A method, apparatus, device, and storage medium for attributing APT attacks.

Abstract

This application discloses an APT attack organization attribution method, apparatus, device, and storage medium, relating to the field of network security technology. The method includes: extracting a first sequence reflecting the time difference between data packets, a second sequence reflecting the packet sending frequency, and a third sequence reflecting the data packet length from each communication traffic flow; filtering out multiple target sequences with periodicity and periodic values ​​from these sequences; constructing an attack organization correlation graph based on the similarity between paired target sequences; and finally using this attack organization correlation graph to attribute APT attack organizations to unknown communication traffic. This approach comprehensively and deeply mines the potential correlations between communication traffic, efficiently and accurately attributing APT attack organizations to unknown target communication traffic, effectively overcoming the limitations of traditional methods that rely on dynamic and static samples and threat intelligence.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to an attribution method, apparatus, device and storage medium for APT attack groups. Background Technology

[0002] With the rapid development of information technology and the widespread use of the Internet, the cybersecurity situation is becoming increasingly severe. Advanced Persistent Threat (APT) attacks are covert and persistent cyberattacks launched by certain organizations against specific targets through careful planning and design. Therefore, APTs are usually characterized by stealth, long-term persistence, and threat.

[0003] The success of APT attacks relies not only on breakthroughs in technical means but also on fully exploiting vulnerabilities in various network resources, such as systems, applications, network devices, and endpoints. Therefore, APT attacks often unfold in a multi-stage, multi-layered manner. Attackers gradually expand the attack scope through lateral movement, covert communication, and other methods, ultimately achieving data breaches, system control, or other malicious objectives. Due to the complexity and persistence of APT attacks, traditional security defense systems are often unable to monitor and respond to these attacks in real time.

[0004] Current technical solutions for APT attack detection mainly focus on dynamic and static sample analysis or threat intelligence-based profiling. However, dynamic and static sample analysis has limitations, including but not limited to the following: APT attackers generally employ highly covert techniques, making it extremely difficult to obtain malicious samples; it requires manual analysis, necessitating security researchers to invest significant time in in-depth reverse engineering and behavioral analysis; attackers widely utilize code obfuscation, multi-layered encryption, and anti-debugging / anti-virtual machine techniques, significantly extending the analysis cycle and increasing the difficulty. Similarly, threat intelligence-based profiling also faces severe challenges, including but not limited to the following: current threat intelligence sources are diverse, the data volume is massive, and the quality varies greatly, making it extremely challenging to quickly and accurately extract effective clues related to APT attack groups from massive amounts of data; the lack of timeliness and contextual relevance makes it difficult to support accurate attribution of APT attacks.

[0005] Therefore, improving the reliability and accuracy of APT attack group attribution is an urgent problem to be solved. Summary of the Invention

[0006] This application provides an APT attack organization attribution method, apparatus, device, and storage medium to improve the reliability and accuracy of APT attack organization attribution.

[0007] Firstly, a method for attributing APT attack groups is provided, including:

[0008] Feature extraction is performed on multiple collected communication traffic samples to obtain at least a first sequence, a second sequence, and a third sequence for each communication traffic sample. The first sequence is generated based on the time difference between two adjacent data packets in the communication traffic sample; the second sequence is generated based on the number of data packets within a continuously set time window; and the third sequence is generated based on the length of each data packet in the communication traffic sample.

[0009] Select multiple target sequences that exhibit periodicity and periodic values ​​from multiple first sequences, multiple second sequences, and multiple third sequences;

[0010] The multiple target sequences are paired to obtain multiple target sequence pairs; wherein, the two target sequences in any one of the target sequences have the same sequence type and the same period value;

[0011] Calculate the similarity between the two target sequences in each target sequence pair;

[0012] Using the multiple communication traffic flows as nodes, and based on the similarity between the two target sequences in each target sequence pair, an attack organization association graph is constructed; wherein, the attack organization association graph is used to attribute APT attack organizations to unknown target communication traffic.

[0013] Using the above method, three sequence features can be extracted from each communication traffic (i.e., a first sequence reflecting the time difference between data packets, a second sequence reflecting the packet sending frequency, and a third sequence reflecting the data packet length). Multiple target sequences with periodicity and periodic values ​​are then selected from these sequences. An attack organization correlation graph is constructed by analyzing the similarity between paired target sequences. Finally, this attack organization correlation graph can be used to attribute unknown communication traffic to APT attack organizations. This approach comprehensively and deeply mines the potential correlations between communication traffic, efficiently and accurately attributing unknown target communication traffic to APT attack organizations. It effectively overcomes the limitations of traditional methods that rely on dynamic and static samples and threat intelligence, providing a highly valuable technical means for network security protection. It can significantly improve the ability to identify, track, and respond to APT attacks, and also improve the reliability and accuracy of APT attack organization attribution.

[0014] In one possible design, the step of selecting multiple target sequences with periodicity and periodic values ​​from multiple first sequences, multiple second sequences, and multiple third sequences includes:

[0015] Calculate the period value of the first candidate sequence; wherein the first candidate sequence is any one of the plurality of first sequences, the plurality of second sequences, and the plurality of third sequences; the period value is calculated using a periodic analysis algorithm;

[0016] The periodic value is verified. When the periodic value is verified to be accurate, the first candidate sequence is taken as the target sequence, and the target sequence is divided into multiple subsequences according to the periodic value. The target sequence is also visualized to obtain the distribution curve of the target sequence. The distribution curve is used to interpret the periodic communication behavior of the target sequence.

[0017] This design calculates the periodicity of a sequence based on periodicity analysis algorithms (such as autocorrelation analysis and / or Fourier transform), and then verifies these periodicity values ​​to ensure their authenticity and accuracy, providing reliable data support for subsequent analysis of the target sequence. Furthermore, the design visualizes the target sequence exhibiting periodicity and periodicity values, allowing users to intuitively understand the periodic changes of the target sequence through distribution curves, enhancing the interpretability of the target sequence's periodic communication behavior.

[0018] In one possible design, verifying the periodic value includes:

[0019] The first candidate sequence is converted into a second-order difference sequence;

[0020] The second-order difference sequence is divided into multiple second-order difference molecular sequences based on the period value;

[0021] When the number of the plurality of second-order difference molecular sequences is greater than or equal to a set number threshold, the period value is verified based on the similarity between pairs of second-order difference molecular sequences in the plurality of second-order difference molecular sequences.

[0022] This design allows the first candidate sequence to be converted into a second-order difference sequence, thereby eliminating the linear trend of the sequence and highlighting the concave and convex points of the sequence. This makes the periodic waveform pattern (such as the alternation of convex to flat) mathematically represent a constant value, and more intuitively reflects the periodic communication behavior pattern of different sequences.

[0023] In one possible design, calculating the similarity between the two target sequences in each target sequence pair includes:

[0024] Calculate the similarity between two target sequences in the first target sequence pair based on the similarity of multiple sub-sequence pairs of the first target sequence pair;

[0025] Wherein, the first target sequence is any one of the plurality of target sequences, and any subsequence pair is composed of a subsequence of each of the two target sequences.

[0026] This design calculates the similarity of the overall sequence by comparing the similarity of periodic subsequences, which can capture the differences in the sequence within each period more precisely, thus obtaining a more accurate similarity measure.

[0027] In one possible design, the step of constructing an attack organization association graph based on the similarity between two target sequences in each target sequence pair, using the multiple communication traffic as nodes, includes:

[0028] Create a node for each communication traffic, and determine the attribute information of each node based on at least one target sequence corresponding to each node;

[0029] For each target sequence pair, when the similarity between the two target sequences in the target sequence pair exceeds a similarity threshold, an undirected edge is created between the two nodes corresponding to the target sequence pair; the weight of the undirected edge is related to the similarity and is used to indicate the association strength between the two nodes.

[0030] The attack organization association diagram includes attribute information for each node, as well as APT attack organization tags to which all or some nodes belong.

[0031] This design transforms abstract traffic similarity relationships into a visual and computable graph structure, laying the data structure foundation for subsequent application of graph analysis algorithms (clustering, neural networks, etc.) for organization and attribution.

[0032] In one possible design, after constructing the attack organization relationship graph, the following is also included:

[0033] The target communication traffic is taken as the node to be attributed; wherein, the node to be attributed is a node that does not have an APT attack organization label in the attack organization association graph;

[0034] Based on the attribute information of the nodes in the attack organization association graph and the APT attack organization tags, the APT attack organization to which the node to be attributed belongs is determined.

[0035] This design, based on the characterization and cross-correlation of different APT attack organization behaviors shown in the attack organization relationship diagram, breaks through the limitation of previous methods that ignore the behavioral relationships between APT attack organizations, and supports more accurate discovery and attribution analysis of mass threats.

[0036] In one possible design, determining the APT attack organization to which the node to be attributed belongs, based on the attribute information of the nodes in the attack organization association graph and the APT attack organization label, includes:

[0037] Based on the attribute information of node 0 and the weight of the undirected edges in the association graph of the attacking organization, multiple nodes in the association graph of the attacking organization are clustered to obtain at least one cluster; wherein, a cluster contains nodes with similar features.

[0038] When it is determined that the node to be attributed belongs to the first cluster, and there is a node with an APT attack organization label in the first cluster, the APT attack organization label is determined as the APT attack organization to which the node to be attributed belongs; wherein, the first cluster is a cluster among the at least one cluster.

[0039] This design utilizes graph clustering algorithms to automatically group nodes with similar communication behavior patterns into the same cluster. Subsequently, the APT attack organization to which an unknown node belongs can be determined based on the cluster it belongs to. This method is simple, efficient, and requires no extensive labeling.

[0040] In one possible design, determining the APT attack organization to which the node to be attributed belongs, based on the attribute information of the nodes in the attack organization association graph and the APT attack organization label, includes:

[0041] The node embedding vector of the node to be attributed is generated based on the attribute information of the node to be attributed, and the corresponding relation embedding vector is generated based on the undirected edge between the node to be attributed and at least one neighboring node.

[0042] The node embedding vector and the relation embedding vector are fused to obtain the first fused embedding vector;

[0043] Calculate the attention coefficient between the node to be attributed and each of its neighboring nodes; wherein the attention coefficient is used to indicate the importance of the neighboring nodes relative to the node to be attributed.

[0044] When there are multiple neighboring nodes, the node embedding vectors of the multiple neighboring nodes are fused according to the attention coefficients of the multiple neighboring nodes to obtain a fused second embedding vector.

[0045] The first embedding vector and the second embedding vector are concatenated to obtain the comprehensive embedding vector of the node to be attributed.

[0046] The integrated embedding vector is input into the prediction layer of the graph attention network to obtain the APT attack group to which the node to be attributed belongs.

[0047] This design extracts the node embedding vector and the relation embedding vector of undirected edges, and uses a self-attention mechanism to dynamically learn the importance of neighboring nodes relative to the node to be attributed. This allows for a more comprehensive and accurate fusion of graph structure information, thereby improving the attribution accuracy of complex and covert APT attack organizations.

[0048] In one possible design, determining the APT attack organization to which the node to be attributed belongs, based on the attribute information of the nodes in the attack organization association graph and the APT attack organization label, includes:

[0049] Calculate the overall correlation degree between the node to be attributed and at least one neighboring node. The overall correlation degree is determined based on the weight of the undirected edge between the node to be attributed and the at least one neighboring node, the node degree, and the similarity between the node to be attributed and the at least one neighboring node.

[0050] Based on the comprehensive correlation degree and the hop count of at least one multi-hop neighbor node, the influence coefficient of the at least one multi-hop neighbor node on the node to be attributed is calculated; the influence coefficient is used to indicate the attribution influence of the multi-hop neighbor node on the node to be attributed.

[0051] Based on the influence coefficient of the at least one multi-hop neighbor node on the node to be attributed and the neighbor nodes with APT attack organization labels, calculate the confidence level of the node to be attributed to each APT attack organization label.

[0052] Based on the confidence level of each APT attack group's label, the APT attack group to which the node to be attributed belongs is determined.

[0053] This design, by simulating the propagation process of APT attack group labels in the relationship graph, enables reasoning using a wider range of graph structure information (multi-hop neighbor nodes), and has better robustness for cases with sparse local connections or few APT attack group labels.

[0054] In one possible design, the feature extraction of the collected multiple communication traffic flows, to obtain at least a first sequence, a second sequence, and a third sequence for each communication traffic flow, includes:

[0055] Over a period of time, multiple collected communication traffic streams are parsed to obtain key fields corresponding to each communication traffic stream at the network layer and transport layer; the key fields include at least: the timestamp of the data packet and the length of the data packet, and the data packet type corresponding to each communication traffic stream is different;

[0056] Feature extraction is performed on the key fields corresponding to each communication traffic at the network layer and transport layer to obtain at least the first sequence, second sequence and third sequence of each communication traffic.

[0057] This design allows for the parsing and preprocessing of multiple collected communication traffic streams to obtain key fields related to the network and transport layers, eliminate the influence of other invalid fields, and provide a data foundation for subsequent feature extraction.

[0058] Secondly, an attribution device for APT attack organizations is provided, comprising:

[0059] The feature extraction module is used to extract features from multiple collected communication traffic streams, obtaining at least a first sequence, a second sequence, and a third sequence for each communication traffic stream; wherein, the first sequence is generated based on the time difference between pairs of adjacent data packets in the communication traffic stream, the second sequence is generated based on the number of data packets within a continuously set time window, and the third sequence is generated based on the data packet length of each data packet in the communication traffic stream;

[0060] The filtering module is used to filter out multiple target sequences that have periodicity and periodic values ​​from multiple first sequences, multiple second sequences, and multiple third sequences;

[0061] A pairing module is used to pair the multiple target sequences to obtain multiple target sequence pairs; wherein, the two target sequences in any target sequence pair have the same sequence type and the same period value;

[0062] The calculation module is used to calculate the similarity between the two target sequences in each target sequence pair;

[0063] A construction module is used to construct an attack organization association graph based on the multiple communication traffic as nodes and the similarity between two target sequences in each target sequence pair; wherein, the attack organization association graph is used to attribute APT attack organizations to unknown target communication traffic.

[0064] Thirdly, an electronic device is provided, comprising:

[0065] A memory for storing computer programs; a processor for executing the computer programs stored in the memory to implement the method steps described in any one of the first aspects.

[0066] Fourthly, a computer-readable storage medium is provided, wherein a computer program is stored therein, and when executed by a processor, the computer program implements the method steps described in any one of the first aspects.

[0067] For the various aspects of the second to fourth aspects mentioned above, and the technical effects that each aspect may achieve, please refer to the above description of the technical effects that can be achieved for the first aspect or the various possible solutions in the first aspect, which will not be repeated here. Attached Figure Description

[0068] Figure 1 A flowchart illustrating an APT attack organization attribution method provided in this application embodiment;

[0069] Figure 2 A logical architecture diagram for determining the APT attack organization to which a node to be attributed belongs, based on a graph attention network, is provided in this application embodiment.

[0070] Figure 3 A logical diagram illustrating the attribution of APT attack groups provided in an embodiment of this application;

[0071] Figure 4 This is a schematic diagram of the structure of an APT attack organization attribution device provided in an embodiment of this application;

[0072] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0073] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application. Unless otherwise specified, the embodiments and features in the embodiments of this application can be arbitrarily combined with each other. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than that shown here.

[0074] The terms "first" and "second" in the specification, claims, and accompanying drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the term "comprising" and any variations thereof are intended to cover non-exclusive protection. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices. The term "multiple" in this application can mean at least two, for example, two, three, or more, and the embodiments of this application do not impose limitations.

[0075] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of this application, including various details to aid understanding. These embodiments should be considered merely exemplary. Therefore, those skilled in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of this application. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description. It should be noted that in the embodiments of this application, certain existing industry solutions such as software, components, and models may be mentioned. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solutions of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0076] To better understand the embodiments of this application, the technical terms involved in the embodiments of this application will be explained below.

[0077] (1) Correlation analysis refers to the analysis of two or more correlated variable elements to measure the degree of correlation between the two variable factors. There must be a certain relationship or probability between the correlated elements for correlation analysis to be performed.

[0078] (2) The Fourier transform can represent a function that satisfies certain conditions as a linear combination of trigonometric functions (sine and / or cosine functions) or their integrals. For example, for time series data, it can be regarded as a combination of a set of trigonometric functions, and each trigonometric function can be separated. The period of the time series data can be obtained according to the least common multiple of the periods of the trigonometric functions. At this time, the time series data can be transformed from the time domain to the frequency domain through the Fourier transform. If the frequency f (number of cycles per second) is consistent with the number of cycles per second of a certain trigonometric function, the frequency domain graph will show a peak shape, and 1 / f can be regarded as the period of the trigonometric function.

[0079] To further illustrate the technical solutions provided in the embodiments of this application, a detailed description is provided below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiments of this application provide method operation steps as shown in the following embodiments or drawings, the method may include more or fewer operation steps based on conventional or non-inventive methods. In steps where there is no logically necessary causal relationship, the execution order of these steps is not limited to the execution order provided in the embodiments of this application. In actual processing or when the device executes the method, it may be executed in the order shown in the embodiments or drawings, or in combination.

[0080] Figure 1 This document provides a flowchart of an APT attack organization attribution method according to an embodiment of this application. This process can be executed by an APT attack organization attribution device to improve the reliability and accuracy of APT attack organization attribution. Figure 1As shown, the process includes the following steps:

[0081] S101: Feature extraction is performed on the multiple collected communication traffics to obtain at least a first sequence, a second sequence, and a third sequence for each communication traffic. The first sequence is generated based on the time difference between two adjacent data packets in the communication traffic. The second sequence is generated based on the number of data packets in the communication traffic within a continuously set time window. The third sequence is generated based on the data packet length of each data packet in the communication traffic.

[0082] Optionally, the aforementioned communication traffic (also known as session traffic) includes, but is not limited to: TCP synchronization sequence number (SYN) session traffic, TCP push (PSH) and acknowledgement. ， ACK session traffic, User Datagram Protocol (UDP) session traffic, Domain Name System (DNS) request session traffic, DNS response session traffic, and Internet Control Message Protocol (ICMP) session traffic.

[0083] Optionally, the aforementioned communication traffic can be collected using open-source network protocol analysis software or toolkits, and this application embodiment does not impose any restrictions on it.

[0084] In some implementations, after collecting multiple communication traffic streams (each communication traffic stream corresponds to a different data packet type), they can be parsed and preprocessed to obtain key fields related to the network layer and transport layer (as shown in Table 1 below), eliminating the influence of other invalid fields (or redundant fields), and providing a data foundation for subsequent feature extraction.

[0085] Table 1: Key fields and their meanings related to communication traffic at the network and transport layers.

[0086]

[0087] Table 1 above records fields such as the timestamp and length of each data packet in the communication traffic. Based on this, detailed feature extraction can be performed on the communication traffic, generating a first sequence (also known as a time interval sequence, reflecting the time difference between consecutive data packets), a second sequence (also known as a packet transmission frequency sequence, reflecting the number of data packets per unit time), and a third sequence (also known as a packet length sequence, reflecting the size distribution of data packets). Since the first sequence is generated based on the time difference between adjacent data packets in the communication traffic, the second sequence is generated based on the number of data packets within a continuously set time window, and the third sequence is generated based on the length of each data packet in the communication traffic, a comprehensive and accurate characterization of the communication traffic can be achieved from multiple key dimensions such as time interval, data packet quantity distribution, and data packet size. This multi-dimensional feature extraction method (including time and spatial dimensions) can capture rich potential information in the communication traffic, providing a solid data foundation for subsequent APT attack organization attribution analysis and effectively avoiding the one-sidedness and errors that may result from single feature analysis.

[0088] In this embodiment, multi-dimensional sequences are extracted from the collected communication traffic for subsequent APT organization attribution analysis, which includes, but is not limited to, the following beneficial effects: Compared with relying on dynamic and static sample analysis or threat intelligence, the acquisition of communication traffic is relatively convenient (since communication traffic can usually be collected at network boundaries or key nodes, the problem of directly obtaining malicious samples is avoided); the natural structure of communication traffic is relatively high, which facilitates the construction of a machine-readable and fast-processing attack behavior feature library and source tracing knowledge graph (i.e., the attack organization association graph below); furthermore, using the collected communication traffic for real-time or near-real-time analysis can greatly shorten the response time of APT organization attribution and improve defense efficiency; communication behavior analysis based on communication traffic can not only perform APT organization attribution, but also effectively identify potential and malicious periodic communication behavior patterns, server addresses, scanning and probing behaviors, etc., providing key threat indicators for proactive defense.

[0089] S102: Select multiple target sequences with periodicity and periodic value from multiple first sequences, multiple second sequences and multiple third sequences.

[0090] Optionally, multiple target sequences exhibiting periodicity and periodic values ​​can be selected through steps A1-A2:

[0091] Step A1: Calculate the period value of the first candidate sequence, which is any one of multiple first sequences, multiple second sequences, and multiple third sequences. The period value is calculated using a periodicity analysis algorithm.

[0092] In some implementations, an autocorrelation analysis algorithm can be used to calculate the period value of the first candidate sequence. Specifically, the process may include the following steps: calculating the autocorrelation coefficients of the first candidate sequence at multiple different lag orders, generating a corresponding autocorrelation coefficient sequence based on the multiple autocorrelation coefficients; calculating the significant peak value corresponding to the autocorrelation sequence using second-order difference, and using the lag order corresponding to the significant peak value as the period value of the first candidate sequence.

[0093] Optionally, the above autocorrelation coefficients satisfy the following expression:

[0094] ...(1)

[0095] Where r is the lag order, indicating how many positions to shift left and right in the first candidate sequence for comparison, and n is the total number of data points contained in the first candidate sequence. This represents the mean of the data (such as time difference, number of data packets, or data packet length) contained in the first candidate sequence. .

[0096] For example, suppose the first candidate sequence is [0.2, 4.0, 0.2, 4.0, 0.2]. Its autocorrelation coefficient sequence will have peaks at r=2, 4, 6, ... The peak at r=2 is the most significant. Therefore, it can be determined that the period value corresponding to the first candidate sequence is 2. The periodicity (periodic communication behavior pattern) of this first candidate sequence is that it repeats once every 2 elements ([0.2, 4.0]).

[0097] In some implementations, the period value of the first candidate sequence can also be calculated using a Fourier transform algorithm. Specifically, this may include the following steps: performing a Fourier transform on the first candidate sequence to obtain its frequency domain amplitude spectrum; calculating the peak value corresponding to the frequency domain amplitude spectrum based on the second-order difference; and finding the corresponding frequency value based on the peak value, then using the relationship between frequency f and period T to calculate the period value of the first candidate sequence. The relationship between frequency f and period T satisfies the following expression:

[0098] ...(2)

[0099] In other implementations, the periodicity of the first candidate sequence can be calculated by combining autocorrelation analysis and Fourier transform algorithms. For example, the first periodicity of the first candidate sequence can be calculated based on autocorrelation analysis; then, the second periodicity of the first candidate sequence can be calculated based on Fourier transform; it is then determined whether the first periodicity T_A and the second periodicity T_B satisfy a preset consistency condition (such as T_A and T_B having a common divisor); if they satisfy the condition, the first candidate sequence is determined to be periodic, and the periodicity is the arithmetic mean, geometric mean, or one of T_A or T_B; if they do not satisfy the condition, the first candidate sequence is determined to be not significantly periodic.

[0100] Step A2: Verify the calculated period value. When the period value is verified to be accurate, take the first candidate sequence as the target sequence, divide the target sequence into multiple subsequences according to the period value, and visualize the target sequence to obtain the distribution curve of the target sequence. This distribution curve is used to interpret the periodic communication behavior of the target sequence.

[0101] Optionally, verifying the period value may include the following process: converting the first candidate sequence into a second-order difference sequence; dividing the second-order difference sequence into multiple second-order difference molecular sequences according to the period value calculated above; when the number of multiple second-order difference molecular sequences is greater than or equal to a set number threshold, verifying the period value based on the similarity between pairs of second-order difference molecular sequences in the multiple second-order difference molecular sequences.

[0102] In some implementations, after dividing the second-order difference sequence into multiple second-order difference molecular sequences, it is also possible to compare whether the lengths of the multiple second-order difference molecular sequences are the same. If the length of the nth second-order difference molecular sequence is different from the lengths of the other second-order difference molecular sequences, the missing data in the nth second-order difference molecular sequence can be supplemented according to the relative position of any of the preceding second-order difference molecular sequences, so as to avoid the nth second-order difference molecular sequence from affecting the subsequent verification process due to missing data.

[0103] For example, given a first candidate sequence X=[x1,x2,...,x7] with a period of T=3, first convert this first candidate sequence into a second-order difference sequence X'=[x1',x2',...,x7'], and then divide this second-order difference sequence into three subsequences: S1=[x1',x2',x3'], S2=[x4',x5',x6'], and S3=[x7']. For the last incomplete second-order difference subsequence S3, it can be completed according to the values ​​corresponding to the relative positions of the previous second-order difference subsequence S2. Then calculate... Calculate the similarity between each pair of second-order difference molecular sequences in the three second-order difference molecular sequences to determine whether different second-order difference molecular sequences are the same, that is, to determine whether S1, S2, and S3 are completely identical. If they are the same, it indicates that the calculated periodic value is real and that the first candidate sequence has stable periodicity. If different second-order difference molecular sequences are different (e.g., the value in a second-order difference molecular sequence is significantly different from the value in other second-order difference molecular sequences), it indicates that the periodic value initially calculated may be due to noise or random factors, and that the first candidate sequence does not have stable periodicity.

[0104] In other implementations, when the number of multiple second-order difference molecular sequences is less than a set threshold (e.g., less than 3), it indicates that the first candidate sequence does not have periodicity and no further analysis is required.

[0105] Optionally, the target sequence can be divided into multiple subsequences according to the periodic value. This can be achieved by visualizing the target sequence for which a periodic value has been verified, displaying the morphological characteristics of its distribution curve (such as concavity / convexity), and dividing the target sequence into multiple continuous subsequences of length equal to the periodic value T (each subsequence represents a complete, minimally repeating unit of communication behavior). Through this process, to gain a deeper understanding and verification of the extracted multidimensional periodic features, the identified multidimensional periodic sequence is visualized (i.e., the time interval sequence, packet length sequence, packet transmission frequency sequence, its autocorrelation function, and spectrum are visualized). This visually demonstrates the complete communication behavior pattern within a period, thus more comprehensively characterizing the communication behavior pattern of APT attack traffic (such as timed heartbeats, command issuance cycles, specific packet length distributions, etc.) and enhancing the interpretability of its periodicity. This helps security analysts understand and verify the data, preparing structured and comparable data units for subsequent similarity analysis.

[0106] Through steps A1-A2 above, after calculating the periodic value corresponding to the sequence based on periodicity analysis algorithms (autocorrelation analysis algorithm and / or Fourier transform), the periodic value is verified to ensure its authenticity and accuracy, providing reliable data support for subsequent analysis of the target sequence. Furthermore, the target sequence exhibiting periodicity and periodic values ​​is visualized, allowing users to intuitively understand the periodic changes of the target sequence through distribution curves, enhancing the interpretability of the periodic communication behavior of the target sequence.

[0107] In this embodiment, multiple target sequences can be filtered out by following the above steps A1-A2, thereby accurately locating target sequences with regularity and stability in the communication traffic. This effectively filters out random noise and irrelevant information in the communication traffic. Moreover, the filtered target sequences are often closely related to the specific behavioral patterns and tool usage habits of APT attack groups, allowing focus on the core characteristics related to APT attack groups, which greatly improves the pertinence and efficiency of subsequent analysis.

[0108] S103: Pair the selected target sequences to obtain multiple target sequence pairs, where the two target sequences in any target sequence pair have the same sequence type and the same period value.

[0109] For example, suppose that target sequence A and target sequence B are both time interval sequences and both have a period value of 5. Target sequence A and target sequence B can be combined into a target sequence pair, which can then be used as the basis for subsequent similarity calculations.

[0110] S104: Calculate the similarity between the two target sequences in each target sequence pair.

[0111] Optionally, the similarity between two target sequences in the first target sequence pair can be calculated based on the similarity of multiple sub-sequence pairs of the first target sequence pair. The first target sequence can be any one of multiple target sequences, and any sub-sequence pair is composed of a sub-sequence of each of the two target sequences.

[0112] Optionally, for each successfully matched target sequence pair—that is, two target sequences with the same sequence type and the same period value (such as time interval sequences corresponding to two communication traffic packets)—the Hausdorff distance can be used to measure the similarity of their sub-sequence pairs. This comprehensively evaluates the overall similarity of the two communication traffic packets in the periodic communication behavior patterns of different dimensional sequences, thereby constructing the association between the two communication traffic packets. Furthermore, this Hausdorff distance satisfies the following expression:

[0113] ……..(3)

[0114] in, and Used to characterize the subsequences contained in each of the two target sequences, d(a, b) represents the basic metric between subsequence a∈target sequence A and subsequence b∈target sequence B (which can be obtained by Euclidean distance).

[0115] Through the above process, the directed distance H(A, B) containing two directions is calculated, which can measure the similarity between two target sequences. Since this distance can capture the global differences in the shape of the distribution curves between different sequences, it can effectively quantify the similarity of different communication traffic in various periodic communication behavior patterns.

[0116] S105: Using multiple communication traffic as nodes, and based on the similarity between two target sequences in each target sequence pair, an attack organization association graph is constructed. This attack organization association graph is used to attribute APT attack organizations to unknown target communication traffic.

[0117] Optionally, constructing an attack organization association graph may include the following process: creating a node for each communication traffic and determining the attribute information of each node based on at least one target sequence corresponding to each node; for each target sequence pair, when the similarity between the two target sequences in the target sequence pair exceeds a similarity threshold, creating an undirected edge between the two nodes corresponding to the target sequence pair, the weight of which is related to the similarity (used to indicate the association strength between the two nodes); finally, the attack organization association graph contains the attribute information corresponding to each node, as well as the APT attack organization labels to which all or some nodes belong.

[0118] Optionally, the node's attribute information is related to the target sequence (or sequence features) where the node has periodicity and periodic values, and may also include information such as node identifier and node name.

[0119] For example, in defining nodes and initializing the graph structure for the attack organization's relationship graph, each independent APT attack event (or communication traffic captured within a specific time window) is abstracted as a node V in the attack organization's relationship graph. i And when the similarity between two target sequences in a target sequence pair exceeds a similarity threshold, an undirected edge is created between the two nodes corresponding to the target sequence pair, ultimately constructing an undirected weighted graph G=(V,E,A), where: For nodes in the communication traffic, E is the set of undirected edges, representing the strength of the association between different nodes; A is the attribute information (or attribute matrix) of the node, which can store the sequence features (or sequences) of the node in different dimensions.

[0120] In constructing the association graph of the attack organization, through the above steps S103-S105, the selected target sequences are first aligned and matched according to sequence type and period value. For each node V constructed... i Its attribute information includes: S i time A time interval sequence (reflecting the communication rhythm of a certain communication traffic); S i freq Packet transmission frequency sequence (reflecting the communication behavior density of a certain communication traffic); S i len Packet length sequence (reflecting the data load of a certain communication traffic). Then, only when two nodes V... i V j Sequences of the same type (such as bag-length sequences) have the same period value T. k At that time, similarity calculations are performed to ensure comparability of the same communication behavior patterns. Specifically, for each pair of matched target sequences... Based on its subsequence pairs (or subsequence sets) and The Hausdorff distance between the two target sequences is used to calculate the similarity H between the two target sequences in the target sequence pair. ij k If H ij k If the similarity is less than the similarity threshold θ, then the sequences in that dimension (such as packet-length sequences) are considered similar, and the sequences of the two nodes satisfy H in at least one dimension. ij k If it is less than θ, then in V i With V j Establish an undirected edge e ij Finally, an attack organization relationship graph G is generated, whose topology and node attribute information together encode the relationship between APT attack organizations.

[0121] Through the above process, target sequences with the same sequence type and periodic value are paired, and the similarity between the two target sequences in each pair is calculated. This allows for in-depth analysis of the inherent correlations between different communication traffic. The similarity calculation considers not only the periodicity of the sequences but also the specific numerical trends of the sequences. Even if these communication traffic originates from different points in time or different attack phases, it can accurately identify communication traffic with similar communication behavior patterns. This effectively links seemingly isolated communication traffic, providing crucial evidence for constructing an attack organization correlation diagram. Furthermore, using multiple communication traffic as nodes, an attack organization correlation diagram is constructed based on the similarity between target sequence pairs, presenting complex network attack behaviors in an intuitive graphical way. This attack organization correlation diagram clearly demonstrates the correlation strength between different communication traffic and the hierarchical structure within the attack organization. This enables security analysts to quickly locate the attack source, trace the attack path, and accurately attribute unknown target communication traffic to APT attack organizations. It not only improves analysis efficiency but also reduces analysis difficulty, providing strong support for subsequent countermeasures and blocking attack propagation.

[0122] In other implementations, after constructing the attack organization association graph, when there is unknown target communication traffic, the APT attack organization attribution for the target communication traffic can be achieved through the attack organization association graph, as shown in steps B1-B2 below.

[0123] Step B1: The target communication traffic is designated as the node to be attributed. This node is one that does not have an APT attack organization label in the attack organization association graph.

[0124] In this step, the target communication traffic can be a node that does not have an APT attack organization label after the attack organization association graph has been constructed; or it can be expanded into the attack organization association graph based on the similarity between the sequence of the target communication traffic (time interval sequence, packet frequency sequence, packet length sequence) and the sequences of other nodes in the graph.

[0125] Step B2: Based on the attribute information of the nodes in the attack organization association graph and the APT attack organization label, determine the APT attack organization to which the node to be attributed belongs.

[0126] Optionally, since the weight of undirected edges between nodes in the attack organization association graph is related to the similarity between two sequences (e.g., the greater the similarity, the greater the weight), this means that the representation of the association between the communication traffic and the APT attack organization of the node to be attributed is not equally important for all its neighboring nodes. Therefore, graph neural network algorithms (such as graph clustering algorithms or graph attention networks (GAT)) or neighbor similarity algorithms can be used to further classify it to determine which APT attack organization the node to be attributed is closer to (or an isolated new APT attack organization).

[0127] Implementation method one, taking graph clustering algorithm as an example, determines the APT attack organization to which the node to be attributed belongs, which may include the following process:

[0128] Based on the attribute information of nodes and the weights of undirected edges in the attack organization association graph, multiple nodes in the attack organization association graph are clustered to obtain at least one cluster. Each cluster contains nodes with similar features. When it is determined that the node to be attributed belongs to the first cluster (which is a cluster of at least one cluster), and there is a node with an APT attack organization label in the first cluster, the APT attack organization label is determined as the APT attack organization to which the node to be attributed belongs.

[0129] Optionally, algorithms based on modularity optimization (such as the Louvain algorithm and the Leiden algorithm) can treat each communication traffic as a node in a community network. Based on the weights of undirected edges in the community network (i.e., the combined similarity between two nodes), a co-organizational analysis is performed on the community network, gradually merging nodes in the attack organization's association graph to achieve clustering. This effectively groups nodes belonging to the same type of APT attack organization into a single cluster. Taking the Louvain algorithm as an example, it measures the impact of each new node joining the community on the tightness of the community structure by calculating the change in modularity (i.e., the modularity increment).

[0130] Furthermore, the modularity (Q) is a key parameter of the algorithm, which satisfies the following expression:

[0131] ... (4)

[0132] in, For any node in the attack organization's relationship graph and The weight of the undirected edge between the nodes (reflecting the strength of the association between the two nodes). For nodes The sum of the weights of the undirected edges between it and all its adjacent nodes. For nodes The sum of the weights of the undirected edges between it and all its adjacent nodes. This represents the total number of undirected edges in the community network. Indicates the average edge weight. This represents the difference between the actual structure of the community network and the expected structure when randomly combined. As a category, and Representing nodes respectively and Category, Function Indicates whether they belong to the same category (i.e., cluster). When, it indicates a node and In the same category, when When, it indicates a node and They are not in the same category.

[0133] The above-mentioned module degree increment satisfies the following expression:

[0134] …(5)

[0135] in, This represents the sum of the weights of undirected edges within a category (i.e., the cluster) after a new node is added to it. This represents the sum of the edge weights connecting this cluster to other categories (i.e., other clusters). Represents a node The sum of weights when added to a category. The process of calculating the modularity increment is repeated until the value of Q no longer changes, indicating that nodes with similar features have been grouped into a cluster or that existing categories cannot be further merged.

[0136] When determining which APT attack group a node belongs to, it can be determined based on which cluster the node belongs to. For example, suppose we have a graph containing 10 nodes (N1-N10) of communication traffic, where N1, N2, and N3 are known to belong to APT attack group A, N8, N9, and N10 are known to belong to APT attack group B, and the rest are unknown target communication traffic (i.e., nodes to be attributed). After the graph clustering algorithm described above, the nodes are divided into cluster 1 {N1, N2, N3, N4, N5}, cluster 2 {N6, N7}, and cluster 3 {N8, N9, N10}. Since cluster 1 contains all nodes of the known APT attack group A, and N4 and N5 are highly similar to them, it can be predicted with high confidence that N4 and N5 also belong to APT attack group A. Cluster 2 is composed of completely new nodes without any APT attack group labels. Its communication behavior patterns (such as "time intervals, burst large packet transmissions") are different from the communication behavior patterns of known APT attack groups. At this time, a new APT attack group label can be predicted for N6 and N7. Cluster 3 contains all nodes of the known APT attack group B.

[0137] Using the above-mentioned first implementation method, the graph clustering algorithm can automatically group nodes with similar communication behavior patterns into the same cluster. Subsequently, the APT attack organization to which the unknown node to be attributed belongs can be determined based on the cluster it belongs to. This method is simple and efficient and does not require a large amount of labeling.

[0138] The second implementation method, taking graph attention networks as an example, involves determining the APT attack organization to which the node to be attributed belongs, which may include the following process:

[0139] Based on the attribute information of the node to be attributed, a node embedding vector is generated for the node to be attributed, and a corresponding relation embedding vector is generated based on the undirected edges between the node to be attributed and at least one neighboring node. The node embedding vector and the relation embedding vector are fused to obtain a fused first embedding vector. The attention coefficient between the node to be attributed and each neighboring node is calculated (the attention coefficient is used to indicate the importance of the neighboring node relative to the node to be attributed). When there are multiple at least one neighboring node, the node embedding vectors of the multiple neighboring nodes are fused according to the attention coefficients of the multiple neighboring nodes to obtain a fused second embedding vector. The first embedding vector and the second embedding vector are concatenated to obtain a comprehensive embedding vector of the node to be attributed. The comprehensive embedding vector is input into the prediction layer in the graph attention network to obtain the APT attack group to which the node to be attributed belongs.

[0140] For example, first, all nodes (such as...) , (Where N is the number of nodes and F is the dimension of each node) is input into the graph attention layer of the graph attention network for embedding vector representation, and the output is... , Next, a self-attention mechanism is executed to calculate the attention coefficients between a node to be attributed and each of its neighboring nodes (as shown in expression (6) below).

[0141] …(6)

[0142] The self-attention mechanism is a single-layer feedforward neural network consisting of a weight vector. Parameterization, and use Perform nonlinear processing, || represents the transpose operation, and || represents the concatenation operation. This represents the set of neighboring nodes associated with the node to be attributed. For a given node to be attributed, the node embedding vector is... This is the node embedding vector of a neighboring node adjacent to the node to be attributed. The node embedding vectors for all neighboring nodes are given by W, which represents the weights.

[0143] Then, for each neighbor node that is equivalent to the current node to be attributed, all neighbor nodes corresponding to the node to be attributed are weighted and aggregated according to their importance. In order to stabilize the learning process of the self-attention mechanism, the multi-head attention mechanism can be used to extend it. Specifically, the results of K independent self-attention mechanisms are concatenated. The node embedding vector of the neighbor node aggregation is shown in expression (7), and finally the fused second embedding vector is obtained.

[0144] …(7)

[0145] in, This represents the attention coefficient of neighbor node j relative to the current node to be attributed, under the k-th attention head. This represents the weight matrix corresponding to the k-th attention head.

[0146] Finally, based on the graph topology of the attack organization association graph, the nodes to be attributed and their relationship features (i.e., undirected edges) in the graph are embedded and represented. The node embedding vectors and their relationship embedding vectors are then summed and fused to obtain the first fused embedding vector. The first embedding vector is then concatenated with the second embedding vector to form the final comprehensive embedding vector. This comprehensive embedding vector is then input into the prediction layer of the graph attention network (the prediction layer may contain a linear layer and an activation function to calculate the probability that the node to be attributed belongs to an existing APT attack organization). A predefined threshold is then set to determine which APT organization it ultimately belongs to.

[0147] Furthermore, the accuracy of the prediction results can be improved by iteratively optimizing the self-attention network (self-attention network model) by minimizing the cross-entropy loss, as shown in expression (8).

[0148] ... (8)

[0149] Where G represents the number of APT attack organizations in the attack organization association diagram (i.e., the number of APT attack organization tags). It is a set of node indexes tagged with APT attack groups. For the first The node to be attributed is output by the prediction layer. The label entry value (probability) of each APT attack organization label represents the confidence level of predicting the i-th node to be attributed as the current APT attack organization label. This is the actual value of the tag entry.

[0150] Based on the above implementation method two Figure 2 This application provides a logical architecture diagram for determining the APT attack organization to which a node to be attributed belongs based on a graph attention network.

[0151] exist Figure 2In this process, the attack traffic correlation graph can be input into a graph attention network to extract the node embedding vector (e.g., embedding vector corresponding to a time interval sequence, a packet length sequence, or a packet frequency sequence) of the node to be attributed (which can be more than one), as well as the relationship embedding vector between the node to be attributed and at least one neighboring node. The node embedding vector of the node to be attributed and the relationship embedding vector are then fused to obtain a fused first embedding vector. By executing a self-attention mechanism, the node embedding vectors of multiple neighboring nodes are fused to obtain a fused second embedding vector. The first and second embedding vectors are then concatenated to obtain a comprehensive embedding vector of the node to be attributed. This comprehensive embedding vector is then input into a prediction layer, and after passing through a linear layer and an activation function in the prediction layer, the APT attack organization result of the node to be attributed is predicted (which may include the probability that the node to be attributed belongs to each existing APT attack organization label, and which specific APT attack organization the node to be attributed belongs to).

[0152] Suppose there is a node X to be attributed, and its neighbors include nodes A, B, C, and D. Nodes A and B are labeled with APT attack group P1, and nodes C and D are labeled with APT attack group P2. Based on the above... Figure 2 The architecture shown considers the embedding vectors of all neighboring nodes (A, B, C, D) and the relation embedding vectors corresponding to the undirected edges. The self-attention coefficients calculated by the self-attention mechanism show that for the node to be attributed, the attention coefficient of neighboring node A is the highest (e.g., 0.6), followed by B (0.3), while C and D are very low (around 0.05). Finally, after aggregating the embedding vectors through the architecture, the output prediction result is that the probability of the node to be attributed belonging to P1 is 0.95, and the probability of belonging to P2 is 0.05. Therefore, it can be determined that the APT attack organization to which the node to be attributed belongs is the APT attack organization identified by P1.

[0153] By implementing the second method described above, by extracting the node embedding vector and the relation embedding vector of the undirected edge, and using a self-attention mechanism to dynamically learn the importance of neighboring nodes relative to the node to be attributed, graph structure information can be more comprehensively and accurately fused, thereby improving the attribution accuracy of complex and covert APT attack organizations.

[0154] The third implementation method, taking the neighbor similarity algorithm as an example, determines the APT attack organization to which the node to be attributed belongs, and may include the following process:

[0155] Calculate the overall correlation between the node to be attributed and at least one neighboring node. This overall correlation is determined based on the weight of the undirected edge between the node to be attributed and at least one neighboring node, the node degree, and the similarity between the node to be attributed and at least one neighboring node. Based on the overall correlation and the hop count of at least one multi-hop neighboring node, calculate the influence coefficient of at least one multi-hop neighboring node on the node to be attributed (this influence generally decreases with increasing hop count). Based on the influence coefficient of at least one multi-hop neighboring node on the node to be attributed and neighboring nodes with APT attack organization labels, calculate the confidence level of the node to be attributed to each APT attack organization label. Based on the confidence level of each APT attack organization label, determine the APT attack organization to which the node to be attributed belongs.

[0156] For example, given the attack organization relationship graph G=(V,E,A), the set of nodes labeled with the APT attack organization is known. Where L is the label set of the APT attack organization, and label prediction is performed on the unknown node to be attributed. First, the node to be attributed, V, is calculated. i With neighbor node V j The comprehensive association strength is calculated using the formula shown in equation (9). Then, a decay model is designed for the influence of multi-hop neighbor nodes, as shown in equation (10). Finally, for the unknown node to be attributed, v... i Calculate the tag l of each APT attack group to which the node to be attributed belongs. k ∈L k The confidence level is shown in formula (11).

[0157] ...(9)

[0158] …(10)

[0159] ... (11)

[0160] Where, ω ij represents the weight of the undirected edge between the node to be attributed (i) and its neighbor (j), i.e., the reciprocal of the similarity distance; deg(.) is the node degree, and sim(A i A j ) represents the similarity between two nodes; d(v i ,v j ) represents the number of hops between the node to be attributed and its multi-hop neighbors (which can be the number of hops on the shortest path). This is the attenuation factor (an adjustable hyperparameter, for example, 0.7). For v j h-hop neighbor set, This is an indicator function that can be set to 1 when the APT attack group label of a multi-hop neighbor node matches.

[0161] Furthermore, when multiple APT attack group labels have similar confidence levels (e.g., the minimum confidence gap threshold between the highest and second-highest confidence levels is less than the threshold β, indicating that the two confidence levels are close), if both the highest and second-highest confidence levels are greater than the threshold... The APT attack group to which the node to be attributed belongs can be determined based on the number of nodes in its neighboring nodes that belong to the two APT attack groups; if both the highest confidence score and the second highest confidence score are less than the threshold... If the highest confidence level is greater than the threshold, then the node to be attributed is marked as belonging to an unknown APT attack group to avoid false positives; The second highest confidence level is less than the threshold. If the APT attack organization to which the node to be attributed belongs is the APT attack organization label corresponding to the highest confidence level, then the APT attack organization to which the node to be attributed belongs is the APT attack organization label.

[0162] By implementing the above method three, and simulating the propagation process of APT attack group labels in the relationship graph, we can use a wider range of graph structure information (multi-hop neighbor nodes) for inference, and have better robustness for cases with sparse local connections or few APT attack group labels.

[0163] In other implementations, when the APT attack organization to which the node to be attributed belongs is determined to be a newly added APT attack organization (i.e., the corresponding newly added APT attack organization label) through any of the above implementation methods one, two, and three, local recalculation can be triggered, such as updating the adjustable parameters involved in the graph neural network algorithm, updating the adjustable parameters involved in the neighbor similarity algorithm, etc., to ensure the accuracy of subsequent prediction results.

[0164] Taking the adjustable parameters involved in updating neighbor similarity algorithms as an example, the following expression can be satisfied:

[0165]

[0166] Where λ is the historical confidence decay coefficient. Historical confidence level.

[0167] It should be noted that, in addition to the three implementation methods listed above, other algorithms can be used to determine the APT attack group to which the node to be attributed belongs, and no specific restrictions are imposed here.

[0168] Based on the above Figure 1 The method shown, Figure 3 This is a logical diagram illustrating an APT attack organization attribution method provided in an embodiment of this application. Figure 3In this process, after preprocessing the collected communication traffic such as data packet parsing, multidimensional sequence extraction is performed to obtain time interval sequences, packet frequency sequences, and packet length sequences. Then, periodic analysis and periodic verification are performed on these sequences (see the relevant descriptions in steps A1-A2 above). Time interval sequences, packet frequency sequences, and packet length sequences with periodicity and periodic values ​​can be visualized to enhance the interpretability of their periodic communication patterns. Next, based on sequence type and periodic value, similarity analysis is performed on paired time interval sequence pairs, packet frequency sequence pairs, and packet length sequence pairs. Based on the similarity between sequences of two different communication traffic types in these sequence pairs, an attack organization association graph is constructed. Subsequently, graph neural network algorithms or neighbor similarity algorithms (see the relevant descriptions in implementation methods one, two, and three above) can be used to attribute the nodes to be attributed to APT attack organizations in the attack organization association graph to determine the APT attack organization to which the node belongs.

[0169] The APT attack organization attribution method described above extracts three sequence features from each communication traffic (i.e., a first sequence reflecting the time difference between data packets, a second sequence reflecting the packet sending frequency, and a third sequence reflecting the data packet length). From these sequences, multiple target sequences with periodicity and periodic values ​​are selected. Then, an attack organization correlation graph is constructed by analyzing the similarity between paired target sequences. Finally, this correlation graph can be used to attribute APT attack organizations to unknown communication traffic. This approach comprehensively and deeply mines the potential correlations between communication traffic, efficiently and accurately attributing APT attack organizations to unknown target communication traffic. It effectively overcomes the limitations of traditional methods that rely on dynamic and static samples and threat intelligence, providing a highly valuable technical means for network security protection. It can significantly improve the ability to identify, track, and respond to APT attacks, and also improve the reliability and accuracy of APT attack organization attribution.

[0170] Based on the same technical concept, this application also provides an APT attack organization attribution device, which can implement the above-mentioned APT attack organization attribution method flow in this application embodiment.

[0171] Figure 4 This is a schematic diagram of an APT attack organization attribution device provided in an embodiment of this application. Figure 4 As shown, the device includes: a feature extraction module 401, a filtering module 402, a pairing module 403, a calculation module 404, and a construction module 405.

[0172] The feature extraction module 401 is used to extract features from multiple collected communication traffic flows, and obtain at least a first sequence, a second sequence, and a third sequence for each communication traffic flow; wherein, the first sequence is generated based on the time difference between two adjacent data packets in the communication traffic flow, the second sequence is generated based on the number of data packets within a continuously set time window, and the third sequence is generated based on the data packet length of each data packet in the communication traffic flow;

[0173] The filtering module 402 is used to filter out multiple target sequences that have periodicity and periodic values ​​from multiple first sequences, multiple second sequences and multiple third sequences;

[0174] The pairing module 403 is used to pair the plurality of target sequences to obtain a plurality of target sequence pairs; wherein, the two target sequences in any target sequence pair have the same sequence type and the same period value;

[0175] Calculation module 404 is used to calculate the similarity between two target sequences in each target sequence pair;

[0176] The construction module 405 is used to construct an attack organization association graph based on the multiple communication traffic as nodes and the similarity between two target sequences in each target sequence pair; wherein, the attack organization association graph is used to attribute APT attack organizations to unknown target communication traffic.

[0177] It should be noted that the apparatus provided in this application embodiment can implement all the method steps in the above method embodiment and achieve the same technical effect. Therefore, the parts and beneficial effects that are the same as those in the method embodiment will not be described in detail here.

[0178] Based on the same technical concept, this application also provides an electronic device that can realize the function of the aforementioned APT attack organization attribution device.

[0179] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0180] At least one processor 501 and a memory 502 connected to at least one processor 501. In this embodiment, the specific connection medium between the processor 501 and the memory 502 is not limited. Figure 5 The example shown is the connection between processor 501 and memory 502 via bus 500. Bus 500 is... Figure 5 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. The Bus 500 can be divided into address bus, data bus, control bus, etc., for ease of representation. Figure 5The term 501 is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, the processor 501 can also be called a controller; there is no restriction on the name.

[0181] In this embodiment, memory 502 stores instructions executable by at least one processor 501. By executing the instructions stored in memory 502, at least one processor 501 can execute an APT attack organization attribution method discussed above. Processor 501 can implement... Figure 4 The functions of each module in the device shown.

[0182] The processor 501 is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing instructions stored in memory 502 and calling data stored in memory 502, the processor can perform various functions and process data, thereby monitoring the device as a whole.

[0183] In this embodiment, processor 501 may include one or more processing units. Processor 501 may integrate an application processor and a modem processor. The application processor mainly handles the operating system, user interface, and applications, while the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into processor 501. In some embodiments, processor 501 and memory 502 may be implemented on the same chip; in other embodiments, they may be implemented on separate chips.

[0184] Processor 501 can be a general-purpose processor, such as a central processing unit (CPU), digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the APT attack organization attribution method disclosed in the embodiments of this application can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0185] Memory 502, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 502 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. Memory 502 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In the embodiments of this application, memory 502 can also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0186] By designing and programming the processor 501, the code corresponding to an APT attack organization attribution method described in the foregoing embodiments can be embedded into the chip, enabling the chip to execute it during runtime. Figure 1 The illustrated embodiment presents an APT attack organization attribution method. How to design and program the processor 501 is a technique well-known to those skilled in the art and will not be described further here.

[0187] It should be noted that the electronic device provided in this application embodiment can implement all the method steps implemented in the above method embodiment and can achieve the same technical effect. Here, the parts and beneficial effects that are the same as those in the method embodiment will not be described in detail.

[0188] Based on the same technical concept, embodiments of this application provide a computer storage medium, which includes computer program code. When the computer program code is run on a computer, it causes the computer to execute any of the APT attack organization attribution methods discussed above. Since the principle by which the above-described computer storage medium solves the problem is similar to that of an APT attack organization attribution method, the implementation of the above-described computer storage medium can be referred to the implementation of the method, and repeated details will not be elaborated further.

[0189] In specific implementation, computer storage media can include: Universal Serial Bus Flash Drive (USB), portable hard drive, Read-Only Memory (ROM), Random Access Memory (RAM), magnetic disk or optical disk, and other storage media that can store program code.

[0190] Based on the same technical concept, this application also provides a computer program product, which includes computer program code. When the computer program code is run on a computer, it causes the computer to execute any of the APT attack organization attribution methods discussed above. Since the principle by which the above-described computer program product solves the problem is similar to that of an APT attack organization attribution method, the implementation of the above-described computer program product can refer to the implementation of the method, and repeated details will not be elaborated further.

[0191] Computer program products may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0192] The methods in this application can be implemented, in whole or in part, by software, hardware, firmware, or any combination thereof. When implemented in software, they can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instructions are loaded and executed on a computer, the processes or functions described in this application are performed, in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, network equipment, user equipment, core network equipment, OAM, or other programmable devices.

[0193] The computer program or instructions may be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. For example, the computer program or instructions may be transferred from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means. The computer-readable storage medium may be any available medium that a computer can access, or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium, such as a floppy disk, hard disk, or magnetic tape; or an optical medium, such as a digital video optical disc; or a semiconductor medium, such as a solid-state drive. The computer-readable storage medium may be a volatile or non-volatile storage medium, or may include both volatile and non-volatile types of storage media.

[0194] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0195] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 Devices that specify the functions in one or more boxes.

[0196] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including an instruction device, which is implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0197] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0198] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if these modifications and variations of the present invention fall within the scope of the claims of this application and their equivalents, this application also intends to include these modifications and variations.

Claims

1. An attribution method for APT attack organizations, characterized in that, include: Feature extraction is performed on multiple collected communication traffic samples to obtain at least a first sequence, a second sequence, and a third sequence for each communication traffic sample. The first sequence is generated based on the time difference between two adjacent data packets in the communication traffic sample; the second sequence is generated based on the number of data packets within a continuously set time window; and the third sequence is generated based on the length of each data packet in the communication traffic sample. Select multiple target sequences that exhibit periodicity and periodic values ​​from multiple first sequences, multiple second sequences, and multiple third sequences; The multiple target sequences are paired to obtain multiple target sequence pairs; wherein, the two target sequences in any target sequence pair have the same sequence type and the same period value; Calculate the similarity between the two target sequences in each target sequence pair; Using the multiple communication traffic flows as nodes, and based on the similarity between the two target sequences in each target sequence pair, an attack organization association graph is constructed; wherein, the attack organization association graph is used to attribute APT attack organizations to unknown target communication traffic; The step of constructing an attack organization association graph using the multiple communication traffic streams as nodes and based on the similarity between two target sequences in each target sequence pair includes: Create a node for each communication traffic, and determine the attribute information of each node based on at least one target sequence corresponding to each node; For each target sequence pair, when the similarity between the two target sequences in the target sequence pair exceeds a similarity threshold, an undirected edge is created between the two nodes corresponding to the target sequence pair; the weight of the undirected edge is related to the similarity and is used to indicate the association strength between the two nodes. The attack organization association graph contains attribute information corresponding to each node, as well as APT attack organization labels to which all or some nodes belong. The attribute information is related to the target sequence of the node with periodicity and periodic value.

2. The method as described in claim 1, characterized in that, The step of selecting multiple target sequences with periodicity and periodic values ​​from multiple first sequences, multiple second sequences, and multiple third sequences includes: Calculate the period value of the first candidate sequence; wherein the first candidate sequence is any one of the plurality of first sequences, the plurality of second sequences, and the plurality of third sequences; the period value is calculated using a periodic analysis algorithm; The periodic value is verified. When the periodic value is verified to be accurate, the first candidate sequence is taken as the target sequence, and the target sequence is divided into multiple subsequences according to the periodic value. The target sequence is also visualized to obtain the distribution curve of the target sequence. The distribution curve is used to interpret the periodic communication behavior of the target sequence.

3. The method as described in claim 2, characterized in that, The verification of the period value includes: The first candidate sequence is converted into a second-order difference sequence; The second-order difference sequence is divided into multiple second-order difference molecular sequences based on the period value; When the number of the plurality of second-order difference molecular sequences is greater than or equal to a set number threshold, the period value is verified based on the similarity between pairs of second-order difference molecular sequences in the plurality of second-order difference molecular sequences.

4. The method as described in claim 2, characterized in that, The calculation of the similarity between the two target sequences in each target sequence pair includes: Calculate the similarity between two target sequences in the first target sequence pair based on the similarity of multiple sub-sequence pairs of the first target sequence pair; Wherein, the first target sequence is any one of the plurality of target sequences, and any subsequence pair is composed of a subsequence of each of the two target sequences.

5. The method as described in claim 1, characterized in that, After constructing the attack organization relationship graph, the following is also included: The target communication traffic is taken as the node to be attributed; wherein, the node to be attributed is a node that does not have an APT attack organization label in the attack organization association graph; Based on the attribute information of the nodes in the attack organization association graph and the APT attack organization tags, the APT attack organization to which the node to be attributed belongs is determined.

6. The method as described in claim 5, characterized in that, The step of determining the APT attack organization to which the node to be attributed belongs based on the attribute information of the nodes in the attack organization association graph and the APT attack organization label includes: Based on the attribute information of the nodes and the weights of the undirected edges in the association graph of the attacking organization, multiple nodes in the association graph of the attacking organization are clustered to obtain at least one cluster; wherein, a cluster contains nodes with similar features. When it is determined that the node to be attributed belongs to the first cluster, and there is a node with an APT attack organization label in the first cluster, the APT attack organization label is determined as the APT attack organization to which the node to be attributed belongs; wherein, the first cluster is a cluster among the at least one cluster.

7. The method as described in claim 5, characterized in that, The step of determining the APT attack organization to which the node to be attributed belongs based on the attribute information of the nodes in the attack organization association graph and the APT attack organization label includes: The node embedding vector of the node to be attributed is generated based on the attribute information of the node to be attributed, and the corresponding relation embedding vector is generated based on the undirected edge between the node to be attributed and at least one neighboring node. The node embedding vector and the relation embedding vector are fused to obtain the first fused embedding vector; Calculate the attention coefficient between the node to be attributed and each of its neighboring nodes; wherein the attention coefficient is used to indicate the importance of the neighboring nodes relative to the node to be attributed. When there are multiple neighboring nodes, the node embedding vectors of the multiple neighboring nodes are fused according to the attention coefficients of the multiple neighboring nodes to obtain a fused second embedding vector. The first embedding vector and the second embedding vector are concatenated to obtain the comprehensive embedding vector of the node to be attributed. The integrated embedding vector is input into the prediction layer of the graph attention network to obtain the APT attack group to which the node to be attributed belongs.

8. The method as described in claim 5, characterized in that, The step of determining the APT attack organization to which the node to be attributed belongs based on the attribute information of the nodes in the attack organization association graph and the APT attack organization label includes: Calculate the overall correlation degree between the node to be attributed and at least one neighboring node. The overall correlation degree is determined based on the weight of the undirected edge between the node to be attributed and the at least one neighboring node, the node degree, and the similarity between the node to be attributed and the at least one neighboring node. Based on the comprehensive correlation degree and the hop count of at least one multi-hop neighbor node, the influence coefficient of the at least one multi-hop neighbor node on the node to be attributed is calculated; the influence coefficient is used to indicate the attribution influence of the multi-hop neighbor node on the node to be attributed. Based on the influence coefficient of the at least one multi-hop neighbor node on the node to be attributed and the neighbor nodes with APT attack organization labels, calculate the confidence level of the node to be attributed to each APT attack organization label. Based on the confidence level of each APT attack group's label, the APT attack group to which the node to be attributed belongs is determined.

9. The method according to any one of claims 1-8, characterized in that, The step of extracting features from multiple collected communication traffic flows to obtain at least a first sequence, a second sequence, and a third sequence for each communication traffic flow includes: Over a period of time, multiple collected communication traffic streams are parsed to obtain key fields corresponding to each communication traffic stream at the network layer and transport layer; the key fields include at least: the timestamp of the data packet and the length of the data packet, and the data packet type corresponding to each communication traffic stream is different; Feature extraction is performed on the key fields corresponding to each communication traffic at the network layer and transport layer to obtain at least the first sequence, second sequence and third sequence of each communication traffic.

10. An attribution device for APT attack organizations, characterized in that, include: The feature extraction module is used to extract features from multiple collected communication traffic streams, obtaining at least a first sequence, a second sequence, and a third sequence for each communication traffic stream; wherein, the first sequence is generated based on the time difference between pairs of adjacent data packets in the communication traffic stream, the second sequence is generated based on the number of data packets within a continuously set time window, and the third sequence is generated based on the data packet length of each data packet in the communication traffic stream; The filtering module is used to filter out multiple target sequences that have periodicity and periodic values ​​from multiple first sequences, multiple second sequences, and multiple third sequences; The pairing module is used to pair the multiple target sequences to obtain multiple target sequence pairs; wherein, the two target sequences in any target sequence pair have the same sequence type and the same period value; The calculation module is used to calculate the similarity between the two target sequences in each target sequence pair; A construction module is used to construct an attack organization association graph based on the multiple communication traffic as nodes and the similarity between two target sequences in each target sequence pair; wherein, the attack organization association graph is used to attribute APT attack organizations to unknown target communication traffic; Specifically, the construction module is used for: Create a node for each communication traffic, and determine the attribute information of each node based on at least one target sequence corresponding to each node; For each target sequence pair, when the similarity between the two target sequences in the target sequence pair exceeds a similarity threshold, an undirected edge is created between the two nodes corresponding to the target sequence pair; the weight of the undirected edge is related to the similarity and is used to indicate the association strength between the two nodes. The attack organization association graph contains attribute information corresponding to each node, as well as APT attack organization labels to which all or some nodes belong. The attribute information is related to the target sequence of the node with periodicity and periodic value.

11. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, when executing a computer program stored in the memory, implements the method of any one of claims 1-9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method of any one of claims 1-9.

Images