APT attack traceability graph construction method based on dynamic sliding window and multi-dimensional time sequence scoring

Abstract

The invention discloses an APT attack traceability graph construction method based on a dynamic sliding window and multi-dimensional time sequence scoring. The method comprises the following steps: collecting multi-source heterogeneous system audit log data, analyzing the multi-source heterogeneous system audit log data into a standardized entity interaction tetrad flow, and constructing a continuous time sequence evolution dynamic traceability graph snapshot through a sliding window mechanism; in order to solve the problems that an existing total traceability graph causes scale explosion along with long-term operation of a system and a traditional statistical pruning method is prone to losing low-frequency key attack semantics, topological connection strength of nodes, time sequence burstiness of interaction frequency and causal association with threat intelligence are utilized, and the probability of low-frequency key attack semantics is lowered. A three-dimensional lightweight scoring model is constructed to quantify node values, and a safety anchor point mechanism is introduced for forced retention for high-risk nodes hitting threat intelligence or key assets, so that the high-risk nodes are prevented from being rejected as noise due to relatively low frequency; and for other background nodes, an exponential moving average algorithm is utilized to capture behavior burst characteristics and perform dynamic Top-K pruning, system interaction with high information content is reserved while denoising is performed, and finally a traceability graph sequence considering scale simplification and semantic completeness is generated. According to the method provided by the invention, the key semantic information of the APT attack can be effectively reserved while the data scale and the calculation overhead are greatly reduced.

Description

Technical Field

[0001] This invention belongs to the field of cyberspace security technology, specifically a method for constructing an APT attack attribution graph based on dynamic sliding window and multi-dimensional temporal scoring. Background Technology

[0002] With the evolution of cyberattack techniques, Advanced Persistent Threats (APTs) have become one of the biggest challenges to cyberspace security. APT attacks are typically characterized by long incubation periods, high stealth, and multiple attack steps. Attackers often use legitimate system tools to remain in systems for extended periods, making traditional signature-based detection methods ineffective.

[0003] Provenance graphs, as a comprehensive attack detection method based on system audit logs, can effectively reconstruct the full picture of an attack by recording the causal interactions between entities such as processes, files, and network sockets in the system. However, in real-world large-scale system monitoring scenarios, existing provenance graph construction and analysis technologies face significant challenges:

[0004] "Dependency explosion" and resource bottlenecks: The massive amount of system logs can cause the size of the traceability graph to grow linearly or even exponentially over time, resulting in memory overflow (OOM) and computing performance bottlenecks, making it extremely impractical to trace back historical data over a long period of time.

[0005] Loss of low-frequency critical attacks: Existing graph compression or pruning algorithms (such as those based on PageRank or simple frequency filtering) often only focus on topology or static frequency. This makes it easy for some low-frequency but highly threatening critical behaviors (such as heartbeat packets of C&C connections or malicious scripts triggered by scheduled tasks) to be mistakenly deleted as noise, resulting in loss of attack semantics and breakage of causal chains. Summary of the Invention

[0006] This invention proposes a method for constructing an APT attack source graph based on a dynamic sliding window and multi-dimensional time-series scoring, aiming to resolve the contradiction between uncontrollable resource consumption and loss of key attack semantics under massive log monitoring.

[0007] The technical solution for implementing this invention is: a method for constructing an APT attack attribution graph based on a dynamic sliding window and multi-dimensional temporal scoring, comprising the following steps:

[0008] Step 1, Data Preprocessing and Standardization: Obtain the raw audit logs of the computer system, extract entity attributes and interaction behaviors through the log parser, and map them uniformly into a standardized four-tuple event flow;

[0009] Step 2, Construction of Temporal Heterogeneous Graph: Set a fixed-length time window and sliding step size Based on the sliding window strategy, the quadruple event flow is divided into a series of continuously evolving dynamic traceability graph snapshots, and incremental injection and expiration elimination mechanisms are executed during the snapshot update process;

[0010] Step 3, Multidimensional Importance Scoring: For nodes in the current graph snapshot, construct a three-dimensional scoring model that includes structural importance, temporal importance, and causal importance to quantify the value of nodes within the current time window;

[0011] Step 4, Dynamic Graph Reduction and Reconstruction: Based on node value scoring, a dual-path pruning strategy combining safe anchor point priority and Top-K completion is implemented to remove low-value background noise and generate a reduced induced subgraph;

[0012] Step 5, Prior Feature Embedding: Transform the node type information in the reduced graph and the calculated 3D score into vectorized features, and output a source graph sequence containing temporal dynamic features and core semantics.

[0013] Furthermore, in step 1, the format of the quadruple event stream is as follows: ,in Represents the main node, Represents the object node, This represents the interaction relationship after semantic normalization. The timestamp; the entity types of the subject node and object node include processes, files, and network sockets; the interaction relationship These are categorized into atomic interaction types, including file read and write operations (Read, Write), code execution and loading (Execute), process forking (Fork), attribute modification (Modify_Attribute), anti-forensic deletion (Unlink), permission change (Change_Principal), and network communication loop (Connect, Send, Recvfrom).

[0014] Further, in step 2, the temporal heterogeneous graph is constructed, specifically using the following method:

[0015] Set sliding step size Smaller than the time window This causes time overlap between adjacent snapshots;

[0016] Incremental injection mechanism: When a new event enters the current window, if the node already exists, its latest active timestamp is updated; if the edge already exists, the weight attribute of the edge is increased to record the interaction frequency.

[0017] Expiration and removal mechanism: As the window slides, the entire graph is periodically scanned. If the latest active timestamp of a node is less than the start time of the current window, and the node has not been marked as a safe anchor, then the node and its associated edges are removed from memory.

[0018] Furthermore, in step 3, the calculation logic of the three-dimensional scoring model is as follows:

[0019] Structural importance: Calculate the sum of the in-degree and out-degree of a node within the current window, and then perform logarithmic smoothing.

[0020] Causal Importance: The node is hash-matched with the pre-set external threat intelligence database and internal critical asset list. If a match is found, the node is marked as a security anchor and the corresponding score is set to Boolean true.

[0021] Time-series importance: Maintain a historical baseline frequency for each node based on the exponential moving average (EMA). Update the baseline value and calculate the current window frequency. The ratio relative to historical benchmarks is used to quantify the degree of suddenness of behavior.

[0022] Furthermore, for safe anchor nodes whose causal importance is determined to be true, they are directly assigned the highest priority and do not participate in subsequent numerical ranking; for non-safe anchor nodes, a multiplicative coupling mechanism is used to calculate the comprehensive score.

[0023]

[0024] in, Score the importance of the structure. The importance of the time sequence is scored.

[0025] Furthermore, in step 4, the specific execution process of the dual-path pruning strategy is as follows:

[0026] First-way safe anchor point retention: Traverse the current graph snapshot and forcibly retain all nodes marked as safe anchor points, forming an absolute retain set. ;

[0027] Second-path Top-K completion: Presets the maximum node capacity per window based on hardware limitations. Calculate the remaining capacity:

[0028]

[0029] For non-safe anchor nodes, the overall score will be used as the basis. Sort in descending order and truncate the first few rows. Nodes form candidate sets ;

[0030] The final reduced graph node set is and The union of .

[0031] Further, in step 5, prior feature embedding is performed using the following method:

[0032] To reduce each node in the graph Constructing feature vectors The formula is:

[0033]

[0034] in This indicates a splicing operation. One-hot encoding for node types, , , These are the structural importance score, causal importance score, and temporal importance score calculated by the three-dimensional scoring model, respectively.

[0035] The unstructured raw logs are ultimately transformed into a serialized graph structure list. ,in, Indicates the total number of time windows. Indicates the first The graph data corresponding to each time window It is an adjacency matrix, used to describe the topological connections between nodes retained after pruning. It is the feature matrix, which consists of the feature vectors of all retained nodes within this time window. It is aggregated and used as input for subsequent neural network models.

[0036] A system for constructing an APT attack source map based on dynamic sliding window and multidimensional time-series scoring includes a memory, a processor, and a computer program stored in the memory and executable on the processor. The system is characterized in that when the processor executes the computer program, it implements the method for constructing an APT attack source map based on dynamic sliding window and multidimensional time-series scoring.

[0037] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, when the processor executes the computer program, it implements the APT attack tracing graph construction method based on dynamic sliding window and multi-dimensional time-series scoring.

[0038] A computer-readable storage medium storing a computer program thereon, characterized in that, when the computer program is executed by a processor, it implements the method for constructing an APT attack tracing graph based on a dynamic sliding window and multi-dimensional time-series scoring.

[0039] Compared with existing technologies, the significant advantages of this invention are: 1) It introduces a dynamic sliding window mechanism to handle infinite streaming logs, reducing memory consumption from linear growth over time to a constant level; 2) It constructs a three-dimensional scoring model that combines topology, temporal bursts, and threat intelligence, effectively distinguishing between high-frequency background noise and low-frequency covert attacks; 3) It proposes a "security anchor" forced residency strategy, which fundamentally prevents critical attack nodes from being mistakenly deleted due to low activity, ensuring the integrity of the attack causal chain.

[0040] The present invention will now be described in further detail with reference to the accompanying drawings. Attached Figure Description

[0041] Figure 1 This is a schematic diagram of the overall process for constructing an APT attack attribution graph based on a dynamic sliding window and multi-dimensional temporal scoring.

[0042] Figure 2 This is a schematic diagram of a dynamic graph snapshot segmentation and expiration mechanism based on a sliding window.

[0043] Figure 3 This is a schematic diagram of the principle of the three-dimensional lightweight node scoring model and multiplication coupling mechanism.

[0044] Figure 4 The flowchart for the execution of the dual-path dynamic pruning strategy of "safety anchor point priority + Top-K completion". Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0046] like Figure 1 As shown, this invention provides a method for constructing an APT attack attribution graph based on a dynamic sliding window and multi-dimensional temporal scoring, with the following steps:

[0047] Step 1: Obtain the multi-source heterogeneous audit logs of the computer system and map the heterogeneous events into a standardized quadruple stream containing ten atomic interaction relationships.

[0048] Step 1-1: Data Acquisition and Parsing. Connect to the target environment to be tested or read offline stored log data. Specifically, this can be done in real-time using auditing tools deployed on the terminal (such as Auditd, Sysmon), or by directly reading audit log files from pre-recorded public security datasets (such as DARPA, OpTC, etc.). Regardless of the source, the system must parse and extract three core entities: processes, files, and network sockets. This includes the process's PID and command-line arguments, the file's inode number, and the network socket's IP port and protocol type.

[0049] Step 1-2: Interaction Semantics Normalization. To eliminate the heterogeneity of underlying system calls and highlight attack semantics, the complex system calls are summarized into 10 key atomic interaction relationships. These include: file read / write operations (Read, Write), code execution and loading (Execute), process forking (Fork), attribute modification (Modify_Attribute), anti-forensic deletion (Unlink), permission change (Change_Principal), and network communication loop (Connect, Send, Recvfrom).

[0050] Steps 1-3: Output a normalized stream. Map heterogeneous events uniformly into a normalized four-tuple event stream. ,in Indicates the subject, Indicates the object, The interaction relationship after semantic normalization. For timestamps.

[0051] Step 2: As Figure 2 As shown, the time window size and sliding step size are set, and the quadruple stream is segmented using the sliding window mechanism to construct a continuously evolving time-series dynamic tracing graph snapshot, and to maintain the incremental update and expiration of the graph structure.

[0052] Step 2-1: Define the graph snapshot sequence. Define the source graph as a sequence over time. Snapshot sequence of changes For any given time , snapshot Included only in the current time window Active entities and their interactions within the system;

[0053] Step 2-2: Sliding window configuration. Set a fixed-length time window. and sliding step size And set This creates a window overlap mechanism. This overlap design provides detection redundancy for short attack sequences, while also providing a natural time transition for cross-window attacks.

[0054] Steps 2-3: Incremental Injection and Edge Aggregation. When a new event arrives, if the node already exists, update its latest active timestamp. For edge relationships, an edge aggregation strategy is adopted: if an edge of the same type already exists between two nodes, only the weight of that edge is increased and a timestamp is appended, rather than creating redundant multiple edges;

[0055] Steps 2-4: Expired and Eliminated. As the window slides, the system periodically scans the entire image. All recently active timestamps are eliminated. Furthermore, old nodes that are not marked as safe anchors—that is, if the latest active timestamp of a node is earlier than the start time of the current window and it is not marked as a safe anchor—are physically removed from memory along with their associated edges to ensure that the graph size remains within a controllable range.

[0056] Step 3: As Figure 3 As shown, for each graph node within the current time window, a three-dimensional lightweight scoring model including structural, causal, and temporal dimensions is established to calculate the node's comprehensive importance score.

[0057] Step 3-1: Calculate structural importance The aim is to identify hub nodes in local topologies. The connectivity strength of nodes is directly calculated using a degree counter maintained during the flow graphing process.

[0058]

[0059] in and These are the in-degree and out-degree of the node, respectively;

[0060] Step 3-2: Calculate causal importance Introducing an external threat intelligence database ( ) and list of internal key assets ( Matching is performed using hash indexes. Indicator functions are defined. The calculation formula is:

[0061]

[0062] The value is 1 when a node matches an external threat intelligence database or an internal list of critical assets; otherwise, it is 0. This indicator serves as the basis for determining security anchor points and does not participate in numerical bidding.

[0063] Step 3-3: Calculate the importance of time series An exponential moving average (EMA) mechanism is introduced to capture sudden behavioral changes. First, the current window frequency is utilized. Update node's historical baseline value :

[0064]

[0065] Where α is the smoothing coefficient. Then, the bounded burst score is calculated:

[0066]

[0067] in To prevent tiny amounts of division by zero, This is the cutoff threshold for burst multiples, used to suppress outliers.

[0068] Step 4: As Figure 4 As shown, based on the comprehensive importance score, a dual-path dynamic pruning strategy combining safe anchor point priority and Top-K completion is adopted to filter nodes in the current graph snapshot.

[0069] Step 4-1: Scoring Coupling. For non-anchor nodes, a multiplicative coupling mechanism is used to calculate the final score, effectively filtering out noisy nodes with only one aspect of features:

[0070]

[0071] Step 4-2: Prioritize retaining safe anchor points. Filter out all points that meet the causal scoring criteria. The nodes constitute an absolute reserve set This mechanism ensures that low-frequency, covert attack clues in the incubation period (such as C&C heartbeat packets) are not mistakenly deleted, maintaining the contextual continuity of long-term attacks;

[0072] Step 4-3: Top-K completion. Maximum node capacity of the order window. Calculate the remaining budget capacity

[0073]

[0074] For the remaining node set, a comprehensive score is applied. Sort in descending order and truncate the first few rows. The high-scoring nodes are used as the candidate set, and the final output is the refined graph node set. .

[0075] Step 5: Using a prior feature embedding strategy, the type information and multidimensional scores of nodes in the reduced source graph are transformed into vectorized feature matrices, and a high-quality source graph sequence containing temporal and semantic information is output.

[0076] Step 5-1: Feature Vector Construction. For each node in the refined graph... Construct feature vectors :

[0077]

[0078] This vector is composed of two concatenated parts: The first part represents the entity type features using one-hot encoding; the subsequent part is the concatenated three-dimensional rating features. The purpose of performing a logarithmic transformation is to compress the power-law distribution of node degrees;

[0079] Step 5-2: Tensor Quantization Output. The unstructured raw log is ultimately transformed into a serialized graph structure list. ,in This represents the output source graph sequence. Representing the The graph data tuples corresponding to each time window. Specifically:

[0080] It is the first The adjacency matrix of each time window describes the topological connections between nodes retained after pruning.

[0081] It is the first The feature matrix for each time window, with each row corresponding to the feature vector of a node. This can be directly used for parallel computation of subsequent neural networks.

[0082] This invention also proposes an APT attack source map construction system based on dynamic sliding window and multi-dimensional time series scoring, including a memory, a processor, and a computer program stored in the memory and executable on the processor. The feature is that when the processor executes the computer program, it implements the APT attack source map construction method based on dynamic sliding window and multi-dimensional time series scoring.

[0083] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, when the processor executes the computer program, it implements the APT attack tracing graph construction method based on dynamic sliding window and multi-dimensional time-series scoring.

[0084] A computer-readable storage medium storing a computer program thereon, characterized in that, when the computer program is executed by a processor, it implements the method for constructing an APT attack tracing graph based on a dynamic sliding window and multi-dimensional time-series scoring.

[0085] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0086] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these modifications and improvements all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for constructing an APT attack attribution graph based on a dynamic sliding window and multi-dimensional temporal scoring, characterized in that, Includes the following steps: Step 1, Data Preprocessing and Standardization: Obtain the raw audit logs of the computer system, extract entity attributes and interaction behaviors through the log parser, and map them uniformly into a standardized four-tuple event flow; Step 2, Construction of Temporal Heterogeneous Graph: Set a fixed-length time window and sliding step size Based on the sliding window strategy, the quadruple event flow is divided into a series of continuously evolving dynamic traceability graph snapshots, and incremental injection and expiration elimination mechanisms are executed during the snapshot update process; Step 3, Multidimensional Importance Scoring: For nodes in the current graph snapshot, construct a three-dimensional scoring model that includes structural importance, temporal importance, and causal importance to quantify the value of nodes within the current time window; Step 4, Dynamic Graph Reduction and Reconstruction: Based on node value scoring, a dual-path pruning strategy combining safe anchor point priority and Top-K completion is implemented to remove low-value background noise and generate a reduced induced subgraph; Step 5, Prior Feature Embedding: Transform the node type information in the reduced graph and the calculated 3D score into vectorized features, and output a source graph sequence containing temporal dynamic features and core semantics.

2. The method for constructing an APT attack attribution graph based on a dynamic sliding window and multi-dimensional temporal scoring as described in claim 1, characterized in that, In step 1, the format of the quadruple event stream is as follows: ,in Represents the main node, Represents the object node, This represents the interaction relationship after semantic normalization. The timestamp; the entity types of the subject node and object node include processes, files, and network sockets; the interaction relationship These are categorized into atomic interaction types, including file read and write operations (Read, Write), code execution and loading (Execute), process forking (Fork), attribute modification (Modify_Attribute), anti-forensic deletion (Unlink), permission change (Change_Principal), and network communication loop (Connect, Send, Recvfrom).

3. The method for constructing an APT attack attribution graph based on a dynamic sliding window and multi-dimensional temporal scoring as described in claim 1, characterized in that, Step 2, construction of the temporal heterogeneous graph, the specific method is as follows: Set sliding step Smaller than the time window This causes time overlap between adjacent snapshots; Incremental injection mechanism: When a new event enters the current window, if the node already exists, its latest active timestamp is updated; If the edge already exists, increase the weight attribute of the edge to record the interaction frequency; Expiration and removal mechanism: As the window slides, the entire graph is periodically scanned. If the latest active timestamp of a node is less than the start time of the current window, and the node has not been marked as a safe anchor, then the node and its associated edges are removed from memory.

4. The method for constructing an APT attack attribution graph based on dynamic sliding window and multi-dimensional temporal scoring according to claim 1, characterized in that, In step 3, the calculation logic of the three-dimensional scoring model is as follows: Structural importance: Calculate the sum of the in-degree and out-degree of a node within the current window, and then perform logarithmic smoothing. Causal Importance: The node is hash-matched with the pre-set external threat intelligence database and internal critical asset list. If a match is found, the node is marked as a security anchor and the corresponding score is set to Boolean true. Time-series importance: Maintain a historical baseline frequency for each node based on the exponential moving average (EMA). Update the baseline value and calculate the current window frequency. The ratio relative to historical benchmarks is used to quantify the degree of suddenness of behavior.

5. The method for constructing an APT attack attribution graph based on a dynamic sliding window and multi-dimensional temporal scoring as described in claim 4, characterized in that, For safe anchor nodes whose causal importance is true, they are directly assigned the highest priority and do not participate in subsequent numerical ranking; for non-safe anchor nodes, a multiplicative coupling mechanism is used to calculate the comprehensive score. ； in, Score the importance of the structure. The importance of the time sequence is scored.

6. The method for constructing an APT attack attribution graph based on a dynamic sliding window and multi-dimensional temporal scoring as described in claim 1, characterized in that, In step 4, the specific execution process of the dual-path pruning strategy is as follows: First-way safe anchor point retention: Traverse the current graph snapshot and forcibly retain all nodes marked as safe anchor points, forming an absolute retain set. ; Second-path Top-K completion: Presets the maximum node capacity per window based on hardware limitations. Calculate the remaining capacity: ； For non-safe anchor nodes, the overall score will be used as the basis. Sort in descending order and truncate the first few rows. Nodes form candidate sets ; The final reduced graph node set is and The union of .

7. The method for constructing an APT attack attribution graph based on a dynamic sliding window and multi-dimensional temporal scoring as described in claim 1, characterized in that, Step 5, prior feature embedding, the specific method is as follows: To reduce each node in the graph Constructing feature vectors The formula is: ； in This indicates a splicing operation. One-hot encoding for node types, , , These are the structural importance score, causal importance score, and temporal importance score calculated by the three-dimensional scoring model, respectively. The unstructured raw logs are ultimately transformed into a serialized graph structure list. ,in, Indicates the total number of time windows. Indicates the first The graph data corresponding to each time window It is an adjacency matrix, used to describe the topological connections between nodes retained after pruning. It is the feature matrix, which consists of the feature vectors of all retained nodes within this time window. It is aggregated and used as input for subsequent neural network models.

8. A system for constructing an APT attack attribution graph based on a dynamic sliding window and multi-dimensional temporal scoring, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the APT attack tracing graph construction method based on dynamic sliding window and multi-dimensional time-series scoring as described in any one of claims 1-7.

9. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the APT attack tracing graph construction method based on dynamic sliding window and multi-dimensional time-series scoring as described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the APT attack tracing graph construction method based on dynamic sliding window and multi-dimensional time-series scoring as described in any one of claims 1-7.

Images