Information security system penetration path tracking method

Abstract

The invention discloses an information security system penetration path tracking method, which comprises the following steps of: collecting an original log through a log collection agent, analyzing and fusing the original log into a time sequence user behavior sequence, extracting multi-dimensional features and converting the multi-dimensional features into numerical vectors to obtain a feature vector set representing a behavior pattern, identifying outliers by using DBSCAN (Density Based Spatial Clustering of Applications with Noise) clustering, and forming a preliminary abnormal sequence list; analyzing the attack rule base by using PageRank, and calculating the steady-state weight of each attack step; mapping the user behavior sequence to an attack knowledge graph, calculating to obtain a second weight through confidence attenuation and personalized weight, comparing the cosine similarity of the steady weight and the second weight, matching an attack mode, outputting a potential penetration path list, positioning permission change nodes from the list, constructing an evaluation feature vector fused with a multi-dimensional context, and obtaining an evaluation result. And inputting a pre-trained random forest model to carry out risk assessment, outputting a risk score and marking a high-risk abnormal permission promotion path, triggering an alarm based on the high-risk path, and completing output from detection to safety response.

Description

Technical Field

[0001] This invention relates to the field of information security systems, and more particularly to a method for tracing penetration paths in information security systems. Background Technology

[0002] With the increasing complexity of information systems and the evolution of cyberattack techniques, sophisticated penetration attacks, such as Advanced Persistent Threats (APTs), targeting critical infrastructure and information assets are becoming increasingly frequent. Penetration attacks often consist of a series of logically coherent, slow, and stealthy steps, forming a complete attack chain. Accurate and automated tracking and identification of penetration paths are crucial for attack attribution, tactical understanding, and incident response. Currently, the mainstream methods for penetration path tracking in the information security field primarily rely on machine learning-based anomaly detection techniques. These methods construct a baseline of user or entity behavior (usually based on historical logs) and use clustering (such as DBSCAN) or classification algorithms to identify anomalous behavioral sequences that deviate from the baseline. While this method reduces reliance on fixed attack signatures to some extent and can detect unknown threats, it exposes the following systemic flaws and limitations when dealing with modern advanced penetration attacks. These flaws directly lead to insufficient detection effectiveness, heavy operational burden, and response delays:

[0003] Specifically, existing clustering-based anomaly detection methods typically output a "preliminary list of anomaly vectors," which only identifies which user behavior sequences deviate from the group's normal behavior in terms of statistical characteristics. This method suffers from two fundamental problems: First, it cannot distinguish between malicious penetration attacks and normal, routine operations (such as emergency maintenance by administrators). A sequence deviating from the norm might simply be a reasonable change in user behavior, yet it is misjudged as high-risk. More importantly, this method completely fails to explain why anomalies occur or whether anomalous behavior sequences conform to any known attack logic. Its output is a black box for security analysts, offering no insights into attack tactics. Second, existing methods only analyze numerical characteristics (such as operation frequency and resource distribution), without conducting deep, structured semantic comparisons of user behavior with known attack knowledge bases. Therefore, it cannot answer the core question of whether the current anomaly sequence is similar to attack patterns like 'brute-force login-lateral movement-data theft,' leading to a massive number of anomaly alerts requiring manual analysis, resulting in low efficiency.

[0004] Furthermore, existing methods typically treat each step in the attack rule base as equally important, lacking a quantitative assessment mechanism for the inherent importance or criticality of attack steps. For example, in a penetration chain, acquiring an initial foothold is significantly more important than cleaning up traces, but traditional methods fail to reflect this difference, resulting in coarse matching results. Traditional sequence matching (such as direct comparison) cannot effectively handle variations used by attackers, the insertion of irrelevant operations (noise), or scrambling of partial sequences (bypassing detection). Its matching logic is rigid, has poor fault tolerance, and is difficult to adapt to the complex and ever-changing tactical actions in real attacks.

[0005] When mapping specific logs to abstract attack steps, a large number of "falsely activated" interference nodes can be generated because normal operations and attack operations may be similar in log representation. Existing methods lack effective mechanisms to filter out this noise caused by surface similarity, resulting in subsequent analysis being based on a large number of erroneous signals and yielding results with low reliability.

[0006] Secondly, privilege escalation is a key target of penetration testing, but existing risk assessment methods have significant shortcomings:

[0007] Specifically, existing methods typically rely solely on static rule judgments or simple model scoring for a single privilege change event (such as whether a sudo command was executed), completely severing the significance of the event within the context of its entire attack sequence. The risk level of a privilege escalation occurring during normal administrator maintenance differs drastically from that of a privilege escalation occurring within a sequence of pre-existing exploits or file theft, yet existing methods fail to differentiate between them.

[0008] Furthermore, existing methods fail to incorporate factors such as the timing of privilege escalation operations (at which stage of the attack chain they occur) and whether multiple related privilege escalation attempts exist along the same attack path into the comprehensive risk assessment. This makes it easy to overlook attackers' strategies such as "step-by-step privilege escalation" and "multi-point probing," resulting in a less comprehensive and in-depth risk assessment.

[0009] Current technological systems largely focus on the "detection" stage, with outputs often limited to reports, dashboard alerts, or simple alarm events. However, high-risk penetration paths identified by detection systems cannot be automatically and in real-time translated into fine-grained, dynamic access control policies (such as temporarily blocking specific users from accessing sensitive interfaces or forcing multi-factor authentication) that can be executed at the network or host level. From the moment security analysts receive alerts, conduct manual assessments, to manually configuring firewalls or endpoint policies, there is a delay of several hours or even days, allowing attackers ample time to complete their objectives and eliminate traces. Existing methods lack an automated bridge between "identifying attack paths" and "immediately implementing targeted protection."

[0010] In summary, existing penetration path tracing techniques suffer from a series of interconnected technical shortcomings, including coarse alerts, high false positive rates, poor interpretability, inaccurate matching, risk assessment divorced from context, and a disconnect between detection and response. These shortcomings leave security teams in a passive situation of "alert fatigue, difficulty in analysis, and delayed response" when facing advanced penetration attacks. There is an urgent need for a new generation of penetration path tracing methods that can deeply integrate attack knowledge, quantitatively assess attack logic, intelligently correlate attack context, and drive real-time dynamic responses. Summary of the Invention

[0011] The purpose of this invention is to provide a method for tracing the penetration path of an information security system, which solves the above-mentioned technical problems pointed out in the prior art.

[0012] This invention provides a method for tracing penetration paths in an information security system, comprising the following steps:

[0013] By deploying a log collection agent on the target system, multi-source heterogeneous log data is collected, including system access logs, permission allocation records, and authentication logs. The collected multi-source heterogeneous log data is then parsed and fused to obtain user behavior sequences.

[0014] Based on user behavior sequences, vectorization is performed using preset feature engineering rules to obtain a set of target user feature vectors.

[0015] Based on the target user feature vector set, density clustering analysis is performed using the DBSCAN clustering algorithm to obtain a preliminary list of anomaly vectors.

[0016] For the user behavior sequences corresponding to the preliminary list of anomaly vectors, sequence matching is performed based on the link analysis of steady-state weight values ​​and mapping accuracy using a predefined penetration attack rule base to obtain a list of potential penetration paths that have been successfully matched.

[0017] Based on a list of potential penetration paths, and combined with a random forest classification model trained from historical attack data, the privilege change nodes in the path are first extracted, and then a privilege escalation risk assessment is performed on each node to obtain abnormal privilege escalation paths containing risk scores.

[0018] An alarm will be triggered based on the abnormal privilege escalation path.

[0019] Compared with the prior art, the embodiments of the present invention have at least the following technical advantages:

[0020] Analysis of the above-mentioned information security system penetration path tracing method provided by the present invention shows that, in specific applications, by deploying a log collection agent, various types of raw logs are collected from the target system, and then parsed and fused. The messy unstructured logs are organized into user behavior sequences that are strictly ordered by timestamps with user and session as the dimensions, providing time-series basic data input for the entire tracing process. Furthermore, by extracting multi-dimensional statistical features (such as operation type distribution, resource access distribution, permission level, time frequency, etc.) from each user behavior sequence according to preset rules, and converting them into numerical vectors, a set of target user feature vectors that can characterize user behavior patterns is obtained. The behavior logs are converted into a standardized format that can be used for mathematical calculations and comparisons by subsequent machine learning algorithms.

[0021] Furthermore, this embodiment uses the DBSCAN clustering algorithm to analyze the feature vectors of all users, identify outliers in low-density areas of the overall behavior pattern, form a preliminary list of abnormal vectors, and filter out abnormal behavior sequences worthy of further in-depth analysis from massive user behavior, thus narrowing the scope of subsequent fine analysis.

[0022] Furthermore, this embodiment utilizes the PageRank algorithm to analyze a predefined penetration attack rule base, calculating the steady-state weight value (i.e., core importance) of each attack step. Then, it maps log entries of user behavior sequences to an attack knowledge graph, and obtains a second weight value reflecting the characteristics of the sequence through confidence decay and personalized weight calculation. Finally, it compares the similarity (cosine similarity) between the steady-state weight value and the second weight value to output a list of potential penetration paths. The list includes successfully matched sequence identifiers, quantified similarity (matching score), and interpretable attack path descriptions, clearly indicating which known attack patterns the abnormal behavior matches and the degree of matching. It also transforms the attack intent into a clear attack chain description, improving the interpretability and operability of alerts. This embodiment identifies all privilege escalation nodes from successfully matched potential penetration paths and constructs an evaluation feature vector for each node, integrating multi-dimensional context (such as temporal consistency, path correlation, and operational characteristics). This vector is then input into a pre-trained random forest model for evaluation, outputting a risk score for each privilege escalation node. Based on this score, high-risk abnormal privilege escalation paths are marked, enabling precise risk assessment of the most destructive links in the attack chain. This avoids judging the risk of privilege operations in isolation, considering them within the complete attack context, thereby more accurately identifying truly malicious privilege escalation behavior. Finally, based on the abnormal privilege escalation paths with high-risk scores derived from the aforementioned analysis, a corresponding alarm mechanism is triggered, completing the output from detection and analysis to security response. Attached Figure Description

[0023] Figure 1This is a schematic diagram of the main process of a penetration path tracing method for an information security system.

[0024] Figure 2 A schematic diagram simulating a log collection agent scenario for a penetration path tracing method in an information security system;

[0025] Figure 3 This is a schematic diagram illustrating the operation process of obtaining a list of successfully matched potential penetration paths in a penetration path tracing method for an information security system.

[0026] Figure 4 This is a schematic diagram simulating the attack mode state diagram in a penetration path tracing method for an information security system.

[0027] Figure 5 This is a schematic diagram simulating the initial activation of an undirected subgraph in a penetration path tracing method for an information security system. Detailed Implementation

[0028] The technical solution of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0029] The present invention will now be described in further detail with reference to specific embodiments and accompanying drawings.

[0030] Example 1

[0031] like Figure 1 As shown, Embodiment 1 of the present invention provides a method for tracing the penetration path of an information security system, including the following steps:

[0032] Step S10: Collect multi-source heterogeneous log data through a log collection agent deployed on the target system (such as a server or network device). The multi-source heterogeneous log data includes system access logs, permission allocation records, and authentication logs. The collected multi-source heterogeneous log data is parsed and fused to obtain the user behavior sequence.

[0033] It should be noted that in the embodiments of this application described above, the log collection agent (such as Logstash or Fluentd) is a software component deployed on the data source side, responsible for capturing raw log data in real time or near real time. A user behavior sequence refers to a linear record formed by strictly sorting all operations of a single user within a specific session or time period according to their timestamps. For example, a user behavior sequence may be expressed as: "User A logs into the system at time T1 → accesses file B at time T2 → attempts to modify its own permissions at time T3". First, parsing techniques such as regular expressions are used to extract key fields (such as timestamps, user identifiers, operation objects, and action types) from the unstructured log text. Then, a fusion process is performed, that is, the discrete log entries are merged according to the user identifier and session ID and arranged in ascending order of timestamps, finally forming complete and ordered user behavior sequences, which are prepared for constructing feature vectors.

[0034] Step S20: Based on the user behavior sequence, vectorize it according to the preset feature engineering rules to obtain the target user feature vector set (the target user feature vector set represents the user's behavior pattern).

[0035] It should be noted that, in the above embodiments of this application, feature engineering rules refer to the process of extracting and constructing features that can be used for machine learning models from raw data. A feature vector is a mathematical representation that encapsulates the features of an object in the form of a fixed-length numerical array.

[0036] In this embodiment, for each user behavior sequence, multiple features are extracted and calculated, including the distribution statistics of operation types (such as read, write, and execute), the distribution statistics of target resources (such as files, databases, and interfaces), the highest permission level appearing in the sequence, the time span of the entire sequence, the operation frequency per unit time (time frequency), and the total number of log entries contained in the sequence (sequence length). After normalization and other processing, the above statistics are combined to form a multi-dimensional feature vector (i.e., the above target user feature vector set). For example, a sequence may be transformed into a vector [login:1, read operation:3, write operation:1, sensitive resource:2, permission level:2, frequency:1.2, length:7].

[0037] Step S30: Based on the target user feature vector set, perform density clustering analysis using the DBSCAN clustering algorithm to obtain a preliminary list of anomaly vectors;

[0038] It should be noted that in the above embodiments of this application, high-density areas are divided into clusters by DBSCAN, and "noise points" or "outliers" located in low-density areas are identified. The feature vectors corresponding to these noise points constitute a preliminary list of abnormal vectors. The output of this list means that the original user behavior sequences corresponding to these vectors have errors in the overall behavior pattern and need further analysis.

[0039] Step S40: For the user behavior sequences corresponding to the preliminary anomaly vector list, combine the predefined penetration attack rule base with the link analysis based on steady-state weight values ​​(i.e., the propagation process of the importance of attack steps in the network to evaluate the coreness of each step) and mapping accuracy to perform sequence matching and obtain a list of potential penetration paths that have been successfully matched.

[0040] It should be noted that in the above embodiments of this application, the penetration attack rule base is a knowledge base that stores typical pattern sequences of known attacks, such as "brute-force login → vulnerability exploitation → lateral movement → data theft," etc. The core of sequence matching is to compare the user behavior sequence to be detected with the pattern sequences in the rule base. The link analysis mentioned above refers to the PageRank algorithm, which evaluates the coreness of each step by simulating the propagation process of the importance of attack steps in the network, thereby matching user behavior sequences with the penetration attack rule base to obtain a list of potential penetration paths in the user behavior sequence. Each record in the list of potential penetration paths is a potential penetration path, which essentially corresponds to each user behavior sequence, but it is labeled as a suspected attack. Therefore, the potential penetration path includes the identifier of the corresponding user behavior sequence, the similarity between the identifier of the user behavior sequence and the penetration attack rule base (i.e., the matching score in the subsequent analysis process), and the attack path description (i.e., the attack step chain, such as brute-force login authentication service → abnormal file access to sensitive directory).

[0041] Step S50: Based on the potential penetration path list, combined with the random forest classification model trained from historical attack data, first extract the permission change nodes in the path, and then conduct a permission jump risk assessment for each node to obtain the abnormal permission escalation path containing the risk score.

[0042] It should be noted that, in the above embodiments of this application, the permission change node refers to the log record point corresponding to the user's behavior sequence when an operation that causes a change in their access permissions is performed. For example, a record shows that the user changes their role from "user" to "admin" by executing a certain command or accessing a specific interface. The permission jump risk assessment is a quantitative risk analysis of the above nodes. Before execution, a random forest classification model needs to be trained in advance using historical data (including normal permission change and malicious permission escalation cases).

[0043] Specifically, first, all nodes with permission changes are located from each potential penetration path input by S40. Then, an evaluation feature vector is constructed for each such node, which may include the difference in permission level before and after the node, the type of operation that triggered the permission change, the time when the operation occurred, the deviation of the source IP address from normal behavior, etc. Finally, this feature vector is input into a pre-trained random forest model. Multiple decision trees within the model will independently judge and output a probability value between 0 and 1 through a "majority voting" mechanism, that is, the permission jump behavior belongs to an abnormal risk score. If the score of any node in the path exceeds the preset score threshold, or the cumulative score of all nodes in the path exceeds the cumulative score threshold, the path is marked as an abnormal permission escalation path, and this path and its risk score will be passed to the downstream access control processing execution process.

[0044] Step S60: Based on the abnormal privilege escalation path, perform alarm processing;

[0045] It should be noted that, in the above embodiments of this application, as Figure 2As shown, by deploying a log collection agent, various raw logs are collected from the target system, and then parsed and fused. The messy, unstructured logs are organized into user behavior sequences strictly ordered by timestamps, with users and sessions as dimensions, providing time-series-based basic data input for the entire tracking process. Furthermore, based on preset rules, multi-dimensional statistical features (such as operation type distribution, resource access distribution, permission level, time frequency, etc.) are extracted from each user behavior sequence and transformed into numerical vectors, resulting in a set of target user feature vectors that characterize user behavior patterns. This transforms the behavior logs into data suitable for subsequent machine learning. The algorithm performs mathematical calculations and comparisons in a standardized format. Further, it uses the DBSCAN clustering algorithm to analyze the feature vectors of all users, identifying outliers in low-density areas of the overall behavior pattern, forming a preliminary list of abnormal vectors. This filters out abnormal behavior sequences worthy of further in-depth analysis from massive user behavior data, narrowing the scope of subsequent refined analysis. Further, it uses the PageRank algorithm to analyze a predefined penetration attack rule base, calculating the steady-state weight value (i.e., coreity) of each attack step. Then, it maps log entries of user behavior sequences to an attack knowledge graph, and uses confidence decay and individualization... The weighting process involves calculating a second weight value reflecting the characteristics of the sequence. Finally, a matching process is performed by comparing the similarity (cosine similarity) between the steady-state weight value and the second weight value, outputting a list of potential penetration paths. This list includes successfully matched sequence identifiers, quantified similarity scores (matching scores), and interpretable attack path descriptions. It clearly identifies which known attack patterns the abnormal behavior matches, the degree of matching, and transforms the attack intent into a clear attack chain description, improving the interpretability and operability of alerts. Furthermore, from the successfully matched potential penetration paths, all permission change nodes are located, and a multi-dimensional framework is constructed for each node. The evaluation feature vectors (such as temporal consistency, path correlation, and operational characteristics) are input into a pre-trained random forest model for evaluation. The model outputs a risk score for each node with changing permissions, and marks high-risk abnormal privilege escalation paths accordingly. This allows for precise risk assessment of the most destructive links in the attack chain, avoiding isolated judgments of permission operations and considering them within the complete attack context. This enables more accurate identification of truly malicious privilege escalation behaviors. Finally, based on the abnormal privilege escalation paths with high-risk scores derived from the aforementioned analysis, the model triggers corresponding alarm mechanisms, completing the output from detection and analysis to security response.

[0046] Specifically, such as Figure 3As shown, in step S40, for the user behavior sequences corresponding to the preliminary anomaly vector list, a sequence matching is performed based on the link analysis of the predefined penetration attack rule base, using steady-state weight values ​​(i.e., the importance of attack steps in the network propagation process to evaluate the coreness of each step) and mapping accuracy, to obtain a list of successfully matched potential penetration paths, including the following steps:

[0047] Step S41: By parsing all attack pattern sequences in the penetration attack rule base, each attack step in the penetration attack rule base is defined as a state node. The identifier of the state node is composed of the operation type and the target context. The number of sequential transitions between state nodes in all sequences is counted, and the state transition probability between each state node is calculated, thereby constructing an attack pattern state graph containing all state nodes and state transition probabilities (a directed edge is established between all two state nodes that have state transitions, and this directed edge is assigned a value of the state transition probability).

[0048] It should be noted that in the above embodiments of this application, the attack mode state graph is a probabilistic directed graph model (e.g., Figure 4 As shown, a directed edge is established between any two state nodes that exhibit state transitions. This is used to formally represent known attack knowledge. The state nodes represent the operation type-target context (e.g., brute-force login-authentication service), ensuring the semantic integrity of the attack actions; state transition probability. Based on the observed number of transitions from node i to node j Total number of outgoing nodes i The calculation shows that, = / This calculation transforms discrete attack rules into a continuous probabilistic network, providing a unified attack knowledge base for subsequent steps.

[0049] Step S42: Obtain the total number of state nodes in the attack mode state graph, and assign an equal initial weight value to each state node in the attack mode state graph (the initial weight calculation formula for each state node is: one divided by the total number of state nodes).

[0050] Step S43: Set the parameters required for algorithm calculation, including the damping coefficient (usually set to 0.85, used to represent the probability of randomly jumping to any state node in the graph), the convergence judgment threshold (usually set to 10 to the power of negative 6, used to determine whether the calculation result has reached a stable state), the maximum allowed number of iterations, and the iteration counter. The iteration counter is initially set to 0.

[0051] Step S44: Increment the iteration count of the iteration counter by 1 to obtain the current iteration count. Traverse all state nodes in the attack mode state diagram and calculate the new weight value of the current state node using the damping coefficient, the total number of state nodes, and the initial weight value of each state node.

[0052] The new weight value of the current state node is calculated as follows:

[0053] ;

[0054] In the formula, d is the new weight value for the v-th state node in the current iteration; d is the damping coefficient; N is the total number of state nodes; u is the u-th state node in the attack mode state graph pointing to the current state node v. , This is the set of all state nodes in the attack mode state graph that point to the current state node v. The attack mode state graph points to the weight value of the u-th state node in the previous iteration (this weight value can be the new weight value of state node u obtained in the previous iteration; in addition, if the number of iterations is 1, this value is the initial weight value of state node u, that is, the initial weight value obtained in step S42 above). The state transition probability from state node u to state node v (i.e., the "state transition probability between each state node" calculated in step S41).

[0055] Step S45: Calculate the maximum absolute difference between the new weight value of each state node and the weight value of each state node obtained in the previous iteration; determine whether the maximum absolute difference is less than the preset convergence threshold; if yes, normalize the new weight value of each state node to obtain the steady-state weight value of each state node; if no (i.e., if the maximum absolute difference is greater than or equal to the convergence threshold), determine whether the current iteration number is greater than or equal to the maximum allowed iteration number; if yes, normalize the new weight value of each state node to obtain the steady-state weight value of each state node; if no, return the new weight value of each state node to the initial weight value in step S42 above, and re-execute the iterative processing of step S44 until the steady-state weight value of each state node is output.

[0056] It should be noted that in the above embodiments of this application, the calculation process of the steady-state weight value is based on the PageRank algorithm. This algorithm evaluates the coreness of each step by simulating the propagation process of the importance of attack steps in the network. The damping coefficient in the calculation formula represents the probability that the attack behavior may randomly jump and restart, which ensures the completeness of the calculation. The convergence judgment threshold controls the accuracy of the calculation. The summation term in the iterative formula reflects the importance of an attack step, which is jointly determined by the importance of all possible preceding steps leading to it and the probability of transition. This calculation process depends entirely on the attack pattern state diagram (including the set of state nodes, transition topology, and probability) provided in step S41. The final output steady-state weight vector reflects the coreness of each attack step in the global attack knowledge network. The PageRank algorithm applied in the above embodiments of this application is derived from the idea of ​​web page ranking. Here, an analogy is used: the attack steps are regarded as web pages, the transition relationship between steps is regarded as links between web pages, and the transition probability is regarded as link weight. By simulating the propagation process of importance in the state diagram (the damping factor d simulates random jumps, usually set to 0.85), the importance of an attack step is jointly determined by the importance of other steps pointing to it and the transition probability.

[0057] Step S46: Map each log entry in the user behavior sequence to the corresponding state node in the attack pattern state graph, and assign a first initial confidence level to each state node based on the mapping accuracy; perform confidence decay processing based on connected components on the first initial confidence level of each state node generated by the mapping to obtain the second confidence level of each state node; filter all state nodes according to the second confidence level and the preset confidence level judgment standard value to obtain high confidence nodes (state nodes with a second confidence level greater than the confidence level judgment standard value are selected as high confidence nodes), and construct a high confidence active state node set based on all high confidence nodes; use the high confidence active state node set as the preference set, perform weight analysis processing based on the preference set to obtain the second weight value of each user behavior sequence;

[0058] It should be noted that in the above embodiments of this application, the assignment of the first initial confidence level is to map and match the operation type and context information of each log entry in the user behavior sequence with each node in the attack mode state diagram. The mapping and matching results are exact match, partial match, fuzzy match, and no match. Among them, exact match means that the log entry is completely consistent with the state node, and its first initial confidence level is 1. Partial match means that only the operation type or only the context information is consistent with the state node, and its first initial confidence level is 0.5. Fuzzy match means that the most similar state node is found through proximity search, and its first initial confidence level is 0.2. No match means that the mapping is unsuccessful, that is, the operation type and context information do not match, and proximity search cannot find a similar state node, and its first initial confidence level is 0.

[0059] For example: There exists a predefined attack pattern state graph, which contains the following state nodes:

[0060] N1: Operation type = brute force, target context = authentication service;

[0061] N2: Operation type = abnormal file operation, target context = sensitive directory;

[0062] N3: Operation type = Execute command, Target context = Database server;

[0063] N4: Operation type = Scan and probe, Target context = Internal network segment;

[0064] Meanwhile, there is a user behavior sequence to be analyzed, and the key fields after parsing the first three log entries are as follows:

[0065] LE1: Operation type = login attempt, target context = OA system login interface, timestamp = T1;

[0066] LE2: Operation type = file access, target context = / etc / shadow, timestamp = T2;

[0067] LE3: Operation type = command execution, target context = 192.168.1.100, timestamp = T3;

[0068] Match LE1 (login attempt, OA system login interface) with the status diagram nodes:

[0069] Compared to N1 (brute force, authentication service), the operation types are not exactly the same ("login attempt" vs. "brute force"), but they are highly semantically related; the target context is authentication-related services. This is judged as a partial match.

[0070] The fields differ significantly from those of other nodes (N2, N3, N4);

[0071] Therefore, LE1 is mapped to node N1, and because it is a partial match, N1 is given a first initial confidence score of 0.5;

[0072] Match LE2 (file access, / etc / shadow) with state graph nodes:

[0073] Compared to N2 (abnormal file operation, sensitive directory), the operation types are similar ("file access" can be considered a type of "abnormal file operation"); the target context / etc / shadow is a typical sensitive file, which is highly consistent with the "sensitive directory" context; it is determined to be an exact match.

[0074] Therefore, LE2 is mapped to node N2, and because it is an exact match, N2 is given a first initial confidence score of 1.0;

[0075] Match LE3 (command execution, 192.168.1.100) with the state graph nodes:

[0076] Compared to N3 (command execution, database server), the operation type matches exactly (both are "command execution"); however, the target context 192.168.1.100 is an IP address, while "database server" is a logical role, requiring further judgment. For example, if a query of the asset database reveals that IP address 192.168.1.100 is not a database server but a web server, then the target context does not match.

[0077] At this point, a nearest neighbor lookup is initiated. In the attack knowledge model, the "command execution" operation is often associated with contexts such as "database server" or "application server". 192.168.1.100 (Web server) and "database server" are nearest neighbors in terms of asset function.

[0078] Therefore, LE3 is mapped to node N3, but since its target context is determined through nearest neighbor search, it is judged as a fuzzy match, and N3 is given a first initial confidence score of 0.2.

[0079] State node N4 (scan probe, internal network segment) is not mapped to any log entries, therefore, N4 is given an initial confidence level of 0.

[0080] Step S47: Calculate the cosine similarity between the steady-state weight value and the second weight value to obtain the matching score; determine whether the matching score is greater than or equal to the preset matching score threshold; if yes (if no, then filter out), then the user behavior sequence is determined to be successfully matched; for the successfully matched user behavior sequence, extract the top K state nodes with the highest weight in its second weight value, and generate an attack path description in chronological order.

[0081] It should be noted that in the above embodiments of this application, cosine similarity is used to measure the similarity between two weights to avoid deviations caused by differences in sequence length. The matching threshold is used to control the strictness of the judgment. Extracting high-weight state nodes and generating descriptions in chronological order are key steps to transform mathematical matching results into an interpretable security event chain.

[0082] The above attack path description is to convert the mathematical matching result (high-weight state node sequence) into a natural language summary that security analysts can intuitively understand. It is generated based on the top K state nodes with the highest weight in the second weight value vector corresponding to the user behavior sequence (e.g., K=5), arranged in the actual time order of their appearance in the original user behavior sequence, and supplemented with key context information.

[0083] For example, suppose there is a user behavior sequence that is determined to be a successful match in step S47 (match score is 0.82). The top 4 state nodes with the highest weights in its second weight value vector, arranged in chronological order, and their original log information are shown in Table 1 below:

[0084] Time series State node (Operation type - Target context) Corresponding original log timestamp Key log details (from step S10 analysis) 1 Brute-force authentication service T1 User Bob initiated 150 failed login attempts to the OA login interface from IP 10.0.0.5 within 2 minutes. 3 Vulnerability Exploitation - Web Application T3 User Bob sends a specially crafted malicious payload from IP 10.0.0.5 to the / api / v1 / upload interface. 5 Abnormal file access - sensitive directory T5 User Bob accessed the / etc / shadow system password file from IP 10.0.0.5. 6 Privileged command execution - database server T6 User Bob executed the `sudosu-postgres` command from IP 10.0.0.5 on host DB-SRV-01.

[0085] Based on the information in Table 1 above, the generated attack path is described as follows:

[0086] User Bob (Session ID: SESS_9f8a) initiated a highly suspicious penetration path from source IP 10.0.0.5 within the time window [T1, T6] (match score: 0.82). The core attack chain is as follows: first, a high-frequency brute-force attack is performed on the authentication service (at time T1); after success, a malicious payload is uploaded using a web application vulnerability (at time T3); then, abnormal access is made to sensitive system files (at time T5); finally, privileged commands are executed on the database server in an attempt to obtain high-level privileges (at time T6).

[0087] Step S48: Integrate all successfully matched user behavior sequences, record the matching score and attack path description for each user behavior sequence; sort all records in descending order of matching score to form the final list of potential penetration paths.

[0088] It should be noted that in the above embodiments of this application, by first constructing an attack knowledge graph, the penetration attack rules described in the text (such as "brute-force login → vulnerability exploitation") are transformed into a directed graph model with probabilities (attack mode state graph), providing a unified and quantifiable knowledge foundation for all subsequent calculations, and transforming discrete rules into a network of continuous transition relationships; furthermore, the PageRank algorithm is used to simulate the propagation of attack importance in the above knowledge graph, and finally a stable weight value (steady-state weight value) is calculated for each attack step (state node) in the graph, evaluating the different attack steps in the entire attack knowledge graph. This approach addresses the issue of traditional methods treating attack steps equally and failing to assess their criticality by prioritizing core elements within the knowledge graph (e.g., "gaining initial privileges" being more important than "cleaning up traces"). Furthermore, through mapping and confidence assignment, user log entries are matched with nodes in the knowledge graph, and different initial confidence levels are assigned based on the accuracy of the match (precise, partial, fuzzy), establishing a connection between specific user behaviors and abstract attack knowledge, and initially quantifying the credibility of this connection. Finally, through confidence decay based on connected components, the initial confidence levels are adjusted to enhance the understanding of the knowledge graph. Nodes forming isolated small groups (which may be normal operations resulting from mismatches) undergo exponential decay to filter out noisy nodes caused by surface similarity, improving the signal quality upon which subsequent analysis depends. Then, personalized weights are generated, and the PageRank algorithm is run again with the purified set of high-confidence nodes as the focus, generating a weight vector (second weight value) reflecting the unique pattern of the current user sequence. This yields a quantitative representation that reflects both the global attack knowledge structure and focuses on suspicious segments of the current sequence, preparing for subsequent matching. Further, the cosine similarity between the global authoritative weight vector (output of step S45) and the personalized weight vector (output of step S46) is calculated to obtain a quantified matching score. An easily understandable attack path description is generated based on high-score nodes. The similarity score objectively judges the degree of match between user behavior and known attack patterns, achieving accurate matching. The mathematical calculation results are transformed into a natural language summary containing specific users, times, and operation steps, directly telling security personnel "what attack occurred," optimizing the inexplicable problem of traditional anomaly detection alarms. Finally, all successfully matched sequences, their scores, and descriptions are integrated and sorted by risk matching score to form an ordered list of suspects.

[0089] Specifically, in step S46, the first initial confidence of each state node generated by the mapping is subjected to confidence attenuation processing based on connected components to obtain the second confidence of each state node, including the following operation steps:

[0090] Step S461: Establish undirected edges between all state nodes with a first initial confidence greater than 0 and a state transition, to obtain an initial activated undirected subgraph;

[0091] It should be noted that in the above embodiments of this application, the state node set generated based on the mapping and the attack mode state diagram are used, such as Figure 5 As shown, all state nodes with a first initial confidence level not equal to 0 are extracted from the attack mode state graph; and the direction of each state transition edge (i.e., the directed edge mentioned above) of the state nodes with a first initial confidence level not equal to 0 is ignored, and each directed state transition probability edge is transformed into an undirected connection edge; the initial activated undirected subgraph is formed by these state nodes with a first initial confidence level not equal to 0 and the corresponding undirected connection edges. The initial activated undirected subgraph is used to analyze the connectivity between state nodes. Ignoring the direction of its directed edges is to discover whether there is a related path between nodes, without considering the order of attack steps.

[0092] Step S462: Execute the breadth-first search algorithm in the initially activated undirected subgraph to find and mark all connected components in the initially activated undirected subgraph; and use the number of state nodes of each connected component as the connected component value of each connected component;

[0093] It should be noted that, in the embodiments of this application described above, a connected component refers to a subset of state nodes in an undirected subgraph connected by undirected edges, wherein any two nodes within the subset are connected by a path, but there is no connection with nodes outside the subset (i.e., a connected component is the largest subset of state nodes in the subgraph connected by undirected edges, where internal state nodes are mutually reachable and external nodes are separated). A connected component reflects the aggregation of initially activated state nodes in the attack knowledge graph. In an undirected graph, a connected component refers to the largest subset of nodes in the graph that are connected to each other. If the graph is considered to be composed of multiple independent parts, then each independent part is a connected component. If the graph is connected, then it has only one connected component, i.e., the entire graph; if it is disconnected, then it contains multiple connected components.

[0094] Step S463: For each state node of each connected component, calculate the second confidence of each state node by combining the first initial confidence of the state node with the connected component value, the connected component value threshold, and the decay base.

[0095] The second confidence level is calculated as follows:

[0096] ;

[0097] In the formula, Let v be the initial confidence level of state node v. This represents the second confidence level of state node v. As the attenuation base, Threshold for connected component values, The connected component value of the connected component to which state node v belongs;

[0098] It should be noted that, in the above embodiments of this application, the calculation of the second confidence level introduces an exponential decay mechanism based on the scale of the connected components, and the connected component value threshold... This represents the minimum set size of nodes considered potentially constituting a valid attack fragment. The attenuation cardinality β (0 < β < 1) determines the strength of each attenuation step. The number of nodes in the connected component... Less than When a node within a connected component is considered isolated or discontinuous, its initial confidence level needs to be exponentially decayed according to the formula, with the decay exponent being... This refers to the degree of shortage in scale. The greater the shortage, the stronger the decay. Through this decay operation, isolated nodes generated by accidental matching are suppressed, while the confidence of a relatively coherent set of nodes is preserved.

[0099] Specifically, in step S50, based on the list of potential penetration paths and combined with a random forest classification model trained from historical attack data, the nodes of permission change in the path are first extracted, and then a permission escalation risk assessment is performed on each node to obtain abnormal permission escalation paths containing risk scores, including the following steps:

[0100] Step S51: Traverse each user behavior sequence in the potential penetration path list; for each user behavior sequence, check each log entry it contains; determine whether the current log entry records a permission change operation (permission change operation, for example, changing the user role from "user" to "admin", or upgrading the privilege level from "normal" to "system"); if the current log entry records a permission change operation (if not, filter it out and do not process it again), then mark the state node corresponding to the log entry (i.e., the state node in the attack mode state diagram mapped in step S46) as a permission change node, and record the node content information of the permission change node; the node content information includes the node identifier, the permission level before the permission change, the permission level after the permission change, the operation type that triggered the permission change, the timestamp of the operation, the source IP address, and the time sequence position (i.e., the time sequence position of the node in its respective user behavior sequence, that is, which node in the sequence).

[0101] Step S52: For each permission change node, construct a node evaluation feature vector based on the node content information; the node evaluation feature vector includes feature values ​​in the following dimensions: attack mode temporal consistency score and permission jump path association score.

[0102] Step S53: Analyze each permission change node using a pre-trained random forest classification model and output the basic permission transition risk score for each permission change node;

[0103] It should be noted that in the above embodiments of this application, the pre-trained random forest classification model consists of multiple decision trees. Each tree outputs a predicted probability based on the node content information of the input permission change node. The model calculates a basic permission jump risk score for each node through a majority voting mechanism.

[0104] Step S54: Calculate the final risk score based on the basic permission transition risk score of each permission change node and the node evaluation feature vector of each permission change node.

[0105] The final risk score is calculated as follows:

[0106] ;

[0107] In the formula, Risk scoring for basic permission transitions. This is the time-series consistency weighting coefficient. This refers to the path association weight coefficient. The attack mode timing consistency score is used to determine the attack mode. The score is associated with the permission transition path.

[0108] It should be noted that the calculation of the final risk score in the above embodiments of this application ensures that when the operation sequence of a node highly conforms to the attack pattern or there is evidence of multiple privilege escalation associations, its risk score is appropriately improved, thereby enhancing the model's ability to detect complex and roundabout attacks.

[0109] Step S55: Set the single-node risk threshold and the path cumulative risk threshold; calculate the path cumulative risk value of the final risk score of each permission change node in each user behavior sequence; determine whether there is any permission change node in the user behavior sequence whose final risk score is greater than or equal to the single-node risk threshold and determine whether the path cumulative risk value of the user behavior sequence is greater than or equal to the path cumulative risk threshold; if any of the above judgment conditions are met, mark the user behavior sequence as an abnormal permission escalation path;

[0110] It should be noted that in the above embodiments of this application, by traversing each attack path (user behavior sequence) judged as suspicious, the specific log points of all permission change operations (such as from user to admin) are accurately located, and associated with the corresponding state nodes in the attack knowledge graph. This focuses the analysis target from broad abnormal behavior sequences to the most critical permission jump actions, providing a specific set of analysis objects for subsequent risk assessment. Furthermore, by utilizing the analysis results of the preceding step (S40), a feature vector is constructed for each permission change node. This vector allows the risk assessment to not view a single privilege escalation event in isolation, but to consider it within the context of the complete attack chain, grasping the essence of advanced attacks' step-by-step and coordinated privilege escalation. Furthermore, the node content information (such as operation type and permission level change value) extracted in step S51 is input into a pre-trained random forest model, which learns from historical attack data. The model outputs a basic risk probability value, providing an objective initial risk assessment based on historical experience, serving as a benchmark for subsequent fine-tuning. The basic score obtained in step S53 is weighted and fused with two feature scores reflecting the attack context constructed in step S52, enhancing the model's ability to detect complex and circuitous attack strategies (such as tentative privilege escalation and step-by-step privilege escalation), addressing the problems of traditional methods having a single evaluation dimension and being detached from context. By setting two judgment conditions: a single-node risk threshold and a path cumulative risk threshold, for each path, it checks whether any node exceeds the threshold, or whether the sum of risks of all nodes in the entire path exceeds the threshold, achieving a more comprehensive risk judgment strategy. This strategy can capture both individual, obvious malicious privilege escalation and the behavior of attackers accumulating attack objectives through multiple low-risk operations. Finally, it outputs a clearly marked list of abnormal privilege escalation paths, providing direct and reliable input for subsequent alarms or handling (step S60).

[0111] Specifically, in step S52, for each node with changed permissions, a node evaluation feature vector is constructed based on the node content information, including the following steps:

[0112] Step S521: Traverse each permission change node, extract the node identifier of the current permission change node (the node identifier is the node identifier in the node content information of step S51 above, and the node identifier is composed of operation type-target context), and initialize and establish a typical time sequence location set; the typical time sequence location set is initially empty.

[0113] Step S522: Traverse each attack pattern sequence (i.e., the attack pattern sequence in step S41), and sequentially judge each state node in the attack pattern sequence to determine whether the operation type of the state node is consistent with the operation type of the current permission change node; if yes (if no, ignore the state node and continue to judge the next state node in the current traversed attack pattern sequence), then add the state node's sequential position in its respective attack pattern sequence (e.g., if the current state node is the first state node in its respective attack pattern sequence, i.e., its sequence number in the attack pattern sequence is 1, then record it as 1 and add it to the typical timing position set); and repeat this step until all state nodes of all attack pattern sequences have been traversed;

[0114] Step S523: Determine whether the typical time-series location set is empty. If not, calculate the absolute value of the difference between each value in the combination of the time-series location of the current permission change node and the typical time-series location, and take the minimum absolute value of the difference as the minimum absolute distance. If yes, take the preset maximum distance as the minimum absolute distance. The preset maximum distance is greater than all absolute values ​​of the difference.

[0115] It should be noted that in the above embodiments of this application, the preset maximum distance value indicates that no attack state node with the same operation type as the current permission change node was found in the current attack knowledge base (the rule base of step S41). Therefore, it is impossible to calculate the actual temporal distance between the current operation and the known attack pattern. Therefore, setting the maximum distance value allows subsequent operations to continue to be executed and can output a meaningful and extremely low value, thereby characterizing the lack of temporal consistency reference state. This is because in the permission risk assessment, if a privilege escalation operation cannot find a similar operation in the known attack knowledge base (i.e., the operation type does not match), then it should be considered that its temporal characteristics do not have typicality of attack, and its consistency score should be very low. In the subsequent calculation, the smaller the minimum absolute distance, the larger the calculated value in the subsequent step S524. Therefore, the value of the maximum distance value should be a very large value, that is, a constant greater than the length of all possible user behavior sequences (the number of log entries generated by a single user in a session or time window, determined by the collection and segmentation strategy of step S10, for example, it may be set that a single user behavior sequence has no more than 100 log entries).

[0116] Step S524: Calculate the timing consistency score of the attack pattern using the minimum absolute distance;

[0117] The calculation method for the timing consistency score of attack patterns is as follows:

[0118] In the formula, The temporal consistency coefficient (a preset constant greater than 0, such as 0.5, used to adjust the rate of decay of distance-based scores). The minimum absolute distance (when the minimum absolute distance is the actual distance, that is, the minimum absolute value of the difference in step S523 above is the minimum absolute distance. The smaller the value, the closer the attack mode timing consistency score is to 1. When the preset maximum distance value is taken, the attack mode timing consistency score is closer to 0).

[0119] Step S525: Initialize the set of related nodes of the same type, which is initially empty; iterate through the status node identifier of each status node in the set of high-confidence active status nodes, and determine whether the status node identifier is not equal to the node identifier of the current permission change node; if yes (if no, that is, the current status node identifier is equal to the node identifier of the current permission change node, then ignore the status node and continue iterating), then take the operation type corresponding to the current status node identifier, and determine whether the operation type corresponding to the current status node identifier is the same as the operation type of the current permission change node; if yes, then put the node identifier of the status node into the set of related nodes of the same type; if no, then ignore the status node and continue iterating; repeat the traversal processing operation of this step until each status node in the set of high-confidence active status nodes has been traversed;

[0120] Step S526: Determine whether the set of related nodes of the same type is empty; if not (if yes (i.e. the set of related nodes of the same type is empty), then set the permission transition path association score to 0), then obtain the timestamp of the corresponding log entry in the user behavior sequence for each state node in the set of related nodes of the same type, calculate the absolute value of the time difference between the timestamp of the corresponding log entry in the user behavior sequence for each state node in the set of related nodes of the same type and the timestamp of the current permission change node, and take the maximum value of the absolute value of the time difference as the maximum time interval;

[0121] Step S527: Calculate the permission transition path association score using the maximum time interval and the matching score of the user behavior sequence to which the current permission change node belongs;

[0122] The calculation method for the permission transition path association score is as follows:

[0123] In the formula, The matching score is calculated as the cosine similarity between the steady-state weight value and the second weight value calculated in step S47. For the maximum time interval, This is a path association adjustment factor (a preset constant greater than 0 (e.g., 0.3), used to adjust the strength of the influence of time intervals on the association degree).

[0124] Step S528: Construct a node evaluation feature vector (i.e., a two-dimensional vector, represented as []) based on the attack mode temporal consistency score and the permission transition path correlation score. ,H]).

[0125] It should be noted that the above-described embodiment of this application extracts the operation type (such as "execute command") of the currently analyzed permission change node and prepares an empty set to store the reference positions found later, thus preparing key inputs and storage structures for subsequent time-series comparisons. Then, it iterates through all known attack patterns in the knowledge base, finds each attack step that is completely identical to the operation type of the current node, and records which step these steps are in their respective attack patterns (e.g., the 2nd or 5th step of the attack chain), forming a typical position reference list, representing which stages of the attack sequence this type of privilege escalation operation usually appears in in past attack knowledge. Then, if a typical position is found (the set is not empty), the distance between the current node's position in the actual user sequence and all typical positions is calculated, and the minimum value is taken as the minimum absolute distance. If no typical position is found (the set is empty), this distance is directly set to a very large preset value to quantify the degree of deviation of the current privilege escalation operation from the typical attack pattern in terms of time sequence. The smaller the distance, the more typical it is. Using a very large value means that there is no typical pattern to refer to. Furthermore, the distance value in the previous step is transformed into a maximum value using an exponential decay formula. Scores ranging from 0 to 1 indicate that the smaller the distance, the closer the score is to 1, indicating a high degree of consistency between the time sequence and the attack pattern. When the distance is extremely large, the score approaches 0, indicating a lack of typicality in the time sequence, thus assessing the reasonableness of this privilege escalation within the attack chain timeline. Furthermore, within the set of high-confidence nodes corresponding to the same suspicious user behavior sequence, other nodes with the same operation type (excluding the user themselves) are searched to identify whether multiple similar privilege escalation attempts exist within the same suspicious attack activity, providing clues for discovering multi-point probing and step-by-step privilege escalation. Further, such as... If other similar nodes are found, the maximum difference (maximum time interval) between these nodes and the current node in terms of occurrence time is calculated to quantify the degree of dispersion of these associated privilege escalation operations in time. The smaller the interval, the more concentrated their occurrence, and the stronger the correlation and coordination may be. Then, the privilege transition path association score is calculated. The higher the value, the more suspicious the current privilege escalation operation is on a path and may be associated with other privilege escalation points on the path. Finally, the temporal consistency score calculated in step S524 and the path association score calculated in step S527 are combined into a two-dimensional vector.

[0126] Example 2

[0127] Embodiment 2 of the present invention provides a method for tracing the penetration path of an information security system. Its execution logic and the resulting technical effects are the same as those in Embodiment 1 above. The difference is that in step S46, a set of high-confidence activated state nodes is used as a preference set, and a weight analysis based on the preference set is performed to obtain the second weight value of each user behavior sequence. This includes the following steps:

[0128] Step S4601: Set the second damping coefficient, the second convergence threshold, the second iteration counter, and the second maximum allowed number of iterations. The initial number of iterations for the second iteration counter is 0.

[0129] Step S4602: Increment the iteration count of the second iteration counter by 1 to obtain the current second iteration count. Traverse all state nodes in the attack mode state diagram and calculate the new second weight value of the current state node using the second damping coefficient, the total number of state nodes, and the initial weight value of each state node.

[0130] The new second weight value is calculated as follows:

[0131] ;

[0132] In the formula, The current second iteration number The new second weight value for the state node v is... This is the second damping coefficient. This represents the second confidence level of state node v. This is the set of active state nodes with high confidence. The sum of the second confidence scores of all state nodes in the set of high-confidence activated state nodes; The indicator function is 1 when state node v belongs to the set of high-confidence active state nodes, and 0 otherwise. u is the u-th state node in the attack mode state graph that points to the current state node v. , This is the set of all state nodes in the attack mode state graph that point to the current state node v. This is the new second weight value of state node u in the previous iteration (the new second weight value here can be the new second weight value of state node u in the previous iteration; in addition, if the number of this iteration is 1, then this value is the initial weight value of state node u, that is, the initial weight value in step S42 above). The dynamic state transition probability from state node u to state node v

[0133] In the above embodiments of this application, the dynamic state transition probability represents the conditional probability estimate of transitioning from attack step (state node) u to attack step (state node) v in the specific context of the current user behavior sequence to be analyzed. This is different from the "state transition probability between state nodes" calculated in step S41. The value is dynamically adjusted based on whether the transition is actually observed in the current sequence. It represents the specific transition habit or pattern exhibited by the current user behavior sequence from one attack operation to another. In the weighted analysis process based on preference sets, importance is the channel strength flowing from node u to node v. If the current sequence frequently shows transitions from u to v, the channel is strengthened; otherwise, it depends on the general probability of the transition in global attack knowledge. If a direct transition from state node u to state node v is observed in the current user behavior sequence, then... The value is an empirical probability value based on the statistics of the current sequence, calculated using the following formula: ,in, This refers to the number of times state node u is immediately followed by state node v in the state node sequence mapped from the current user behavior sequence. Let v be the total number of transitions originating from state node u in the state node sequence mapped from the current user behavior sequence (i.e., the total number of times state node u appears in the sequence and is followed by other nodes); if a non-direct transition from state node u to state node v is observed in the current user behavior sequence, then... The value is obtained by using the "state transition probability between each state node" calculated in step S41;

[0134] For example: the current user behavior sequence is mapped to the following state node order: A→B→C→A→B. For the transition A→B: 2 times are observed (steps 1 to 2, and 4 to 5). The total number of transitions starting from A is 2 (A appears in steps 1 and 4, and there are nodes after it). Therefore, if we calculate... Therefore, the empirical probability = 2 / 2 = 1.0; For the transition B→C: 1 instance is observed (steps 2 to 3), and the total number of transitions starting from B is 2 (B appears in steps 2 and 5, but there are no nodes after step 5, so there is only one transition after step 2). =1 / 1=1.0; For the transition C→A: 1 instance is observed (steps 3 to 4), the total number of transitions starting from C is 1 (C appears in step 3 and is followed by a node), therefore, =1 / 1=1.0; For the transition A→C: no direct transition was observed, therefore, The state transition probabilities between each state node will be calculated using step S41.

[0135] Step S4603: Calculate the second maximum absolute value difference between the new second weight value of each state node and the new second weight value in the previous iteration. Determine whether the second maximum absolute value difference is less than the preset second convergence threshold. If yes, normalize the new second weight value of each state node to obtain the target second weight value of each state node. If no, determine whether the current iteration number is greater than or equal to the second maximum allowed iteration number. If yes, normalize the new second weight value of each state node to obtain the target second weight value of each state node. If no, use the new second weight value of each state node as the initial weight value of each state node, and re-execute the weight analysis processing in step S4602 above until the target second weight value of each state node (i.e., the second weight value in step S46 above) is output.

[0136] It should be noted that, in the above embodiments of this application, the target second weight value The analysis and calculation process is based on the PageRank algorithm. It evaluates the core importance of each step to the current specific sequence by simulating the propagation process of the importance of attack steps in the state graph. Compared with the global PageRank algorithm of steps S42-S45, its core difference lies in the different probability distribution of restart (jump) behavior: the global algorithm uses uniform probability. Jump to any node; in this embodiment of the application, the node is used with a second initial confidence level. Proportional probability Jumping to a node in the set of high-confidence activated states demonstrates the guiding role of the preference set, and the dynamic state transition probability in the formula... Prioritize using empirical probabilities from within the current sequence's statistics to ensure weight propagation reflects the sequence's unique transition patterns. If not, revert to global probabilities to guarantee the universality of the calculation. (Second damping coefficient) The functions of the second convergence threshold and the second maximum allowed number of iterations are similar to their corresponding parameters in the global algorithm, but they operate independently in the calculation process of this step, ultimately outputting the second weight value. It is a fusion of global attack knowledge structure (through state graph topology and...) ) and the quantized vector of the local behavioral features of the current sequence (through the preference set and its second confidence).

[0137] In summary, the penetration path tracing method for information security systems proposed in this invention involves collecting and parsing logs to form user behavior sequences. After extracting feature vectors, DBSCAN clustering is used to filter out abnormal sequences. Then, the PageRank algorithm is used to compare the similarity between the weights of the behavior sequences and the steady-state weights of attack knowledge to match attack patterns. Finally, multi-dimensional feature vectors are constructed for the privilege change nodes in the matching path, and input into a random forest model for risk assessment and to trigger alarms. This method transforms unstructured logs into time-series behavior sequences and numerical features, providing standardized data input for subsequent analysis. DBSCAN initially filters out outliers from massive amounts of behavior, narrowing the scope of fine-grained analysis. PageRank weight similarity matching associates abnormal behavior with known attack patterns and outputs interpretable attack path descriptions, improving the interpretability of alarms. By integrating multi-dimensional context to evaluate privilege escalation nodes and considering them within the complete attack chain, malicious privilege escalation behavior can be identified more accurately, completing a closed loop from detection to response.

[0138] In the specific execution process, firstly, an attack knowledge graph is constructed and the rules are transformed into a directed graph model with probabilistics. Then, the PageRank algorithm is used to calculate the steady-state weight value of each attack step in the graph to evaluate its coreness. Next, user log entries are mapped to knowledge graph nodes and assigned initial confidence. Then, noisy nodes are filtered through confidence decay processing based on connected components. Then, the PageRank algorithm is run again with the purified high-confidence node set as the focus to generate a personalized weight vector (second weight value) that reflects the unique pattern of the current user sequence. By calculating the cosine similarity between the steady-state weight vector and the personalized weight vector, the attack pattern is quantitatively matched and ranked. The result is transformed into an interpretable natural language description, transforming discrete rules into a continuous probabilistic network, evaluating the criticality of attack steps, filtering mismatch noise, and generating an easy-to-understand attack path summary, thus optimizing the problem of traditional alarms being uninterpretable.

[0139] In the further execution process, an initial activated undirected subgraph is first constructed based on nodes with a first initial confidence greater than 0 and their undirected edges. Then, a breadth-first search algorithm is executed in this undirected subgraph to discover and mark all connected components and record the number of nodes (connected component values) in each connected component. Finally, the second confidence of each node is calculated by combining the first initial confidence of the node, the connected component value of its corresponding connected component, the preset connected component value threshold, and the decay base, using an exponential decay formula. By analyzing the connectivity (clustering) of activated nodes in the undirected graph, the confidence of isolated or discontinuous nodes belonging to small-scale connected components is exponentially decayed, thereby suppressing noisy nodes caused by accidental matching, preserving the confidence of relatively coherent node sets, and improving the quality of the signals on which subsequent analysis depends.

[0140] Furthermore, by locating all permission change nodes from suspicious attack paths and constructing an evaluation feature vector for each node that integrates multi-dimensional context such as temporal consistency and path correlation, the feature vector is input into a pre-trained random forest model to obtain a basic risk score. This score is then weighted and fused with the context feature score to form the final evaluation. By setting two conditions—a single-node risk threshold and a path cumulative risk threshold—the risk of privilege escalation paths is determined. Privilege escalation operations are considered within the context of the complete attack chain rather than in isolation, thereby identifying complex attack strategies such as probing and step-by-step privilege escalation. The dual-threshold determination strategy can capture both single high-risk operations and behaviors that achieve the attack objective through the accumulation of multiple low-risk operations, outputting a more reliable list of abnormal privilege escalation paths.

[0141] Furthermore, when constructing the feature vector, two scores are specifically calculated: the sequence consistency score and the path association score. By comparing the position of the current privilege operation in the sequence with the typical position of similar operations in the attack knowledge base, the rationality of its occurrence is measured. By analyzing whether there are other nodes of similar privilege operations and their time intervals in the same suspicious sequence, the correlation and synergy of the operations are measured. The typicality of the current privilege escalation operation on the attack chain timeline is quantitatively evaluated, as well as whether it is part of a multi-point probing, step-by-step privilege escalation, or other patterns. Together, these constitute multi-dimensional features that reflect the attack context for risk assessment.

[0142] Furthermore, after obtaining the set of high-confidence activated nodes (preference set), an improved PageRank algorithm is run to calculate the second weight value. Specifically, the restart (jump) probability set is assigned to the nodes in the preference set, and the assignment probability is proportional to the second confidence of the node. When calculating the state transition probability, dynamic empirical probabilities obtained from the current user behavior sequence are used first. The calculation is iterative until the weight value converges, and finally the normalized target second weight value is obtained. This ensures that the importance (weight) propagation process is guided by high-confidence suspicious nodes and reflects the state transition habits unique to the current sequence.

[0143] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; those skilled in the art can modify the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for tracing penetration paths in an information security system, characterized in that, The following steps are included: By deploying a log collection agent on the target system, multi-source heterogeneous log data is collected, including system access logs, permission allocation records, and authentication logs. The collected multi-source heterogeneous log data is then parsed and fused to obtain user behavior sequences. Based on user behavior sequences, vectorization is performed using preset feature engineering rules to obtain a set of target user feature vectors. Based on the target user feature vector set, density clustering analysis is performed using the DBSCAN clustering algorithm to obtain a preliminary list of anomaly vectors. For the user behavior sequences corresponding to the preliminary list of anomaly vectors, sequence matching is performed based on the link analysis of steady-state weight values ​​and mapping accuracy using a predefined penetration attack rule base to obtain a list of potential penetration paths that have been successfully matched. Based on a list of potential penetration paths, and combined with a random forest classification model trained from historical attack data, the nodes of permission change in the path are first extracted, and then a permission jump risk assessment is performed on each node to obtain abnormal permission escalation paths containing risk scores. An alarm will be triggered based on the abnormal privilege escalation path.

2. The method for tracing penetration paths in an information security system according to claim 1, characterized in that, For the user behavior sequences corresponding to the initial list of abnormal vectors, sequence matching is performed based on link analysis using a predefined penetration attack rule base and steady-state weight values ​​and mapping accuracy to obtain a list of successfully matched potential penetration paths. The steps include: By analyzing all attack pattern sequences in the penetration attack rule base, each attack step in the penetration attack rule base is defined as a state node; the number of sequential transitions between state nodes in all sequences is counted, and the state transition probability between each state node is calculated, thereby constructing an attack pattern state diagram that includes all state nodes and state transition probabilities. Obtain the total number of state nodes in the attack mode state graph, and assign an equal initial weight value to each state node in the attack mode state graph; Set the parameters required for the algorithm calculation, including the damping coefficient, convergence threshold, maximum allowed number of iterations, and iteration counter; Based on the attack mode state diagram, the steady-state weight values ​​of each state node are obtained by iterative analysis and processing, combining the initial weight values ​​with the parameters required for algorithm calculation. By mapping and analyzing log entries, the second weight value of each user behavior sequence is obtained; based on the steady-state weight value and the second weight value, a list of potential penetration paths is obtained.

3. The method of claim 2, wherein, Based on the attack mode state diagram, and combining the initial weight values ​​with the parameters required for algorithm calculation, iterative analysis is performed to obtain the steady-state weight values ​​of each state node, including the following steps: Increment the iteration count of the iteration counter by 1 to obtain the current iteration count. Traverse all state nodes in the attack mode state diagram and calculate the new weight value of the current state node using the damping coefficient, the total number of state nodes, and the initial weight value of each state node. Calculate the maximum absolute difference between the new weight value of each state node and the weight value of each state node obtained in the previous iteration; judge and process the maximum absolute difference with the preset convergence judgment threshold and the current iteration number to obtain the steady-state weight value of each state node.

4. The information security system penetration path tracking method of claim 3, wherein, The second weight value of each user behavior sequence is obtained through mapping analysis of log entries, including the following steps: Map each log entry in the user behavior sequence to the corresponding state node in the attack pattern state graph, and assign a first initial confidence level to each state node based on the mapping accuracy. The first initial confidence of each state node generated by the mapping is subjected to confidence decay processing based on connected components to obtain the second confidence of each state node; All state nodes are filtered according to the second confidence level and the preset confidence level evaluation criteria to obtain high confidence nodes, and a high confidence active state node set is constructed based on all high confidence nodes; Using the set of high-confidence activated state nodes as the preference set, weight analysis based on the preference set is performed to obtain the second weight value of each user behavior sequence.

5. The information security system penetration path tracking method of claim 4, wherein, Based on the steady-state weight value and the second weight value, a potential penetration path list is obtained, including the following steps: calculate the cosine similarity between the steady-state weight value and the second weight value to obtain the matching score; determine whether the matching score is greater than or equal to the preset matching score threshold; if so, the user behavior sequence is determined to be successfully matched; for the successfully matched user behavior sequence, extract the top K state nodes with the highest weight in the second weight value and generate an attack path description in chronological order. Integrate all successfully matched user behavior sequences, record the matching score and attack path description for each user behavior sequence; sort all records in descending order of matching score to form the final list of potential penetration paths.

6. The information security system penetration path tracking method of claim 5, wherein, The initial confidence scores of each state node generated by the mapping are subjected to confidence decay processing based on connected components to obtain the second confidence scores of each state node, including the following steps: An undirected edge is established between all state nodes with a first initial confidence greater than 0 and a state transition, resulting in an initial activated undirected subgraph. A breadth-first search algorithm is performed in the initially activated undirected subgraph to find and mark all connected components in the initially activated undirected subgraph; and the number of state nodes in each connected component is used as the connected component value of each connected component. For each state node of each connected component, combine the first initial confidence of the state node with the connected component value of the connected component, the connected component value threshold, and the decay base to calculate a second confidence of the state node 7. The information security system penetration path tracking method of claim 6, wherein, Based on a list of potential penetration paths, and combined with a random forest classification model trained from historical attack data, the following steps are taken: First, nodes with changed privileges are extracted from the paths. Then, a privilege escalation risk assessment is performed on each node to obtain abnormal privilege escalation paths containing risk scores. Iterate through each log entry of each user behavior sequence in the potential penetration path list; determine whether the current log entry records a permission change operation; if the current log entry records a permission change operation, mark the status node corresponding to the log entry as a permission change node, and record the node content information of the permission change node; For each node with changed permissions, construct a node evaluation feature vector based on the node content information; Each node with changing permissions is analyzed using a pre-trained random forest classification model, and the basic permission transition risk score for each node with changing permissions is output. The final risk score is calculated by combining the basic permission transition risk score of each permission change node with the node evaluation feature vector of each permission change node. Set single-node risk thresholds and path cumulative risk thresholds; Calculate the cumulative path risk value of the final risk score for each permission change node in each user behavior sequence; Determine whether the final risk score of any permission change node in the user behavior sequence is greater than or equal to the single node risk threshold, and determine whether the cumulative path risk value of the user behavior sequence is greater than or equal to the cumulative path risk threshold; if any of the above judgment conditions are met, then mark the user behavior sequence as an abnormal permission escalation path.

8. The information security system penetration path tracking method of claim 7, wherein, For each node with changed permissions, construct a node evaluation feature vector based on the node content information, including the following steps: Iterate through each permission change node, extract the operation type information of the node identifier of the current permission change node, and initialize a typical time sequence location set; the typical time sequence location set is initially empty; Iterate through each attack pattern sequence and judge each state node in the attack pattern sequence in turn to determine whether the operation type of the state node is consistent with the operation type of the current permission change node. If so, add the sequential position of the state node in its respective attack mode sequence to the typical temporal position set; Determine if the typical time-series location set is empty. If not, calculate the absolute value of the difference between each value in the combination of the time-series location of the current permission change node and the typical time-series location, and take the minimum absolute value of the difference as the minimum absolute distance. If yes, take the preset maximum distance as the minimum absolute distance. The preset maximum distance is greater than all absolute values ​​of the difference. Calculate the timing consistency score of the attack pattern using the minimum absolute distance; By combining the attack pattern temporal consistency score with the state node identifier and permission change nodes of each state node in the high-confidence activated state node set, a node evaluation feature vector is obtained.

9. The information security system penetration path tracking method of claim 8, wherein, The attack pattern temporal consistency score is combined with the state node identifier and permission change nodes of each state node in the high-confidence active state node set for judgment and analysis to obtain the node evaluation feature vector, including the following operation steps: Initialize the set of related nodes of the same type; analyze and process the judgment of the equality of the status node identifier of each status node in the set of high-confidence active status nodes with the current permission change node and the judgment of the same operation type, and add the status nodes that meet the judgment conditions to the set of related nodes of the same type. Determine if the set of related nodes of the same type is empty; if not, obtain the timestamp of the corresponding log entry in the user behavior sequence for each state node in the set of related nodes of the same type, calculate the absolute value of the time difference between the timestamp of the corresponding log entry in the user behavior sequence for each state node in the set of related nodes of the same type and the timestamp of the current permission change node, and take the maximum value of the absolute value of the time difference as the maximum time interval. The permission transition path association score is calculated by using the maximum time interval and the matching score of the user behavior sequence to which the current permission change node belongs. Node evaluation feature vectors are constructed based on the temporal consistency score of attack mode and the correlation score of permission jump path.

10. The information security system penetration path tracking method of claim 9, wherein, Using the set of high-confidence activated state nodes as the preference set, weight analysis based on the preference set is performed to obtain the second weight value of each user behavior sequence, including the following steps: Set a second damping coefficient, a second convergence threshold, a second iteration counter, and a second maximum allowed number of iterations. The number of iterations for the second iteration counter is initially set to 0. Increment the iteration count of the second iteration counter by 1 to obtain the current second iteration count. Traverse all state nodes in the attack mode state diagram and calculate the new second weight value of the current state node using the second damping coefficient, the total number of state nodes, and the initial weight value of each state node. Calculate the second maximum absolute value difference between the new second weight value of each state node and the new second weight value of the previous iteration. Use the second maximum absolute value difference, the preset second convergence threshold, and the current iteration number to make judgments and perform iterative processing analysis, and output the target second weight value of each state node.

Images