A method of modeling host abnormal behavior
By normalizing and analyzing the causal relationships of multi-source log data, a source tracing graph is constructed and key edges are identified, which solves the problem of low attack source tracing efficiency in existing technologies and achieves efficient and accurate attack path reconstruction and anomaly detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- XIDIAN UNIV
- Filing Date
- 2026-02-05
- Publication Date
- 2026-06-02
AI Technical Summary
Existing technologies struggle to efficiently and accurately extract key security events from massive amounts of multi-source log data and reconstruct complete attack paths, resulting in low efficiency in attack tracing and behavioral analysis. Furthermore, traditional methods are prone to missing crucial steps.
By normalizing multi-source log data, constructing a source graph and performing causal relationship analysis, and combining LDA and KMeans++ clustering algorithms, key edges are identified and attack paths are constructed, thus achieving standardized expression of multi-source log data and connection of causal relationships.
It improves the accuracy and efficiency of anomaly detection and attack attribution, eliminates analytical biases caused by inconsistent data formats, and enhances the visualization and interpretability of attack paths.
Smart Images
Figure CN121664567B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of network security technology, and in particular to a method for modeling abnormal host behavior. Background Technology
[0002] With the widespread application of computer systems and the rapid development of the Internet, the security of hosts, as core components of networks, has become a major concern in the field of network security technology. In various network environments, hosts not only carry critical business data and services but also frequently become primary targets of network attacks. Abnormal host behavior typically manifests as violations of normal operating procedures, unauthorized access, abnormal resource consumption, and malware activity. These abnormal behaviors not only threaten the normal operation of the system but may also lead to data leaks, service interruptions, and even more serious network security incidents. Therefore, timely detection, analysis, and tracing of abnormal host behavior are crucial for ensuring network security.
[0003] After an attack occurs, security analysts need to trace and reconstruct the complete attack process based on limited alert data, i.e., attack clues. This process is called attack investigation. The core objectives of attack investigation are to find the attack entry point, identify affected systems and data, assess the scope of damage, and take corresponding measures to restore business operations, patch vulnerabilities, remove backdoors, and reduce future risks through security hardening. Traditional attack investigation methods mainly rely on security analysts manually correlating attack events, combining log data and professional experience to determine the attack origin and its scope of impact. However, modern cyberattacks often involve multiple targets and have long-term latency capabilities, employing highly covert techniques, which poses a serious challenge to traditional investigation methods. In addition, security devices generate a massive number of alerts every day, most of which are irrelevant "background noise" originating from normal operation or attack activities with no actual impact. Manual analysis is not only time-consuming but also prone to missing key attack steps, making it difficult to quickly and accurately determine the scope of damage.
[0004] To improve the efficiency and accuracy of attack investigations, security information management systems (SIEMs) are used to collect multi-source logs and alert data. These SIEMs reconstruct attack trajectories based on spatiotemporal correlation rules or known attack patterns. However, these SIEMs often rely on predefined rules or historical attack samples, making them ineffective in dealing with novel, unknown, or complex attacks spanning multiple hosts and network nodes. Therefore, achieving efficient and accurate attack attribution and behavioral analysis in the face of constantly evolving attack methods and massive amounts of log data has become a pressing issue in the field of cybersecurity. Summary of the Invention
[0005] To address the aforementioned technical challenges, this application proposes a modeling method for abnormal host behavior. This method aims to efficiently extract key security events from massive amounts of multi-source log data and reconstruct complete attack paths, deeply mine the causal relationships between system entities, and enhance the logical connections between events, thereby significantly improving the accuracy of anomaly detection and attack tracing.
[0006] To achieve the above objectives, embodiments of this application propose a method for modeling abnormal host behavior. The method includes the following steps: acquiring multi-source log data of the target host and normalizing the multi-source log data based on parameter heterogeneity and operation type divergence; defining a quadruple consisting of subject, object, edge relationship, corresponding attributes, and timestamp based on the normalized multi-source log data, modeling the interaction relationships between system entities, and constructing a source graph; reducing the source graph based on the rules for merging events with the same timestamp and the rules for merging events with the same time window, to obtain a reduced source graph; performing backward causal relationship analysis and forward causal relationship analysis on the reduced source graph, and constructing a complete attack path based on the analysis results.
[0007] To achieve the above objectives, embodiments of this application also propose a modeling device for abnormal host behavior. The device includes: a normalization processing module for acquiring multi-source log data of the target host and normalizing the multi-source log data based on parameter heterogeneity and operation type divergence; a source graph construction module for defining quadruples composed of subject, object, edge relationships, corresponding attributes, and timestamps based on the normalized multi-source log data, modeling the interaction relationships between system entities, and constructing a source graph; a source graph reduction module for reducing the source graph based on rules for merging events with the same timestamp and rules for merging events with the same time window, obtaining a reduced source graph; and an attack path construction module for performing backward causal analysis and forward causal analysis on the reduced source graph, constructing a complete attack path based on the analysis results.
[0008] To achieve the above objectives, embodiments of this application also propose an electronic device, including: a processor and a memory, wherein the memory stores instructions executable by the processor, and the processor is configured to execute the instructions such that the electronic device can implement a host abnormal behavior modeling method as described above.
[0009] To achieve the above objectives, embodiments of this application also propose a computer-readable storage medium storing a computer program that, when executed by a processor, enables a method for modeling abnormal host behavior as described above.
[0010] Optionally, parameter heterogeneity includes:
[0011] ETW uses the SourceIP / DestinationIP and SourcePort / DestinationPort fields to describe the receiving parties in the network. FiveDirections uses the localAddress / remoteAddress and localPort / remotePort fields for naming. The protocol fields have naming differences between Protocol and ipProtocol.
[0012] Operation type disagreements include:
[0013] ETW uses NetConnection events to uniformly describe network interaction behavior, with FiveDirections further divided into three operation types: EVENT_SENDTO, EVENT_RECVFROM, and EVENT_CONNECT.
[0014] Optionally, multi-source log data from the target host is acquired, and the multi-source log data is normalized to account for parameter heterogeneity and operational type discrepancies, including:
[0015] Map the ETW's SourceIP field and FiveDirections' localAddress field to the source IP identifier sip, and map the ETW's DestinationIP field and FiveDirections' remoteAddress field to the destination IP identifier rip.
[0016] Regarding port parameters, the ETW's SourcePort field and FiveDirections' localPort field are uniformly mapped to the source port sport, and the ETW's DestinationPort field and FiveDirections' remotePort field are uniformly mapped to the destination port rport.
[0017] Standardize the protocol fields to use the protocol identifier;
[0018] The ETW's NetConnection events and the three types of operations of FiveDirections, EVENT_SENDTO, EVENT_RECVFROM, and EVENT_CONNECT, are semantically encapsulated by defining a unified operation predicate socket.
[0019] Optionally, based on the normalized multi-source log data, a quadruple consisting of subject, object, edge relationship, corresponding attributes, and timestamp is defined to model the interaction relationships between system entities, thus constructing a source graph, including:
[0020] Define quadruples based on normalized multi-source log data. The interaction relationships between entities in the modeling system are used to construct a source graph, in which... Indicates the subject, Indicates the object, express and The edge relationships and corresponding attributes between them. Indicates the timestamp of the event;
[0021] For any edge in the source graph , ,have ;
[0022] For any two edges in the source graph and , , ,like and Then it is believed and There are dependencies between them.
[0023] Optionally, based on the rules for merging events with the same timestamp and the rules for merging events with the same time window, the source graph is reduced to obtain a reduced source graph, including:
[0024] In the system log, when a process processes files in batches, it will generate events with the same time. These events are represented as many connections with the same timestamp in the source graph. By identifying the event type and the operation object, multiple edges with the same and related timestamps are merged into one, preserving the time characteristics and reducing interference information.
[0025] Based on a preset time window, duplicate events with the same event type and the same key attributes within the window period are merged and grouped into a unified edge. The timestamp of the earliest event is retained as the time identifier, and finally a reduced source graph is obtained.
[0026] Optionally, backward causality analysis and forward causality analysis are performed on the reduced source map, including:
[0027] A backward causal relationship analysis is performed on the reduced source graph. Starting from the alarm point, related events and entities are traced backward along the time axis to construct a closely related backward analysis graph. Based on the quantity weight, time weight, and the in-degree to out-degree ratio of event nodes, the weights of the edges in the backward analysis graph are calculated in detail. Then, LDA (Linear Discriminant Analysis) and KMeans++ clustering algorithm (an improved version of KMeans clustering algorithm) are combined to identify key edges. Finally, the node with the highest node reputation value is identified as the initial intrusion point by calculating the node reputation value.
[0028] Based on the key nodes and key edges identified in the backward causal relationship analysis, forward causal relationship analysis is performed. Starting from the initial intrusion point, forward traversal is carried out along the event relationships. If the target entity of an event has not yet been visited, it is added to the entity list, and its corresponding event is simultaneously recorded in the edge list, thereby gradually constructing the forward analysis graph. In particular, each initial intrusion point independently performs forward causal relationship analysis to fully depict the spread trend and scope of the attack.
[0029] Optionally, a complete attack path can be constructed based on the analysis results, including:
[0030] The forward and backward analysis graphs are merged to obtain a fused analysis graph;
[0031] On the fusion analysis graph, the alarm point is taken as the starting point and its formation path is traced back to construct a complete attack path. In the process of constructing the attack path, the upstream entities associated with the alarm point are traced up layer by layer, and key indicators, including the number of hops, total weight and average weight, are recorded in real time.
[0032] The most representative attack paths are selected through a pre-defined path optimization mechanism, and the branches with the highest average weight are retained first.
[0033] When different paths point to the same node, the path with the highest average weight is automatically selected to ensure the accuracy and completeness of the attack path.
[0034] This application proposes a method for modeling abnormal host behavior. It normalizes multi-source log data, unifying node and edge types, and transforms abnormal behavior analysis into graph-based analysis. This standardized representation of multi-source log data eliminates analytical biases caused by inconsistent data formats. The multi-source log data is represented as a source graph, where nodes represent system entities (e.g., processes, files, network connections) and edges represent relationships between entities (e.g., process creation, file reading / writing, network communication). This graph-structured representation enables correlation analysis of multi-source log data, allowing previously isolated log events to be linked together through causal relationships, thereby improving the visualization and interpretability of attack paths. During attack path reconstruction, bidirectional causal relationship analysis, triple weighting, LDA, and K-means++ clustering algorithms are combined to identify key edges. Reputation value propagation is used to sort initial intrusion points, and breadth-first search and average weight calculation are combined to ultimately identify the attack path. This method deeply mines the causal relationships between system entities, strengthens the logical connections between events, and significantly improves the accuracy of anomaly detection and attack tracing. Attached Figure Description
[0035] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies of this application will be briefly introduced below. Obviously, the following drawings are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. The drawings described herein are only used to explain this application and are not intended to limit this application.
[0036] Figure 1 This is a flowchart illustrating a method for modeling abnormal host behavior according to an embodiment of this application;
[0037] Figure 2 This is a structural diagram of a host abnormal behavior modeling device provided in another embodiment of this application;
[0038] Figure 3 This is a structural diagram of an electronic device provided in another embodiment of this application. Detailed Implementation
[0039] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the various embodiments of this application will be described in detail below with reference to the accompanying drawings. Those skilled in the art will understand that many technical details have been presented in the embodiments of this application to facilitate better understanding. However, the technical solutions claimed in this application can be implemented even without these technical details and various variations and modifications based on the following embodiments. The division of the following embodiments is for ease of description and should not constitute any limitation on the specific implementation of this application. The following embodiments can be combined with and referenced by each other without contradiction.
[0040] One embodiment of this application proposes a method for modeling abnormal host behavior, applied to a server. The implementation details of the method for modeling abnormal host behavior proposed in this embodiment are described below. The following implementation details are provided for ease of understanding and are not necessary for implementing this solution.
[0041] The specific process of the host abnormal behavior modeling method proposed in this embodiment is as follows: Figure 1 As shown, it includes:
[0042] Step 11: Obtain multi-source log data from the target host, and normalize the multi-source log data based on parameter heterogeneity and operation type differences.
[0043] In practical implementation, for target hosts requiring abnormal behavior modeling, the server first needs to acquire multi-source log data from the target host. Then, considering parameter heterogeneity and operational type discrepancies, the acquired multi-source log data is normalized. Multi-source log data often suffers from missing context and inconsistent semantic representation, making it difficult for the server to effectively correlate security events from different sources. This affects the accuracy of anomaly detection and the completeness of attack attribution. Normalization effectively solves these problems, achieving standardized representation of multi-source log data and improving the compatibility and consistency of cross-platform log analysis.
[0044] In one example, the differences between multi-source log data mainly include two parts: parameter heterogeneity and operation type divergence. The following explanation uses ETW (Event Tracing for Windows, the built-in event tracing mechanism in Windows systems) and FiveDirections (the built-in event tracing mechanism in Firefox) as examples.
[0045] For cases with heterogeneous parameters:
[0046] ETW uses the SourceIP / DestinationIP and SourcePort / DestinationPort fields to describe the receiving parties in the network. FiveDirections uses the localAddress / remoteAddress and localPort / remotePort fields for naming. The protocol fields have naming differences between Protocol and ipProtocol.
[0047] It should be noted that SourceIP, DestinationIP, SourcePort, and DestinationPort are fields used by ETW to describe the receiving parties in the network. Protocol is a protocol field of ETW. localAddress, remoteAddress, localPort, and remotePort are fields used by FiveDirections to describe the receiving parties in the network. ipProtocol is a protocol field of FiveDirections. These fields do not have Chinese explanations.
[0048] Regarding the disagreement on the type of operation:
[0049] ETW uses NetConnection events to uniformly describe network interaction behavior, with FiveDirections further divided into three operation types: EVENT_SENDTO, EVENT_RECVFROM, and EVENT_CONNECT.
[0050] It is important to note that NetConnection events are used by ETW to describe network interaction behavior. EVENT_SENDTO, EVENT_RECVFROM, and EVENT_CONNECT are three operation types defined in FiveDirections, and these events and operation types do not have Chinese explanations.
[0051] In response to the heterogeneity of parameters and the differences in operation types between ETW and FiveDirections, the HST framework (HST is a file extension with no Chinese explanation) normalizes multi-source log data by constructing a unified semantic mapping table.
[0052] Map the ETW's SourceIP field and FiveDirections' localAddress field to the source IP identifier sip, and map the ETW's DestinationIP field and FiveDirections' remoteAddress field to the destination IP identifier rip.
[0053] Regarding port parameters, the ETW's SourcePort field and FiveDirections' localPort field are uniformly mapped to the source port sport, and the ETW's DestinationPort field and FiveDirections' remotePort field are uniformly mapped to the destination port rport.
[0054] The protocol fields are standardized to the protocol identifier.
[0055] The ETW's NetConnection events and the three types of operations of FiveDirections, EVENT_SENDTO, EVENT_RECVFROM, and EVENT_CONNECT, are semantically encapsulated by defining a unified operation predicate socket.
[0056] At this point, the normalization process for multi-source log data is complete.
[0057] It should be noted that sip, rip, sport, rport, protocol, and socket are all identifiers used after unified mapping and have no Chinese explanation.
[0058] Step 12: Based on the normalized multi-source log data, define a quadruple consisting of subject, object, edge relationship, corresponding attributes and timestamp, model the interaction relationship between system entities, and construct the source graph.
[0059] In the specific implementation, after the server completes the normalization processing of multi-source log data, it can define a quadruple consisting of subject, object, edge relationship and corresponding attributes and timestamp based on the normalized multi-source log data, model the interaction relationship between system entities, and construct the source graph.
[0060] In one example, the server needs to define quadruples based on normalized multi-source log data. To model the interaction relationships between system entities, a source graph is constructed, in which... Indicates the subject, Indicates the object, express and The edge relationships and corresponding attributes between them. This represents the timestamp of the event. For any edge in the source graph... , ,have .
[0061] For any two edges in the source graph and , , ,like and Then it is believed and There are dependencies between them.
[0062] Each node in the source graph is assigned corresponding attributes, and each edge records the relationships between nodes in detail. Based on the "who ( To whom () What did they do, and when? The information ")" is used to continuously expand entity nodes and establish event-driven dependency edges, thereby constructing a complete traceability graph.
[0063] Step 13: Based on the rules for merging events with the same timestamp and the rules for merging events with the same time window, the source graph is reduced to obtain the reduced source graph.
[0064] In practice, due to the massive amount of system logs, the resulting source graph is enormous, leading to an exponential increase in search paths, excessive computational overhead, a surge in storage pressure, and a decline in query efficiency. Therefore, the server needs to reduce the source graph based on rules for merging events with the same timestamp and rules for merging identical events within a time window, resulting in a reduced source graph.
[0065] In one example, the server first merges events with the same timestamp. In the system logs, processes batch-processing files generate events with the same time. These events appear as many connections with the same timestamp in the source graph. By identifying the event type and the operation object, the server can merge multiple related edges with the same timestamp into one, thus preserving the time characteristics and reducing interference. Next, the server merges identical events within a time window. Based on a preset time window, the server merges repeated events with the same event type and the same key attributes within the window, grouping them into a unified edge and retaining the timestamp of the earliest occurring event as the time identifier, ultimately obtaining a reduced source graph.
[0066] Step 14: Perform backward causality analysis and forward causality analysis on the reduced source graph, and construct a complete attack path based on the analysis results.
[0067] In practice, after obtaining the reduced source graph, the server can perform backward causal analysis and forward causal analysis on the reduced source graph, and construct a complete attack path based on the analysis results.
[0068] In one example, the server first performs backward causal analysis on the reduced source graph, taking the alarm point as the starting point and tracing related events and entities backward along the time axis to construct a closely related backward analysis graph. Based on the quantity weight, time weight, and the in-degree to out-degree ratio of event nodes, the weights of the edges in the backward analysis graph are calculated in detail. Then, the key edges are identified by combining LDA and KMeans++ clustering algorithms. Finally, the node with the highest node reputation value is identified as the initial intrusion point by calculating the node reputation value.
[0069] In one example, starting from the alarm point, the reduced source graph is traversed backward along the time axis (from late to early), retaining only nodes and edges that have a "direct / indirect causal relationship" with the alarm point, forming a non-redundant backward analysis graph. , , , , Represents the node set of the backward analysis graph. In the backward analysis graph, the first... 1 node Describes the edge set of the backward analysis graph. express arrive The causal edge, yes The causal precursor, and . It's a timeline constraint to avoid introducing irrelevant historical nodes. During reverse tracing, it starts from the alert point. Start by finding all the predecessor edges that point to it, and then recursively trace the predecessor of the predecessor node until there are no earlier causal nodes.
[0070] Edge weight Reflects right The causal strength influence needs to be considered in conjunction with quantity weights. Time weight Weights compared to node degree The three dimensions are obtained through linear weighted fusion, and the weight coefficients of the linear weighted fusion can be optimized through cross-validation. Among them, the node degree ratio is the weight. That is, the ratio of the in-degree to the out-degree of an event node.
[0071] Quantity weight measure and Frequency of association between them Historically triggered The more times they occur, the stronger the causal relationship between them.
[0072] Quantity weight The calculation formula is:
[0073] ;
[0074] in, Represents the source diagram trigger The total number of historical times, Represents the source diagram trigger The total number of historical times, express The set of all causal predecessor nodes, i.e., the denominator of the above equation. The sum of the number of times all causal predecessor nodes are triggered.
[0075] Time weight measure and The closer the time interval between causal events, the stronger the correlation. For example, "file writing triggered within 1 second after process creation" is more likely to be a direct intrusion than "file writing triggered 1 hour after process creation".
[0076] Time weight The calculation formula is:
[0077] ;
[0078] in, This is the preset attenuation coefficient, which is usually set to 0.1.
[0079] Node degree ratio weight The purity of a node's causal influence is measured by the ratio of its in-degree to its out-degree. The small out-degree and large in-degree indicate that It is more likely to be a passive trigger rather than an active influencer, and its causal weight on subsequent nodes should be reduced, and vice versa.
[0080] Node degree ratio weight The calculation formula is:
[0081] ;
[0082] in, express The number of incoming edges, i.e. in-degree, express The number of outgoing edges, i.e. The out-degree is increased by 1 in the numerator and 2 in the denominator to avoid extreme weighting caused by 0 in-degree or 0 out-degree, that is, to set the weight of isolated nodes to 0.5.
[0083] Edge weight The calculation formula is:
[0084] ;
[0085] in, , , They are respectively , , The corresponding weight coefficients for linear weighted fusion are generally set to 0.3, 0.4, and 0.3, respectively.
[0086] After triple weighting, the server obtains a weighted backward analysis graph. , Each edge in the array has a unique weight. ,therefore Represented as .
[0087] When identifying key edges, the edges are first transformed into clusterable topic feature vectors using the LDA algorithm, and then the KMeans++ clustering algorithm is used to cluster the topic feature vectors to select edges with high weights and consistent topics as key edges.
[0088] The input to LDA topic modeling is the attribute features of each edge, such as event type and node type. During the modeling process, each edge is treated as a document, and the edge's attribute features are treated as words. The number of topics is obtained through LDA training. and each edge correspond Probability distribution of each topic (Topic feature vector) , Indicates the first Each component. The final output is the topic feature matrix for all edges. , , This represents the total number of edges. Indicates the first Each topic feature vector.
[0089] The KMeans++ clustering algorithm first selects initial cluster centers using distance-weighted probability to avoid the local optima problem caused by random initialization. Next, it uses cosine similarity to measure the similarity of the topic feature vectors of two edges, as cosine similarity effectively measures distribution consistency. After clustering all edges according to similarity, it calculates the average weight of the edges in each cluster and selects the one or two clusters with the highest average weights as the key edge clusters. Key edge cluster All edges inside the key edge are critical edges.
[0090] Finally, the initial intrusion point is determined by calculating the node reputation value. The initial intrusion point is the source node of the backward analysis graph (with no earlier critical edges pointing to it) and has the strongest association with the critical edges. This association strength is quantified by the node reputation value, and the node with the highest reputation value is the initial intrusion point.
[0091] The calculation of a node's reputation value consists of two parts, for each node... In terms of its node reputation value Reputation value of the first node Second node reputation value composition.
[0092] First node reputation value corresponding nodes It is the starting point of the critical edge, that is Since this node directly influences subsequent nodes through the critical edge, its weight is directly included in the reputation value of the first node. .
[0093] The calculation formula is: .
[0094] Second node reputation value Corresponding to node It is the endpoint of the critical edge, that is The influence of this node comes from its predecessor node, and the reputation value of the predecessor node needs to be recursively accumulated.
[0095] The calculation formula is: .
[0096] The calculation formula is: .
[0097] Next, you can... The largest node was identified as the initial intrusion point.
[0098] In one example, after the backward causal analysis is completed, forward causal analysis can be performed based on the key nodes and key edges identified in the backward causal analysis. Starting from the initial intrusion point, forward traversal is performed along the event relationships. If the target entity of an event has not yet been visited, it is added to the entity list and its corresponding event is recorded in the edge list, thereby gradually constructing the forward analysis graph.
[0099] It is important to note that each initial intrusion point independently performs forward causality analysis to generate multiple forward propagation paths, thereby fully depicting the spread trend and scope of the attack.
[0100] In one example, after performing backward and forward causal relationship analysis, the server can merge the forward and backward analysis graphs to obtain a fused analysis graph. On this fused graph, starting from the alert point, the attack path is traced back to construct a complete attack path. During this process, upstream entities are traced layer by layer from the alert point, and key metrics, including hop count, total weight, and average weight, are recorded in real time. The server uses a pre-defined path optimization mechanism to select the most representative attack paths, prioritizing the branch with the highest average weight. When different paths point to the same node, the path with the highest average weight is automatically selected to ensure the accuracy and completeness of the attack path.
[0101] This embodiment proposes a modeling method for abnormal host behavior. It normalizes multi-source log data to unify node and edge types, transforming abnormal behavior analysis into graph structure analysis. This standardized representation of multi-source log data eliminates analytical biases caused by inconsistent data formats. The multi-source log data is represented as a source graph, where nodes represent system entities (e.g., processes, files, network connections) and edges represent relationships between entities (e.g., process creation, file reading / writing, network communication). This graph-structured representation enables correlation analysis of multi-source log data, allowing previously isolated log events to be linked together through causal relationships, thereby improving the visualization and interpretability of attack paths. During attack path reconstruction, bidirectional causal relationship analysis, triple weighting, LDA, and K-means++ clustering algorithms are combined to identify key edges. Reputation value propagation is used to sort initial intrusion points, and breadth-first search and average weight calculation are combined to ultimately identify the attack path. This method deeply mines the causal relationships between system entities, strengthens the logical connections between events, and thus significantly improves the accuracy of anomaly detection and attack tracing.
[0102] The steps described above are for clarity only. In implementation, they can be combined into one step, or some steps can be broken down into multiple steps, as long as they involve the same logical relationship, they are all within the scope of protection of this application. Adding insignificant modifications or introducing insignificant designs to the algorithm or process, without changing the core design of the algorithm and process, are also within the scope of protection of this application.
[0103] Another embodiment of this application proposes a modeling device for abnormal host behavior. The details of the modeling device for abnormal host behavior proposed in this embodiment are described below. The following content is only for the convenience of understanding and is not necessary for implementing this solution. Figure 2This is a structural diagram of a host abnormal behavior modeling device proposed in this embodiment, including: a normalization processing module 21, a source graph construction module 22, a source graph reduction module 23, and an attack path construction module 24.
[0104] The normalization processing module 21 is used to obtain multi-source log data from the target host and perform normalization processing on the multi-source log data in response to parameter heterogeneity and operation type differences.
[0105] The source graph construction module 22 is used to define a quadruple consisting of subject, object, edge relationship and corresponding attributes and timestamp based on the normalized multi-source log data, to model the interaction relationship between system entities and construct the source graph.
[0106] The source graph reduction module 23 is used to reduce the source graph based on the rules for merging events with the same timestamp and the rules for merging events with the same time window, so as to obtain the reduced source graph.
[0107] The attack path construction module 24 is used to perform backward causal relationship analysis and forward causal relationship analysis on the reduced source graph, and construct a complete attack path based on the analysis results.
[0108] It is worth mentioning that all modules and units involved in this embodiment are logical modules. In practical applications, a logical unit can be a physical unit, a part of a physical unit, or a combination of multiple physical units. Furthermore, to highlight the innovative aspects of this application, this embodiment does not introduce units that are not closely related to solving the technical problems proposed in this application; however, this does not mean that other units do not exist in this embodiment.
[0109] It is not difficult to see that this embodiment is a system embodiment corresponding to the above method embodiments, and this embodiment can be implemented in conjunction with the above method embodiments. The relevant technical details and technical effects mentioned in the above method embodiments are still valid in this embodiment, and will not be repeated here to reduce repetition. Accordingly, the relevant technical details mentioned in this embodiment can also be applied to the above method embodiments.
[0110] Another embodiment of this application provides an electronic device, such as Figure 3 As shown, it includes a processor 31 and a memory 32. The memory 32 stores instructions that the processor 31 can execute. When the processor 31 is configured to execute the instructions, the electronic device can implement a host abnormal behavior modeling method as described in the above method embodiment.
[0111] The memory and processor are connected via a bus, which includes any number of interconnecting buses and bridges, connecting various circuits of one or more processors and the memory. The bus can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and will not be described further herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by the processor is transmitted over the wireless medium via an antenna, which further receives data and transmits it to the processor.
[0112] The processor manages the bus and general processing, and also provides various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory is used to store data used by the processor during operation.
[0113] Another embodiment of this application proposes a computer-readable storage medium storing a computer program that, when executed by a processor, enables a method for modeling abnormal host behavior as described in the above method embodiments.
[0114] That is, those skilled in the art will understand that all or part of the steps in the above method embodiments can be implemented by a program instructing related hardware. The program is stored in a storage medium and includes several instructions to cause a device (such as a microcontroller, chip, etc.) or processor to execute all or part of the steps of the method described in the method embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory, random access memory, magnetic disks, or optical disks.
[0115] Those skilled in the art will understand that the above embodiments are specific implementations of this application, and in practical applications, various changes can be made in form and detail without departing from the spirit and scope of this application. For those skilled in the art, several improvements and modifications can be made without departing from the principles of this application, and these improvements and modifications are also considered to be within the scope of protection of this application.
Claims
1. A method for modeling abnormal host behavior, characterized in that, include: Obtain multi-source log data from the target host, and normalize the multi-source log data based on parameter heterogeneity and operation type differences; Based on the normalized multi-source log data, a quadruple consisting of subject, object, edge relationship, corresponding attributes and timestamp is defined to model the interaction relationship between system entities and construct the source graph. Based on the rules for merging events with the same timestamp and the rules for merging events with the same time window, the source graph is reduced to obtain the reduced source graph. Backward and forward causal relationship analyses are performed on the reduced source graph, and a complete attack path is constructed based on the analysis results; Backward and forward causal analysis were performed on the reduced source graph, including: A backward causal relationship analysis is performed on the reduced source graph. Starting from the alarm point, related events and entities are traced backward along the time axis to construct a closely related backward analysis graph. Based on the quantity weight, time weight, and the in-degree to out-degree ratio of event nodes, the weight of the edges in the backward analysis graph is calculated in detail. Then, LDA and KMeans++ clustering algorithms are combined to identify key edges. Finally, the node with the highest node reputation value is identified as the initial intrusion point through node reputation value calculation. Based on the key nodes and key edges identified in the backward causal relationship analysis, forward causal relationship analysis is performed. Starting from the initial intrusion point, forward traversal is carried out along the event relationships. If the target entity of an event has not yet been visited, it is added to the entity list, and its corresponding event is simultaneously recorded in the edge list, thereby gradually constructing the forward analysis graph. In particular, each initial intrusion point independently performs forward causal relationship analysis to fully depict the spread trend and scope of the attack. The backward analysis diagram is as follows , , , , Represents the node set of the backward analysis graph. In the backward analysis graph, the first... 1 node Describes the edge set of the backward analysis graph. express arrive The causal edge, yes The causal precursor, , It is a timeline constraint to avoid introducing irrelevant historical nodes, starting from the alarm point during reverse tracing. Start by finding all the predecessor edges that point to it, and then recursively trace the predecessor of the predecessor node until there are no earlier causal nodes. Edge weight Reflects right The influence of causal strength Combining quantity weights Time weight Weights compared to node degree The three dimensions are obtained by linear weighted fusion. The weight coefficients of the linear weighted fusion are optimized through cross-validation. Among them, the node degree is greater than the weight. That is, the ratio of the in-degree to the out-degree of an event node; Quantity weight measure and Frequency of association between them Historically triggered The more times it occurs, the stronger the causal relationship between the two, and the greater the quantity weight. The calculation formula is: ； in, Represents the source diagram trigger The total number of historical times, Represents the source diagram trigger The total number of historical times, express The set of all causal predecessor nodes, i.e., the denominator of the above equation. The sum of the number of triggers of all causal predecessor nodes; Time weight measure and The closer the temporal proximity between causal events, the stronger the correlation; time weighting. The calculation formula is: ； in, The preset attenuation coefficient; Node degree ratio weight The purity of a node's causal influence is measured by the ratio of its in-degree to its out-degree. The small out-degree and large in-degree indicate that More likely to be a passive trigger than an active influencer, node degree is more important than weight. The calculation formula is: ； in, express The number of incoming edges, i.e. in-degree, express The number of outgoing edges, i.e. The degree of departure; Edge weight The calculation formula is: ； in, , , They are respectively , , The corresponding weighting coefficients for linear weighted fusion; After triple weighting, a weighted backward pie chart is obtained. , Each edge in the array has a unique weight. , ; When identifying key edges, the edges are first transformed into clusterable topic feature vectors using the LDA algorithm, and then the KMeans++ clustering algorithm is used to cluster the topic feature vectors to select edges with high weights and consistent topics as key edges. The input to LDA topic modeling is the attribute features of each edge. During the modeling process, each edge is treated as a document, and the attribute features of the edges are treated as words. The number of topics is obtained through LDA training. and each edge correspond Probability distribution of each topic That is, the main feature vector. , Indicates the first Each component is used to ultimately output the topic feature matrix of all edges. , , This represents the total number of edges. Indicates the first Each topic feature vector; The KMeans++ clustering algorithm first selects initial cluster centers using distance-weighted probability to avoid the local optima problem caused by random initialization. Next, it uses cosine similarity to measure the similarity of the topic feature vectors of two edges. After clustering all edges into clusters based on similarity, it calculates the average weight of the edges in each cluster and selects the one or two clusters with the highest average weights as the key edge clusters. Key edge cluster All edges inside the key edge are critical edges; The calculation of a node's reputation value consists of two parts, for each node... In terms of its node reputation value Reputation value of the first node Second node reputation value composition; First node reputation value corresponding nodes It is the starting point of the critical edge, that is Since this node directly influences subsequent nodes through the critical edge, its weight is directly included in the reputation value of the first node. ; The calculation formula is: ; Second node reputation value Corresponding to node It is the endpoint of the critical edge, that is The influence of this node comes from its predecessor node, and the reputation value of the predecessor node needs to be recursively accumulated. The calculation formula is: ; The calculation formula is: ; Will The largest node was identified as the initial intrusion point.
2. The method for modeling abnormal host behavior according to claim 1, characterized in that, Parameter heterogeneity includes: ETW uses the SourceIP / DestinationIP and SourcePort / DestinationPort fields to describe the receiving parties in the network. FiveDirections uses the localAddress / remoteAddress and localPort / remotePort fields for naming. The protocol fields have naming differences between Protocol and ipProtocol. Operation type disagreements include: ETW uses NetConnection events to uniformly describe network interaction behavior, with FiveDirections further divided into three operation types: EVENT_SENDTO, EVENT_RECVFROM, and EVENT_CONNECT.
3. The method for modeling abnormal host behavior according to claim 2, characterized in that, Obtain multi-source log data from the target host, and normalize the multi-source log data based on parameter heterogeneity and operation type differences, including: Map the ETW's SourceIP field and FiveDirections' localAddress field to the source IP identifier sip, and map the ETW's DestinationIP field and FiveDirections' remoteAddress field to the destination IP identifier rip. Regarding port parameters, the ETW's SourcePort field and FiveDirections' localPort field are uniformly mapped to the source port sport, and the ETW's DestinationPort field and FiveDirections' remotePort field are uniformly mapped to the destination port rport. Standardize the protocol fields to use the protocol identifier; The ETW's NetConnection events and the three types of operations of FiveDirections, EVENT_SENDTO, EVENT_RECVFROM, and EVENT_CONNECT, are semantically encapsulated by defining a unified operation predicate socket.
4. The method for modeling abnormal host behavior according to claim 1, characterized in that, Based on the normalized multi-source log data, a quadruple consisting of subject, object, edge relationship, corresponding attributes, and timestamp is defined to model the interaction relationships between system entities, thus constructing a source graph, including: Quadruples are defined based on multi-source log data after normalization. The interaction relationships between entities in the modeling system are used to construct a source graph, in which... Indicates the subject, Indicates the object, express and The edge relationships and corresponding attributes between them. Indicates the timestamp of the event; For any edge in the source graph , ,have ; For any two edges in the source graph and , , ,like and Then it is believed and There are dependencies between them.
5. The method for modeling abnormal host behavior according to claim 1, characterized in that, Based on the rules for merging events with the same timestamp and the rules for merging events with the same time window, the source graph is reduced to obtain the reduced source graph, including: In the system log, when a process processes files in batches, it will generate events with the same time. These events are represented as many connections with the same timestamp in the source graph. By identifying the event type and the operation object, multiple edges with the same and related timestamps are merged into one, preserving the time characteristics and reducing interference information. Based on a preset time window, duplicate events with the same event type and the same key attributes within the window period are merged and grouped into a unified edge. The timestamp of the earliest event is retained as the time identifier, and finally a reduced source graph is obtained.
6. The method for modeling abnormal host behavior according to claim 1, characterized in that, Based on the analysis results, a complete attack path is constructed, including: The forward and backward analysis graphs are merged to obtain a fused analysis graph; On the fusion analysis graph, the alarm point is taken as the starting point and its formation path is traced back to construct a complete attack path. In the process of constructing the attack path, the upstream entities associated with the alarm point are traced up layer by layer, and key indicators, including the number of hops, total weight and average weight, are recorded in real time. The most representative attack paths are selected through a pre-defined path optimization mechanism, and the branches with the highest average weight are retained first. When different paths point to the same node, the path with the highest average weight is automatically selected to ensure the accuracy and completeness of the attack path.
7. A modeling apparatus for abnormal host behavior, used to implement a modeling method for abnormal host behavior as described in any one of claims 1 to 6, characterized in that, include: The normalization processing module is used to obtain multi-source log data from the target host and normalize the multi-source log data in response to parameter heterogeneity and operation type differences. The source graph construction module is used to define a quadruple consisting of subject, object, edge relationship, corresponding attributes and timestamp based on normalized multi-source log data, model the interaction relationship between system entities and construct the source graph. The source graph reduction module is used to reduce the source graph based on the rules for merging events with the same timestamp and the rules for merging events with the same time window, so as to obtain the reduced source graph. The attack path construction module is used to perform backward causal analysis and forward causal analysis on the reduced source graph, and construct a complete attack path based on the analysis results.
8. An electronic device, characterized in that, include: A processor and a memory, wherein the memory stores instructions that the processor can execute, and the processor is configured to, when executing the instructions, enable the electronic device to implement a host abnormal behavior modeling method as described in any one of claims 1 to 6.
9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it can implement a modeling method for abnormal host behavior as described in any one of claims 1 to 6.