A Method for Investigating Large-Scale Language Model Attacks Based on Knowledge Graph Augmentation and Dynamic Context

Abstract

This application proposes a method for investigating large-scale language model attacks based on knowledge graph augmentation and dynamic context, including the following steps: constructing a candidate event sequence, a first dynamic context module, and a second dynamic context module; obtaining the current event in the candidate event sequence and its event relevance; if the current event is related to the attack chain under investigation, updating the second and first dynamic context modules; obtaining causal precursor events using the updated second dynamic context module, and iteratively updating the first and second dynamic context modules based on the causal reachability of the causal precursor events to obtain the attack investigation results. This scheme uses the field semantics and tactical reachability of the current event as the core to determine the connection between the current event and the attack chain under investigation, and uses causal reachability to obtain the causal precursor events of the current event to reverse-search the starting event of the attack chain under investigation to complete the source tracing.

Description

Technical Field

[0001] This application relates to the field of cybersecurity, and in particular to a method for investigating large-scale language model attacks based on knowledge graph enhancement and dynamic context. Background Technology

[0002] In the field of cybersecurity situational awareness and attack attribution, attack investigation technology is a core support for ensuring cybersecurity and accurately responding to attacks. Its core objective is to sift through massive amounts of security logs to identify attack-related events and construct complete attack chains, providing a basis for attribution analysis and emergency response. Currently, mainstream attack investigation technologies mainly fall into two categories, both of which have significant shortcomings and are difficult to meet the needs of complex attack scenarios.

[0003] One type is the static analysis method based on rule matching. This method filters log events by pre-setting fixed attack characteristic rules (such as specific port access behavior, malicious code signatures, etc.), and then relies on manual correlation analysis of the filtered events to construct the attack chain. Its core limitation is that it relies too much on pre-set rules. When faced with constantly emerging new attack methods, the fixed rules cannot be quickly adapted, and it is easy to miss detections. At the same time, the efficiency of manual correlation analysis is extremely low, it is difficult to deal with massive log data, and it is also highly subjective, easily leading to misjudgments due to human negligence, and it cannot meet the needs of efficient and accurate investigation.

[0004] Another type is dynamic reasoning methods based on large-scale language models (LLMs). These methods convert log events into natural language text input to the LLM and use the model's semantic understanding capabilities to determine event relevance. However, these methods generally use free text prompts and do not introduce structured tactical logic constraints, which can lead to semantic drift during natural language generation, causing the evaluation results to deviate from the actual log data. At the same time, they only refer to threat intelligence or the surface semantics of the logs, lack a multi-source knowledge fusion mechanism, and do not consider the reachability constraints of attack tactics. They cannot guarantee that the event association conforms to the internal logic of the attack phase, often resulting in tactical jumps, disordered attack chain sequence, and other problems. Furthermore, the reasoning process lacks traceable judgment criteria, resulting in extremely poor interpretability.

[0005] In summary, the core common flaw of traditional attack investigation techniques lies in their single-dimensional input and static / weakly constrained reasoning. This ultimately leads to a series of problems, including semantic drift, insufficient assessment accuracy, poor interpretability, chaotic attack chain logic, and low investigation efficiency, making them ill-suited to the current complex and ever-changing cyberattack landscape. Therefore, there is an urgent need to construct a systematic attack investigation method that integrates multi-source knowledge and dynamic constraints to overcome the current technological bottlenecks. Summary of the Invention

[0006] This application provides a method for investigating large-scale language model attacks based on knowledge graph enhancement and dynamic context. It uses the field semantics and tactical reachability of the current event as the core to determine the connection between the current event and the attack chain to be investigated. It also uses causal reachability to obtain the causal predecessor events of the current event to reverse search for the starting event of the attack chain to be investigated, thereby accurately tracing the entire attack method of the attack chain to be investigated.

[0007] In a first aspect, embodiments of this application provide a method for investigating large-scale language model attacks based on knowledge graph enhancement and dynamic context, the method comprising:

[0008] S1: Based on log data, obtain the attack interest points of the attack chain to be investigated as initial events, add the initial events to the candidate event sequence, and initialize the first dynamic context module and the second dynamic context module. The first dynamic context module is used to store the attack behavior description of each event, and the second dynamic context module is used to store the topology structure built based on the MITREATT&CK system in an orderly manner.

[0009] S2: Obtain the highest-ranked event in the candidate event sequence as the current event, obtain enhanced hints from the knowledge base generated by self-retrieval based on the current event, obtain dynamic context hints from the first dynamic context module and the second dynamic context module, concatenate the enhanced hints and dynamic context hints into a structured hint, input the structured hints and the current event into the event correlation model to output the correlation between the current event and the attack chain, if the correlation is greater than the set threshold, execute step S3;

[0010] S3: Update the second dynamic context module based on the attack tactics of the current event, and update the first dynamic context module based on the attack behavior description of the current event;

[0011] S4: Obtain the predecessor extension range using the updated second dynamic context module, and obtain the causal predecessor event corresponding to the current event in the log data based on the predecessor extension range. Calculate the causal reachability between each causal predecessor event and the current event. If the causal reachability is not less than a set threshold, add the causal predecessor event to the candidate event sequence and repeat steps S2-S4. When the termination condition is met, end the attack investigation and output the attack investigation results based on the first dynamic context module and the second dynamic context module.

[0012] Secondly, embodiments of this application provide an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform a method for investigating large-scale language model attacks based on knowledge graph enhancement and dynamic context.

[0013] The main contributions and innovations of this invention are as follows:

[0014] This application constructs a unified log structure semantic library, an adversarial tactical state machine library, and a threat intelligence report library to integrate multi-source knowledge, making up for the shortcomings of traditional single-dimensional input and providing comprehensive support for event assessment. This application uses a weighted sum of field semantics, tactical reachability, and descriptions of similar historical attack patterns as a multi-source consistency score to evaluate the correlation between the current event and the attack chain under investigation from multiple dimensions, ensuring the core position of log semantics while comprehensively improving the rationality of event correlation. This application updates the second dynamic context module based on the tactical sequence stability factor, avoiding time sequence inversion caused by simple head insertion, ensuring the stage coherence of the tactical sequence, forming a stable TTP sequence blueprint, and providing structured support for subsequent inference and reverse search. This application uses dual dynamic context modules to constrain the acquisition of the predecessor extension range, strictly limiting the reverse search to the predecessor range reachable by ATT&CK tactics, avoiding search drift caused by irrelevant logs, and improving the directionality and efficiency of the reverse search. This application performs reverse search iteration by calculating causal reachability, thereby accurately filtering predecessor events causally consistent with the current event, avoiding tactical jumps and noise interference, and ensuring the logical coherence of attack chain construction.

[0015] Details of one or more embodiments of this application are set forth in the following drawings and description to make other features, objects and advantages of this application more readily apparent. Attached Figure Description

[0016] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0017] Figure 1 This is a flowchart of a method for investigating large-scale language model attacks based on knowledge graph enhancement and dynamic context, according to an embodiment of this application.

[0018] Figure 2 This is a flowchart illustrating the construction of a knowledge base and the initialization of a first dynamic context module and a second dynamic context module according to an embodiment of this application;

[0019] Figure 3 This is a flowchart illustrating an embodiment of obtaining event relevance according to this application;

[0020] Figure 4 This is a flowchart illustrating an embodiment of updating the first dynamic context module and the second dynamic context module according to this application.

[0021] Figure 5 This is a flowchart illustrating a reverse search based on causal reachability according to an embodiment of this application;

[0022] Figure 6 This is a flowchart illustrating the generation of attack investigation results according to an embodiment of this application;

[0023] Figure 7 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0024] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with one or more embodiments of this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

[0025] It should be noted that the steps of the corresponding methods are not necessarily performed in the order shown and described in this specification in other embodiments. In some other embodiments, the methods may include more or fewer steps than described in this specification. Furthermore, a single step described in this specification may be broken down into multiple steps in other embodiments; and multiple steps described in this specification may be combined into a single step in other embodiments.

[0026] Example 1

[0027] This application provides a method for investigating large-scale language model attacks based on knowledge graph enhancement and dynamic context. It uses the field semantics and tactical reachability of the current event as the core to determine the connection between the current event and the attack chain under investigation. Furthermore, it uses causal reachability to obtain the causal precursor events of the current event and then reverse-searches for the starting event of the attack chain under investigation. This allows for accurate tracing of the entire attack method within the attack chain under investigation. Specifically, refer to... Figure 1 The method includes:

[0028] S1: Based on log data, obtain the attack interest points of the attack chain to be investigated as initial events, add the initial events to the candidate event sequence, and initialize the first dynamic context module and the second dynamic context module. The first dynamic context module is used to store the attack behavior description of each event, and the second dynamic context module is used to store the topology structure built based on the MITREATT&CK system in an orderly manner.

[0029] S2: Obtain the highest-ranked event in the candidate event sequence as the current event, obtain enhanced hints from the knowledge base generated by self-retrieval based on the current event, obtain dynamic context hints from the first dynamic context module and the second dynamic context module, concatenate the enhanced hints and dynamic context hints into a structured hint, input the structured hints and the current event into the event correlation model to output the correlation between the current event and the attack chain, if the correlation is greater than the set threshold, execute step S3;

[0030] S3: Update the second dynamic context module based on the attack tactics of the current event, and update the first dynamic context module based on the attack behavior description of the current event;

[0031] S4: Obtain the predecessor extension range using the updated second dynamic context module, and obtain the causal predecessor event corresponding to the current event in the log data based on the predecessor extension range. Calculate the causal reachability between each causal predecessor event and the current event. If the causal reachability is not less than a set threshold, add the causal predecessor event to the candidate event sequence and repeat steps S2-S4. When the termination condition is met, end the attack investigation and output the attack investigation results based on the first dynamic context module and the second dynamic context module.

[0032] In the current embodiment, attack interest points are selected from the security logs of the enterprise terminal as initial events. Attack interest points are suspicious events manually screened by security analysts in the enterprise terminal, and the attack chain corresponding to the initial event is the attack chain to be investigated.

[0033] For example, taking the investigation of a ransomware attack in a real network environment as an example, security analysts selected a suspicious encrypted file operation event from the enterprise endpoint security logs as the initial event. The original log entry contained the following fields:

[0034] timestamp=2023-10-27T14:35:22Z,process_name=”ransomware.exe”,action=”file_encrypt”,target_file=” .docx".

[0035] In the current embodiment, the first dynamic context module stores a fine-grained attack description for each attack behavior, such as recording the specific behavior of a certain event in decrypting an encrypted file, or recording the specific behavior of a certain event in leaking an encrypted file.

[0036] The MITREATT&CK framework's tactical layer covers the entire process of adversarial activities, from entry, residence, lateral movement, and execution of objectives, with a highly structured phase logic. Its tactical division granularity is superior to the KillChain, which is mainly based on phase linearity. This provides a controllable, locatable, and scalable attack phase reference baseline in event reasoning. Since ATT&CKTTP has verified its stable mapping capability with log behavior in a large number of security studies, this solution is based on the MITREATT&CK framework to construct a coarse-grained second dynamic context module, thereby providing clear phase progression logic support for subsequent event reasoning.

[0037] In other words, the second dynamic context module is a framework based on the MITREATT&CK system, but without specific event content. The second dynamic context module benefits from the MITREATT&CK system, which records the logical order of the entire attack chain.

[0038] Specifically, the second dynamic context module adopts a fixed tactical order instead of simple head insertion, thereby ensuring that the second dynamic context module maintains the predecessor and successor relationship between different events when updating.

[0039] In the current embodiment, a unified log structure semantic library, an adversarial tactical state machine library, and a threat intelligence report library are constructed. The enhanced knowledge base is retrieved and includes the unified log structure semantic library, the adversarial tactical state machine library, and the threat intelligence report library. The unified log structure semantic library stores the semantic information of each event in the log data. The adversarial tactical state machine library stores a directed graph structure with TTPs of the MITREATT&CK system as nodes and the execution logic order between TTPs as edges. The threat intelligence report library stores behavioral pattern reports of historical attack chains.

[0040] Furthermore, the field semantics of the current event are obtained from the unified log structure semantic library, the predecessor and successor nodes related to the current event are queried from the adversarial tactical state machine library, and the tactical reachability is calculated based on the topology of the state machine. The behavioral pattern report that matches the semantics of the current event is obtained from the threat intelligence report library as a description of similar historical attack patterns. Based on the field semantics, tactical reachability and similar historical attack pattern descriptions, a structured enhanced hint is constructed.

[0041] Specifically, the tactical reachability is used to represent the logical connection rationality of the tactical topology of the current event under the MITREATT&CK system. For example, if the current event is data corruption, then the predecessor node corresponding to the current event is privilege escalation and the successor node is data leakage. If the tactical reachability of privilege escalation and data corruption calculated through the topology structure of the state machine is 0.8, it indicates that the current event has a high correlation with the attack chain under investigation. However, if the tactical reachability of privilege escalation and data corruption calculated through the topology structure of the state machine is 0.2, it indicates that the current event has a low correlation with the attack chain under investigation.

[0042] Specifically, the description of similar historical attack patterns is used to represent the attack pattern description with the highest semantic similarity to the current event in historical attack events.

[0043] Specifically, the flowchart for constructing the knowledge base and initializing the first dynamic context module and the second dynamic context module in this solution is as follows: Figure 2 As shown in the diagram, in this scheme, the calling priority of the unified log structure semantic library, the adversarial tactical state machine library, and the threat intelligence reporting library is: unified log structure semantic library > adversarial tactical state machine library > threat intelligence reporting library, ensuring that subsequent inference is dominated by log semantics.

[0044] In the current embodiment, the flowchart for obtaining event relevance is as follows: Figure 3 As shown, the event correlation model has a built-in multi-source consistency scoring function and a consistency constraint function. The multi-source consistency scoring function calculates the multi-source consistency score based on enhanced hints and the current event, while the consistency constraint function calculates the constraint value based on dynamic context hints and the current event, and corrects the multi-source consistency score output correlation based on the constraint value.

[0045] Furthermore, the formula for calculating the multi-source consistency score is as follows:

[0046]

[0047] in, For multi-source consistency scoring, For the field semantics of the current event, This is the first dynamic context module. This is a log semantic consistency mapping function used to quantify the semantic correlation strength between the field semantics of the current event and the corresponding context event. For the tactical accessibility of the current event, For the second dynamic context module, This is a tactical reachability mapping function used to quantify the logical coherence of the tactical topology of the current event within the second dynamic context module into a continuous value. Describe similar historical attack patterns to the current event. This is an intelligence matching mapping function used to quantify the semantic similarity between the current event and descriptions of similar historical attack patterns. , , These are the weighting coefficients, and .

[0048] In other words, in multi-source consistency scoring, For fact-level evaluation, it is used to determine the detailed coherence between the current event and the existing attack behavior in the first dynamic context module, thereby determining whether the current event and the attack behavior in the first dynamic context module are a continuation of the same attack behavior; For pattern layer evaluation, it is used to determine whether the node corresponding to the current event in the MITREATT&CK system is reasonable, thereby determining whether the attack path of the current event conforms to the regular pattern; This is an empirical-level assessment used to determine whether the current event matches a known attack pattern, addressing the question of whether there is historical experience to support the correlation.

[0049] Specifically, when performing multi-source consistency scoring, it is essential to ensure that the event relevance model always prioritizes the semantics of the current event's fields; therefore, the weights are set to... .

[0050] Specifically, By measuring the strength of the association between events and fine-grained context through field semantic consistency, we can ensure that the interpretation process closely follows the actual log structure. Based on the predecessor and successor relationships of the adversarial tactical state machine, the reachability score of the current tactic is given, and the topological constraints are mapped to continuous values ​​rather than hard rules, thereby improving interpretability. The supporting strength of intelligence patterns is assessed by semantic vector matching degree.

[0051] In the current embodiment, the consistency constraint function constrains the multi-source consistency score based on semantic consistency conflicts between the first dynamic context module and the second dynamic context module. The formula for the consistency constraint function is as follows:

[0052]

[0053] in, Here, d is the consistency constraint function, and d is the cross-layer semantic inconsistency measure. The inconsistency penalty coefficient, For the second dynamic context module, This is the first dynamic context module.

[0054] Specifically, the degree of semantic conflict between the first dynamic context module and the second dynamic context module is quantified based on the cross-layer semantic inconsistency measure. The value range is [0,1]. The higher the value, the more serious the conflict between the two. When a semantic conflict occurs between the first dynamic context module and the second dynamic context module, the overall multi-source consistency score decreases, thereby forcing the event relevance model to make corrections to the inconsistent parts during inference.

[0055] The event correlation model in this scheme uses a threshold judgment method to determine whether the current event is related to the attack chain under investigation based on event correlation. The output of the event correlation model includes whether the current event is related to the attack chain and the corresponding evidence. The evidence comes from the unified log structure semantic library, the adversarial tactical state machine library, the threat intelligence report library, and the first dynamic context module and the second dynamic context module.

[0056] Specifically, the formula for constraining the multi-source consistency score using the consistency constraint function is expressed as follows:

[0057]

[0058] in, For event relevance, For multi-source consistency scoring, β is the penalty coefficient. This is the consistency constraint function.

[0059] For example, the semantic field of the current event obtained from the unified log structure semantic library is "process ransomware.exe performed an encryption operation on the .docx file". The tactical node that this behavior might map to is found in the adversarial tactical state machine library. The threat intelligence report database retrieved Conti ransomware pattern descriptions that matched the semantics of "file encryption," and these patterns were included in the multi-source consistency score. Set to 0.6, Set it to 0.25, Setting it to 0.15 yields... The result is 0.9. The result is 0.8. If the score is 0.7, then the multi-source consistency score is... for: Then, the consistency constraint function is calculated to be 0.5, and the preset penalty coefficient β is 0.5. Then the event correlation... for: The event correlation model, based on an event correlation of 0.824, determines that the current event is highly correlated with the attack chain under investigation and outputs structured evidence.

[0060] In the current embodiment, the flowchart for updating the first dynamic context module and the second dynamic context module is as follows: Figure 4 As shown, based on the multi-source consistency score, the attack tactics of the current event are calculated for each available topological position in the second dynamic context module, and the attack tactics of the current event are inserted into the available topological position with the highest tactical sequence stability factor. The structured template large language model is called to reconstruct the attack behavior description of the current event, and the first dynamic context module is updated with the reconstructed attack behavior description of the current event.

[0061] Specifically, this solution first updates the second dynamic context module, and then updates the first dynamic context module.

[0062] Specifically, the formula for calculating the tactical sequence stability factor is as follows:

[0063]

[0064] in, The tactical sequence stability factor is α, and the stability factor adjustment coefficients are β. For the tactical accessibility of the current event, For the second dynamic context module, This indicates the reachability deviation between the current event and the currently available topological location. For multi-source consistency scoring.

[0065] Specifically, the reachability deviation refers to the degree of deviation between the tactical reachability of the current event and the phase progression logic of the second dynamic context module in the MITRE ATT&CK tactical topology system. Reachability deviation is a measure of... A quantitative indicator of the degree of fit with existing tactical paths; the smaller the deviation, the better. The more closely it conforms to the logic of the attack phase, the greater the deviation, indicating a more obvious conflict between the two in terms of tactical pre- and post-attack correlation.

[0066] Specifically, when calculating the reachability deviation, the degree of mismatch between the current event and the second dynamic context module in terms of predecessor-follower association and stage connection is quantified to obtain the quantified value of the reachability deviation, which is in the range of [0,1].

[0067] Specifically, the tactical sequence stability factor is related to the multi-source consistency score. The higher the multi-source consistency score, the higher the correlation between the current event and the attack chain under investigation, and therefore the higher the tactical sequence stability factor. By calculating the tactical sequence stability factor, the current event is accurately located in a unique position that is reachable and conforms to the attack phase logic under the ATT&CK tactical topology system. This avoids the time sequence reversal caused by the simple head insertion method and ensures the phase continuity of the second dynamic context module through quantitative adjustment, providing stable structural support for the subsequent first dynamic context module and reverse search.

[0068] Specifically, the updated second dynamic context module forms a structured TTP sequence blueprint under the ATT&CK tactical phase framework. This blueprint uses the phase sequence of the adversarial chain as its skeleton, enabling the coarse-grained context to not only have sequentiality but also semantic phase mapping capabilities. As the sequence is continuously updated by new verification events, the blueprint gradually presents the overall structure of the attack tracing back from the later phase to the earlier phase, providing LLM with a stable and continuously refined outline of adversarial activities and avoiding the temporal reversal caused by simple head insertion.

[0069] Specifically, the structured template large language model reconstructs the attack behavior description of the current event in a compressed manner. The reconstructed attack behavior description occupies less storage space and has a uniform format while maintaining semantic integrity.

[0070] Specifically, a consistency compression function is introduced into the structured template large language model to compress the attack behavior narrative of the current event. This consistency compression function is used to evaluate the redundancy of the natural language narrative and perform temporal compression without losing the semantics of key actions. The formula for the consistency compression function is as follows:

[0071]

[0072] in, Here, is the consistency compression function, d is the cross-layer semantic inconsistency measure, and γ is the compression sensitivity coefficient. For the second dynamic context module, This is the first dynamic context module. For multi-source consistency scoring.

[0073] Specifically, the consistency compression function enables the attack behavior narrative of the current event to automatically increase information density when the consistency of the tactical sequence is enhanced, while converging to a mitigation mode when semantic drift exists to prevent disruption of the narrative chain structure.

[0074] For example, with As the current event related to the attack chain under investigation, the second dynamic context module is first updated. The known mapping node corresponding to the current event is... The multi-source consistency score was 0.824. Reachability deviation from a currently available topology location in the second dynamic context module If the value is 0, and the adjustment coefficients α and β are set to 1.2 and 0.8 respectively, then the tactical sequence stability factor is... If the value is 0.824×1.2+0×0.8=0.989, then the current event is inserted into the available topology position at the corresponding location. When updating the first dynamic context module, the consistency compression function is calculated. Given that the compression sensitivity coefficient is 2 and the cross-layer semantic inconsistency is 0.05, the compression strength obtained based on the consistency compression function is 0.095.

[0075] In the current embodiment, the retrieval anchor point is described by the tactical node of the current event in the second dynamic context module and the attack behavior in the first dynamic context module. The positional constraints of the current event in the second dynamic context module are derived based on the state machine topology to obtain the predecessor extension range. Events within the predecessor extension range are obtained from the log data as causal predecessor events.

[0076] Specifically, the number of causal precursor events is at least one. The attack behavior description after the current event is reconstructed is structurally coupled with the position node of the current event in the second dynamic context module, and the precursor extension range is obtained in the second dynamic context module based on the coupling result.

[0077] Specifically, in this scheme, the scope of the precursor extension is constrained by the updated first dynamic context module and the updated second dynamic context module. The decision to stop the extension is based not only on whether the initial tactic is included, but also on the reachability of the adversarial tactic state machine: when the precursor tactic corresponding to the current event is unreachable in the state machine or has reached the starting position in the second dynamic context module, the precursor extension is stopped.

[0078] Specifically, since the second dynamic context module has formed a stable TTP sequence blueprint under the ATT&CK tactical system, the predecessor retrieval range of the reverse search can be strictly limited to the predecessor tactical range that the blueprint can reach. The topology of the attack phase serves as the search boundary here, providing a structured direction for causal tracing, so that the reverse expansion process always backtracks around the phase path of the real attack chain, thereby avoiding search drift caused by irrelevant behaviors.

[0079] In the current embodiment, a reverse search for the event under investigation is achieved through causal reachability calculation. The flowchart for the reverse search based on causal reachability is as follows: Figure 5 As shown, the formula for calculating causal reachability is:

[0080]

[0081] in, For causal accessibility, This is the tactical sequence stability factor for the current event, used to maintain the ordering constraints of the current event in the second dynamic context module. For the tactical accessibility of the current event, For the tactical accessibility of causal precursor events, For the field semantics of the current event, For the semantics of causal precursor events, The structural difference in semantics between the current event and its causal precursor events reflects the principle that semantic fields play a dominant role in all steps. The reachability value of the counter-tactical state machine is used to reflect... arrive Topological continuity and embedding reachability into causal analysis, This is the difference suppression coefficient.

[0082] Specifically, by calculating causal reachability, candidate predecessor events that are consistent with the causal relationship of the current event are accurately screened out, which not only ensures the directionality and context matching of the reverse search, but also avoids expansion drift caused by tactical jumps and noisy logs.

[0083] For example, in this scheme, if the causal reachability of a causal precursor event is greater than 0.6, then the causal precursor event is added to the candidate event sequence.

[0084] In the current embodiment, the termination condition is: the causal reachability is less than a set threshold, or the tactical phase sequence of the second dynamic context module covers the preset attack initial phase, or the number of iterations reaches a preset value.

[0085] In other words, if the causal reachability is not greater than the set threshold, it indicates that the causal relationship between the causal precursor event and the current event is insufficient, and the causal precursor event is not a precursor event of the current event. Therefore, there is no need to verify the relationship between the causal precursor event and the attack chain to be investigated. If the tactical phase sequence of the second dynamic context module covers the preset attack initial phase, then the second dynamic context module has completely covered the entire attack chain to be investigated, indicating that the attack chain to be investigated has been investigated, so the attack investigation ends. In addition, in order to avoid excessive resource consumption due to infinite loops in extreme scenarios, a preset iteration number threshold is set. When the iteration number reaches the iteration number threshold, the attack investigation ends, or there is no causal precursor event within the precursor expansion range, that is, all the initially selected attack interest points and the causal precursor events expanded by reverse search have completed the correlation determination and context integration, at which point the investigation ends.

[0086] In the current embodiment, the first dynamic context module describes the entire process of the attack chain under investigation in chronological order, while the second dynamic context module records a clear sequence of attack tactics within the attack chain. Therefore, the combined output of the first and second dynamic context modules constitutes the attack investigation result. The flowchart for generating the attack investigation result is as follows: Figure 6 As shown.

[0087] For example, suppose the final candidate event sequence Empty, and the second dynamic context module The tactical sequence constructed in the middle is This sequence has covered the entire ATT&CK tactical chain from initial access to impact, and There is no predecessor in the state machine. The number of iterations is 15, which does not exceed the preset threshold of 100. At this point, the termination condition is triggered. The system outputs the final investigation conclusion: First dynamic context module. The output provides a fine-grained description of the attack behavior, detailing the entire process in chronological order: "the attacker delivers the payload via phishing email, establishes persistence, moves laterally, and finally encrypts the file"; second dynamic context. Output clear coarse-grained tactical sequences This corresponds perfectly to the ATT&CK matrix phase. The two corroborate each other, forming a logically consistent and traceable attack investigation report.

[0088] Example 2

[0089] This embodiment also provides an electronic device, see reference. Figure 7 It includes a memory 404 and a processor 402, the memory 404 storing a computer program and the processor 402 being configured to run the computer program to perform the steps in any of the above method embodiments.

[0090] Specifically, the processor 402 may include a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0091] Memory 404 may include a mass storage device for data or instructions. For example, and not limitingly, memory 404 may include a hard disk drive (HDD), a floppy disk drive, a solid-state drive (SSD), flash memory, an optical disk drive, a magneto-optical disk drive, magnetic tape, or a Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 404 may include removable or non-removable (or fixed) media. Where appropriate, memory 404 may be internal or external to a data processing device. In a particular embodiment, memory 404 is non-volatile memory. In a particular embodiment, memory 404 includes read-only memory (ROM) and random access memory (RAM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable read-only memory (PROM), an erasable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), an electrically alterable read-only memory (EAROM), or flash memory, or a combination of two or more of these. Where appropriate, the RAM can be Static Random-Access Memory (SRAM) or Dynamic Random-Access Memory (DRAM). DRAM can be Fast Page Mode Dynamic Random-Access Memory (FPMDRAM), Extended Data Out Dynamic Random-Access Memory (EDODRAM), Synchronous Dynamic Random-Access Memory (SDRAM), etc.

[0092] The memory 404 can be used to store or cache various data files that need to be processed and / or communicated, as well as possible computer program instructions executed by the processor 402.

[0093] The processor 402 reads and executes computer program instructions stored in the memory 404 to implement any of the large-scale language model attack investigation methods based on knowledge graph enhancement and dynamic context in the above embodiments.

[0094] Optionally, the electronic device may further include a transmission device 406 and an input / output device 408, wherein the transmission device 406 is connected to the processor 402, and the input / output device 408 is connected to the processor 402.

[0095] The transmission device 406 can be used to receive or send data via a network. Specific examples of the network described above may include wired or wireless networks provided by the communication provider of the electronic device. In one example, the transmission device includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 406 may be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0096] Input / output device 408 is used to input or output information. In this embodiment, the input information may be an initial event, etc., and the output information may be the results of an attack investigation, etc.

[0097] Optionally, in this embodiment, the processor 402 can be configured to perform the following steps via a computer program:

[0098] S1: Based on log data, obtain the attack interest points of the attack chain to be investigated as initial events, add the initial events to the candidate event sequence, and initialize the first dynamic context module and the second dynamic context module. The first dynamic context module is used to store the attack behavior description of each event, and the second dynamic context module is used to store the topology structure built based on the MITREATT&CK system in an orderly manner.

[0099] S2: Obtain the highest-ranked event in the candidate event sequence as the current event, obtain enhanced hints from the knowledge base generated by self-retrieval based on the current event, obtain dynamic context hints from the first dynamic context module and the second dynamic context module, concatenate the enhanced hints and dynamic context hints into a structured hint, input the structured hints and the current event into the event correlation model to output the correlation between the current event and the attack chain, if the correlation is greater than the set threshold, execute step S3;

[0100] S3: Update the second dynamic context module based on the attack tactics of the current event, and update the first dynamic context module based on the attack behavior description of the current event;

[0101] S4: Obtain the predecessor extension range using the updated second dynamic context module, and obtain the causal predecessor event corresponding to the current event in the log data based on the predecessor extension range. Calculate the causal reachability between each causal predecessor event and the current event. If the causal reachability is not less than a set threshold, add the causal predecessor event to the candidate event sequence and repeat steps S2-S4. When the termination condition is met, end the attack investigation and output the attack investigation results based on the first dynamic context module and the second dynamic context module.

[0102] It should be noted that the specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementations, and will not be repeated here.

[0103] Generally, various embodiments can be implemented in hardware or dedicated circuitry, software, logic, or any combination thereof. Some aspects of the invention can be implemented in hardware, while others can be implemented by firmware or software executed by a controller, microprocessor, or other computing device, but the invention is not limited thereto. Although various aspects of the invention may be shown and described as block diagrams, flowcharts, or using some other graphical representation, it should be understood that, by way of non-limiting example, these blocks, apparatuses, systems, techniques, or methods described herein can be implemented in hardware, software, firmware, dedicated circuitry or logic, general-purpose hardware or controllers or other computing devices, or some combination thereof.

[0104] Embodiments of the present invention can be implemented by computer software, which may be executable by a data processor of a mobile device, such as a processor entity, or by hardware, or by a combination of software and hardware. Computer software or programs (also referred to as program products) including software routines, applets, and / or macros can be stored in any device-readable data storage medium, and they include program instructions for performing specific tasks. The computer program product may include one or more computer-executable components configured to perform the embodiments when the program is run. The one or more computer-executable components may be at least one piece of software code or a portion thereof. Additionally, it should be noted in this respect that, as Figure 7 Any box in the logical flow can represent a program step, or interconnected logic circuits, boxes and functions, or a combination of program steps and logic circuits, boxes and functions. Software can be stored on physical media such as memory chips or blocks of storage implemented within a processor, magnetic media such as hard disks or floppy disks, and optical media such as DVDs and their data variants, CDs, etc. The physical medium is a non-transient medium.

[0105] Those skilled in the art should understand that the technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments have been described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0106] The above embodiments are merely illustrative of several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for investigating attacks on large-scale language models based on knowledge graph augmentation and dynamic context, characterized in that, Includes the following steps: S1: Based on log data, obtain the attack interest points of the attack chain to be investigated as initial events, add the initial events to the candidate event sequence, and initialize the first dynamic context module and the second dynamic context module. The first dynamic context module is used to store the attack behavior description of each event, and the second dynamic context module is used to store the topology structure built based on the MITREATT&CK system in an orderly manner. S2: Obtain the highest-ranked event in the candidate event sequence as the current event, obtain enhanced hints from the knowledge base generated by self-retrieval based on the current event, obtain dynamic context hints from the first dynamic context module and the second dynamic context module, concatenate the enhanced hints and dynamic context hints into a structured hint, input the structured hints and the current event into the event correlation model to output the correlation between the current event and the attack chain, if the correlation is greater than the set threshold, execute step S3; S3: Update the second dynamic context module based on the attack tactics of the current event, and update the first dynamic context module based on the attack behavior description of the current event; S4: Obtain the predecessor extension range using the updated second dynamic context module, and obtain the causal predecessor event corresponding to the current event in the log data based on the predecessor extension range. Calculate the causal reachability between each causal predecessor event and the current event. If the causal reachability is not less than a set threshold, add the causal predecessor event to the candidate event sequence and repeat steps S2-S4. When the termination condition is met, end the attack investigation and output the attack investigation results based on the first dynamic context module and the second dynamic context module.

2. The method for investigating large-scale language model attacks based on knowledge graph enhancement and dynamic context as described in claim 1, characterized in that, The enhanced knowledge base includes a unified log structure semantic library, an adversarial tactical state machine library, and a threat intelligence report library. The unified log structure semantic library stores the semantic information of each event in the log data. The adversarial tactical state machine library stores a directed graph structure with TTPs of the MITREATT&CK system as nodes and the execution logic order between TTPs as edges. The threat intelligence report library stores behavioral pattern reports of historical attack chains.

3. The method for investigating large-scale language model attacks based on knowledge graph enhancement and dynamic context as described in claim 1, characterized in that, The system retrieves the field semantics of the current event from the unified log structure semantic library, queries the predecessor and successor nodes related to the current event from the adversarial tactical state machine library, calculates tactical reachability based on the topology of the state machine, retrieves behavioral pattern reports that match the semantics of the current event from the threat intelligence report library as descriptions of similar historical attack patterns, and constructs structured enhanced hints based on field semantics, tactical reachability, and descriptions of similar historical attack patterns.

4. The method for investigating large-scale language model attacks based on knowledge graph enhancement and dynamic context as described in claim 1, characterized in that, The event correlation model incorporates a multi-source consistency scoring function and a consistency constraint function. The multi-source consistency scoring function calculates the multi-source consistency score based on enhanced hints and the current event, while the consistency constraint function calculates the constraint value based on dynamic context hints and the current event. The correlation of the multi-source consistency score output is then corrected based on the constraint value.

5. The method for investigating large-scale language model attacks based on knowledge graph enhancement and dynamic context as described in claim 4, characterized in that, The multi-source consistency scoring function is: in, For multi-source consistency scoring, For the field semantics of the current event, This is the first dynamic context module. This is a log semantic consistency mapping function. For the tactical accessibility of the current event, For the second dynamic context module, For tactical reachability mapping function, Describe similar historical attack patterns to the current event. For intelligence matching mapping functions, , , These are the weighting coefficients, and ; The formula for the consistency constraint function is expressed as: in, Here, d is the consistency constraint function, and d is the cross-layer semantic inconsistency measure. The inconsistency penalty coefficient, For the second dynamic context module, This is the first dynamic context module.

6. The method for investigating large-scale language model attacks based on knowledge graph enhancement and dynamic context as described in claim 1, characterized in that, Based on the multi-source consistency score, the attack tactics of the current event are calculated, and the tactical sequence stability factor of each available topological position in the second dynamic context module is calculated. The attack tactics of the current event are then inserted into the available topological position with the highest tactical sequence stability factor. The structured template large language model is invoked to reconstruct the attack behavior description of the current event, and the first dynamic context module is updated with the reconstructed attack behavior description of the current event.

7. The method for investigating large-scale language model attacks based on knowledge graph enhancement and dynamic context as described in claim 1, characterized in that, The anchor point is retrieved by describing the tactical node of the current event in the second dynamic context module and the attack behavior in the first dynamic context module. The positional constraints of the current event in the second dynamic context module are derived based on the state machine topology to obtain the predecessor extension range. Events within the predecessor extension range are obtained from the log data as causal predecessor events.

8. The method for investigating large-scale language model attacks based on knowledge graph enhancement and dynamic context as described in claim 1, characterized in that, The formula for calculating causal reachability is: in, For causal accessibility, The tactical sequence stability factor for the current event. For the tactical accessibility of the current event, For the tactical accessibility of causal precursor events, For the field semantics of the current event, For the semantics of causal precursor events, The structural difference in semantics between the current event and the causal predecessor event fields. To counter the reachability value of the tactical state machine, This is the difference suppression coefficient.

9. The method for investigating large-scale language model attacks based on knowledge graph enhancement and dynamic context as described in claim 1, characterized in that, The termination conditions are: causal reachability is less than a set threshold, or the tactical phase sequence of the second dynamic context module covers the preset attack initial phase, or the number of iterations reaches a preset value.

10. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to execute the large-scale language model attack investigation method based on knowledge graph enhancement and dynamic context as described in any one of claims 1-9.

Images