escalation. Conversely, if the "privilege escalation behavior detection" strategy determines that the attacker only executed routine system maintenance commands, such as viewing logs and checking service status, without any operations related to privilege changes, "negative evidence" is captured, and the unverified attack intent hypothesis of privilege escalation is excluded.

[0082] In another specific example, suppose in attack detection scenario B, the attack event dynamic evolution engine receives an attack event labeled: Kill_Chain_Stage: "Reconnaissance / InitialAccess". However, the contextual data of this target triggering event shows that the account has recently been accessed by a former employee. For the aforementioned broad-spectrum attack detection contextual data, the attack event dynamic evolution engine first performs intent reasoning to obtain a hypothesis of the attack intent to be verified for this target triggering event. Specifically, after deep analysis and reasoning, the attack event dynamic evolution engine deduces that the target triggering event may be an "insider threat" or "account hijacking," potentially leading to malicious damage to the target system. Therefore, the attack event dynamic evolution engine can primarily use "targeted damage" as the hypothesis of the attack intent to be verified.

[0083] For example, in response to a hypothetical targeted attack intent, the attack event dynamic evolution engine loads a "targeted sabotage behavior detection" strategy. This strategy, when performing positive evidence detection, can use exact matching (e.g., operation_types="DELETE") to identify destructive behavior. If the destructive behavior matches successfully, it confirms that the hypothetical targeted attack intent has obtained positive evidence of a positive attack detection result. Conversely, if the "targeted sabotage behavior detection" strategy determines that the attacker, after logging in, accessed a sensitive directory but all operations were "read" (GET), with no "write" (PUT), "modify" (MODIFY), or "delete" (DELETE) operations, it captures "negative evidence." This evidence is used to exclude the hypothetical targeted attack intent, significantly reducing the likelihood of a "targeted sabotage" intent, and potentially reclassifying it as "information gathering" or "low-risk anomaly."

[0084] In an optional embodiment of the present invention, after performing attack detection on the current real-time operation association data of the target triggering event through the attack event dynamic evolution strategy, the method may further include: acquiring attack detection association data of the current real-time operation association data; wherein, the attack detection association data includes verification attack scenario labels, exclusion of intent hypotheses, and confidence scores; generating a multi-dimensional attack event comprehensive analysis report of the target triggering event based on the attack detection association data of the current real-time operation association data; wherein, the multi-dimensional attack event comprehensive analysis report includes a multi-dimensional attack event profile and a visualized attack chain.

[0085] The attack detection associated data can include data related to the attack detection process and results. Verified attack scenario labels can be attack scenario labels that have been verified for the target triggering event. Excluded intent hypotheses can be intent hypotheses that have been eliminated through negative evidence detection. The multi-dimensional attack event comprehensive analysis report can be a comprehensive analysis report of attack events including multi-dimensional analysis data.

[0086] In this embodiment of the invention, the attack event processing system can also perform a comprehensive analysis based on the attack detection association data of the current real-time operation association data involved in the event that completes the attack detection. For example, it can create a multi-dimensional profile of the target trigger event and the associated subsequent events, and generate a comprehensive analysis report that includes multi-dimensional analysis content such as verifying attack scenario tags, excluding intent assumptions, and confidence scores.

[0087] For example, the content of a comprehensive analysis report of a multi-dimensional attack incident may include:

[0088] T1: High risk of data theft (verified): Matches a broad-spectrum strategy, and the "data theft verification" strategy has strong positive evidence, with no exclusionary negative evidence found.

[0089] T2: Suspected targeted sabotage (excluded): The broad-spectrum strategy was matched, but the "targeted sabotage detection" strategy captured key negative evidence (no destructive operation), so the intent was excluded and the overall risk was downgraded.

[0090] T3: Abuse of privilege detection (low confidence): Matches a broad spectrum of strategies, but all advanced intent assumptions (data theft, privilege escalation, and sabotage) are excluded by negative evidence, resulting in a profile of "abnormal behavior, unclear intent".

[0091] A comprehensive analysis report of a multi-dimensional attack incident may include a complete chain of evidence. For example, the chain of evidence may include, but is not limited to, suspicious login times / source IPs, details of positive evidence supporting the conclusions, and key negative evidence used to rule out other hypotheses.

[0092] A comprehensive analysis report of multi-dimensional attack events can also include detailed descriptions of the visualized attack chain. The attack event processing system can fuse attack detection results (including excluded paths) from broad-spectrum attack detection correlation data and current real-time operation correlation data to automatically reconstruct a visualized attack chain. For example, the view of the visualized attack chain may include the following: confirmed attack nodes, such as 22:30 - unauthorized login; highly suspicious attack nodes, such as 22:35-23:50 - batch download of core code; interrupted or excluded attack paths, such as those assessed by the system but interrupted due to insufficient evidence; the current stage of the attack chain, such as Stage: "Actions on Objectives"; and the final, verified attack scenario label, such as Intent: "Data Exfiltration (Verified)".

[0093] To achieve automated response and closed-loop, the attack incident handling system can also automatically trigger corresponding response scripts based on different attack scenario tags and confidence scores through the Security Orchestration, Automation and Response (SOAR) module. In a specific example, for "T2: High Risk of Targeted Damage" in the multi-dimensional attack incident comprehensive analysis report, the attack incident handling system can automatically execute: (1) force the user offline; (2) isolate its login IP; (3) back up the core files being manipulated; (4) create a high-priority work order and notify the security analyst, among other response scripts.

[0094] Specific application scenarios

[0095] Suppose that the attack incident handling system detects malicious activity conducted overnight using a high-privilege account in the log system. At this moment, the system uses an adaptive parsing engine to access the Windows 4624 login logs and SVN operation logs in real time. All entities in the logs, such as users, IPs, and files, are mapped to unified, preset standard entities.

[0096] The attack event handling system detected an account with the username "Administrator" logging in at 23:30 using a Logon_Type of 3, originating from an IP address of 10.65.64.109. This login event triggered the attack event broad-spectrum mapping model, which performed broad-spectrum detection, generated an initial threat signal, and assigned the attack event label: Kill_Chain_Stage: "Initial Access".

[0097] The attack incident handling system sends the initial threat signal, attack incident label, and contextual data of the login event to the attack incident dynamic evolution engine for policy evolution and intent verification. Upon receiving this signal, the attack incident dynamic evolution engine generates two main attack intent hypotheses to be verified: "data theft" and "targeted destruction," and executes two attack incident dynamic evolution strategies in parallel for these two hypotheses: "data theft verification" and "targeted destruction detection." During the execution of the "data theft verification" strategy, it was discovered that between 23:35 and 00:50, the "Administrator" user made an attack on the login event... .py and " The .java file executed over 200 GET (data retrieval) operations, obtaining strong positive evidence. During the execution of the "targeted destruction detection" strategy, it was found that at 01:15, the "Administrator" user made an operation on the .java file. Important documents "The file under the path was deleted, providing strong positive evidence. In another scenario, if the 'Administrator' user logs in and only executes the commands 'ipconfig / all' (a command-line tool for displaying complete TCP / IP configuration information for all network adapters) and 'systeminfo' (a command-line tool for quickly displaying system configuration and status information for local or remote computers), without accessing any files or databases, then both the 'data theft verification' and 'targeted sabotage detection' strategies will capture negative evidence, leading to the exclusion of the two main attack intent hypotheses to be verified: 'data theft' and 'targeted sabotage'."

[0098] Furthermore, the attack incident handling system integrates all evidence to generate a complete attack chain: 23:30 Initial Access -> 23:35-00:50 Actions on Objectives (Data Exfiltration) -> 01:15 Actions on Objectives (Destruction). Simultaneously, the system can generate a high-risk alert for "Highly Suspected Targeted Destruction and Data Theft (both verified)," and automatically trigger a SOAR response: forcibly taking the account offline; isolating IP 10.65.64.109; backing up accessed and deleted files; creating a high-priority ticket and notifying the security team.

[0099] The aforementioned technical solution provides a dynamic strategy evolution mechanism based on attack chain context. Throughout the entire attack event processing flow, this mechanism automatically parses and unifies semantic modeling to map log data from different sources to standard security entities, breaking down data silos. Simultaneously, based on the attack stage of the initial threat signal triggered by the target event, it intelligently triggers and executes subsequent deep analysis strategies, organically integrating the initial threat signal with precise analysis results to automatically generate a visualized attack path containing a complete evidence chain and threat intent. Finally, based on the formed attack chain and intent tags, it automatically matches and executes precise handling strategies, achieving an efficient closed loop in attack event processing. This attack event processing method, by decomposing complex analysis logic into strategy combinations at different stages, enables both broad-spectrum monitoring and in-depth analysis, effectively balancing false negatives and false positives. Furthermore, it can connect isolated events into a complete attack chain, providing a global perspective and contextual information for the analysis of the entire attack process. The strategy evolution based on attack chain stages allows the attack event processing system to "predict" the attacker's next move and deploy defenses in advance, achieving proactive defense. Responses based on the attack chain stages enable more targeted measures, avoiding overly simplistic "one-size-fits-all" responses and improving the efficiency and accuracy of attack response.

[0100] It should be noted that all information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) involved in this disclosure are information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data comply with the relevant laws, regulations and standards of the relevant regions.

[0101] It should be noted that any arrangement or combination of the technical features in the above embodiments also falls within the protection scope of this invention.

[0102] Example 3

[0103] Figure 3 This is a schematic diagram of an attack event processing device provided in Embodiment 3 of the present invention, as shown below. Figure 3 As shown, the device includes: an event-triggered operation-related data acquisition module 310, an event-related data broad-spectrum detection module 320, an event attack intent reasoning module 330, and an event operation-related data attack detection module 340, wherein:

[0104] The event-triggered operation associated data acquisition module 310 is used to acquire the event-triggered operation associated data of the target-triggered event in the target system in real time;

[0105] The broad-spectrum detection module 320 for event-related data is used to perform broad-spectrum detection on the event-triggered operation-related data through a broad-spectrum mapping model of attack events, and generate broad-spectrum attack detection-related data.

[0106] The event attack intent reasoning module 330 is used to perform intent reasoning on the broad spectrum attack detection association data through the attack event dynamic evolution engine to obtain the attack intent hypothesis to be verified for the target triggering event;

[0107] The event operation-related data attack detection module 340 is used to determine the dynamic evolution strategy of the attack event that matches the attack intent hypothesis to be verified, and to perform attack detection on the current real-time operation-related data of the target triggering event through the dynamic evolution strategy of the attack event.

[0108] This invention acquires event-triggered operation association data of target-triggered events in the target system in real time, and performs broad-spectrum detection on this data using an attack event broad-spectrum mapping model to generate broad-spectrum attack detection association data. Furthermore, an attack event dynamic evolution engine performs intent reasoning on the broad-spectrum attack detection association data to obtain a hypothesis of attack intent to be verified for the target-triggered event. After determining the attack event dynamic evolution strategy that matches the hypothesis of attack intent to be verified, the attack event dynamic evolution strategy is used to perform attack detection on the current real-time operation association data of the target-triggered event. This solves the problems of low efficiency and accuracy in existing attack event detection methods, improves the monitoring efficiency and detection accuracy of attack events, and thus improves the response efficiency of attack events.

[0109] Optionally, the event-triggered operation associated data acquisition module 310 is further configured to: acquire multimodal raw log data of the target triggered event in real time; convert the multimodal raw log data into target structured field data; and map the target structured field data onto a target preset standard entity to obtain the event-triggered operation associated data.

[0110] Optionally, the event-related data broad-spectrum detection module 320 is further configured to: perform broad-spectrum detection on the event-triggered operation-related data through the attack event broad-spectrum mapping model; generate an attack event tag for the target-triggered event based on the target attack event broad-spectrum mapping model matched by the event-triggered operation-related data; obtain the context-related data of the target-triggered event; and use the attack event tag and context-related data of the target-triggered event as the broad-spectrum attack detection-related data of the target-triggered event.

[0111] Optionally, the event attack intent reasoning module 330 is further configured to: parse the broad-spectrum attack detection association data through the attack event dynamic evolution engine to determine the system operation permissions and / or abnormal association events triggered by the target triggering event; and perform intent reasoning based on the system operation permissions and / or abnormal association events triggered by the target triggering event to obtain the attack intent hypothesis to be verified.

[0112] Optionally, the event operation association data attack detection module 340 is further configured to: perform positive evidence detection on the current real-time operation association data of the target triggering event through the attack event dynamic evolution strategy, determine the hit result of the attack intent hypothesis to be verified, and obtain a positive attack detection result; and perform negative evidence detection on the current real-time operation association data of the target triggering event through the attack event dynamic evolution strategy, determine the exclusion result of the attack intent hypothesis to be verified, and obtain a negative attack detection result.

[0113] Optionally, the above-mentioned device further includes a comprehensive analysis report generation module, used to: acquire attack detection correlation data of the current real-time operation correlation data; wherein, the attack detection correlation data includes verification attack scenario tags, exclusion intent assumptions, and confidence scores; generate a multi-dimensional attack event comprehensive analysis report of the target triggering event based on the attack detection correlation data of the current real-time operation correlation data; wherein, the multi-dimensional attack event comprehensive analysis report includes a multi-dimensional attack event profile and a visualized attack chain.

[0114] The aforementioned attack event handling apparatus can execute the attack event handling method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the method. Technical details not described in detail in this embodiment can be found in the attack event handling method provided in any embodiment of the present invention.

[0115] Since the attack event processing apparatus described above is capable of executing the attack event processing method in the embodiments of the present invention, those skilled in the art can understand the specific implementation and various variations of the attack event processing apparatus in this embodiment based on the attack event processing method described in the embodiments of the present invention. Therefore, how the attack event processing apparatus implements the attack event processing method in the embodiments of the present invention will not be described in detail here. Any apparatus used by those skilled in the art to implement the attack event processing method in the embodiments of the present invention falls within the scope of protection of this application.

[0116] Example 4

[0117] Figure 4 A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0118] like Figure 4As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0119] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0120] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as attack event handling methods.

[0121] Optionally, the attack event handling method may include: acquiring event-triggered operation association data of a target-triggered event in the target system in real time; performing broad-spectrum detection on the event-triggered operation association data using an attack event broad-spectrum mapping model to generate broad-spectrum attack detection association data; performing intent reasoning on the broad-spectrum attack detection association data using an attack event dynamic evolution engine to obtain an attack intent hypothesis to be verified for the target-triggered event; determining an attack event dynamic evolution strategy that matches the attack intent hypothesis to be verified, and performing attack detection on the current real-time operation association data of the target-triggered event using the attack event dynamic evolution strategy.

[0122] In some embodiments, the attack event handling method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the attack event handling method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to execute the attack event handling method by any other suitable means (e.g., by means of firmware).

[0123] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0124] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0125] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0126] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0127] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0128] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0129] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0130] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. An attack event processing method characterized by comprising: The method comprises the following steps: real-time acquisition of event trigger operation correlation data of a target trigger event in a target system; wide-spectrum detection of the event trigger operation correlation data by an attack event wide-spectrum mapping model to generate wide-spectrum attack detection correlation data; intention reasoning of the wide-spectrum attack detection correlation data by an attack event dynamic evolution engine to obtain a to-be-verified attack intention hypothesis of the target trigger event; determination of an attack event dynamic evolution strategy matched with the to-be-verified attack intention hypothesis, and attack detection of current real-time operation correlation data of the target trigger event by the attack event dynamic evolution strategy.

2. The method of claim 1, wherein, The real-time acquisition of event trigger operation correlation data of a target trigger event in a target system comprises the following steps: real-time acquisition of multi-modal original log data of the target trigger event; conversion of the multi-modal original log data into target structured field data; mapping of the target structured field data to a target preset standard entity to obtain the event trigger operation correlation data.

3. The method of claim 1, wherein, The wide-spectrum detection of the event trigger operation correlation data by an attack event wide-spectrum mapping model to generate wide-spectrum attack detection correlation data comprises the following steps: wide-spectrum detection of the event trigger operation correlation data by the attack event wide-spectrum mapping model, generation of an attack event label of the target trigger event according to a target attack event wide-spectrum mapping model matched with the event trigger operation correlation data; acquisition of context correlation data of the target trigger event; taking the attack event label and the context correlation data of the target trigger event as the wide-spectrum attack detection correlation data of the target trigger event.

4. The method of claim 1, wherein, The intention reasoning of the wide-spectrum attack detection correlation data by an attack event dynamic evolution engine to obtain a to-be-verified attack intention hypothesis of the target trigger event comprises the following steps: analysis of the wide-spectrum attack detection correlation data by the attack event dynamic evolution engine to determine system operation permissions and / or abnormal associated events triggered by the target trigger event; intention reasoning according to the system operation permissions and / or abnormal associated events triggered by the target trigger event to obtain the to-be-verified attack intention hypothesis.

5. The method of claim 1, wherein, The attack detection of current real-time operation correlation data of the target trigger event by the attack event dynamic evolution strategy comprises the following steps: forward evidence detection of the current real-time operation correlation data of the target trigger event by the attack event dynamic evolution strategy to determine a hit result of the to-be-verified attack intention hypothesis, and obtain a forward attack detection result; negative evidence detection of the current real-time operation correlation data of the target trigger event by the attack event dynamic evolution strategy to determine an exclusion result of the to-be-verified attack intention hypothesis, and obtain a negative attack detection result.

6. The method of claim 1, wherein, After the attack detection of the current real-time operation correlation data of the target trigger event by the attack event dynamic evolution strategy, the following step is further included: acquisition of attack detection correlation data of the current real-time operation correlation data; wherein the attack detection correlation data comprises a verified attack scenario label, an excluded intention hypothesis, and a confidence score. The multi-dimensional attack event comprehensive analysis report of the target trigger event is generated according to attack detection association data of the current real-time operation association data, wherein the multi-dimensional attack event comprehensive analysis report comprises a multi-dimensional attack event portrait and a visual attack chain.

7. An attack event processing apparatus characterized by comprising: Comprise: An event trigger operation association data acquisition module, configured to acquire event trigger operation association data of a target trigger event in a target system in real time; An event association data broad-spectrum detection module, configured to perform broad-spectrum detection on the event trigger operation association data through an attack event broad-spectrum mapping model to generate broad-spectrum attack detection association data; An event attack intention reasoning module, configured to perform intention reasoning on the broad-spectrum attack detection association data through an attack event dynamic evolution engine to obtain a to-be-verified attack intention hypothesis of the target trigger event; An event operation association data attack detection module, configured to determine an attack event dynamic evolution strategy matched with the to-be-verified attack intention hypothesis, and perform attack detection on current real-time operation association data of the target trigger event through the attack event dynamic evolution strategy.

8. An electronic device, comprising: The electronic device comprises: At least one processor; and A memory connected in communication with the at least one processor; wherein The memory stores a computer program executed by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the attack event processing method in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions, and the computer instructions are used to enable the processor to execute the attack event processing method in any one of claims 1-6 when executed.

10. A computer program product, characterised in that, Comprise computer program / instructions, wherein the computer program / instructions are executed by the processor to implement the attack event processing method in any one of claims 1-6.

Images