Attack behavior prediction model training method, attack behavior prediction method and related equipment

Abstract

The embodiment of the invention discloses a training method of an attack behavior prediction model, an attack behavior prediction method and related equipment, and belongs to the technical field of network security processing. The method comprises the following steps: extracting a plurality of attack entities from original alarm information, and determining an attack event between any two attack entities and attack time corresponding to the attack event; inputting a plurality of sample attack sequences determined by the attack entity, the attack event and the attack time into the attack behavior prediction model, and outputting a predicted attack sequence after shielded information in each sample attack sequence is recovered; and determining a sequence loss value according to each predicted attack sequence and the corresponding tag attack sequence, and performing iterative training on the attack behavior prediction model according to the sequence loss value to obtain a trained attack behavior prediction model which is used for predicting the next attack behavior of the generated target attack behavior to obtain a predicted attack behavior. According to the invention, the accuracy of completely predicting all attack behaviors can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security processing, in particular to a training method of an attack behavior prediction model, an attack behavior prediction method and related equipment. BACKGROUND

[0002] With the acceleration of global digital transformation, attackers are constantly evolving new tactics that are automated, intelligent and concealed. Attack behaviors are usually hidden in a large amount of information in a fragmented, multi-stage and cross-domain collaborative manner. In the related art, the current network behavior is matched with a predefined rule to predict the next possible attack behavior.

[0003] However, due to the limited detection capability of security devices, only known attack patterns can be identified, and other abnormal behaviors cannot be identified, resulting in missed reports or misjudgments of new attack behaviors as normal traffic, thereby causing threats to remain latent and even causing serious network security problems. That is, the related art has the problem of poor accuracy in predicting all attack behaviors. SUMMARY

[0004] The embodiments of the present application provide a training method of an attack behavior prediction model, an attack behavior prediction method and related equipment, which can improve the accuracy of predicting all attack behaviors.

[0005] To achieve the above-mentioned purpose, the embodiments of the present application provide a training method of an attack behavior prediction model, comprising:

[0006] extracting a plurality of attack entities from the obtained original alarm information, determining attack events occurring between any two attack entities and attack times corresponding to the attack events; According to any two attack entities and corresponding attack events and attack times, an attack sequence of any two attack entities is generated to obtain a plurality of different attack sequences; According to each attack time, at least part of the labeled attack sequences are selected from the plurality of attack sequences, and the information in each labeled attack sequence is randomly occluded to obtain a sample attack sequence; inputting the plurality of sample attack sequences into the attack behavior prediction model, and outputting a predicted attack sequence after recovering the occluded information in each sample attack sequence; According to each predicted attack sequence and the corresponding labeled attack sequence, a sequence loss value is determined, and the attack behavior prediction model is iteratively trained according to the sequence loss value to obtain a trained attack behavior prediction model. The trained attack behavior prediction model is used to predict the next attack behavior of the target attack behavior that has occurred, and a predicted attack behavior is obtained.

[0007] In some embodiments, an attack sequence of any two attack entities is generated according to any two attack entities and corresponding attack events and attack times, including: An attack scene in which any two attack entities occur is obtained. An attack sequence of any two attack entities is generated according to the attack scene, any two attack entities and corresponding attack events and attack times.

[0008] In some embodiments, an attack scene in which any two attack entities occur is obtained, including: An event attack scene in which any two attack entities occur is determined according to attack events. A time attack scene in which any two attack entities occur is determined according to attack times. An attack scene in which any two attack entities occur is determined according to the event attack scene and the time attack scene.

[0009] In some embodiments, information in each labeled attack sequence is randomly occluded to obtain a sample attack sequence, including: If the current mode is a time explicit training mode, information in each labeled attack sequence is randomly occluded to obtain a sample attack sequence. If the current mode is a time implicit training mode, an attack time corresponding to each labeled attack sequence is hidden to obtain an initial sample attack sequence. Information in each initial sample attack sequence is randomly occluded to obtain a sample attack sequence.

[0010] In some embodiments, the attack time includes an attack start time and an attack end time. At least part of the labeled attack sequences is selected from the plurality of attack sequences according to each attack time, including: An attack time period to which a corresponding attack sequence belongs is determined according to each attack start time. An attack duration of a corresponding attack sequence is determined according to the attack start time and the attack end time. At least part of the labeled attack sequences is selected from the plurality of attack sequences according to an attack time period and / or an attack duration corresponding to each attack sequence.

[0011] In some embodiments, a sequence loss value is determined according to each predicted attack sequence and a corresponding labeled attack sequence, including: A sequence difference between each predicted attack sequence and a corresponding labeled attack sequence is calculated. logarithmize the sequence difference to obtain a logarithmized sequence difference value between each predicted attack sequence and the corresponding labeled attack sequence, to obtain a plurality of different logarithmized sequence difference values; obtain a sequence loss value according to the plurality of different logarithmized sequence difference values.

[0012] In some embodiments, the determining the sequence loss value according to each predicted attack sequence and the corresponding labeled attack sequence further comprises: determining an initial sequence loss value according to each predicted attack sequence and the corresponding labeled attack sequence; obtaining attack tactic knowledge base information; determining a tactic logic rationality degree corresponding to each predicted attack sequence according to the attack tactic knowledge base information; determining a predicted reward and punishment factor according to the tactic logic rationality degree corresponding to each predicted attack sequence; updating the initial sequence loss value according to the predicted reward and punishment factor to obtain the sequence loss value.

[0013] To achieve the above-mentioned purposes, the embodiments of the present application provide an attack behavior prediction method, comprising: obtaining target alarm information; determining a target attack sequence according to the target alarm information, wherein the target attack sequence comprises a target attack behavior that has occurred and to-be-predicted information associated with the target attack behavior, and the to-be-predicted information is in a blocked state; inputting the target attack sequence into a pre-trained attack behavior prediction model to output a predicted attack behavior, the predicted attack behavior being used to predict a next attack behavior of the target attack behavior that has occurred.

[0014] To achieve the above-mentioned purposes, the embodiments of the present application provide an attack behavior prediction model training device, comprising: an obtaining module, configured to extract a plurality of attack entities from obtained original alarm information, and determine an attack event occurring between any two attack entities and an attack time corresponding to the attack event; an attack sequence determining module, configured to generate an attack sequence of any two attack entities according to the any two attack entities and the corresponding attack event and attack time, to obtain a plurality of different attack sequences; a sample attack sequence determining module, configured to select at least part of labeled attack sequences from the plurality of attack sequences according to each attack time, and perform random blocking processing on information in each labeled attack sequence to obtain a sample attack sequence; a predicted attack sequence determining module, configured to input the plurality of sample attack sequences into an attack behavior prediction model to output a predicted attack sequence after recovery of blocked information in each sample attack sequence; The target training module is configured to determine a sequence loss value according to each predicted attack sequence and a corresponding labeled attack sequence, iteratively train the attack behavior prediction model according to the sequence loss value, and obtain a trained attack behavior prediction model. The trained attack behavior prediction model is configured to predict a next attack behavior of a target attack behavior that has occurred, and obtain a predicted attack behavior.

[0015] To achieve the above object, in one aspect, an embodiment of the present application provides a computer readable storage medium, which stores a plurality of instructions. The instructions are adapted to be loaded by a processor to execute steps in a training method of an attack behavior prediction model or an attack behavior prediction method provided by the embodiment of the present application.

[0016] To achieve the above object, in one aspect, an embodiment of the present application provides a computer device, which comprises a memory, a processor, and a computer program stored in the memory and capable of running on the processor. The processor executes the computer program to implement steps in a training method of an attack behavior prediction model provided by the embodiment of the present application.

[0017] To achieve the above object, in one aspect, an embodiment of the present application provides a computer program product, which comprises a computer program or instructions. The computer program or instructions are executed by a processor to implement steps in a training method of an attack behavior prediction model or an attack behavior prediction method provided by the embodiment of the present application.

[0018] The training method of the attack behavior prediction model, the attack behavior prediction method and the related device provided by the embodiment of the present application extract a plurality of attack entities from the obtained original alarm information, determine attack events between any two attack entities and attack times corresponding to the attack events, generate attack sequences of any two attack entities according to any two attack entities and corresponding attack events and attack times, select at least part of labeled attack sequences from the plurality of attack sequences according to each attack time, and perform random occlusion processing on information in each labeled attack sequence to obtain sample attack sequences. The plurality of sample attack sequences are input into the attack behavior prediction model, and a predicted attack sequence after recovery of occluded information in each sample attack sequence is output. A sequence loss value is determined according to each predicted attack sequence and a corresponding labeled attack sequence. The attack behavior prediction model is iteratively trained according to the sequence loss value, and a trained attack behavior prediction model is obtained. The trained attack behavior prediction model is configured to predict a next attack behavior of a target attack behavior that has occurred, and obtain a predicted attack behavior.

[0019] It can be understood that the related information of the attack behavior that the security device fails to detect will be output in the form of original alarm information. Based on this, the embodiment of the application determines the attack sequence containing the attack entity, event and time from the original alarm information containing a large amount of unknown information, selects at least part of the labeled attack sequence from the multiple attack sequences according to the time attack time, obtains the sample attack sequence by randomly occluding the information in each labeled attack sequence, and trains the attack behavior prediction model, so that the trained attack behavior prediction model has the generalization reasoning ability for the attack behavior. Therefore, when facing fragmentation, concealment or new attack methods that have never been seen before, the pre-trained attack behavior prediction model can still reason out the related attack behavior according to the behavior sequence that has occurred, thereby making up for the defect that the security device cannot completely predict all attack behaviors, and improving the accuracy of completely predicting all attack behaviors.

[0020] Other features and advantages of the present application will be set forth in the following description, and in part will become apparent to those skilled in the art from the description, or can be learned by practice of the application. The objects and other advantages of the application will be realized and attained by means of the instrumentalities particularly pointed out in the description and claims, and the appended drawings. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0022] Figure 1 is a system framework schematic diagram corresponding to the training method of the attack behavior prediction model provided by the embodiments of the present application; Figure 2 is a flowchart of the training method of the attack behavior prediction model provided by the embodiments of the present application; Figure 3 is a vector initialization schematic diagram of the training method of the attack behavior prediction model provided by the embodiments of the present application; Figure 4 is a time explicit training mode schematic diagram of the training method of the attack behavior prediction model provided by the embodiments of the present application; Figure 5 is a time implicit training mode schematic diagram of the training method of the attack behavior prediction model provided by the embodiments of the present application; Figure 6 is a flowchart of the attack behavior prediction method provided by the embodiments of the present application; Figure 7is a module structure schematic diagram of a training device for an attack behavior prediction model provided by an embodiment of the present application. Figure 8 is a hardware structure schematic diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order for those skilled in the art to better understand the scheme of the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0024] It should be noted that in each specific embodiment of the present application, when it is necessary to obtain the original table, the permission or consent of the relevant personnel managing the original table will be obtained first, and the collection, use and processing of these data will comply with relevant laws, regulations and standards. In addition, when the embodiments of the present application need to obtain sensitive personal information of relevant personnel, the separate permission or separate consent of the relevant personnel will be obtained through a pop-up window or jumping to a confirmation page, and after obtaining the separate permission or separate consent of the relevant personnel, the necessary original table for enabling the embodiments of the present application to normally operate will be obtained. The other data obtained by the embodiments of the present application are authorized and legal data, which will not be described one by one here.

[0025] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld devices or portable devices, tablet devices, multi-processor systems, microprocessor-based systems, programmable consumer computer devices, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in a distributed computing environment, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0026] The technical problems existing in the related art are as follows: With the acceleration of global digital transformation, attackers are constantly evolving new tactics that are automated, intelligent, and stealthy. Attack behavior is usually hidden in a large amount of information in a fragmented, multi-stage, and cross-domain collaborative manner. In the related art, the current network behavior is matched with the predefined rules to predict the next possible attack behavior.

[0027] However, due to the limited detection capability of the security device, only known attack patterns can be identified, and other abnormal behaviors cannot be identified, resulting in missed reports or misjudgments of new attack behaviors as normal traffic, and further causing threats to remain latent or even causing serious network security problems. That is, the related art has the problem of poor accuracy in predicting all attack behaviors.

[0028] For example, in highly digitized fields such as finance, energy, or critical infrastructure, defenders need to build an active security protection system with attack prediction technology for threat hunting, attack chain restoration, or dynamic risk control. Since the related art only matches the current observed network behavior with predefined rules (such as YARA rules, Snort signatures, or MITRE ATT&CK known techniques), when facing new tactics such as 0day vulnerabilities, fileless attacks, legal tool abuse (Living-off-the-Land), or low-frequency slow penetration, security devices often cannot identify unknown attack patterns, and related abnormal data will be output in the form of alarm information. Related technical personnel cannot fully utilize the content in the alarm information, and only rely on the output content of the security device to determine the current attack behavior, which severely limits the coverage and adaptability of attack prediction. Especially in the face of complex attack scenarios such as evolving zero-day exploit, lateral movement, or cross-platform penetration, the related art often cannot predict all attack behaviors, resulting in advanced threats remaining latent, moving laterally, and eventually causing data leakage or business interruption, and further causing network security crises.

[0029] The training method of an attack behavior prediction model, the attack behavior prediction method, and the related device provided in the application determine attack events occurring between any two attack entities and attack times corresponding to the attack events by extracting a plurality of attack entities from the obtained original alarm information. The attack sequence of any two attack entities is generated according to any two attack entities and the corresponding attack events and attack times, so as to obtain a plurality of different attack sequences. At least part of the labeled attack sequences are selected from the plurality of attack sequences according to each attack time, and the information in each labeled attack sequence is randomly occluded to obtain a sample attack sequence. The plurality of sample attack sequences are input into the attack behavior prediction model, and the predicted attack sequence after the occluded information in each sample attack sequence is recovered is output. The sequence loss value is determined according to each predicted attack sequence and the corresponding labeled attack sequence, the attack behavior prediction model is iteratively trained according to the sequence loss value, and the trained attack behavior prediction model is obtained. The trained attack behavior prediction model is used to predict the next attack behavior of the target attack behavior that has occurred, and the predicted attack behavior is obtained.

[0030] It can be understood that the related information of the attack behavior that the security device fails to detect will be output in the form of original alarm information. Based on this, the attack sequence containing attack entities, events, and times is determined from the original alarm information containing a large amount of unknown information in the embodiment of the application, at least part of the labeled attack sequences are selected from the plurality of attack sequences according to the attack time, the sample attack sequence is obtained by randomly occluding the information in each labeled attack sequence, the attack behavior prediction model is trained, and the trained attack behavior prediction model has the generalization reasoning ability of attack behavior. Therefore, when facing fragmentation, concealment, or a new attack method that has never been seen before, the pre-trained attack behavior prediction model can still reason the related attack behavior according to the behavior sequence that has occurred, thereby making up for the defect that the security device cannot completely predict all attack behaviors, and improving the accuracy of completely predicting all attack behaviors.

[0031] The content of the training method of an attack behavior prediction model, the attack behavior prediction method, and the related device provided in the embodiment of the application will be described in detail below.

[0032] Please refer to Figure 1 , Figure 1 The system framework schematic diagram corresponding to the training method of an attack behavior prediction model provided in the embodiment of the application. The training method of an attack behavior prediction model provided in the embodiment of the application can be applied in the system framework.

[0033] It includes a terminal 140, an Internet 130, a gateway 120, a server 110, and the like.

[0034] Terminal 140 or server 110 may be a device that performs a training method for an attack behavior prediction model.

[0035] Terminal 140 includes, but is not limited to, mobile phones, tablets, computers, and intelligent computing centers. Terminal 140 can be a single device or a collection of multiple devices. For example, multiple computers can be interconnected via a local area network, sharing a single monitor to work collaboratively, thus forming a terminal 140. Terminal 140 can communicate with the Internet 130 via wired or wireless means to exchange data.

[0036] Server 110 refers to a computer system that can provide certain services to terminal 140. Compared to ordinary terminal 140, server 110 has higher requirements in terms of stability, security, and performance. Server 110 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0037] Gateway 120, also known as an internetwork connector or protocol converter, is a computer system or device that acts as a translator, enabling network interconnection at the transport layer. It bridges the gap between two systems using different communication protocols, data formats, languages, or even completely different architectures. Gateways can also provide filtering and security functions. Messages sent from terminal 140 to server 110 are forwarded to the corresponding server 110 via gateway 120. Messages sent from server 110 to terminal 140 are also forwarded to the corresponding terminal 140 via gateway 120.

[0038] The embodiments of this application can be applied to various scenarios, such as digital twin security simulation systems, early warning of advanced persistent threats (APT), attack chain reconstruction and missing link completion, red team and blue team exercises and attack and defense drills and evaluations. These are only examples and do not represent a limitation on the scenarios in which the training method of the attack behavior prediction model can be applied.

[0039] Next, we will describe the attack behavior prediction model from the perspective of its training device, such as... Figure 2 As shown, Figure 2 This is a flowchart illustrating the training method for the attack behavior prediction model provided in this application embodiment. The training method for the attack behavior prediction model is applied to the training device for the attack behavior prediction model. Figure 2The method may include, but is not limited to, the following steps 210 to 250. When the training device for the attack behavior prediction model executes the training method for the attack behavior prediction model, the specific process is as follows. It should be noted first that this embodiment... Figure 2 The order of steps 210 to 250 is not specifically limited. The order of steps can be adjusted or some steps can be reduced or added according to actual needs.

[0040] Step 210: Extract multiple attack entities from the obtained original alarm information, and determine the attack events that occur between any two attack entities and the attack time corresponding to the attack events. Step 220: Generate an attack sequence for any two attack entities based on the corresponding attack events and attack times, so as to obtain multiple different attack sequences. Step 230: Select at least a portion of the labeled attack sequences from multiple attack sequences based on each attack time, and randomly occlude the information in each labeled attack sequence to obtain the sample attack sequence; Step 240: Input multiple sample attack sequences into the attack behavior prediction model and output the predicted attack sequence after the occluded information in each sample attack sequence is restored. Step 250: Determine the sequence loss value based on each predicted attack sequence and the corresponding labeled attack sequence. Iteratively train the attack behavior prediction model based on the sequence loss value to obtain the trained attack behavior prediction model. The trained attack behavior prediction model is used to predict the next attack behavior of the target attack behavior that has already occurred, and obtain the predicted attack behavior.

[0041] Steps 210 to 250 are described in detail below.

[0042] In step 210, multiple attack entities are extracted from the obtained original alarm information, and the attack events that occur between any two attack entities and the corresponding attack times are determined.

[0043] Raw alert information refers to unprocessed alert logs generated by network security devices (such as intrusion detection systems, firewalls, and endpoint protection software) when they detect suspicious or malicious behavior during network or host activity monitoring. Raw alert information typically includes multiple fields such as timestamp, source Internet Protocol Address (IP address), destination IP address, protocol type, attack type, and alert level. For example, a sample raw alert message A is shown below: { "id":"8:192.168.8.8:192.168.8.7", "src":"192.168.8.8", "dst":"192.168.8.7", "tag":"attack", "attack_time":"2023-11-18 15:37:33", "attack_type":"T1105", "attack_type_name":"Tool transfer", "attack_step":8, "attack_desc":"

[68655] Suspicious webshell backdoor access control" } It should be noted that the data format of the original alarm information obtained by different approaches is different, and the embodiments of the present application do not limit this. However, regardless of which form, the original alarm information will be used for subsequent information extraction to obtain multiple different attack sequences.

[0044] Among them, the attack entity refers to the subject or target object participating in the attack behavior in the network attack process, and the attack entity includes the attacker (such as a malicious IP address, a zombie host) and the attacked (such as a victim server, a terminal user).

[0045] Among them, the attack event refers to the attack relationship between any two attack entities, that is, the specific malicious behavior implemented by one attack entity on another attack entity. The attack event can be described by attack behavior description or technique, for example, the attack event can be port scanning, vulnerability exploitation, lateral movement, data theft, etc. The attack event reflects the interactive nature and attack intention between two attack entities.

[0046] Among them, the attack time refers to the relevant time point of the attack event, and the attack time includes the attack start time and the attack end time.

[0047] In step 220, according to any two attack entities and corresponding attack events and attack times, an attack sequence of any two attack entities is generated to obtain multiple different attack sequences.

[0048] In some embodiments, for any two attack entities, an attack sequence of the two attack entities in a four-tuple format is generated according to the two attack entities and corresponding attack events and attack times, thereby obtaining a plurality of different attack sequences. Due to the training phase, the attack behavior prediction model (hereinafter also referred to as "model" for convenience of description) needs to be trained using attack sequences with complete information, so the attack sequences obtained here must contain complete attacker information, victim information, attack relationship between the two, and related attack time. If any sequence is missing any or more of the four types of information, the complete attack sequence can be obtained first by manual completion, or the sequence is determined to be an invalid sequence, which is not in the range of a plurality of different attack sequences.

[0049] Exemplarily, for the original alarm information A, the corresponding elements are extracted in the four-tuple format (head entity, attack relationship, tail entity, attack time), thereby forming an attack sequence corresponding to the head entity and the tail entity, wherein the head entity refers to the attacker, the tail entity refers to the victim, and the attack relationship refers to any two attack entities and corresponding attack events. Specifically, the corresponding attack sequence ("src", "attack_type / attack_type_name", "dst", "attack_time / attack_step") is extracted from the original alarm information A, wherein "src" represents the source IP, i.e., the attacker IP, "dst" represents the destination IP, i.e., the attacked IP, "attack_type / attack_type_name" represents the attack relationship between the head and tail entities, and "attack_time / attack_step" represents the attack time of the attack event.

[0050] Exemplarily, according to the attacker (subject, s), the attack relationship (relation, r), the victim (object, o), and the attack time (time, t), an attack sequence X is constructed: X=[CLS]⊕s⊕[SEP]⊕r⊕[SEP]⊕o⊕[SEP]⊕t⊕[SEP]. Wherein, ⊕ represents string concatenation processing; [CLS] and [SEP] are special marks (classification marks and separators) of the pre-training model.

[0051] It should be noted that the representation format of the attack sequence is not limited to the four-tuple format, and other multi-tuple formats can be appropriately increased according to specific needs, and the embodiments of the present application do not limit this. In addition, in the original alarm information in different formats, different types of data representing the head and tail entities, attack relationships and attack times can be extracted according to the information provided by the original alarm information. For example, in some alarm devices, if the IP of the attacked party cannot be provided, other symbols representing the objects affected by the attacked party can be used, such as MAC address, and in addition to using alarm description to represent attack relationship, technical and tactical number can also be used to represent attack relationship. Here, only examples are given, and no more description is given for other feasible cases.

[0052] In some embodiments, according to any two attack entities and corresponding attack events and attack times, an attack sequence of any two attack entities is generated, including: (1.1) obtaining an attack scene in which any two attack entities occur; (1.2) generating an attack sequence of any two attack entities according to the attack scene, any two attack entities and corresponding attack events and attack times.

[0053] In some embodiments, in addition to generating an attack sequence in a four-tuple format according to any two attack entities and corresponding attack events and attack times, an attack scene in which any two attack entities occur can also be obtained, and an attack sequence of any two attack entities can be generated according to the attack scene, any two attack entities and corresponding attack events and attack times.

[0054] Among them, the attack scene refers to the specific environment, context and tactical background and other scene comprehensive information describing the attack between the two attack entities in the network security event. The attack scene provides semantic context for understanding attack behavior, which helps to further depict the interaction relationship between the two attack entities.

[0055] In this way, the attack scene is included in the construction of the attack sequence, which can provide richer contextual semantic information for the attack sequence compared to the basic four-tuple information. Then, when the attack behavior prediction model is trained using the attack sequence containing the attack scene, the model can more accurately learn the tactical intention of similar attack behaviors in different environments, thereby more effectively identifying the association relationship between various attack behaviors and improving the prediction ability of potential attack behaviors on related systems.

[0056] In some embodiments, the attack scene in which any two attack entities occur is obtained, including: (1.1.1) According to the attack event, determine the event attack scene in which any two attack entities are located under the event driving; (1.1.2) According to the attack time, determine the time attack scene in which any two attack entities are located under the time driving; (1.1.3) According to the event attack scene and the time attack scene, determine the attack scene in which any two attack entities are located.

[0057] In some embodiments, to determine the attack scene in which any two attack entities are located, first, according to the specific attack event identified, determine the event attack scene in which any two attack entities are located under the event driving. The event attack scene refers to the event context environment defined by the attack event. After determining the attack event, the prior knowledge related to the attack event can be obtained, and the corresponding event attack scene is determined according to the prior knowledge and the attack event. For example, obtain the MITRE ATT&CK general knowledge framework, when the specific attack event is identified as "T1105 tool transmission", according to MITRE ATT&CK, determine the semantic interpretation or operational description of the typical behavior of "T1105 tool transmission" in actual attack as "transmitting malicious tools or scripts from C2 server to controlled host", and further determine the event attack scene in which the corresponding two attack entities are located under the event driving as "malicious payload delivery scene".

[0058] Further, according to the attack time at which the attack event occurs, determine the time attack scene in which any two attack entities are located under the time driving. The time attack scene refers to the time context environment in which the corresponding two attack entities are located under the time driving, which is inferred based on the time characteristics of the attack. After determining the attack time, the corresponding time attack scene is determined according to the attack time itself. For example, when the same two attack entities attack multiple times, each corresponding attack time indicates that the two attack entities interact intensively at night when they are not working, so the time attack scene in which the two attack entities are located can be obtained as "concealed night activity scene".

[0059] For another example, an attack event with an attack time of "step 1" can be determined as "attack initial stage scene", and an event occurring at "step 8" can be determined as "attack deep stage scene". The representation form of the time attack scene will be adaptively adjusted according to the form of the attack time.

[0060] Furthermore, by combining event-based attack scenarios and time-based attack scenarios, the attack scenario in which any two attacking entities are located can be determined. In the example above, based on the event-based attack scenario "malicious payload delivery scenario" and the time-based attack scenario "covert nighttime activity scenario," the attack scenario in which any two attacking entities are located can be determined as "covert nighttime malicious payload delivery scenario."

[0061] It should be noted that the above are only illustrative examples. The specific representation of event attack scenarios, time attack scenarios, and attack scenarios can be set according to the actual situation, and this application embodiment does not limit them.

[0062] Understandably, the construction of attack scenarios greatly enhances the representational ability of input features, providing a richer information foundation for attack behavior prediction models to accurately infer the attacker's intent and predict their subsequent attack behaviors, thereby effectively improving the accuracy of predicting complex, multi-stage attack behaviors.

[0063] In step 230, at least a portion of the labeled attack sequences are selected from multiple attack sequences based on each attack time, and the information in each labeled attack sequence is randomly occluded to obtain a sample attack sequence.

[0064] In some embodiments, after constructing multiple different attack sequences, to ensure that the selected samples can cover representative temporal behavior patterns, at least a portion of the labeled attack sequences are selected from the multiple attack sequences based on each attack time. Then, random occlusion processing is applied to any one of the attacker information, attack event information, or attacked party information in each labeled attack sequence within the batch to obtain sample attack sequences used to train the attack behavior prediction model. That is, the information involved in the random occlusion processing only includes the attack entity and the attack relationship.

[0065] "At least part" means that the selected labeled attack sequence is at least a part of multiple attack sequences, or it can mean that all attack sequences are used as labeled attack sequences.

[0066] In some embodiments, after obtaining at least a partial label attack sequence (assuming it is a label attack sequence in quadruplet format), such as Figure 3 As shown, Figure 3 This is a vector initialization diagram of the training method for the attack behavior prediction model provided in this application embodiment. An attack entity set and an attack relation set are constructed based on the labeled attack sequence, and each attack entity and attack relation is randomly assigned a k-dimensional vector as its initial representation. This application embodiment avoids mixing entity and relation vector spaces by first partitioning the sets and then initializing them independently, ensuring that each can evolve along a direction suitable for its semantic characteristics during subsequent training.

[0067] It can be understood that, compared with the way of screening the tag attack sequence without considering the attack time in the traditional method, the embodiments of the present application can more accurately capture the attack sequence with evolution rules and context-dependent relationships in the time dimension as the tag attack sequence by introducing the attack time as a key screening basis, so that the attack behavior prediction model can be trained based on the tag attack sequences with the same time characteristics, thereby more effectively learning the evolution patterns of different attack behaviors within a specific time window, and further improving the attack behavior prediction accuracy in actual application.

[0068] In some embodiments, selecting at least part of the tag attack sequences from the plurality of attack sequences according to each attack time comprises: (2.1) determining the attack time period to which the corresponding attack sequence belongs according to each attack start time; (2.2) determining the attack duration of the corresponding attack sequence according to the attack start time and the attack end time; (2.3) selecting at least part of the tag attack sequences from the plurality of attack sequences according to the attack time period and / or the attack duration of each attack sequence.

[0069] Wherein, the attack start time refers to the specific time information marking the starting point of the attack sequence, and the attack time period refers to the time interval or label after the attack start time is classified by time attribute. For example, 24 hours in a day can be divided into "working hours", "non-working hours", "early morning" and other attack time periods, when the attack start time of a certain attack sequence falls within a certain interval, the attack sequence is assigned the corresponding attack time period attribute.

[0070] Wherein, the attack duration is obtained by calculating the time difference between the attack end time and the attack start time, which reflects the complete time span of a certain attack activity. For example, a very short attack duration may indicate a quick scanning probe, while a longer attack duration may mean a persistent penetration or latent activity.

[0071] In some embodiments, at least part of the tag attack sequences can be selected from the plurality of attack sequences according to each attack time period, at least part of the tag attack sequences can be selected from the plurality of attack sequences according to each attack end time, and at least part of the tag attack sequences can be selected from the plurality of attack sequences according to each attack time period and attack end time. For example: (1) Assuming that an unusually dense attack is suffered within the time period from 00:00 on December 24, 2025 to 23:59 on December 31, 2025, this interval can be defined as a high-risk attack time period, and the sequences with attack start times falling within this time period are selected from all attack sequences as labeled attack sequences for in-depth analysis of the positive samples used by the attacker; (2) To construct a high-risk threat detection model, attack sequences with a duration of more than 72 hours are selected as "long-term latent" labeled attack sequences, which are used to train the attack behavior prediction model to more accurately identify ongoing advanced threat activities; (3) Assuming that network automated long-time attacks surge on statutory holidays, attack sequences with a duration of 30 minutes or more during the period from October 1, 2025 to October 7, 2025 can be selected as "automated scanning attack" labeled attack sequences; for example, assuming that a year is divided into four quarterly attack time periods (Q1-Q4), an attack sequence starts in Q3 of 2025 and ends in Q1 of 2026, with a duration of 120 days, then at least some labeled attack sequences can be selected from multiple attack sequences based on the screening conditions of "duration > 90 days" and "spanning at least two attack time periods", and marked as "advanced persistent threat (APT) candidate" labeled attack sequences.

[0072] It can be understood that the training of the attack behavior prediction model in the embodiments of the application is not blindly using all data, but can focus on learning attack patterns under specific time characteristics according to needs. For example, by focusing on attack sequences in a specific attack time period or with a long duration, the prediction ability of the model for advanced persistent threats with specific work schedule characteristics or long-term latent characteristics can be significantly improved, thereby improving the ability of the model to cope with attack behaviors in different time patterns.

[0073] In some embodiments, the information in each labeled attack sequence is randomly occluded to obtain a sample attack sequence, including: (3.1) If the current time is in the time explicit training mode, the information in each labeled attack sequence is randomly occluded to obtain a sample attack sequence; (3.2) If the current time is in the time implicit training mode, the attack time corresponding to each labeled attack sequence is hidden to obtain an initial sample attack sequence; (3.3) The information in each initial sample attack sequence is randomly occluded to obtain a sample attack sequence.

[0074] The time explicit training mode refers to that, in the model training process, the attack time directly participates in the construction of the sample attack sequence as an explicit feature. In this mode, the attack time in the attack sequence is not hidden, and any one of the attack source information, attack event information, attacked entity information and attack time information in the label attack sequence is randomly masked to obtain the sample attack sequence.

[0075] As shown in Figure 4 , Figure 4 is a time explicit training mode schematic diagram of a training method of an attack behavior prediction model provided by the embodiment of the application. In the time explicit training mode, the input sample attack sequence includes a start token [CLS], an attack source IP address "192.168.XX.11", an attack event type "T1105 / tool transmission", a separator [SEP], a masked field ([MASK]), an attack time "2023-11-18 15:37:33 / Step8" and an end token [SEP]. The [MASK] position represents the attacked entity to be predicted, and the real value thereof is "192.168.XX.22", which represents the attacked IP address. In the case that the attack time in the sample attack sequence is not hidden, the entire sequence is input into the attack behavior prediction model, so that the subsequent model infers the information at the [MASK] position by learning the context information, and outputs the prediction result.

[0076] The time implicit training mode refers to that, in the model training process, the attack time will not participate in the construction of the sample attack sequence as an explicit feature, but is first hidden in the label attack sequence to obtain an initial sample attack sequence. Then, the information in each initial sample attack sequence is randomly masked to obtain the sample attack sequence. In this way, without providing the time feature, the model infers any two attack entities and the attack relationship therebetween from the behavior context itself, so as to capture the internal timing rules or semantic associations of the attack behavior.

[0077] As shown in Figure 5 , Figure 5is a time implicit training mode schematic diagram of a training method of an attack behavior prediction model provided by the embodiment of the application. In the time implicit training mode, the input sample attack sequence includes a start mark [CLS], an attack source IP address "192.168.XX.11", a separator [SEP], an attack event type "T1105 / tool transmission", another [SEP] separator, and a [MASK] position that is blocked, indicating an attacked entity to be predicted. The [MASK] position is labeled with a real value "192.168.XX.22" below, that is, an attacked IP address. In the case that the attack time in the sample attack sequence is blocked, the entire sequence is input into the attack behavior prediction model, so that the subsequent model infers the information at the [MASK] position by learning the context information, and outputs a prediction result.

[0078] Further, the training mode of the model can be pre-set, that is, the model can only use one of the time explicit training mode and the time implicit training mode, or train the time explicit training mode and the time implicit training mode in sequence, to obtain a trained model having both attack behavior prediction capabilities. Further, the current training mode can be determined according to the pre-set training mode of the model, for example, assuming that the model needs to be trained in two modes, the model will enter different training modes in a specific time period, and then the device can determine the training mode of the model according to the current time, and further adopt different processing means for attack information.

[0079] For another example, the model can select one of the training modes according to actual needs: the explicit time modeling mode is suitable for a phased covert attack mining and discovery task in network security protection, for example, an operator obtains attack behavior data in a certain time range, finds that some attack steps are missing in the attack event, inputs the context data of the missing behavior into the model, and performs completion reasoning of the missing attack entity. This kind of scene is inclined to "post-analysis review" of important attack events. The time implicit training mode is suitable for attack behavior prediction in real time, the model can be trained according to all historical data obtained at present, and missing entities and relationships in future time can be predicted and reasoned. This kind of scene is inclined to "real-time prediction in the process".

[0080] It can be understood that the embodiments of the present application can make the attack behavior prediction results output by the model more suitable for actual network security application scenarios by constructing the "time explicit" and "time implicit" double training modes of the model. Specifically, the time explicit training mode focuses on "post-mortem analysis", greatly improves the integrity and accuracy of attack event review by learning the missing attack steps within the known time range; and the time implicit training mode focuses on "in-process prediction", and can effectively extrapolate and predict the attack that may occur in the future by stripping the time information to learn the internal evolution logic of the attack behavior. In this way, the embodiments of the present application enable a single model to perform both "interpolation completion" and "extrapolation prediction" tasks while the model participates in both training modes, thereby fully covering the needs from passive response to active defense, and thus having stronger scene adaptability and practical application value.

[0081] In step 240, the plurality of sample attack sequences are input into the attack behavior prediction model, and a predicted attack sequence after the occluded information in each sample attack sequence is recovered is output.

[0082] In some embodiments, the plurality of sample attack sequences are input into a pre-constructed attack behavior prediction model as input. The attack behavior prediction model performs deep analysis and context understanding on the input sample attack sequences containing occluded information, infers and predicts the occluded information in the sample attack sequences, and thus obtains a predicted attack sequence after the occluded information in each sample attack sequence is recovered.

[0083] Exemplarily, a certain entity or relationship in the attack sequence is subjected to mask processing, and the mask position is the ith token, so as to obtain a sample attack sequence and a label attack sequence, so as to input the sample attack sequence into the attack behavior prediction model, and output a predicted attack sequence after the occluded information in each sample attack sequence is recovered. X masked = Replace (X, x i , [MASK]). Wherein, [MASK] represents a mask, X represents an attack sequence, x i ∈{s,r,o} is the real information corresponding to the occluded information; the sample attack sequence is determined according to X and [MASK], and the label attack sequence is determined according to X.

[0084] In step 250, a sequence loss value is determined according to each predicted attack sequence and the corresponding label attack sequence, the attack behavior prediction model is iteratively trained according to the sequence loss value, and a trained attack behavior prediction model is obtained. The trained attack behavior prediction model is used to predict the next attack behavior of the target attack behavior that has occurred, and a predicted attack behavior is obtained.

[0085] In some embodiments, after the model outputs a predicted attack sequence, each predicted attack sequence output by the model is compared with the original unoccluded label attack sequence corresponding to the predicted attack sequence, a sequence loss value quantifying the difference between the two is calculated, and the sequence loss value reflects the accuracy of the model prediction. Subsequently, the internal parameters of the attack behavior prediction model are adjusted and updated using an optimization algorithm such as gradient descent according to the sequence loss value. This training process is repeated, i.e., iterative training, until a preset iterative training condition is reached, and a pre-trained attack behavior prediction model is obtained. The trained attack behavior prediction model can receive a target attack behavior sequence that has occurred as input and infer the most likely next attack behavior based on the attack entity, event type, time relationship, and other information in the sequence.

[0086] The preset iterative training condition can be that the model training reaches a specified number of training rounds, or the sequence loss value falls below a certain threshold, or the loss value hardly changes in consecutive rounds of training, indicating that the model converges, or the prediction accuracy on a sample validation set no longer improves, etc. The preset iterative training conditions exemplified herein can be used alone or in combination to determine when to stop training the model, thereby obtaining an attack behavior prediction model that is accurate and has good generalization ability.

[0087] Further, after training, each entity / relationship corresponds to a real-valued dense vector of a unified dimension (which can be set). For example, the final vector of the entity "Beijing" in a 512-dimensional space is as follows: [0.31, 0.57, 0.44, 0.12, 0.09, 0.66, …, 0.23] (512 32-bit floating-point numbers, modulus ≈ 1). After pre-training model ranking loss optimization and norm constraint ≤1, the vector obtained for each entity and relationship is the final vectorized representation thereof.

[0088] It can be understood that, by converting the original alert information into a structured attack sequence, and using a pre-trained attack behavior prediction model to further analyze the original alert information in the case where the security device can predict known attack patterns, the embodiments of the present application can assist the security device in providing comprehensive security protection for related systems, and thus the embodiments of the present application greatly improve the completeness of attack behavior prediction for related systems.

[0089] In some embodiments, determining the sequence loss value according to each predicted attack sequence and the corresponding label attack sequence includes: (4.1) calculating the sequence difference between each predicted attack sequence and the corresponding label attack sequence; (4.2) log-transforming the sequence difference to obtain a log-transformed sequence difference value between each predicted attack sequence and the corresponding labeled attack sequence, to obtain a plurality of different log-transformed sequence difference values; (4.3) obtaining a sequence loss value according to the plurality of different log-transformed sequence difference values.

[0090] In some embodiments, after the model outputs the predicted attack sequence, a sequence loss value is determined according to each predicted attack sequence and the corresponding labeled attack sequence. Specifically, the masked X masked In the input attack behavior prediction model, the context representation H = M θ ( Xmasked ) of all positions is outputted, where M θ represents the attack behavior prediction model; H ∈ R{L×d} (L is the sequence length, and d is the hidden dimension); for a masked position i, its hidden state hi ∈ Rd is extracted, and a softmax classification head is used to predict the original label by the following formula, so as to obtain the sequence difference P between each predicted attack sequence and the corresponding labeled attack sequence: P(xi∣Xmasked)=softmax(W˙hi+b). Where W ∈ R{|V|×d} and b ∈ R{|V|} are the weights and biases of the model output layer; |V| is the size of the entity set.

[0091] Further, the sequence loss value L is determined by the following formula: . Wherein, represents the sequence difference; log represents the logarithmic processing; represents the log-transformed sequence difference value.

[0092] Further, the training target of the embodiment of the present application is to minimize the cross-entropy loss of the masked position, and then the loss calculation part of the training can be represented as a whole by the following formula: .

[0093] It can be understood that the embodiment of the present application quantifies the sequence difference between the predicted value and the true value, and obtains the sequence loss value by using the log transformation, which ensures that the convergence process of the model is more stable and efficient during each iteration update, thereby outputting an attack behavior prediction model with better performance.

[0094] In some embodiments, the sequence loss value is determined according to each predicted attack sequence and the corresponding labeled attack sequence, further comprising: (5.1) determining an initial sequence loss value according to each predicted attack sequence and the corresponding labeled attack sequence; (5.2) obtaining attack tactic knowledge base information; (5.3) According to the attack tactic knowledge base information, determine the logical degree of each predicted attack sequence corresponding to the tactic; (5.4) According to the logical degree of each predicted attack sequence corresponding to the tactic, determine the prediction reward and punishment factor; (5.5) Update the initial sequence loss value according to the prediction reward and punishment factor to obtain the sequence loss value.

[0095] In some embodiments, when determining the sequence loss value, the predicted result and the true result can be compared first to obtain the initial sequence loss value. Specifically, each predicted attack sequence generated by the model is compared with its corresponding label attack sequence (i.e. the true attack sequence) element by element or position by position to calculate the initial sequence loss value. The loss function used to calculate the initial sequence loss value can be a cross-entropy loss function, a mean square error loss function, the loss calculation method of steps (4.1) to (4.3), or other loss functions suitable for sequence modeling to quantify the difference between the two.

[0096] Further, in order to integrate expert knowledge in the field of network security into the training process of the model, the output accuracy of the prediction output result is evaluated based on the calculated initial sequence loss value through professional domain knowledge. Among them, the attack tactic knowledge base information refers to a structured knowledge set systematically organized about the network attack behavior at the tactical level, which usually includes typical tactics, techniques and steps followed by attackers in the implementation of the attack process (such as the tactic categories in the MITRE ATT&CK framework, such as “initial access”, “execution”, “persistence”, “lateral movement”, etc.), as well as the logical dependency relationship, the order constraint, the applicable scenario and the target association between each attack event (or technique), etc. The attack tactic knowledge base provides a priori basis for judging whether the predicted attack sequence conforms to the tactic logic of the real attacker, thereby supporting the semantic rationality and tactic coherence evaluation of the model prediction result.

[0097] Further, according to the attack tactic knowledge base information, each predicted attack sequence generated by the model is verified to determine the rationality of the corresponding tactic logic. The rationality of the tactic logic refers to judging whether the attack step chain described by the predicted sequence conforms to the tactic flow defined in the knowledge base, which is usually followed by real-world attackers. For example, the model outputs a predicted attack sequence: "Attacker A → exploit T1105 (file and tool transfer) → Server B". According to the attack tactic knowledge base (such as MITRE ATT&CK), T1105 usually occurs after the attacker has obtained initial access, and is used to deploy tools or payloads in the internal network, which is a typical technology in the "command and control" or "execution" phase. If this sequence appears in a more complete context (such as a previous sequence of "phishing email" to achieve initial access), its rationality of tactic logic is higher; but if this sequence appears in isolation, and attacker A has never established any contact with the target network before, then "directly exploiting T1105 to transfer tools to Server B" is not reasonable, because there is a lack of initial access steps, therefore, by comparing the applicable prerequisites, dependent conditions and typical context of T1105 in the attack tactic knowledge base, it can be evaluated whether the triple sequence conforms to the tactic evolution logic of real attackers, so as to quantify the rationality of the tactic logic and adjust the loss function of model training.

[0098] Further, according to the rationality of the tactic logic corresponding to each predicted attack sequence, a corresponding prediction reward and punishment factor is determined. The value of the prediction reward and punishment factor is positively correlated with the rationality of the tactic logic, when the rationality of the tactic logic of the predicted attack sequence is high, the corresponding prediction reward and punishment factor will be "rewarded" (for example, a multiplier less than 1); and when its rationality of the tactic logic is low, the factor will be "punished" (for example, a multiplier greater than 1), so as to exert greater correction pressure on the model's prediction that does not conform to the tactic logic.

[0099] Further, the initial sequence loss value is updated according to the prediction reward and punishment factor, so as to obtain the final sequence loss value. Specifically, the update can be completed by multiplying the initial sequence loss value by the prediction reward and punishment factor, and the updated sequence loss value not only contains the consideration of the matching degree of the prediction result and the label data, but also contains the evaluation of its rationality of the tactic logic, and the sequence loss value will be used to guide the iterative optimization of the model parameters.

[0100] It can be understood that, by rewarding reasonable prediction of tactical logic and punishing unreasonable prediction, the embodiments of the present application can effectively inject expert knowledge and attack logic in the field of network security into the learning process of the model, guiding the model to generate prediction results that not only conform to the data distribution but also have practical logic. This greatly improves the accuracy and credibility of predicting attack behavior, making the finally trained model more robust and practical in actual application.

[0101] Next, continue to describe from the dimension of the attack behavior prediction device, as shown in Figure 6 , the flowchart of the attack behavior prediction method provided by the embodiments of the present application is shown in Figure 6 , the attack behavior prediction method is applied to the method in the attack behavior prediction device, Figure 6 may include but not limited to the following steps 310 to 330, when the attack behavior prediction device executes the attack behavior prediction method, the specific process is as follows, it needs to be first pointed out that, the order of steps 310 to 330 in Figure 6 is not specifically limited, the order of steps can be adjusted or some steps can be reduced or increased according to actual needs.

[0102] Step 310, obtaining target alarm information; Step 320, determining a target attack sequence according to the target alarm information, wherein the target attack sequence includes a target attack behavior that has occurred and to-be-predicted information associated with the target attack behavior, the to-be-predicted information being in a shielded state; Step 330, inputting the target attack sequence into a pre-trained attack behavior prediction model to output a predicted attack behavior, the predicted attack behavior being used to predict a next attack behavior of the target attack behavior that has occurred.

[0103] The target alarm information refers to a specific alarm data or a group of alarm data that needs to be analyzed in the next step of behavior analysis, which is captured by a security device in real time or extracted from historical logs in an actual network security monitoring scene. The target attack sequence refers to an attack sequence determined according to the target alarm information, which contains two key contents: the first part is the target attack behavior that has occurred, which is a known attack entity or attack relationship directly extracted from the target alarm information; the second part is to-be-predicted information associated with the target attack behavior, which represents unknown content expected to be predicted by the model, which can be an attack entity or an attack relationship. The to-be-predicted information is set to a shielded state in the target attack sequence, for example, marked with [MASK] to occupy a place to achieve the purpose of shielding. The definition of the target alarm information is similar to that of the original alarm information, and the definition of the target attack sequence is similar to that of the sample attack sequence, which will not be described here.

[0104] Further, the target attack sequence containing the occluded information is input into the attack behavior prediction model trained by steps 210 to 250. After receiving the input, the model decodes and fills in the position of the occluded state in the target attack sequence, and finally outputs a specific predicted attack behavior. The predicted attack behavior is a prediction of the next attack behavior of the target attack behavior that has occurred, to reveal the attack behavior that the attacker is most likely to take.

[0105] It can be understood that the content that cannot be recognized by the security device in actual application will be output in the form of alarm information, but the attack behavior information contained in the target alarm information is also incomplete, so the incomplete part will be marked in the form of a mask to prompt the model to predict the content at this part. In this way, the trained attack behavior prediction model can predict real content in actual application to determine potential attack behaviors that are not detected by the security device based on the target alarm information, thereby improving the accuracy of predicting all attack behaviors.

[0106] In order to facilitate the reader to understand, the following is a complete example: (1) Given a new network security log or alarm data, extract the known fields to form a quadruple, and explicitly mark the position to be predicted as [MASK]. For example: Input: <[CLS] [MASK] [SEP] tool transmission [SEP] 192.168.8.7 [SEP] step6 [SEP]>; Target: Predict the real attacker entity at the [MASK] position (such as attackerIP: 192.168.1.100).

[0107] (2) Model forward propagation. Input the constructed Xmasked into the trained pre-trained model Mθ, and obtain the hidden state hi of the mask position by the following formula: hi=M θ (X masked )[i]。

[0108] (3) Entity decoding. Calculate the probability distribution of each entity in the vocabulary corresponding to the mask position through the output layer (softmax classification head) of the model: .

[0109] Then, select the entity with the highest probability as the prediction result: . Where, entity is a pre-defined attack entity vocabulary.

[0110] (4) Post-processing and confidence filtering, including: ①Top-K filtering: return the K top-ranked candidate entities (e.g., K = 5) for manual verification by security analysts.

[0111] ②Threshold filtering: if the top-ranked probability is below a threshold (e.g., 0.7), mark it as an "unknown entity" and trigger manual investigation.

[0112] As shown in Figure 7 FIG. 4 is a schematic diagram of a module structure of an attack behavior prediction model training device according to an embodiment of the present application. The attack behavior prediction model training device 400 can include the following modules 410-450: Figure 7 The obtaining module 410 is configured to extract a plurality of attack entities from the obtained original alarm information, determine attack events occurring between any two attack entities, and determine attack times corresponding to the attack events. The attack sequence determination module 420 is configured to generate an attack sequence of any two attack entities according to the any two attack entities and the corresponding attack events and attack times, so as to obtain a plurality of different attack sequences. The sample attack sequence determination module 430 is configured to select at least part of labeled attack sequences from the plurality of attack sequences according to each attack time, and perform random occlusion processing on information in each labeled attack sequence, so as to obtain a sample attack sequence. The predicted attack sequence determination module 440 is configured to input the plurality of sample attack sequences into an attack behavior prediction model, and output a predicted attack sequence after recovery of occluded information in each sample attack sequence. The target training module 450 is configured to determine a sequence loss value according to each predicted attack sequence and the corresponding labeled attack sequence, iteratively train the attack behavior prediction model according to the sequence loss value, obtain a trained attack behavior prediction model, and use the trained attack behavior prediction model to predict a next attack behavior of a target attack behavior that has occurred, so as to obtain a predicted attack behavior. In some embodiments, the attack sequence determination module 420 is configured to:

[0113] obtain an attack scene in which any two attack entities that have attacked are located; generate an attack sequence of the any two attack entities according to the attack scene, the any two attack entities, and the corresponding attack events and attack times. In some embodiments, the attack sequence determination module 420 is further configured to:

[0114] determine an event attack scene in which the any two attack entities are located under event driving according to the attack events; determine a time attack scene in which the any two attack entities are located under time driving according to the attack times. ​According to the event attack scene and the time attack scene, attack scenes in which any two attack entities occur are determined.

[0115] In some embodiments, the sample attack sequence determination module 430 is configured to: If the current time is in the time explicit training mode, the information in each label attack sequence is randomly occluded to obtain a sample attack sequence; If the current time is in the time implicit training mode, the attack time corresponding to each label attack sequence is hidden to obtain an initial sample attack sequence; The information in each initial sample attack sequence is randomly occluded to obtain a sample attack sequence.

[0116] The attack time includes an attack start time and an attack end time; In some embodiments, the sample attack sequence determination module 430 is further configured to: According to each attack start time, determine the attack time period to which the corresponding attack sequence belongs; According to the attack start time and the attack end time, determine the attack duration of the corresponding attack sequence; According to the attack time period and / or the attack duration corresponding to each attack sequence, select at least part of the label attack sequences from the plurality of attack sequences.

[0117] In some embodiments, the target training module 450 is configured to: Calculate the sequence difference between each predicted attack sequence and the corresponding label attack sequence; Take the logarithm of the sequence difference to obtain the logarithmic sequence difference value between each predicted attack sequence and the corresponding label attack sequence, to obtain a plurality of different logarithmic sequence difference values; According to the plurality of different logarithmic sequence difference values, obtain a sequence loss value.

[0118] In some embodiments, the target training module 450 is further configured to: According to each predicted attack sequence and the corresponding label attack sequence, determine an initial sequence loss value; Obtain attack tactic knowledge base information; According to the attack tactic knowledge base information, determine the degree of rationality of the tactic logic corresponding to each predicted attack sequence; According to the degree of rationality of the tactic logic corresponding to each predicted attack sequence, determine a prediction reward and punishment factor; According to the prediction reward and punishment factor, update the initial sequence loss value to obtain a sequence loss value.

[0119] The training method of an attack behavior prediction model, the attack behavior prediction method, and the related device provided in the application determine attack events occurring between any two attack entities and attack times corresponding to the attack events by extracting a plurality of attack entities from acquired original alarm information; generate attack sequences of any two attack entities according to the any two attack entities and the corresponding attack events and attack times, to obtain a plurality of different attack sequences; select at least part of labeled attack sequences from the plurality of attack sequences according to each attack time, and perform random occlusion processing on information in each labeled attack sequence to obtain sample attack sequences; input the plurality of sample attack sequences into an attack behavior prediction model, and output a predicted attack sequence after recovery of occluded information in each sample attack sequence; determine a sequence loss value according to each predicted attack sequence and a corresponding labeled attack sequence, iteratively train the attack behavior prediction model according to the sequence loss value, and obtain a trained attack behavior prediction model, which is used to predict a next attack behavior of a target attack behavior that has occurred, to obtain a predicted attack behavior.

[0120] It can be understood that the related information of the attack behavior that the security device fails to detect will be output in the form of original alarm information. Based on this, the embodiments of the application determine attack sequences containing attack entities, events, and times from the original alarm information that contains a large amount of unknown information, select at least part of labeled attack sequences from the plurality of attack sequences according to the attack time, obtain sample attack sequences by performing random occlusion processing on information in each labeled attack sequence, train the attack behavior prediction model, so that the trained attack behavior prediction model has the generalization reasoning ability for attack behaviors. Therefore, when facing fragmentation, concealment, or a new attack method that has never been seen before, the pre-trained attack behavior prediction model can still reason the related attack behavior according to the behavior sequence that has occurred, thereby making up for the defect that the security device cannot completely predict all attack behaviors, and improving the accuracy of completely predicting all attack behaviors.

[0121] As shown in Figure 8 , the hardware structure of the electronic device provided in the embodiments of the application is shown in Figure 8 , which includes: The processor 401 can be implemented in a general-purpose central processing unit (CPU), a microprocessor, an application specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute related programs to implement the technical solutions provided in the embodiments of the application. The memory 402 can be implemented in the form of a Read Only Memory (ROM), a static storage device, a dynamic storage device, or a Random Access Memory (RAM), etc. The memory 402 can store an operating system and other application programs, and when the technical solutions provided by the embodiments of the present specification are implemented by software or firmware, the related program codes are stored in the memory 402 and are called and executed by the processor 401 to implement the training method of the attack behavior prediction model of the embodiments of the present application; The input / output interface 403 is configured to realize information input and output. The communication interface 404 is configured to realize the communication interaction between the device and other devices, and the communication can be realized by a wired manner (for example, a USB, a network cable, etc.) or a wireless manner (for example, a mobile network, WIFI, Bluetooth, etc.). The bus 405 is configured to transmit information between various components (for example, the processor 401, the memory 402, the input / output interface 403, and the communication interface 404) of the device. The processor 401, the memory 402, the input / output interface 403, and the communication interface 404 are connected to each other through the bus 405 to realize the communication connection between the device.

[0122] The embodiments of the present application also provide a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the training method of the attack behavior prediction model.

[0123] The memory is a kind of non-transient computer readable storage medium, and can be used to store non-transient software programs and non-transient computer executable programs.In addition, the memory can include a high-speed random access memory, and can also include a non-transient memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transient solid-state memory device.In some embodiments, the memory can optionally include a memory remotely arranged relative to the processor, and these remote memories can be connected to the processor through a network.The examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0124] The training method of an attack behavior prediction model, the attack behavior prediction method and the related device provided by the application extract a plurality of attack entities from the obtained original alarm information, determine attack events occurring between any two attack entities and attack times corresponding to the attack events, generate attack sequences of any two attack entities according to the any two attack entities and the corresponding attack events and attack times, obtain a plurality of different attack sequences, select at least part of the labeled attack sequences from the plurality of attack sequences according to each attack time, and perform random occlusion processing on the information in each labeled attack sequence to obtain sample attack sequences, input the plurality of sample attack sequences into the attack behavior prediction model, output the predicted attack sequences after the occluded information in each sample attack sequence is recovered, determine sequence loss values according to each predicted attack sequence and the corresponding labeled attack sequence, iteratively train the attack behavior prediction model according to the sequence loss values, obtain the trained attack behavior prediction model, and use the trained attack behavior prediction model to predict the next attack behavior of a target attack behavior that has occurred, and obtain a predicted attack behavior.

[0125] It can be understood that the related information of the attack behavior that the security device fails to detect will be output in the form of original alarm information. Based on this, the embodiments of the application determine attack sequences containing attack entities, events and times from the original alarm information containing a large amount of unknown information, select at least part of the labeled attack sequences from the plurality of attack sequences according to the attack time, obtain sample attack sequences by performing random occlusion processing on the information in each labeled attack sequence, train the attack behavior prediction model, so that the trained attack behavior prediction model has the generalization reasoning ability for attack behaviors. Therefore, when facing fragmentation, concealment or new attack methods that have never been seen before, the pre-trained attack behavior prediction model can still reason the related attack behavior according to the behavior sequence that has occurred, thereby making up for the defect that the security device cannot completely predict all attack behaviors, and improving the accuracy of completely predicting all attack behaviors.

[0126] The embodiments described in the embodiments of the application are used to more clearly illustrate the technical solutions of the embodiments of the application, and do not constitute a limitation on the technical solutions provided by the embodiments of the application. Those skilled in the art can know that, with the evolution of technology and the appearance of new application scenarios, the technical solutions provided by the embodiments of the application are also applicable to similar technical problems.

[0127] Those skilled in the art can understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the application, and can include more or fewer steps than those shown in the figures, or combine certain steps or different steps.

[0128] The apparatus embodiments described above are merely exemplary, and the units described as separate units can or can not be physically separate, i.e., can be located in one place, or can be distributed over multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the embodiment.

[0129] Those skilled in the art can understand that all or some of the steps in the method disclosed above, the functional modules / units in the system and the device can be implemented as software, firmware, hardware and appropriate combinations thereof.

[0130] The terms "first", "second", "third", "fourth" and the like in the description of the application and in the claims of the foregoing drawings, if any, are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the use of the terms so

[0131] It should be understood that in this application, "at least one" means one or more, and "multiple" means two or more. "And / or" is used to describe the relationship between the associated objects, which means that there can be three relationships, for example, "A and / or B" can mean that there are three cases: only A, only B, and A and B at the same time, where A and B can be singular or plural. The character " / " generally represents that the associated objects before and after are a "or" relationship. "At least one of the following" or the like means any combination of these items, including any combination of single or multiple items. For example, at least one of a, b or c, can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0132] In several embodiments provided in the present application, it should be understood that the disclosed apparatus and method can be implemented by other manners. For example, the apparatus embodiments described above are merely illustrative, for example, the division of the above units is merely a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units or components shown or discussed can be indirect coupling or communication connection through some interfaces, apparatuses or units, and can be electrical, mechanical or other forms.

[0133] The units described above as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they can be located in one place or distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0134] In addition, the functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0135] If the integrated unit is realized in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part of the prior art that makes a contribution or the whole or part of the technical solutions can be embodied in the form of a software product, which is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method of each embodiment of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various program storage media.

[0136] The preferred embodiments of the embodiments of the present application are described above with reference to the accompanying drawings, but this does not limit the scope of the embodiments of the present application. Any modifications, equivalent replacements and improvements made by those skilled in the art without departing from the scope and essence of the embodiments of the present application shall be within the scope of the embodiments of the present application.

Claims

1. A training method for an attack behavior prediction model, characterized in that, include: Multiple attack entities are extracted from the obtained raw alarm information, and the attack events that occur between any two attack entities and the attack time corresponding to the attack events are determined. Based on any two attack entities, the corresponding attack events, and the attack time, an attack sequence for the two attack entities is generated to obtain multiple different attack sequences. Based on each attack time, at least a portion of the labeled attack sequences are selected from the plurality of attack sequences, and the information in each labeled attack sequence is randomly occluded to obtain a sample attack sequence; Multiple sample attack sequences are input into the attack behavior prediction model, and the predicted attack sequence after the occlusion information in each sample attack sequence is restored is output. A sequence loss value is determined based on each predicted attack sequence and the corresponding labeled attack sequence. The attack behavior prediction model is iteratively trained based on the sequence loss value to obtain a trained attack behavior prediction model. The trained attack behavior prediction model is used to predict the next attack behavior of a target attack behavior that has already occurred, thereby obtaining the predicted attack behavior.

2. The training method for the attack behavior prediction model according to claim 1, characterized in that, The step of generating an attack sequence for any two attack entities based on the corresponding attack events and attack times includes: Obtain the attack scenario in which any two attacking entities that have been attacked are located; Based on the attack scenario, the arbitrary two attack entities, the corresponding attack events, and the attack time, an attack sequence for the arbitrary two attack entities is generated.

3. The training method for the attack behavior prediction model according to claim 2, characterized in that, The acquisition of the attack scenario in which any two attacking entities that have been attacked includes: Based on the attack event, determine the event attack scenario in which any two attacking entities are located under event-driven conditions; Based on the attack time, determine the time attack scenario in which any two attacking entities are located under time-driven conditions; Based on the event attack scenario and the time attack scenario, determine the attack scenario in which any two attacking entities that have launched the attack are located.

4. The training method for the attack behavior prediction model according to claim 1, characterized in that, The step of randomly obscuring information in each of the labeled attack sequences to obtain sample attack sequences includes: If the current training mode is time-explicit, the information in each of the labeled attack sequences is randomly occluded to obtain the sample attack sequence; If the current training mode is implicit in time, the attack time corresponding to each of the label attack sequences is hidden to obtain the initial sample attack sequence; The information in each initial sample attack sequence is randomly occluded to obtain the sample attack sequence.

5. The training method for the attack behavior prediction model according to claim 1, characterized in that, The attack time includes the attack start time and the attack end time; The step of selecting at least a portion of the labeled attack sequences from a plurality of attack sequences based on each of the attack times includes: The attack time period to which the corresponding attack sequence belongs is determined based on the start time of each attack. The attack duration of the corresponding attack sequence is determined based on the attack start time and the attack end time. Based on the attack time period and / or attack duration corresponding to each attack sequence, at least a portion of the labeled attack sequences are selected from the plurality of attack sequences.

6. The training method for the attack behavior prediction model according to claim 1, characterized in that, The step of determining the sequence loss value based on each predicted attack sequence and the corresponding labeled attack sequence includes: Calculate the sequence difference between each predicted attack sequence and the corresponding labeled attack sequence; The sequence differences are logarithmically processed to obtain the logarithmic sequence difference value between each predicted attack sequence and the corresponding labeled attack sequence, so as to obtain multiple different logarithmic sequence difference values; The sequence loss value is obtained based on the difference values ​​of multiple different logarithmic sequences.

7. The training method for the attack behavior prediction model according to claim 1, characterized in that, The step of determining the sequence loss value based on each predicted attack sequence and the corresponding labeled attack sequence further includes: An initial sequence loss value is determined based on each predicted attack sequence and the corresponding labeled attack sequence; Acquire attack tactics knowledge base information; Based on the attack tactical knowledge base information, the degree of tactical logical rationality corresponding to each predicted attack sequence is determined; Based on the rationality of the tactical logic corresponding to each predicted attack sequence, a prediction reward / penalty factor is determined; The sequence loss value is obtained by updating the initial sequence loss value according to the predicted reward / penalty factor.

8. A method for predicting attack behavior, characterized in that, include: Obtain target alarm information; The target attack sequence is determined based on the target alarm information, wherein the target attack sequence includes the target attack behavior that has occurred and the information to be predicted associated with the target attack behavior, and the information to be predicted is in an obscured state. The target attack sequence is input into a pre-trained attack behavior prediction model, which outputs a predicted attack behavior. The predicted attack behavior is used to predict the next attack behavior after the target attack behavior has occurred.

9. A training device for an attack behavior prediction model, characterized in that, include: The acquisition module is used to extract multiple attack entities from the acquired raw alarm information, determine the attack event that occurs between any two attack entities and the attack time corresponding to the attack event; An attack sequence determination module is used to generate an attack sequence for any two attack entities based on the any two attack entities, the corresponding attack events, and the attack time, so as to obtain multiple different attack sequences. The sample attack sequence determination module is used to select at least a portion of the labeled attack sequences from a plurality of attack sequences based on each attack time, and to perform random occlusion processing on the information in each labeled attack sequence to obtain the sample attack sequence; The attack sequence prediction module is used to input multiple sample attack sequences into the attack behavior prediction model and output the predicted attack sequence after the occlusion information in each sample attack sequence is restored. The target training module is used to determine the sequence loss value based on each predicted attack sequence and the corresponding labeled attack sequence, and to iteratively train the attack behavior prediction model based on the sequence loss value to obtain the trained attack behavior prediction model. The trained attack behavior prediction model is used to predict the next attack behavior of the target attack behavior that has occurred, and to obtain the predicted attack behavior.

10. An electronic device, characterized in that, The electronic device includes a memory and a processor. The memory stores a computer program. When the processor executes the computer program, it implements the training method of the attack behavior prediction model according to any one of claims 1 to 7, or implements the attack behavior prediction method according to claim 8.

11. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the training method of the attack behavior prediction model according to any one of claims 1 to 7, or the attack behavior prediction method according to claim 8.

Images