Cross-device lateral movement attack dynamic detection method and device

Abstract

The invention discloses a cross-device lateral movement attack dynamic detection method and device, and belongs to the technical field of network security. The method comprises the following steps: constructing a plurality of discrete dynamic graph snapshots based on a weblog of a network environment to be analyzed; generating a graph embedding representation of each dynamic graph snapshot; performing time sequence modeling based on the graph embedding representation to obtain a dynamic feature representation of the network environment to be analyzed; reconstructing an adjacent matrix based on the dynamic feature expression, and calculating the reconstruction loss of the adjacent matrix; and obtaining a cross-device lateral movement attack detection result of the network environment to be analyzed according to the adjacency matrix and the reconstruction loss. According to the invention, the lateral movement attack between different devices can be dynamically detected.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method and apparatus for dynamic detection of cross-device lateral movement attacks. Background Technology

[0002] APT attackers typically start with a compromised internal host, gradually infiltrating other devices on the network and seizing their accounts to escalate privileges until they obtain high-level credentials such as domain administrator privileges. This penetration and diffusion process consists of several steps and often lasts for a considerable period. Although the specific methods used vary across different incidents, analysis of numerous APT cases shows that lateral movement is a common and crucial element. In the field of cross-device lateral movement attack detection, dynamic monitoring and behavioral correlation analysis are key technologies for combating APT attacks and internal network penetration attacks. Lateral movement attacks usually occur after attackers successfully compromise the first device, gradually breaching the boundaries of multiple different types of devices through credential abuse, remote execution, and vulnerability exploitation to achieve privilege expansion and target control.

[0003] As networks continue to expand, logs from multiple sources—terminals, servers, network devices, and application systems—are characterized by massive data volume, diverse dimensions, complex structures, and dense relationships. Traditional rule-based or simple statistical methods are no longer sufficient to effectively process this high-dimensional dynamic data. On the one hand, rule matching has limited ability to identify unknown and variant attacks, easily resulting in false negatives. On the other hand, statistical methods are usually based on fixed thresholds, lacking adaptability to abnormal fluctuations in complex scenarios, easily generating a large number of false positives, and failing to support cross-node and cross-session behavioral correlation analysis. In recent years, with the development of graph computing and deep learning technologies, mapping devices, users, processes, and communication relationships in the network environment to graph structures and using graph neural networks for lateral movement attack detection has become a research hotspot. Graph structures can model the behavioral chains of attackers propagating across hosts and identities within the internal network at the relational level, thereby capturing hidden attack paths that are difficult to detect using traditional methods. However, static graph detection 1) cannot reflect real-time changes in security events and is difficult to capture the temporal characteristics of lateral movement behavior; 2) once the graph structure is fixed, when new nodes or edges appear, it is necessary to reconstruct the graph and retrain, which is very costly; 3) static graphs usually only focus on the relationship structure and ignore the order of events, which can easily lead to broken attack chains or misjudgments; 4) in dynamic network environments, attackers can change the graph structure through evasion behavior, making the static detection model ineffective.

[0004] Therefore, to cover real-world attack patterns that are cross-host, multi-stage, and continuously evolving, it is essential to build a dynamic detection mechanism that spans devices and event sources. This mechanism must continuously update entity relationships over time, establish behavioral chains, and identify lateral movement trajectories in real time. Through dynamic correlation analysis, time series modeling, and dynamic graph learning, attack paths can be revealed from a global perspective, enabling timely detection and precise blocking of lateral movement attacks. Summary of the Invention

[0005] To address the aforementioned problems, this invention proposes a method and apparatus for dynamic detection of cross-device lateral movement attacks. By incorporating temporal sequences into a graph neural network, attack paths in the network are detected, thereby dynamically detecting lateral movement attacks between different devices.

[0006] To achieve the above objectives, the specific technical solutions adopted by the present invention include the following:

[0007] A method for dynamic detection of cross-device lateral movement attacks, the method comprising: Based on the network logs of the network environment to be analyzed, construct... A discrete dynamic graph snapshot ; Generate snapshot of each dynamic graph Graph embedding representation ; Based on graph embedding representation Temporal modeling is performed to obtain the dynamic feature representation of the network environment to be analyzed. ; Based on dynamic feature representation Reconstruct the adjacency matrix And calculate the adjacency matrix. Reconstruction loss ; According to the adjacency matrix and reconstruction loss To obtain the detection results of cross-device lateral movement attacks in the network environment to be analyzed.

[0008] Furthermore, generate snapshots of each dynamic graph. Graph embedding representation ,include: pass Encoding definition dynamic graph snapshot Node features are obtained from the node type sequence and edge sequence. Sum of edge features , , For node indexing, Indicates the edge type; Define edge type The following node update pass function: ;in, Event window The previous time window, Indicates time window and time window The time difference between them; For nodes In the event window Received internally Next update message Aggregate and update messages based on attention mechanism , obtain the node update representation ; Based on node update representation Update node features , obtain node At any moment Spatial Embedding Representation .

[0009] Furthermore, based on graph embedding representation Temporal modeling is performed to obtain the dynamic feature representation of the network environment to be analyzed. ,include: Obtaining dynamic feature representation using zero vector initialization ; A recurrent neural network is introduced as a temporal encoder, and graph embedding representation is used as the basis. and dynamic feature expression Generate dynamic feature representations of the network environment to be analyzed. .

[0010] Furthermore, the adjacency matrix .

[0011] Furthermore, the reconstruction loss ;in, Represents the set of positive samples. Represents the set of negative samples. Indicates that in a given Under the condition, the side The probability of existence , For node indexing.

[0012] Furthermore, based on the adjacency matrix and reconstruction loss To obtain cross-device lateral movement attack retrieval results for the network environment to be analyzed, including: Based on the adjacency matrix Get nodes and nodes In time Connection probability ; Reconstructing loss As reconstruction error ; Based on connection probability and reconstruction error compute nodes and nodes The edge between Abnormal scores ; This abnormal score With preset threshold By comparing the results, we can obtain the retrieval results for cross-device lateral movement attacks in the network environment to be analyzed.

[0013] A cross-device lateral movement attack dynamic detection device, the device comprising: The dynamic graph snapshot building module is used to build a snapshot based on network logs of the network environment to be analyzed. A discrete dynamic graph snapshot ; The graph embedding representation generation module is used to generate each dynamic graph snapshot. Graph embedding representation ; Dynamic feature representation generation module for graph embedding representation Temporal modeling is performed to obtain the dynamic feature representation of the network environment to be analyzed. ; Reconstruction module, used for dynamic feature representation Reconstruct the adjacency matrix And calculate the adjacency matrix. Reconstruction loss ; The detection result generation module is used to generate detection results based on the adjacency matrix. and reconstruction loss To obtain the detection results of cross-device lateral movement attacks in the network environment to be analyzed.

[0014] An electronic device includes: a processor and a memory storing computer program instructions; the processor, when executing the computer program instructions, implements the cross-device lateral movement attack dynamic detection method described above.

[0015] A computer-readable storage medium, characterized in that the computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the cross-device lateral movement attack dynamic detection method described above.

[0016] A computer program product, characterized in that, when the computer program product is run on a computer device, it causes the computer device to execute the cross-device lateral movement attack dynamic detection method described above.

[0017] Compared with the prior art, the present invention has at least the following beneficial effects.

[0018] 1) Cross-device dynamic graph construction and log fusion: Unifies multi-source logs (hosts, network devices, etc.) into discrete-time cross-device dynamic graph snapshots, solving the problem that existing technologies can hardly cover the complete lateral movement path when only targeting a single device or a single log source.

[0019] 2) Temporal graph neural network modeling combining node / edge semantics: Node type, edge type and their temporal evolution are explicitly encoded in the graph neural network, and an attention mechanism is introduced to select the most critical neighbor update for lateral movement, which improves the modeling ability for cross-host and multi-hop attack chains. 3) Joint detection mechanism based on connection probability and reconstruction error based on temporal embedding: By using node temporal embedding to simultaneously predict future connection probabilities and reconstruct the graph structure, lateral movement attacks are modeled as rare graph events with "low connection probability and high reconstruction error". Compared with general anomaly detection schemes based solely on reconstruction error, this mechanism can more finely distinguish between normal cross-device access and abnormal lateral movement behavior. Attached Figure Description

[0020] Figure 1 This is the overall flowchart of this method. Detailed Implementation

[0021] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, and to make the objectives, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0022] To address two problems with lateral movement attacks: 1) single-device, static analysis leads to broken attack chains and makes cross-device propagation difficult to understand attacker behavior; 2) static graphs or discrete graph neural networks, while capable of capturing structural relationships, cannot express the characteristics of attack behavior evolving over time. The core innovation of this invention lies in introducing dynamic graph construction, cross-time information transmission, and temporal neural network encoding to achieve real-time, global, and interpretable detection of lateral movement attacks.

[0023] Specifically, the cross-device lateral movement attack dynamic detection method of the present invention, such as Figure 1 As shown, it includes the following steps.

[0024] Step 1: Collect network logs from various entities and related devices in the network environment to be analyzed, and perform standardization processing such as unifying log format, extracting key information, time synchronization, and removing redundant and invalid data to obtain standardized system logs. Construct a discrete-time graph by parsing the standardized system logs. ,in This is a snapshot at time T.

[0025] Step 2: Construct a directed graph , representing a specific time window The network state within the network. V represents node information, mainly hosts or abstract network entities. E represents edge information, involving login, connection, access, use, execution, etc. Represents a collection of node attributes. Represents the set of edge attributes.

[0026] Step 3: To enable the graph neural network to recognize different devices, a dynamic graph snapshot is constructed, and node and edge information are represented in a structured manner. Node type sequences and edge sequences are defined using one-hot encoding. Each node is encoded, mapping discrete category information to a fixed-dimensional binary vector.

[0027] Step 4: In discrete time Animated GIF snapshot In the middle, when a node is detected With nodes When interaction events occur between nodes, node characteristics are updated through information transmission mechanisms. This applies to each slave node. Pointing to node Directed edge By using node features and edge features as inputs to a multilayer perceptron, a node update transfer function is formed. Similarly, from the nodes Reverse reception from node Information update function Through the MLP information transmission mechanism, the model not only integrates the static behavioral features between the source and target nodes, but also incorporates edge information and event span factors into feature learning. Thus, when an attacker moves laterally across devices in the network, the interaction features between nodes can be propagated layer by layer along the lateral path through the MLP, achieving information association along the attack chain.

[0028] Step 5: Due to the phased and leapfrog propagation characteristics of cross-device lateral movement attacks, a single node may receive updates from multiple different source nodes at a single moment. To ensure that node features accurately represent the combined impact of these multiple updates, a multi-event aggregation mechanism for node features is designed. For nodes... In the event window Received internally Next update message set To avoid the loss of temporal information caused by simple summation or average aggregation, an attention mechanism is employed to dynamically select the update information that has the greatest impact on the node state, thereby achieving optimal fusion of node features. Specifically... Attention is calculated as follows: in, A learnable scoring function used to evaluate the importance of individual updates. , where is the attention weight, representing the contribution of this update to the node's final state. Ultimately, the node features at time ... The updated representation is defined as the spatial embedding representation. This represents the behavior characteristics of a node within that time window and its relationship structure with other nodes, thus allowing us to obtain the first... Graph embedding representation of time snapshots .

[0029] Step 6: To capture the trend of node behavior changing over time, a recurrent neural network is introduced as a temporal encoder. When a lateral movement attack occurs, the behavior of nodes in the graph and their neighbor relationships change abruptly; the graph embedding represents the sequence. It will fluctuate significantly over time. Therefore, the node representations output in each time window are input into an RNN to model temporal dependencies, forming a dynamic feature representation: ,in for Moment-time snapshot embedding, The hidden state of the previous moment ( (Obtained using zero vector initialization) That is, time. The final node representation, which incorporates historical evolution information, is used for subsequent connection prediction.

[0030] Step 7: To predict future interactions between nodes, the dynamic feature representation learned by the encoder is utilized. To reconstruct the adjacency matrix of the graph Decoder The goal is to base it on the currently accumulated time-series state. Estimate a certain time in the future The connection probabilities between internal nodes are used to reconstruct the future adjacency matrix: The inner product decoding method is used, which calculates the similarity between node vectors to estimate the probability of their future interactions. The closer the vector representations of two nodes are, the more likely they are to interact or propagate attack behavior in the model's semantic space. Specifically, nodes... With node v Predicted connection probability at time step .

[0031] Step 8: To enable the model to automatically learn the probability of interaction relationships between nodes, an unsupervised training strategy is adopted, which involves comparing the predicted adjacency matrices. With the real adjacency matrix The model learns by analyzing the differences between node embedding vectors. Its goal is to make the node embedding vectors... The graph is distinguishable in its structural space, making lateral movement attacks a low-probability event. After reconstructing the graph structure using the decoder, the reconstruction loss is: ;in, Represents the set of positive samples. Represents the set of negative samples. Indicates that in a given Under the condition, the side The probability of its existence.

[0032] Step 9: After completing the encoding and decoding training, jointly determine whether a lateral movement attack exists based on the connection probability and reconstruction error. After training, the model can automatically learn normal interaction patterns and topology changes between different nodes, therefore detection can be performed without any attack samples. During the detection phase, for any two nodes... and In time The interaction relationship, denoted by the connection probability obtained in step 7. Let the reconstruction error obtained in step 8 be . This invention defines the joint anomaly score of this edge as... in, This indicates the rarity of the edge in the normal interaction semantic space learned by the model, and is used to... Apply weighted averages. When a certain edge's joint anomaly score is calculated... Greater than the preset threshold When, it means This indicates abnormal lateral movement behavior.

[0033] In summary, this invention enables real-time and continuous monitoring of lateral movement attacks through dynamic graph construction, cross-node information transmission, and time series modeling. It not only tracks the interaction relationships between different devices but also predicts the next-hop attack target and automatically identifies abnormal behavior through unsupervised reconstruction errors, thus enabling the detection of unknown attacks without requiring attack samples.

[0034] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail using examples, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for dynamic detection of cross-device lateral movement attacks, characterized in that, The method includes: Based on the network logs of the network environment to be analyzed, construct... A discrete dynamic graph snapshot ; Generate snapshot of each dynamic graph Graph embedding representation ; Based on graph embedding representation Temporal modeling is performed to obtain the dynamic feature representation of the network environment to be analyzed. ; Based on dynamic feature representation Reconstruct the adjacency matrix And calculate the adjacency matrix. Reconstruction loss ; According to the adjacency matrix and reconstruction loss To obtain the detection results of cross-device lateral movement attacks in the network environment to be analyzed.

2. The method according to claim 1, characterized in that, Generate snapshot of each dynamic graph Graph embedding representation ,include: pass Encoding definition dynamic graph snapshot Node features are obtained from the node type sequence and edge sequence. Sum of edge features , , For node indexing, Indicates the edge type; Define edge type The following node update pass function: ;in, Event window The previous time window, Indicates time window and time window The time difference between them; For nodes In the event window Received internally Next update message Aggregate and update messages based on attention mechanism , obtain the node update representation ; Based on node update representation Update node features , obtain node At any moment Spatial Embedding Representation .

3. The method according to claim 1, characterized in that, Based on graph embedding representation Temporal modeling is performed to obtain the dynamic feature representation of the network environment to be analyzed. ,include: Obtaining dynamic feature representation using zero vector initialization ; A recurrent neural network is introduced as a temporal encoder, and graph embedding representation is used as the basis. and dynamic feature expression Generate dynamic feature representations of the network environment to be analyzed. .

4. The method according to claim 1, characterized in that, The adjacency matrix .

5. The method according to claim 1, characterized in that, The reconstruction loss ;in, Represents the set of positive samples. Represents the set of negative samples. Indicates that in a given Under the condition, the side The probability of existence , For node indexing.

6. The method according to claim 1, characterized in that, According to the adjacency matrix and reconstruction loss To obtain cross-device lateral movement attack retrieval results for the network environment to be analyzed, including: Based on the adjacency matrix Get nodes and nodes In time Connection probability ; Reconstructing loss As reconstruction error ; Based on connection probability and reconstruction error compute nodes and nodes The edge between Abnormal scores ; This abnormal score With preset threshold By comparing the results, we can obtain the retrieval results for cross-device lateral movement attacks in the network environment to be analyzed.

7. A cross-device lateral movement attack dynamic detection device, characterized in that, The device includes: The dynamic graph snapshot building module is used to build a snapshot based on network logs of the network environment to be analyzed. A discrete dynamic graph snapshot ; The graph embedding representation generation module is used to generate each dynamic graph snapshot. Graph embedding representation ; Dynamic feature representation generation module for graph embedding representation Temporal modeling is performed to obtain the dynamic feature representation of the network environment to be analyzed. ; Reconstruction module, used for dynamic feature representation Reconstruct the adjacency matrix And calculate the adjacency matrix. Reconstruction loss ; The detection result generation module is used to generate detection results based on the adjacency matrix. and reconstruction loss To obtain the detection results of cross-device lateral movement attacks in the network environment to be analyzed.

8. An electronic device, characterized in that, The electronic device includes: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the cross-device lateral movement attack dynamic detection method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions that, when executed by a processor, implement the cross-device lateral movement attack dynamic detection method as described in any one of claims 1-6.

10. A computer program product, characterized in that, When the computer program product is run on a computer device, the computer device performs the cross-device lateral movement attack dynamic detection method as described in any one of claims 1-6.

Images