Threat identification and traceability system

Abstract

According to the threat identification and traceability system provided by the invention, static feature analysis, dynamic behavior monitoring and network flow analysis are deeply fused by constructing a multi-level collaborative analysis architecture, so that comprehensive detection and accurate judgment of security threats are realized; multi-source security data are integrated through a correlation analysis engine, a complete security event sequence is constructed, and each stage of an attack chain is effectively identified; and in combination with threat intelligence fusion and traceability analysis, an attack path can be accurately restored and an attack source can be accurately positioned, so that the complex threat detection capability and traceability efficiency of the system are remarkably improved, and a comprehensive technical support is provided for network security protection.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a threat identification and tracing system. Background Technology

[0002] With the rapid development of information technology, cybersecurity threats are becoming increasingly complex and covert. Malware attack methods are constantly evolving, from early single-signature attacks to today's multi-stage, persistent advanced threats. Traditional security protection technologies mainly rely on signature-based matching and rule-based detection methods, which often prove inadequate when facing new and unknown threats. In existing technologies, threat detection systems typically employ independent analysis modules, such as standalone static or dynamic analysis systems. These systems lack effective collaborative mechanisms, leading to fragmented analysis results and making it difficult to form a complete view of the attack chain. In particular, the lack of deep correlation and contextual integration between various types of security data makes it difficult for the system to effectively identify complex multi-stage attack behaviors, accurately reconstruct attack paths, and locate the attack source, thus failing to provide security personnel with a complete understanding of the attack situation and effective response guidelines. Summary of the Invention

[0003] In view of this, the present invention provides a threat identification and tracing system to address the technical deficiencies existing in the prior art.

[0004] Specifically, the present invention provides a threat identification and tracing system, comprising: The static analysis module is used to extract static features from suspicious files and generate first feature data. The dynamic analysis module, connected to the static analysis module, is used to execute suspicious files in an isolated environment and monitor the execution process based on the first feature data to generate behavioral feature data. The network traffic analysis module, connected to the dynamic analysis module, is used to capture and parse network communication data generated by the dynamic analysis module during the execution of suspicious files to generate traffic feature data. The correlation analysis engine connects to the static analysis module, dynamic analysis module, and network traffic analysis module. It is used to receive and integrate primary feature data, behavioral feature data, and traffic feature data, and combine them with external log data to perform event correlation analysis to generate security event sequences. The threat intelligence fusion module connects to the correlation analysis engine and is used to match and compare security event sequences with external threat intelligence data, and output the final threat determination result. The source tracing analysis module connects to the correlation analysis engine and the threat intelligence fusion module. It is used to reconstruct attack paths and locate attack sources based on security event sequences and final threat assessment results, combined with external log data, to generate source tracing analysis reports.

[0005] In some implementations, the static features extracted by the static analysis module include file header structure, import table, strings, entropy value, resource segment, and signature information.

[0006] In some implementations, the behavioral characteristic data monitored by the dynamic analysis module includes API call sequences, registry modification operations, network connection requests, process injection behavior, and file operation behavior.

[0007] In some implementations, the network traffic analysis module extracts traffic characteristic data by parsing HTTP, DNS, and TLS protocols.

[0008] In some implementations, the correlation analysis engine performs correlation analysis on the integrated data by constructing an attack chain model to identify the lateral movement phase, persistence phase, and command and control phase in the attack process.

[0009] In some implementations, the external threat intelligence sources that the threat intelligence fusion module interfaces with include virus signature databases, attack technique knowledge bases, and open-source intelligence platforms.

[0010] In some implementations, the final threat assessment result includes a threat confidence score, and the formula for calculating the threat confidence score includes:

[0011] in, Threat confidence score, used to quantify the overall threat level of a sequence of security events; The total number of security events identified in the association analysis is derived from the statistics of security event sequences by the association analysis engine. The severity weight of attack chain stage c to which the i-th security event belongs is obtained by querying a predefined attack stage weight mapping table; The number of abnormal behavior indicators identified in the behavioral feature data is derived from the analysis report of the dynamic analysis module; The threat value of the j-th abnormal behavior indicator is derived from the scoring of specific API call sequences and file operations in the behavioral feature data; It is a smoothing constant, a predefined small positive number used to prevent the denominator from being zero; The number of threat intelligence matches associated with the security incident sequence is derived from the initial matching results of the threat intelligence fusion module; The credibility score of the kth threat intelligence match is derived from the credibility rating of the match by external threat intelligence sources. is the time decay factor for the kth threat intelligence match, calculated based on the difference between the first appearance time of the match in the external threat intelligence source and the current time; and These are predefined normalized weighting coefficients used to balance the dimensions and range of the contributions of the two parts in the formula.

[0012] In some implementations, the formula for calculating the threat value of the aberrant behavior indicator includes:

[0013] in, Let be the threat value of the j-th abnormal behavior indicator; It is a frequency variable, with the dimension of Hertz (Hz); and The preset lower and upper limits for frequency analysis; Let f(j) be the frequency domain representation function obtained after the fast Fourier transform of the behavior sequence corresponding to the j-th abnormal behavior indicator, and let the square of its modulus be... Characterizing the frequency of this behavioral sequence The energy density at that location is derived from frequency domain analysis of the API call time series generated by the dynamic analysis module; The total number of known malicious behavior patterns used for comparison is derived from a pre-built malicious behavior pattern library; The baseline threat value for the m-th known malicious behavior pattern is derived from a preset score in the malicious behavior pattern library. The temporal concentration of the j-th abnormal behavior indicator is obtained by calculating the reciprocal of the standard deviation of the related behaviors on the timestamps, which is derived from the analysis of timestamps in the behavioral feature data. The typical temporal concentration of the m-th known malicious behavior pattern is derived from the malicious behavior pattern library; The number of system resource types associated with the j-th abnormal behavior indicator is derived from the classification statistics of registry keys, file paths, and network addresses involved in the behavior feature data; The score for the impact of the j-th abnormal behavior indicator on the n-th type of system resources is derived from the product of the predefined resource criticality weight and the operational severity weight. and These are predefined normalized weighting coefficients used to balance the dimensions and range of the contributions of the two parts in the formula.

[0014] In some implementations, the specific process of the source tracing analysis module to reconstruct the attack path includes: constructing a directed acyclic graph model based on the timestamps, process IDs, and network connection information of each event in the security event sequence, and visually reconstructing the attack steps.

[0015] In some implementations, the specific process of the source tracing analysis module to locate the attack source includes: performing deep packet inspection on the captured network traffic data, and combining the output of the threat intelligence fusion module to locate the IP address, domain name, or digital certificate fingerprint of the command and control server.

[0016] At least one embodiment of the present invention, by constructing a multi-layered collaborative analysis architecture, deeply integrates static feature analysis, dynamic behavior monitoring, and network traffic parsing, achieving comprehensive detection and accurate judgment of security threats; by integrating multi-source security data through a correlation analysis engine, a complete security event sequence is constructed, effectively identifying each stage of the attack chain; combined with threat intelligence fusion and source tracing analysis, the attack path can be accurately reconstructed and the attack source located, significantly improving the system's ability to detect complex threats and its source tracing efficiency, providing comprehensive technical support for network security protection. Attached Figure Description

[0017] Figure 1 This is a structural block diagram of a threat identification and tracing system provided by the present invention. Detailed Implementation

[0018] Many specific details are set forth in the following description to provide a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar extensions without departing from the spirit of this specification. Therefore, this specification is not limited to the specific implementations disclosed below.

[0019] The terminology used in one or more embodiments of this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of the one or more embodiments of this specification. The singular forms “a” and “the” as used in one or more embodiments of this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items. The modifications “a” and “a plurality” as used in this disclosure are illustrative and not restrictive, and those skilled in the art will understand that they should be understood as “one or more” unless the context clearly indicates otherwise.

[0020] It should be understood that although the terms first, second, etc., may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first may also be referred to as second without departing from the scope of one or more embodiments of this specification, and similarly, second may also be referred to as first. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to a determination."

[0021] See Figure 1 , Figure 1 This document illustrates a structural block diagram of a threat identification and tracing system according to some embodiments thereof. The system includes: a static analysis module for extracting static features from suspicious files and generating first feature data; a dynamic analysis module connected to the static analysis module for executing the suspicious files in an isolated environment and monitoring the execution process based on the first feature data to generate behavioral feature data; a network traffic analysis module connected to the dynamic analysis module for capturing and parsing network communication data generated by the dynamic analysis module during the execution of the suspicious files to generate traffic feature data; a correlation analysis engine connected to the static analysis module, the dynamic analysis module, and the network traffic analysis module for receiving and integrating the first feature data, behavioral feature data, and traffic feature data, and combining them with external log data to perform event correlation analysis to generate a security event sequence; a threat intelligence fusion module connected to the correlation analysis engine for matching and comparing the security event sequence with external threat intelligence data and outputting a final threat determination result; and a tracing analysis module connected to the correlation analysis engine and the threat intelligence fusion module for reconstructing attack paths and locating attack sources based on the security event sequence and the final threat determination result, combined with external log data, to generate a tracing analysis report.

[0022] The static analysis module refers to a component that extracts features from suspicious files without execution. For example, it generates initial feature data by parsing the file header structure, import table, strings, entropy values, resource segments, and signature information, enabling rapid acquisition of initial threat indicators in a non-intrusive manner. Suspicious files refer to programs or documents suspected of containing malicious code or behavior. For instance, such files might enter the protected system via email attachments, network downloads, or external storage devices, serving as the initial input for the entire threat analysis process. Static features refer to the inherent technical attributes of a file that can be observed without execution, such as a multi-dimensional feature set including file header structure, import table, strings, entropy values, resource segments, and signature information, providing foundational data support for subsequent dynamic and correlation analyses. Initial feature data refers to the preliminary feature set output by the static analysis module. This data may include structured information extracted from the suspicious file, such as file structure features, import function lists, readable string distribution, information entropy values, resource content, and digital signature status, guiding the dynamic analysis module for targeted behavioral monitoring.

[0023] A dynamic analysis module can refer to a component that executes suspicious files in an isolated environment and monitors their behavior. For example, it might run files using sandbox technology and monitor API call sequences, registry modifications, network connections, and other behaviors based on primary characteristic data to generate behavioral characteristic data, capturing the file's true performance during runtime. An isolated environment can refer to a secure execution space separated from the actual production system, such as a sandbox built using virtualization technology. This environment provides interfaces similar to the real system but restricts access to actual resources, allowing for the secure execution of suspicious files without causing harm. The execution process can refer to all activities of a suspicious file being loaded and run in the isolated environment, including process creation, instruction execution, system calls, resource requests, and other operational steps, revealing the file's dynamic behavioral characteristics. Behavioral characteristic data can refer to recording various operational information generated by the suspicious file during its execution. For example, it can generate time-series behavioral logs by monitoring API call sequences, registry modifications, network connection requests, process injection behaviors, and file operation behaviors, revealing the file's malicious intent and attack methods.

[0024] A network traffic analysis module refers to a component that captures and parses network communications generated during dynamic analysis. For example, it uses deep packet inspection (DBI) technology to parse HTTP, DNS, and TLS protocols to extract traffic characteristic data, enabling the identification of communication behavior between malware and external servers. Network communication data refers to all data packets sent and received through network interfaces during the execution of suspicious files, including complete communication content such as HTTP requests and responses, DNS query records, and TLS handshake messages. This data can be used to analyze malware's remote control and data transfer activities. Traffic characteristic data refers to key feature indicators extracted from network communication data. For example, it uses parsing HTTP header fields, DNS query domain names, and TLS certificate fingerprints to construct network behavior profiles, aiding in the determination of whether command and control communications exist.

[0025] A correlation analysis engine can refer to a processor that integrates and correlates multi-source security data. For example, it receives and integrates primary characteristic data, behavioral characteristic data, and traffic characteristic data, and combines this with external log data to perform event correlation analysis to generate security event sequences, thus constructing a complete attack chain view. External log data refers to recorded information from external data sources such as system logs, application logs, and security device logs. Examples include time-series log data such as Windows system event logs, firewall intercept records, and intrusion detection system alerts, which can be used to provide contextual information for security event analysis. Event correlation analysis refers to the process of linking multiple isolated security events according to their chronological order and logical relationships. For example, by constructing an attack chain model and performing pattern matching and time-series analysis on the integrated data, it can identify attack stages and reveal complex multi-step attack processes. A security event sequence refers to a set of security events with a logical order formed after correlation analysis. For example, this sequence can be arranged by timestamps and identify key attack stages such as the lateral movement stage, persistence stage, and command and control stage, which can be used to visually display the full picture of an attack.

[0026] A threat intelligence fusion module refers to a component that compares internal analysis results with external threat intelligence. For example, it might match security event sequences with external threat intelligence data and output a final threat assessment result, improving the accuracy and confidence level of threat identification. External threat intelligence data can refer to threat information sets provided by third parties, such as virus signature databases, attack technique knowledge bases, and malicious indicator data from open-source intelligence platforms. This data can be used to verify suspicious activities discovered through internal analysis. The final threat assessment result refers to the final conclusion on the nature of the threat after multi-dimensional analysis. For example, this result includes comprehensive assessment information such as threat type, severity level, and confidence score, serving as a direct basis for security response decisions.

[0027] The source tracing analysis module refers to components that reconstruct attack paths and locate attack sources in security incidents. For example, based on the security incident sequence and the final threat assessment results, combined with external log data, it reconstructs attack paths and locates attack sources to generate a source tracing analysis report, enabling the tracking of the attack's origin and spread path. Attack path reconstruction refers to restoring the complete technical route of the attacker from intrusion to achieving the goal. For example, based on the timestamps, process IDs, and network connection information of each event in the security incident sequence, a directed acyclic graph model is constructed to visualize and reconstruct the attack steps, helping to understand attack methods and vulnerabilities. Attack source location refers to determining the specific location of the attack initiator or control server. For example, deep packet inspection of captured network traffic data, combined with the output of the threat intelligence fusion module, can locate the IP address, domain name, or digital certificate fingerprint of the command and control server, identifying the source of the attack. The source tracing analysis report refers to a comprehensive document containing the analysis of the entire attack process and the source tracing conclusions. For example, this report details the attack timeline, the technical means used, the scope of the affected systems, and the information of the located attack source, providing the security team with a basis for emergency response and hardening.

[0028] As a concrete example: When detecting a malicious Word document spread via phishing emails, the static analysis module first extracts its macro code, OLE objects, and digital signatures as primary characteristic data. The dynamic analysis module enables macro execution in a virtualized sandbox, monitoring the generation of a PowerShell process and its use of Win32 APIs to modify the registry, generating behavioral characteristic data. The network traffic analysis module simultaneously captures DNS queries and HTTP POST requests initiated by the document to a suspicious domain, resolving its TLS certificate to generate traffic characteristic data. The correlation analysis engine correlates this data with external log data such as firewall logs, identifying it as a multi-stage attack involving initial intrusion, persistent persistence, and data transmission, forming a security event sequence. The threat intelligence fusion module matches this sequence with an external threat intelligence platform, discovering that the domain is known to be associated with an APT group, and outputs a high-confidence final threat assessment result. Based on all the information, the source tracing analysis module reconstructs the complete attack path from document opening, macro execution, establishing persistence, to data transmission, ultimately locating the C2 server's IP address and registered domain name, generating a detailed source tracing analysis report.

[0029] The beneficial effects of one of the embodiments in this specification include at least the following: by constructing a multi-layered collaborative analysis architecture, static feature analysis, dynamic behavior monitoring, and network traffic parsing are deeply integrated, achieving comprehensive detection and accurate judgment of security threats; by integrating multi-source security data through a correlation analysis engine, a complete security event sequence is constructed, effectively identifying each stage of the attack chain; and by combining threat intelligence fusion and source tracing analysis, the attack path can be accurately reconstructed and the attack source located, significantly improving the system's ability to detect complex threats and its source tracing efficiency, providing comprehensive technical support for network security protection.

[0030] In some implementations, the static features extracted by the static analysis module include file header structure, import table, strings, entropy value, resource segment, and signature information.

[0031] The file header structure refers to a specific data area located at the beginning of a file that describes its format and attributes. For example, parsing fields such as Machine, NumberOfSections, and TimeDateStamp in a PE file header can identify the file type and compilation time, determining whether the file conforms to normal format specifications. The import table is a data structure that records a list of external functions that an executable file needs to call during runtime. For example, analyzing the import address table of a PE file can obtain the API function names in dynamic link libraries such as kernel32.dll and user32.dll, used to infer the system operations the file might perform. Strings refer to readable text sequences embedded in a file. For example, scanning the binary content of a file to extract ASCII and Unicode encoded strings and filtering out suspicious strings such as IP addresses, domain names, and registry paths can provide important clues for threat analysis. Entropy is an indicator used to quantify the degree of randomness in file data segments. For example, calculating the Shannon entropy value of the .text section or the entire file; when the entropy value exceeds a preset threshold, it indicates the possible presence of encrypted or compressed code, which can be used to detect obfuscated malware. Resource sections can refer to specific sections in a PE file that store non-code data such as icons, dialog boxes, and version information. For example, analyzing bitmaps, cursors, and dialog templates extracted from the .rsrc section can reveal hidden malicious payloads or spoofed information. Signature information refers to digital certificate data used to verify the identity and integrity of the file publisher. For example, checking the file's Authenticode digital signature status, certificate chain validity, and timestamp information can be used to determine whether the file has been tampered with or has had its legitimate signature misused.

[0032] As a concrete example: When analyzing a suspicious executable file, the static analysis module first parses its PE file header structure, obtaining key field values ​​such as SectionAlignment and FileAlignment to verify the file format's legitimacy. Next, it extracts the API functions referenced in the import table, discovering numerous calls to network-related functions in Wininet.dll, such as InternetOpenA and InternetReadFile. Subsequently, it scans the strings in the file, identifying multiple hard-coded C2 server domain names and abnormal registry paths. Calculating the entropy values ​​of each section shows a significantly high entropy value in the .data section, suggesting the possible presence of encrypted data. Further analysis of the resource sections reveals embedded additional executable code in the .rsrc section. Finally, verifying the signature information shows that the file is signed with a revoked digital certificate. These static characteristics collectively point to a high degree of malicious intent in the file, providing a clear monitoring direction for subsequent dynamic analysis.

[0033] By extracting multi-dimensional static features such as file header structure, import table, strings, entropy value, resource segment and signature information, the suspiciousness of a file can be comprehensively assessed, providing accurate monitoring directions for subsequent dynamic behavior analysis and effectively improving the coverage and early identification capabilities of threat detection.

[0034] In some implementations, the behavioral characteristic data monitored by the dynamic analysis module includes API call sequences, registry modification operations, network connection requests, process injection behavior, and file operation behavior.

[0035] API call sequences refer to the sequential record of when a program calls operating system application programming interface functions during execution. For example, monitoring the call order and parameters of critical APIs such as CreateRemoteThread and WriteProcessMemory using hooking techniques can identify malicious behavior patterns such as process injection. Process injection refers to the operation of inserting code or data from one process into the memory space of another process. For example, monitoring the call sequences of APIs such as VirtualAllocEx, WriteProcessMemory, and SetThreadContext can detect DLL injection and code injection, which can be used to discover covert attacks that evade detection. File operation behavior refers to operations such as reading, writing, creating, and deleting on the file system. For example, monitoring the access patterns of APIs such as CreateFile, WriteFile, and DeleteFile to critical system directories and user documents can identify data theft and file corruption.

[0036] As a concrete example: When a suspicious sample is executed in a sandbox environment, the dynamic analysis module first records a complete process injection sequence formed by calling APIs such as VirtualAlloc, WriteProcessMemory, and CreateRemoteThread. Subsequently, it monitors the sample repeatedly calling the RegSetValueEx function, attempting to create a startup item under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. Simultaneously, it detects the sample initiating TLS connection requests to port 443 of multiple overseas IP addresses via the socket and connect functions. Further monitoring reveals that the sample uses CreateFile and ReadFile operations to access the system password storage file, and ultimately writes encrypted data to a temporary directory via WriteFile. These behavioral characteristics collectively reveal that the sample possesses a full set of malicious behavioral characteristics, including process injection, persistent persistence, command and control communication, and data theft.

[0037] By monitoring multi-dimensional dynamic behavioral characteristics such as API call sequences, registry modification operations, network connection requests, process injection behavior, and file operation behavior, it is possible to comprehensively capture the real behavior of malware at runtime, effectively identify covert attack methods and persistence mechanisms, and provide reliable dynamic behavioral evidence for threat assessment.

[0038] In some implementations, the network traffic analysis module extracts traffic characteristic data by parsing HTTP, DNS, and TLS protocols.

[0039] As a concrete example: When analyzing a ransomware sample, the network traffic analysis module first captured the sample's DNS query requests. Parsing revealed that the sample queried multiple domain names composed of pseudo-random characters, consistent with domain name generation algorithm characteristics. Subsequently, the module detected that the sample established a TLS connection with one of the successfully resolved IP addresses. By parsing the TLS handshake process, the module extracted the server certificate, which was self-signed and had empty organization information. In subsequent communications, the module also parsed encrypted data packets transmitted via the HTTP protocol, discovering that the request path contained unusually long parameters and the User-Agent field mimicked a normal browser. These traffic characteristic data obtained through deep analysis of the HTTP, DNS, and TLS protocols collectively confirmed that the sample engaged in command and control communication.

[0040] By analyzing key network protocols such as HTTP, DNS, and TLS, we can extract the communication characteristics of malware from different dimensions, effectively identify command and control behaviors under encrypted channels, domain name generation algorithm mechanisms, and abnormal data transmission patterns, and provide reliable evidence of network behavior for threat assessment.

[0041] In some implementations, the correlation analysis engine performs correlation analysis on the integrated data by constructing an attack chain model to identify the lateral movement phase, persistence phase, and command and control phase in the attack process.

[0042] An attack chain model refers to a theoretical framework describing the typical sequence of stages in a network attack from initial intrusion to target achievement. For example, by constructing models including stages such as reconnaissance, weaponization, delivery, exploitation, installation, command and control, and action, it can be used to identify the lateral movement, persistence, and command and control stages in the attack process. The lateral movement stage refers to the process by which attackers spread laterally within the victim network to find critical assets. This stage can be identified by analyzing behavioral patterns such as SMB connections between multiple hosts, WMI command execution, and credential dumping, revealing the attacker's penetration path within the network. The persistence stage refers to the process by which attackers establish long-term persistence mechanisms to maintain access to the victim system. This stage can be identified by detecting persistence techniques such as registry Run key modifications, scheduled task creation, and service installation, revealing the attacker's long-term control attempts. The command and control stage refers to the process by which attackers establish communication channels with the victim system and remotely control it. This stage can be identified by analyzing network communication patterns such as periodic heartbeats, command transmissions, and data feedback, confirming the attacker's remote control behavior.

[0043] As a concrete example: When analyzing an advanced persistent threat (APS) incident, the correlation analysis engine first constructs a network kill chain model. The engine correlates malicious document characteristics discovered through static analysis, PowerShell execution behavior captured through dynamic analysis, DNS tunneling activity detected through network traffic analysis, and abnormal connection records in firewall logs. Through attack chain model analysis, it is identified that the attacker first completed the initial intrusion by delivering malicious documents via spear-phishing emails, then created scheduled tasks within the system to achieve persistent residency, followed by lateral movement on the internal network using WMI commands, and finally established an encrypted channel with an external C2 server to enter the command and control phase. This complete attack chain view clearly reveals the attacker's tactical intent and technical path.

[0044] By constructing an attack chain model and performing correlation analysis on the integrated multi-source security data, it is possible to systematically identify key attack phases such as the lateral movement phase, persistence phase, and command and control phase in the attack process, effectively reconstructing the full picture of complex attacks and providing a complete attack context and handling basis for security response.

[0045] In some implementations, the external threat intelligence sources that the threat intelligence fusion module interfaces with include virus signature databases, attack technique knowledge bases, and open-source intelligence platforms.

[0046] External threat intelligence sources can refer to third-party data services that provide information related to cybersecurity threats. For example, by connecting with various intelligence sources, including virus signature databases, attack technique knowledge bases, and open-source intelligence platforms, they can be used to verify and enrich internal analysis results. Virus signature databases can refer to databases that store the signatures of known malware. For example, they can quickly match identifiers such as hash values, signature codes, and digital certificate fingerprints, enabling the identification of known threat samples with high accuracy. Attack technique knowledge bases can refer to knowledge systems that systematically describe attack methods and techniques. For example, attack techniques, tactics, and procedural information recorded based on the MITRE ATT&CK framework can be used to analyze attacker behavior patterns and skill levels. Open-source intelligence platforms can refer to network platforms that collect threat information from publicly available sources. For example, by crawling public information sources such as security forums, blogs, and vulnerability announcements to build threat intelligence databases, they can provide the latest threat dynamics and attack activity information.

[0047] As a concrete example: When the correlation analysis engine generates a security event sequence involving a fileless attack, the threat intelligence fusion module first queries multiple virus signature databases to match the hash value of the PowerShell script used in the attack, finding that it is marked as malicious in multiple databases. Next, the module queries the attack technique knowledge base, confirming that the techniques used in the attack sequence, such as registry Run key persistence and WMI lateral movement, correspond to specific technique numbers such as T1112 and T1047 in the MITRE ATT&CK framework. Simultaneously, the module obtains intelligence from multiple open-source intelligence platforms, discovering that similar attack patterns have recently been reported to be associated with a specific attack organization. By fusing this multi-dimensional threat intelligence from virus signature databases, attack technique knowledge bases, and open-source intelligence platforms, the module ultimately outputs a high-confidence threat assessment result and identifies the relevant attack organization attribute.

[0048] By connecting with multi-dimensional external threat intelligence sources such as virus signature databases, attack technology knowledge bases, and open-source intelligence platforms, it is possible to comprehensively utilize information from multiple aspects, including known feature matching, attack technology analysis, and the latest threat dynamics, to effectively verify the credibility of internal analysis results and provide rich attack background and contextual information, significantly improving the accuracy and completeness of threat assessment.

[0049] In some implementations, the final threat assessment result includes a threat confidence score, and the formula for calculating the threat confidence score includes:

[0050] in, Threat confidence score, used to quantify the overall threat level of a sequence of security events; The total number of security events identified in the association analysis is derived from the statistics of security event sequences by the association analysis engine. The severity weight of attack chain stage c to which the i-th security event belongs is obtained by querying a predefined attack stage weight mapping table; The number of abnormal behavior indicators identified in the behavioral feature data is derived from the analysis report of the dynamic analysis module; The threat value of the j-th abnormal behavior indicator is derived from the scoring of specific API call sequences and file operations in the behavioral feature data; It is a smoothing constant, a predefined small positive number used to prevent the denominator from being zero; The number of threat intelligence matches associated with the security incident sequence is derived from the initial matching results of the threat intelligence fusion module; The credibility score of the kth threat intelligence match is derived from the credibility rating of the match by external threat intelligence sources. is the time decay factor for the kth threat intelligence match, calculated based on the difference between the first appearance time of the match in the external threat intelligence source and the current time; and These are predefined normalized weighting coefficients used to balance the dimensions and range of the contributions of the two parts in the formula.

[0051] Threat confidence score refers to a dimensionless scalar value used to quantify the overall threat level of a security event sequence. For example, it can be derived by comprehensively calculating parameters such as security event severity, anomalous behavior indicator threat value, and threat intelligence matching credibility, and can be used to provide an objective threat level assessment. A security event refers to a potential malicious activity instance identified in network security monitoring, such as security alerts marked with abnormal login behavior, suspicious process creation, and malicious network connections, and can serve as the basic data unit for threat analysis. An attack chain stage refers to a typical link in a network attack process with specific goals and techniques. For example, a predefined attack stage weight mapping table can be used to assign severity weights to different stages such as reconnaissance, weaponization, and delivery, quantifying the threat level of different attack stages. Severity weight refers to a numerical parameter used to measure the relative importance of different attack chain stages. For example, different weight coefficients can be assigned to different stages such as initial intrusion, persistence, and data theft based on expert experience or historical data analysis, and can be used to adjust the contribution of each stage in threat assessment. Anomaly indicators refer to operational characteristics that deviate from normal patterns identified in dynamic behavior monitoring. For example, suspicious behavior patterns identified through analysis of API call sequences, file operation patterns, and registry modification behavior can reflect potential malicious activities. Threat values ​​are dimensionless scalar values ​​used to quantify the maliciousness of a single anomaly indicator. For example, they are derived through multi-dimensional analysis of behavior sequences, such as frequency domain analysis, time concentration calculation, and resource impact assessment, and can be used to evaluate the suspiciousness of specific behaviors. Smoothing constants are preset small positive numbers used in mathematical calculations to prevent the denominator from being zero or to ensure stable numerical operations. For example, adding a positive number much smaller than the normal value when calculating the geometric mean avoids the influence of zero values ​​and ensures the numerical stability of the calculation formula. Threat intelligence matching items refer to records that match internal analysis results with external threat intelligence databases. For example, correspondences found through hash value comparison, signature matching, and behavior pattern similarity calculation can verify suspicious activities discovered through internal analysis. Credibility score refers to a rating parameter used to assess the reliability of a single threat intelligence match. This score is often based on factors such as the authority of the intelligence source, historical accuracy, and timeliness of updates, and can be used to measure intelligence quality. Time decay factor refers to a parameter used to adjust the degree to which the weight of a threat intelligence match decays over time. For example, it can be calculated based on the difference between the first appearance time of the match in an external threat intelligence source and the current time, reflecting the timeliness value of the intelligence. Normalized weighting coefficient refers to a preset coefficient used to balance the contribution dimensions and value ranges of different parts in the formula. For example, it can be used through statistical analysis or machine learning methods to determine the relative weights of the two calculation results, ensuring that the final score is within a reasonable range.

[0052] By calculating a threat confidence score that comprehensively considers the severity of security incidents, the threat value of abnormal behavior, and the credibility of threat intelligence, multi-dimensional threat characteristics can be transformed into unified quantitative indicators, providing an objective basis for prioritizing security responses and effectively improving the accuracy of threat assessment and decision-making efficiency.

[0053] In some implementations, the formula for calculating the threat value of the aberrant behavior indicator includes:

[0054] in, Let be the threat value of the j-th abnormal behavior indicator; It is a frequency variable, with the dimension of Hertz (Hz); and The preset lower and upper limits for frequency analysis; Let f(j) be the frequency domain representation function obtained after the fast Fourier transform of the behavior sequence corresponding to the j-th abnormal behavior indicator, and let the square of its modulus be... Characterizing the frequency of this behavioral sequence The energy density at that location is derived from frequency domain analysis of the API call time series generated by the dynamic analysis module; The total number of known malicious behavior patterns used for comparison is derived from a pre-built malicious behavior pattern library; The baseline threat value for the m-th known malicious behavior pattern is derived from a preset score in the malicious behavior pattern library. The temporal concentration of the j-th abnormal behavior indicator is obtained by calculating the reciprocal of the standard deviation of the related behaviors on the timestamps, which is derived from the analysis of timestamps in the behavioral feature data. The typical temporal concentration of the m-th known malicious behavior pattern is derived from the malicious behavior pattern library; The number of system resource types associated with the j-th abnormal behavior indicator is derived from the classification statistics of registry keys, file paths, and network addresses involved in the behavior feature data; The score for the impact of the j-th abnormal behavior indicator on the n-th type of system resources is derived from the product of the predefined resource criticality weight and the operational severity weight. and These are predefined normalized weighting coefficients used to balance the dimensions and range of the contributions of the two parts in the formula.

[0055] Behavioral sequences refer to the time-sequential operation records generated during program execution, such as the timestamp sequence formed by monitoring system API function calls through hooking techniques, reflecting the dynamic execution pattern of the program. Energy density refers to the signal energy contained within a unit frequency range in the frequency domain; for example, calculating the square of the modulus of the frequency domain representation function yields the energy distribution of each frequency component, identifying the dominant frequency characteristics in a behavioral sequence. Malicious behavior patterns refer to standardized descriptions of typical behavioral characteristics of known malware, such as behavioral templates for process injection, credential theft, and data encryption summarized by analyzing historical malicious samples, serving as a reference benchmark for identifying abnormal behavior. A malicious behavior pattern library refers to a database storing templates of known malicious behavior characteristics, such as a set of feature descriptions for typical malicious techniques like process following, registry persistence, and network tunneling, which can be used for behavioral similarity matching analysis. A baseline threat value refers to preset baseline scoring parameters for known malicious behavior patterns; for example, assigning initial threat scores to different malicious behavior patterns based on factors such as the degree of harm, propagation ability, and stealth, providing a reference benchmark for threat assessment. Temporal concentration refers to a quantitative indicator of the degree of concentration of behavior over time. For example, it can be obtained by calculating the reciprocal of the standard deviation of behavior timestamps, reflecting the temporal regularity of behavior execution. Typical temporal concentration refers to a representative parameter of a specific malicious behavior pattern in terms of temporal distribution. For example, statistical analysis of historical samples can yield typical temporal concentration characteristics of a certain attack behavior, which can be used to assess the similarity between current behavior and known patterns. System resource type refers to different categories of resources in a computer system that are manipulated by programs. This includes different types of system resources such as registry keys, file paths, network addresses, and process objects, allowing for the classification and statistical analysis of the resource scope affected by the behavior. Registry key refers to key-value pairs in the Windows registry used to store system configuration information, such as subkeys under root keys like HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER, recording system configuration status and program settings. Impact score refers to a parameter that quantifies the degree of impact of abnormal behavior on system resources. For example, it can be calculated by multiplying a predefined resource criticality weight by an operation severity weight, assessing the actual harm of the behavior to system security. Resource criticality weight refers to weight parameters assigned based on the importance of system resources. For example, different importance weights are assigned to core system registry keys, critical system files, and sensitive network services, reflecting the security value of the resources. Operation severity weight refers to weight parameters assigned based on the severity of the operation type. For example, different severity coefficients are assigned to different types of operations such as deletion, modification, and reading, reflecting the destructive power of the operation.

[0056] As a concrete example: When analyzing a ransomware sample, the dynamic analysis module captured a sequence of file encryption behaviors it generated. The system performed a Fast Fourier Transform on this sequence to obtain its frequency domain representation function, and calculated its energy density in a specific frequency band, revealing a high-intensity periodicity. Simultaneously, the temporal concentration of this behavior was calculated to be 0.85, highly close to the typical temporal concentration of 0.82 for ransomware in the malicious behavior pattern library. Statistical analysis revealed that this behavior affected three types of system resources: modifying numerous user document file paths, deleting file paths in backup directories, and connecting to the network address of the command and control server. Based on predefined resource criticality weights and operation severity weights, the impact scores on each type of resource were calculated to be 0.8, 0.9, and 0.6, respectively. Finally, by balancing the scores of the frequency domain characteristics and resource impact using normalized weighted coefficients, the threat value of this abnormal behavior indicator was calculated to be 0.78, indicating a high degree of malicious intent.

[0057] By comprehensively calculating the frequency domain characteristics, temporal concentration, and similarity to known malicious patterns of behavioral sequences, and combining this with an assessment of the impact on system resources, the threat level of abnormal behavior can be quantified from multiple dimensions, providing more accurate and objective malicious behavior assessment results and effectively improving the accuracy and reliability of threat detection.

[0058] In some implementations, the specific process of the source tracing analysis module to reconstruct the attack path includes: constructing a directed acyclic graph model based on the timestamps, process IDs, and network connection information of each event in the security event sequence, and visually reconstructing the attack steps.

[0059] Network connection information refers to data that records network communication endpoints and protocol characteristics, such as connection parameters including source IP address, destination IP address, port number, and protocol type. This information can reveal the attacker's communication patterns and data flow. A directed acyclic graph (DAG) model refers to a graph structure model composed of vertices and directed edges that does not contain loops. For example, a DAG model can be constructed using security events as vertices and causal relationships between events as directed edges, clearly visually representing the logical relationships of attack steps.

[0060] As a concrete example: When analyzing a supply chain attack, the attribution analysis module received a sequence of 15 security events, each with a timestamp accurate to milliseconds, the process ID involved, and information about established network connections. The module first sorted all events by timestamp, identifying the initial software update process ID as 1024, which subsequently created a child process ID 2036. Analysis of the network connection information revealed that process 2036 established an encrypted connection with an external IP address. Based on this data, a directed acyclic graph model was constructed, with vertices representing security events and directed edges representing process creation or network connection relationships. This model clearly shows the attack path: starting with the initial software update process, through a series of process injections and lateral movements, ultimately establishing a persistent connection with the command and control server, completely reconstructing the attacker's entire process from intrusion to control.

[0061] By constructing a directed acyclic graph model based on timestamps, process IDs, and network connection information in the security event sequence, the causal relationships and temporal logic between attack steps can be intuitively visualized and restored, fully demonstrating the attacker's technical route and penetration path, and providing clear attack chain analysis and vulnerability location for security protection.

[0062] In some implementations, the specific process of the source tracing analysis module to locate the attack source includes: performing deep packet inspection on the captured network traffic data, and combining the output of the threat intelligence fusion module to locate the IP address, domain name, or digital certificate fingerprint of the command and control server.

[0063] Network traffic data refers to all data packets sent and received through network interfaces during the execution of a suspicious file. This includes complete communication content such as HTTP requests and responses, DNS query records, and TLS handshake messages, which can be used to analyze the remote control and data transfer activities of malware. Deep packet inspection (DPI) refers to techniques for in-depth analysis of network packet payloads. For example, by parsing application-layer data in HTTP messages, query records in DNS messages, and certificate information in TLS handshake messages, detailed communication content can be obtained, revealing hidden malicious communication characteristics. Command and control servers refer to server devices used by attackers to remotely control victim hosts. These are malicious servers uniquely identified by identifiers such as IP addresses, domain names, or digital certificate fingerprints, serving as key targets for attack source location. Digital certificate fingerprints refer to unique identifiers obtained by calculating digital certificates using hash algorithms. For example, the hash value obtained by calculating the content of an X.509 certificate using the SHA-256 algorithm uniquely identifies the certificate and is difficult to forge.

[0064] As a concrete example: When tracking a botnet attack, the source analysis module performs deep packet inspection on captured network traffic data, extracts the server certificate from the TLS handshake message, and calculates its SHA-256 fingerprint as a 64-character hash value. Simultaneously, it extracts the Host field from the HTTP request header to obtain the command and control server's domain name and resolves the server's actual IPv4 address from the IP packet header. The threat intelligence fusion module matches these characteristics with external threat intelligence data, discovering that the certificate fingerprint is flagged as malicious on multiple public intelligence platforms, and that the domain registration information is forged. Combining this information, the source analysis module accurately locates the command and control server's real IP address within a specific autonomous system and confirms that the domain name belongs to a dynamic domain name service provider. Finally, this attack source identification information is written into the source analysis report.

[0065] By performing deep packet inspection on network traffic data to extract key communication features and combining the output of the threat intelligence fusion module for multiple verifications, it is possible to accurately identify and locate key identifying information such as the IP address, domain name, and digital certificate fingerprint of the command and control server, providing reliable source location evidence and support for attack tracing.

[0066] The preferred embodiments disclosed above are merely illustrative of this specification. The optional embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this invention. These embodiments are selected and specifically described in this specification to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize this specification. This specification is limited only by the claims and their full scope and equivalents.

Claims

1. A threat identification and attribution system, comprising: include: The static analysis module is used to extract static features from suspicious files and generate first feature data. A dynamic analysis module, connected to the static analysis module, is used to execute the suspicious file in an isolated environment and monitor the execution process based on the first feature data to generate behavioral feature data. A network traffic analysis module, connected to the dynamic analysis module, is used to capture and parse network communication data generated by the dynamic analysis module during the execution of the suspicious file to generate traffic feature data. The correlation analysis engine, connected to the static analysis module, the dynamic analysis module, and the network traffic analysis module, is used to receive and integrate the first feature data, the behavioral feature data, and the traffic feature data, and combine them with external log data to perform event correlation analysis to generate a security event sequence. The threat intelligence fusion module, connected to the correlation analysis engine, is used to match and compare the security event sequence with external threat intelligence data and output the final threat determination result. The source tracing analysis module, connected to the correlation analysis engine and the threat intelligence fusion module, is used to reconstruct attack paths and locate attack sources based on the security event sequence and the final threat determination result, combined with the external log data, to generate a source tracing analysis report.

2. The system of claim 1, wherein, The static features extracted by the static analysis module include file header structure, import table, strings, entropy value, resource segment, and signature information.

3. The system of claim 1, wherein, The behavioral characteristic data monitored by the dynamic analysis module includes API call sequences, registry modification operations, network connection requests, process injection behavior, and file operation behavior.

4. The system of claim 1, wherein, The network traffic analysis module extracts the traffic feature data by parsing the HTTP, DNS, and TLS protocols.

5. The system of claim 1, wherein, The correlation analysis engine performs correlation analysis on the integrated data by constructing an attack chain model to identify the lateral movement phase, persistence phase, and command and control phase in the attack process.

6. The system of claim 1, wherein, The external threat intelligence sources that the threat intelligence fusion module interfaces with include virus signature databases, attack technology knowledge bases, and open-source intelligence platforms.

7. The system of claim 1, wherein, The final threat assessment result includes a threat confidence score, and the formula for calculating the threat confidence score includes: in, The threat confidence score is used to quantify the overall threat level of the security event sequence; The total number of security events identified in the correlation analysis is derived from the statistics of the security event sequence by the correlation analysis engine; The severity weight of attack chain stage c to which the i-th security event belongs is obtained by querying a predefined attack stage weight mapping table; The number of abnormal behavior indicators identified in the behavioral feature data is derived from the analysis report of the dynamic analysis module; The threat value of the j-th abnormal behavior indicator is derived from the scoring of specific API call sequences and file operations in the behavioral feature data; It is a smoothing constant, a predefined small positive number used to prevent the denominator from being zero; The number of threat intelligence matches associated with the security event sequence is derived from the preliminary matching results of the threat intelligence fusion module; The credibility score of the kth threat intelligence match is derived from the credibility rating of the match by the external threat intelligence source. The time decay factor for the kth threat intelligence match is calculated based on the difference between the first appearance time of the match in the external threat intelligence source and the current time. and These are predefined normalized weighting coefficients used to balance the dimensions and range of the contributions of the two parts in the formula.

8. The system according to claim 7, characterized in that, The formula for calculating the threat value of the abnormal behavior indicator includes: in, Let be the threat value of the j-th abnormal behavior indicator; It is a frequency variable, with the dimension of Hertz (Hz); and The preset lower and upper limits for frequency analysis; Let f(j) be the frequency domain representation function obtained after the fast Fourier transform of the behavior sequence corresponding to the j-th abnormal behavior indicator, and let the square of its modulus be... Characterizing the frequency of this behavioral sequence The energy density at that location is derived from frequency domain analysis of the API call time series generated by the dynamic analysis module. The total number of known malicious behavior patterns used for comparison is derived from a pre-built malicious behavior pattern library; The baseline threat value for the m-th known malicious behavior pattern is derived from the preset score of the malicious behavior pattern library; The time concentration of the j-th abnormal behavior indicator is obtained by calculating the reciprocal of the standard deviation of the related behaviors on the timestamps, which is derived from the analysis of the timestamps in the behavioral feature data. The typical time concentration of the m-th known malicious behavior pattern is derived from the malicious behavior pattern library; The number of system resource types associated with the j-th abnormal behavior indicator is derived from the classification statistics of registry keys, file paths, and network addresses involved in the behavior feature data; The score for the impact of the j-th abnormal behavior indicator on the n-th type of system resources is derived from the product of the predefined resource criticality weight and the operational severity weight. and These are predefined normalized weighting coefficients used to balance the dimensions and range of the contributions of the two parts in the formula.

9. The system according to claim 1, characterized in that, The specific process of the attack path reconstruction by the source tracing analysis module includes: constructing a directed acyclic graph model based on the timestamps, process IDs and network connection information of each event in the security event sequence, and visually reconstructing the attack steps.

10. The system according to claim 1 or 9, characterized in that, The specific process of the source tracing analysis module to locate the attack source includes: performing deep packet inspection on the captured network traffic data, and combining the output results of the threat intelligence fusion module to locate the IP address, domain name, or digital certificate fingerprint of the command and control server.

Images