Causal reasoning driven attack intention restoration method

Abstract

The invention discloses a causal reasoning-driven attack intention restoration method, relates to the technical field of network security protection, and solves the problem that a causal chain of an attack event is difficult to restore accurately in the prior art. The method comprises the following steps: acquiring multi-source security data; constructing an initial causal graph based on the multi-source security data; when an abnormal event is detected, performing reverse backtracking from a node corresponding to the abnormal event in the initial causal graph, and calculating a minimum full cause set causing the abnormal event; generating an attack script based on the minimum full cause set; and executing corresponding security response actions based on different attack stages in the attack script. According to the embodiment of the invention, the anti-fact causal model is adopted to perform reverse backtracking on the abnormal event to determine the minimum full cause set, so that associated noise can be eliminated, and the recovery accuracy of an attack link is improved; the average repair time can be shortened by generating an attack script through a minimum full cause set and driving an automated response based on the attack script.

Description

Technical Field

[0001] This invention relates to the field of network security protection technology, and in particular to a method for reconstructing attack intent driven by causal reasoning. Background Technology

[0002] With the rapid development of information technology, network attack methods are becoming increasingly covert, chain-like, and complex, placing higher demands on network security protection systems. Security Information and Event Management (SIEM) tools, as core components of network security protection, are widely used to collect, store, and analyze various security log data. Their analytical capabilities directly determine the efficiency and accuracy of security threat detection.

[0003] However, existing SIEM tools rely on pre-defined rule engines for event analysis. These existing correlation engines can only establish statistical correlations in event correlation analysis, failing to distinguish causal chains within attack events. This makes it difficult to accurately reconstruct attack paths and pinpoint the root cause of attacks, leading to high false positive rates and delayed attack responses, severely weakening the proactive defense capabilities of network security protection systems.

[0004] Therefore, a method for reconstructing attack intent driven by causal reasoning is needed. Summary of the Invention

[0005] To address the problem that existing technologies struggle to accurately reconstruct the causal chain in attack events, this invention provides a causal reasoning-driven method for reconstructing attack intent, capable of accurately reconstructing the causal chain in attack events. The specific technical solution is as follows: In a first aspect, embodiments of this application provide a method for reconstructing attack intent driven by causal reasoning, the method comprising: Acquire multi-source security data, which consists of data from different data sources used for security analysis. Based on this multi-source security data, construct an initial causal graph using a counterfactual causal model. This initial causal graph is a directed acyclic graph, and the nodes in the initial causal graph represent data entities in the multi-source security data. In the event of an anomaly, backtracking is performed on the initial causal graph based on the node corresponding to the anomaly to calculate the minimum sufficient set of causes leading to the anomaly. Based on the minimum sufficient set of causes and the node corresponding to the anomaly, a causal path is obtained, and an attack script is generated based on this causal path. The attack script includes attack phases, which indicate the type of attack behavior. Based on the attack phases, execute the corresponding security response actions.

[0006] Preferably, the initial causal graph is constructed based on the multi-source security data using a counterfactual causal model, including: generating an edge candidate set based on the association and temporal relationship of the data entities; calculating the corresponding average causal effect ACE value as the edge weight for each candidate edge in the edge candidate set using the counterfactual causal model; and generating the initial causal graph based on the candidate edges whose edge weights exceed a first threshold.

[0007] Preferably, when an abnormal event is detected, the process involves backtracking in the initial causal graph based on the node corresponding to the abnormal event to calculate the minimum sufficient set of causes leading to the abnormal event. This includes: performing a reverse traversal of the initial causal graph based on the node corresponding to the abnormal event to obtain a set of candidate causes; obtaining a set of sufficient causes based on the set of candidate causes, wherein the probability of the abnormal event occurring is greater than a second threshold when all causes in the set of sufficient causes occur; and minimizing the set of sufficient causes by removing redundant causes to obtain the minimum sufficient set of causes.

[0008] Preferably, the attack script generation based on the causal path includes: identifying causal boundaries based on the causal path, where the causal boundary is an edge on the causal path, and the difference between the edge weight of the causal boundary and the average edge weight of the causal path is greater than a third threshold; the causal boundary is used to divide the causal path into multiple intervals; within each interval, the edges of the causal path are clustered to form an event cluster; wherein the events in the event cluster are obtained based on the edges of the causal path; based on the semantic features of the events in each event cluster and the context corresponding to the interval in the attack lifecycle, the attack stage and tactical intent are labeled for each event cluster; and a structured attack script is generated based on the labeling results.

[0009] Preferably, the labeling process for this tactical intent includes: for each event in the event cluster, calculating the causal importance weight of that event, wherein the formula for calculating the causal importance weight includes: ; in, Here, i represents the causal importance weight, i is the event index, and n is the total number of events in the event cluster. Indicates from the event to abnormal events The aggregate causal strength of the path, which is the sum of the aggregate causal strengths from the event to abnormal events In the path, the average or minimum edge weight of all edges is calculated; the events in the event cluster are sorted in descending order of causal importance weight to form an event sequence, and the first K events in the event sequence are selected as key events; where K is greater than or equal to 1 and less than n; the semantic features of the key events are input into the classification model to obtain the tactical intent label output by the classification model; based on the tactical intent label, the tactical intent is labeled for the event cluster.

[0010] Preferably, the attack script includes an attack summary, a phased description of the attack, and a root cause analysis.

[0011] Preferably, the multi-source security data includes network device traffic data, terminal system data, process data and application (APP) data, and server APP data.

[0012] Secondly, embodiments of this application provide a causal reasoning-driven attack intent reconstruction system, applied to the method described in the first aspect, the system comprising: The acquisition module is used to acquire multi-source security data, which is data from different data sources used for security analysis. The module is used to construct an initial causal graph based on the multi-source security data using a counterfactual causal model. The initial causal graph is a directed acyclic graph, and the nodes in the initial causal graph represent data entities in the multi-source security data. The cause-tracing module is used to backtrack backward in the initial cause-effect graph based on the node corresponding to the abnormal event when an abnormal event is detected, and to calculate the minimum sufficient set of causes that led to the abnormal event. The generation module is used to obtain the causal path based on the minimum sufficient factor set and the node corresponding to the abnormal event, and to generate an attack script based on the causal path. The attack script includes an attack phase, which is used to indicate the type of attack behavior. The response module is used to execute corresponding security response actions based on the attack phase.

[0013] Thirdly, embodiments of this application provide a computing device, including: a memory for storing a program; and a processor for loading the program to execute the method as described in the first aspect.

[0014] Fourthly, embodiments of this application provide a computer-readable storage medium including a stored program, wherein the program, when running, controls the device where the computer-readable storage medium is located to perform the method described in the first aspect.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: by using a counterfactual causal model to backtrack abnormal events to determine the minimum sufficient factor set, correlation noise can be eliminated and the accuracy of attack link reconstruction can be improved; by generating attack scripts through the minimum sufficient factor set and driving automated response based on the attack scripts, the average repair time can be shortened. Attached Figure Description

[0016] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn to scale.

[0017] Figure 1 A flowchart illustrating a causal reasoning-driven attack intent reconstruction method provided in an embodiment of this application; Figure 2 A system architecture diagram of a causal reasoning-driven attack intent reconstruction system provided in this application embodiment; Figure 3 This is a schematic diagram of the structure of a computing device provided in an embodiment of this application. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0020] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0021] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0022] To address the problem that existing technologies struggle to accurately reconstruct the causal chain in attack events, this invention provides a causal reasoning-driven attack intent reconstruction method that can accurately reconstruct the causal chain in attack events.

[0023] Please see Figure 1 , Figure 1 This application provides a flowchart illustrating a causal reasoning-driven attack intent reconstruction method, which is applied to a computing device. Figure 1 As shown, the method includes: Step 101: The computing device acquires multi-source security data.

[0024] This multi-source security data refers to data from different data sources used for security analysis. Specifically, computing devices can obtain this multi-source security data from network devices, terminals, and servers within the protected area.

[0025] Specifically, computing devices can collect this multi-source security data through an agent or through a direct network connection.

[0026] Preferably, the multi-source security data includes network device traffic data, terminal system data, process data and application (APP) data, and server APP data.

[0027] The network device traffic data can be traffic logs, specifically including fields such as source IP, destination IP, port, protocol, and timestamp; system data can be the terminal operating system's system logs, specifically including events such as process creation, file access, and user login; process data can be process monitoring data from Endpoint Detection and Response (EDR) tools, specifically including process ID, parent process ID, CPU / memory usage, and command-line arguments; and APP data. It is understandable that this multi-source security data is data from a past period of time. After acquiring multi-source security data, the computing device can preprocess the data. This includes parsing the data into uniform fields and aligning them; then processing missing values, outliers, and duplicate records; mapping fields from different data sources to a common standard format; and finally adding contextual information to the data.

[0028] For example, computing devices can use interpolation to fill in missing timestamps and use the Z-score algorithm to filter out outlier values.

[0029] For example, computing devices can resolve the geographical location of IP addresses through a geographic IP database or mark malicious IPs through a threat intelligence platform.

[0030] Then, the computing device can identify data entities from the preprocessed data, such as IP addresses, process IDs, user IDs, file paths, etc.; and assign a unique identifier to each entity; and then use a unified association key, such as session ID, device ID, or user ID, to associate entities corresponding to the same event.

[0031] Step 102: The computing device constructs an initial causal graph based on the multi-source security data using a counterfactual causal model.

[0032] The computing device can generate an initial causal graph based on the data entities in the multi-source security data and the relationships between the data entities.

[0033] The initial causal graph is a directed acyclic graph. The nodes in the initial causal graph represent data entities in the multi-source security data, and the edges represent causal events with a direction from the cause entity to the result entity.

[0034] Preferably, the computing device can generate a candidate edge set based on the association and temporal relationship of the data entity; through the counterfactual causal model, for each candidate edge in the candidate edge set, the corresponding average causal effect (ACE) value is calculated as the edge weight; based on the candidate edges whose edge weights exceed a first threshold, the initial causal graph is generated.

[0035] In this case, the edge A→B is only considered when the timestamp of entity A is earlier than that of entity B, thus ensuring causal temporal order.

[0036] In particular, by incorporating network security knowledge, impossible edges are filtered out, such as "the process cannot cause an IP address change".

[0037] Counterfactual causal models use counterfactual logic to calculate the causal strength of each candidate edge to distinguish between true causal relationships and coincidental associations. Specifically, ACE is used as the metric, and the formula for calculating ACE is as follows: ; in, This represents the probability that entity B exists or occurs (B=1) given an intervention setting A is 1 (i.e., entity A exists or occurs). The `do` operation represents external intervention, simulating a forced change in the state of A in the real world. Similarly, This represents the probability of event B occurring (B=1) when intervention setting A is 0 (i.e., A does not exist or does not occur).

[0038] The range of ACE is [-1, 1]. ACE > 0 indicates that A has a positive causal effect on B, ACE < 0 indicates a negative causal effect, and ACE = 0 indicates no causal effect.

[0039] In cybersecurity scenarios, A and B can be considered binary events, meaning the entity exists / does not exist, occurs / does not occur, or is generated / does not generate. The specific event type is determined by the event operation. It is understood that, for the sake of brevity and clarity, the following description may only use one of several possible events as an example, but this does not mean that the determination condition for the entity is limited to only one of existence, occurrence, or generation.

[0040] Since direct experimental intervention is not possible for all binary events, the data sample obtained in a single instance may not support probability calculations. Therefore, the computing device needs to estimate ACE from historical observation data using statistical methods. Specifically, the computing device can use adjustment formulas to control for confounders, i.e., common causes affecting A and B, in order to perform observational calculations: C is a set of confounding variables, including variables that may affect A and B, which can be obtained from the data entities and their relationships obtained in step 101. It is the conditional probability of B occurring given A and C=c, which can be statistically estimated from historical data; The probability of the confounding variable C taking the value c can be obtained by calculating the frequency from historical data.

[0041] Then, the computing device can retain only edges with ACE greater than the first threshold to ensure that only strong causal relationships are included in the initial causal graph; then, a topological sorting algorithm is used to detect and remove cyclic edges to ensure the acyclicity of the initial causal graph.

[0042] One approach is to first select entity pairs with strong causal relationships based on expert experience, and then calculate the ACE of the entity pair; then, based on the average ACE of these entity pairs, set a similar value as the first threshold.

[0043] The computing device can then save the graph structure as an adjacency list or graph database format, where edge attributes include cause nodes, result nodes, and edge weights.

[0044] Step 103: In the event of an abnormal event, the computing device performs a reverse backtracking on the initial causal graph based on the node corresponding to the abnormal event, and calculates the minimum sufficient set of causes that led to the abnormal event.

[0045] The source of the abnormal event can be a real-time alarm from the monitoring system. The nodes corresponding to the abnormal event include the causal entities and result entities of the abnormal event in the initial cause-effect graph, such as the source and destination addresses of the abnormal access, or the process and creator of the abnormal event. The computing device can obtain the relevant data entities of the abnormal event and match them with the nodes in the initial cause-effect graph.

[0046] Preferably, when an abnormal event is detected, the computing device can perform a reverse traversal of the initial causal graph based on the node corresponding to the abnormal event to obtain a set of candidate causes; obtain a set of sufficient causes based on the set of candidate causes, wherein the probability of the abnormal event occurring is greater than a second threshold when all causes in the set of sufficient causes occur; and minimize the set of sufficient causes by removing redundant causes from the set of sufficient causes to obtain a minimum set of sufficient causes.

[0047] Among them, the computing device can obtain the causal edge corresponding to the abnormal event. Begin by performing a reverse traversal of the initial causal graph to obtain all paths that can be traversed through edges containing causal elements. The directed path leading to the ancestor nodes of the result node of the abnormal event is used to form a set of candidate causes. .

[0048] Specifically, the edges in the initial causal graph represent causal events, that is, events that create a causal relationship between the cause entity and the result entity connected by the edge.

[0049] Here, a sufficient causal set refers to a causal edge where all causes in the set occur together. The probability of occurrence is greater than the second threshold, approaching 100%. The minimum sufficient factor set is the set with the smallest size among all sufficient factor sets, which cannot be removed from any element while maintaining its sufficiency.

[0050] Specifically, this second threshold can be calibrated experimentally. For example, the second threshold is 95%.

[0051] For candidate cause set Each candidate reason Calculate its counterfactual probability, that is, if the candidate cause Neither occurred nor does it exist; causal boundary The probability that it will still happen.

[0052] Then, calculate each candidate cause. probability increase = .

[0053] in, This indicates that under the intervention settings, the cause is forced. No occurrence ( When = 0), causal edge The probability that it will still happen; Causal edge Marginal probability of occurrence.

[0054] if It's very large, which means it's preventing... It can significantly reduce The probability of occurrence means This is a highly necessary reason.

[0055] Due to the candidate cause set The causal graph may contain numerous causal entities, and completely enumerating all subsets would be computationally too intensive. Therefore, the computational device can employ a heuristic approach, considering only those entities located in the causal graph that originate from the ancestor node and pass through... ,arrive The result entity is a combination of entities on the causal path. Specifically, the computing device can create an empty set from... Starting with the causal entity, path nodes are gradually added towards the ancestor nodes of each causal path, forming a candidate subset. .

[0056] After each path node is added, the updated candidate subset is calculated. When all causes occur, this anomalous event (causal edge) The probability of occurrence of ( ). Specifically, the computing device can calculate this probability by controlling the confusion variable using the above adjustment formula; if this probability is greater than the second threshold, the current candidate subset is determined. For a sufficient set of factors.

[0057] To reduce computational load, computing devices can use greedy algorithms or Monte Carlo simulations. Simultaneously, impossible paths (such as combinations of events without direct causal edges) can be pruned using the structure of the causal graph.

[0058] Understandably, there can be multiple sufficient factor sets, each representing a possible attack path.

[0059] For each sufficient factor set, iterate through each cause node: after temporarily removing the cause node, calculate the probability of the abnormal event occurring when the remaining causes occur; if the probability is greater than the fourth threshold, the cause node is considered a redundant node and is permanently removed; otherwise, cancel the temporary removal of the cause node and restore it to the sufficient factor set; repeat this verification process until no event can be removed from the sufficient factor set. In this way, the corresponding minimum sufficient factor set is obtained.

[0060] Among them, the probability boosting degree is found in the minimum sufficient factor set. The largest cause node can be considered the root cause node of the abnormal event.

[0061] Step 104: The computing device obtains the causal path based on the minimum sufficient factor set and the node corresponding to the abnormal event, and generates an attack script based on the causal path.

[0062] The computing device can construct a target causal path containing these nodes based on the minimum sufficient factor set and the causal path corresponding to the anomalous event; then, based on the multi-source security data corresponding to the events (edges) on the causal path, an attack script can be generated.

[0063] Specifically, in step 103, while determining the minimum sufficient factor set, all causal paths obtained by traversing the abnormal event nodes in reverse are obtained; the computing device can find the causal path related to the minimum sufficient factor set from these causal paths, and take the nodes in the minimum sufficient factor set as the starting point, and advance along the causal path towards the abnormal event to form a clear attack direction, thereby obtaining the causal path used to generate the attack script.

[0064] Specifically, the attack script lists the causal events of the attack path in chronological order, while also explaining the attacker's tactical intentions and the various stages in the attack lifecycle.

[0065] Specifically, this attack lifecycle is defined based on the network attack lifecycle model, which describes the typical stages of an attack from start to finish, including reconnaissance, weaponization, penetration, presence, privilege escalation, lateral movement, and data leakage. It is understandable that attack scripts do not necessarily adhere strictly to these stages, but rather categorize the attack types of events by combining the location of each event within the path and the specific content of each event.

[0066] Preferably, the computing device can identify causal boundaries based on the causal path, where the causal boundary is an edge on the causal path, and the difference between the edge weight of the causal boundary and the average edge weight of the causal path is greater than a third threshold; the causal boundary is used to divide the causal path into multiple intervals; within each interval, the edges of the causal path are clustered to form event clusters; wherein, the events in the event cluster are obtained based on the edges of the causal path; based on the semantic features of the events in each event cluster, and the context corresponding to the interval in the attack lifecycle, the attack stage and tactical intent are labeled for each event cluster; based on the labeling results, a structured attack script is generated.

[0067] The attack script includes an attack phase, which indicates the type of attack behavior.

[0068] In this context, the attacker's actions lead to critical and destructive results, reflected in changes in the edge weights of the event paths. Therefore, the computing device can determine the changes in the attack phase based on the changes in edge weights along the causal path.

[0069] The computing device can cluster the event edges within each interval, that is, cluster the events that occur within the same attack phase, in order to better identify the attack phase and the attacker's intent in that phase.

[0070] Specifically, the computing device can obtain data on the corresponding event from multi-source security data, and then extract the action type as behavioral features, the object type of the event operation as target features, and the security context in which the event occurred as context features from the event data; and then perform clustering based on these features.

[0071] Then, the computing device can determine the attack phase based on the event clusters that account for the largest proportion in the clustering results. For example, a cluster dominated by {action: scan, target: network} is classified as the "reconnaissance" phase; a cluster dominated by {action: write, target: file, context: high_privilege} is classified as the "weaponization" or "penetration" phase.

[0072] Preferably, the annotation process for this tactical intent includes: For each event in the event cluster, calculate the causal importance weight of that event. The formula for calculating the causal importance weight includes: ; in, Here, i represents the causal importance weight, i is the event index, and n is the total number of events in the event cluster. Indicates from the event to abnormal events The aggregate causal strength of the path, which is the sum of the aggregate causal strengths from the event to abnormal events In the path, the average or minimum edge weight of all edges is obtained; the events in the event cluster are sorted in descending order of causal importance weight to form an event sequence, and the first K events in the event sequence are selected as key events; the semantic features of the key events are input into the classification model to obtain the tactical intent label output by the classification model; based on the tactical intent label, the tactical intent is labeled for the event cluster.

[0073] Where K is greater than or equal to 1 and less than n.

[0074] The semantic features of this key event refer to the behavioral features, target features, and contextual features extracted from the event data in the above clustering steps.

[0075] Preferably, the attack script includes an attack summary, a phased description of the attack, and a root cause analysis.

[0076] The computing device can use a preset template to generate an attack summary that summarizes the current attack behavior based on the attack phase and abnormal events.

[0077] For example, the preset template can be: "The current attack is an [attack type] activity that started from the [initial attack phase]. The attacker used methods such as [intermediate attack phase 1] and [intermediate attack phase 2] to ultimately cause the [abnormal event]." The computing device can list each attack phase in chronological order. For each phase, it specifies the phase name and time window, key events and causal basis (edge ​​weights of corresponding edges), and the inferred tactical intent.

[0078] The computing device can explain why the combination of these causes is sufficient to lead to an attack based on the cause nodes in the minimum sufficient cause set, and use the probability boosting degree of each cause node obtained in step 103 to demonstrate the reasoning results; then, it can combine security defense strategies to analyze security weaknesses.

[0079] Step 105: The computing device executes the corresponding security response action based on this attack phase.

[0080] After obtaining the attack script, the computing device can match and execute the corresponding security response actions based on each stage or key event in the attack script to enhance network defense.

[0081] Specifically, computing devices can access a Security Orchestration, Automation and Response (SOAR) system to obtain matching rules. This SOAR system maintains a static base of response rules containing matching rules in IF-THEN format.

[0082] Then, the computing device can parse the attack script to obtain key features; then match the key features with matching rules to obtain the corresponding security response action.

[0083] These key characteristics include the attack phase name, event type, involved entities, and threat indicators. Among them, threat indicators refer to specific data or information that can directly or indirectly point to the existence, characteristics, or attack behaviors of security threats, and can be used to identify, detect, and trace network attacks.

[0084] For example, the matching rule may include: IF Phase == "Weaponization" AND Event Type == "File Creation" AND File Hash IN Malicious Hash Library THEN Security Response Action = ["Delete File" OR "Quarantine File"].

[0085] For example, the matching rule may also include: IF Phase == "Penetration" AND Event Type == "Process Execution" AND Parent Process == "Suspicious Process" THEN Security Response Action = ["Terminate Process" OR "Isolate Process"].

[0086] In this embodiment of the application, by using a counterfactual causal model to backtrack abnormal events to determine the minimum sufficient factor set, correlation noise can be eliminated and the accuracy of attack chain reconstruction can be improved; by generating attack scripts through the minimum sufficient factor set and driving automated response based on the attack scripts, the average repair time can be shortened.

[0087] Please see Figure 2 , Figure 2 This application provides a schematic diagram of a structure for reconstructing attack intent driven by causal reasoning, as shown in the embodiments of this application. Figure 2 As shown, the system 20 includes: The acquisition module 201 is used to acquire multi-source security data, which is data from different data sources used for security analysis; Module 202 is used to construct an initial causal graph based on the multi-source security data using a counterfactual causal model. The initial causal graph is a directed acyclic graph, and the nodes in the initial causal graph represent data entities in the multi-source security data. The causation module 203 is used to perform reverse backtracking on the initial causal graph based on the node corresponding to the abnormal event when an abnormal event is detected, and to calculate the minimum sufficient set of causes that led to the abnormal event. The generation module 204 is used to obtain a causal path based on the minimum sufficient factor set and the node corresponding to the abnormal event, and generate an attack script based on the causal path. The attack script includes an attack phase, which is used to indicate the type of attack behavior. The response module 205 is used to execute the corresponding security response action based on the attack phase.

[0088] Preferably, the construction module 202 is specifically used to generate a candidate edge set based on the association and temporal relationship of the data entity; through the counterfactual causal model, for each candidate edge in the candidate edge set, calculate the corresponding average causal effect ACE value as the edge weight; and generate the initial causal graph based on the candidate edges whose edge weights exceed a first threshold.

[0089] Preferably, the tracing module 203 is specifically used to perform a reverse traversal of the initial causal graph based on the node corresponding to the abnormal event to obtain a set of candidate causes; obtain a set of sufficient causes based on the set of candidate causes, wherein the probability of the abnormal event occurring is greater than a second threshold when all causes in the set of sufficient causes occur; and perform a minimization process on the set of sufficient causes, removing redundant causes in the set of sufficient causes to obtain a minimum set of sufficient causes.

[0090] Preferably, the generation module 204 is specifically used to identify causal boundaries based on the causal path, wherein the causal boundary is an edge on the causal path, and the difference between the edge weight of the causal boundary and the average edge weight of the causal path is greater than a third threshold; the causal boundary is used to divide the causal path into multiple intervals; within each interval, the edges of the causal path are clustered to form an event cluster; wherein the events in the event cluster are obtained based on the edges of the causal path; based on the semantic features of the events in each event cluster, and the context corresponding to the interval in the attack lifecycle, the attack stage and tactical intent are labeled for each event cluster; based on the labeling results, a structured attack script is generated.

[0091] Preferably, the labeling process for this tactical intent includes: for each event in the event cluster, calculating the causal importance weight of that event, wherein the formula for calculating the causal importance weight includes: ; in, Here, i represents the causal importance weight, i is the event index, and n is the total number of events in the event cluster. Indicates from the event to abnormal events The aggregate causal strength of the path, which is the sum of the aggregate causal strengths from the event to abnormal events In the path, the average or minimum edge weight of all edges is calculated; the events in the event cluster are sorted in descending order of causal importance weight to form an event sequence, and the first K events in the event sequence are selected as key events; where K is greater than or equal to 1 and less than n; the semantic features of the key events are input into the classification model to obtain the tactical intent label output by the classification model; based on the tactical intent label, the tactical intent is labeled for the event cluster.

[0092] Preferably, the attack script includes an attack summary, a phased description of the attack, and a root cause analysis.

[0093] Preferably, the multi-source security data includes the network device's traffic data, the terminal's system data, process data, and application (APP) data, as well as the server's APP data.

[0094] The attack intent reconstruction system driven by causal reasoning provided in this application can be understood by referring to the relevant content in the foregoing method embodiment section, and will not be repeated here.

[0095] like Figure 3 As shown, Figure 3 This is a schematic diagram of a possible logical structure of a computing device provided in an embodiment of this application. The computing device 30 includes a processor 301, a communication interface 302, a memory 303, and a bus 304. The processor 301, the communication interface 302, and the memory 303 are interconnected via the bus 304. In an embodiment of this application, the processor 301 is used to control and manage the operation of the computing device 30. For example, the processor 301 is used to execute... Figure 1 The steps in the embodiments and / or other processes used in the techniques described herein. Communication interface 302 is used to support communication by computing device 30. Memory 303 is used to store program code and data of computing device 30.

[0096] The processor 301 can be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, etc. The bus 304 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0097] In another embodiment of this application, a computer-readable storage medium is also provided, the computer-readable storage medium including instructions that, when executed on a computer, cause the computer to perform the above-described... Figure 1 The method described in the embodiments.

[0098] Those skilled in the art will recognize that the units of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of the invention.

[0099] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0100] In the embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0101] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0102] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0103] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0104] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be covered within the scope of the claims and specification of the present invention.

Claims

1. A method for reconstructing attack intent driven by causal reasoning, characterized in that, The method includes: Acquire multi-source security data, which is data from different data sources used for security analysis; Based on the multi-source security data, an initial causal graph is constructed using a counterfactual causal model. The initial causal graph is a directed acyclic graph, and the nodes in the initial causal graph represent data entities in the multi-source security data. In the event of an abnormal event, based on the node corresponding to the abnormal event, a reverse backtracking is performed on the initial causal graph to calculate the minimum sufficient set of causes that led to the abnormal event; A causal path is obtained based on the minimum sufficient factor set and the nodes corresponding to the abnormal events, and an attack script is generated based on the causal path. The attack script includes an attack phase, which is used to indicate the type of attack behavior. Based on the attack phase, execute the corresponding security response actions.

2. The method according to claim 1, characterized in that, The construction of an initial causal graph based on the multi-source security data using a counterfactual causal model includes: Based on the association and temporal relationships of the data entities, an edge candidate set is generated; Using the counterfactual causal model, for each candidate edge in the candidate edge set, the corresponding average causal effect ACE value is calculated as the edge weight. The initial causal graph is generated based on candidate edges whose edge weights exceed a first threshold.

3. The method according to claim 1, characterized in that, In the event of an abnormal event, the method involves backtracking in the initial causal graph based on the node corresponding to the abnormal event to calculate the minimum sufficient set of causes leading to the abnormal event, including: Upon detecting the abnormal event, a reverse traversal is performed on the initial causal graph based on the node corresponding to the abnormal event to obtain a set of candidate causes; A sufficient set of causes is obtained based on the candidate cause set, wherein the probability of the abnormal event occurring is greater than a second threshold when all causes in the sufficient cause set occur. The sufficient factor set is minimized by removing redundant causes from the sufficient factor set to obtain the minimum sufficient factor set.

4. The method according to claim 1, characterized in that, The generation of attack scripts based on the causal path includes: Based on the causal path, causal boundaries are identified. The causal boundary is an edge on the causal path, and the difference between the edge weight of the causal boundary and the average edge weight of the causal path is greater than a third threshold. The causal boundary is used to divide the causal path into multiple intervals. Within each interval, the edges of the causal path are clustered to form an event cluster; wherein, the events in the event cluster are obtained based on the edges of the causal path; Based on the semantic features of events in each event cluster and the context of the corresponding interval in the attack lifecycle, each event cluster is labeled with the attack stage and tactical intent. Based on the annotation results, a structured attack script is generated.

5. The method according to claim 4, characterized in that, The process of annotating the tactical intent includes: For each event in the event cluster, the causal importance weight of the event is calculated, and the formula for calculating the causal importance weight includes: ； in, Here, i represents the causal importance weight, i is the event index, and n is the total number of events in the event cluster. Indicates from the event to abnormal events The aggregate causal strength of the path, wherein the aggregate causal strength is from event to abnormal events In the path, the average or minimum edge weight of all edges; The events in the event cluster are sorted in descending order of causal importance weight to form an event sequence, and the first K events in the event sequence are selected as key events; where K is greater than or equal to 1 and less than n; The semantic features of the key events are input into the classification model to obtain the tactical intent labels output by the classification model. Based on the tactical intent label, the event cluster is labeled with the tactical intent.

6. The method according to claim 1, characterized in that, The attack script includes an attack summary, a phased description of the attack, and a root cause analysis.

7. The method according to any one of claims 1-6, characterized in that, The multi-source security data includes traffic data, system data, process data, and application (APP) data.

8. A causal reasoning-driven attack intent reconstruction system, characterized in that, The system, applied to the method of any one of claims 1-7, comprises: The acquisition module is used to acquire multi-source security data, which is data from different data sources used for security analysis; The construction module is used to construct an initial causal graph based on the multi-source security data using a counterfactual causal model. The initial causal graph is a directed acyclic graph, and the nodes in the initial causal graph represent data entities in the multi-source security data. The cause-tracing module is used to perform reverse backtracking on the initial causal graph based on the node corresponding to the abnormal event when an abnormal event is detected, and to calculate the minimum sufficient set of causes that led to the abnormal event. A generation module is used to obtain a causal path based on the minimum sufficient factor set and the node corresponding to the abnormal event, and to generate an attack script based on the causal path. The attack script includes an attack phase, which is used to indicate the type of attack behavior. The response module is used to execute corresponding security response actions based on the attack phase.

9. A computing device, characterized in that, include: Memory, used to store programs; A processor for loading the program to perform the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the device on which the computer-readable storage medium is located to perform the method of any one of claims 1-7.

Images