Network attack traceability graph construction method and device, equipment and storage medium

Abstract

The invention discloses a network attack traceability graph construction method and device, equipment and a storage medium, and relates to the technical field of computers, and the method comprises the steps: extracting a network alarm event, and determining a target terminal based on a quintuple in an obtained alarm feature vector; determining an anchor point process based on the terminal log of the target terminal in the target time range; performing upward and downward bidirectional traversal on the anchor point process based on the identifier information corresponding to the anchor point process, constructing a candidate attack chain set by using an obtained traversal result, and performing multi-dimensional scoring on each candidate attack chain in the candidate attack chain set to obtain each target basic score, performing attention enhancement on a target node meeting a target condition in the candidate attack chain to obtain an attention enhancement score; and combining the basic score and the attention enhancement score to obtain a target score, and constructing an attack traceability map based on the candidate attack chain with the highest target score. And when a large number of automatic attacks are suffered, accurate and deep tracing of network attacks is realized.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, device, and storage medium for constructing a network attack attribution map. Background Technology

[0002] In modern network attack and defense, attackers' actions are often cross-domain: they might send malicious attachments via phishing emails (terminal behavior), trigger Office macros or PowerShell (a command-line shell) to execute malicious scripts (terminal behavior), then connect to an external C2 server (Command and Control Server) to download the payload, and finally move laterally (network + terminal behavior). The entire attack chain involves events across multiple dimensions of the terminal and network.

[0003] Existing technologies include fuzzy matching schemes based on IP address and time. This means that if an IP address appears in the terminal logs at a similar time, these terminal events are associated with network alarms and displayed to the user. However, this scheme has a high probability of incorrectly associating normal system process traffic with malicious attack traffic, leading to incorrect attribution results. Another approach involves grouping or collapsing alarms based on preset fixed rules. This predefines simple rules (e.g., all alarms from the same source IP within 5 minutes are considered a group), grouping or collapsing a large number of alarms according to these rules. Alarms within the same group are treated as a single security event, but there is a lack of further correlation between different groups, making in-depth attribution impossible.

[0004] As can be seen from the above, how to achieve accurate and in-depth attribution of network attacks when subjected to a large number of automated attacks is an urgent problem to be solved. Summary of the Invention

[0005] In view of this, the purpose of this invention is to provide a method, apparatus, device, and storage medium for constructing a network attack attribution map, which can achieve accurate and in-depth attribution of network attacks when subjected to a large number of automated attacks. The specific solution is as follows: Firstly, this application provides a method for constructing a network attack attribution map, including: Network alarm events are extracted to obtain alarm feature vectors. Based on the five-tuple in the alarm feature vector and using the enterprise asset management database, the target terminal corresponding to the network alarm event is determined. The alarm feature vector includes a five-tuple and an alarm trigger timestamp. Based on the terminal logs of the target terminal within the target time range, the target terminal program corresponding to the network alarm event is determined, the target terminal program is identified as the anchor process, and the identifier information corresponding to the anchor process is recorded; the identifier information includes a process identifier and a source identifier. Based on the identifier information, the anchor process is traversed bidirectionally upwards and downwards, and a candidate attack chain set is constructed using the obtained traversal results. Each candidate attack chain in the candidate attack chain set is scored in multiple dimensions to obtain a basic score for each target. Attention enhancement is performed on target nodes in the candidate attack chains that meet the target conditions to obtain a corresponding attention enhancement score. The multi-dimensional scores include threat level score, threat intelligence hit score, and attack link depth score. The base score and the attention enhancement score are combined to obtain the target score for each candidate attack chain. The target attack path is determined based on the candidate attack chain with the highest target score, and the corresponding attack tracing graph is constructed based on the target attack path.

[0006] Optionally, determining the target terminal corresponding to the network alarm event based on the five-tuple in the alarm feature vector and using the enterprise asset management database includes: Obtain the source IP address from the quintuple in the alarm feature vector, and determine whether there is a program identifier corresponding to the source IP address in the enterprise asset management database; If a program identifier corresponding to the source IP address exists, the target terminal is determined based on the program identifier; If no program identifier exists corresponding to the source IP address, the tracing operation for the network alarm event is stopped.

[0007] Optionally, the step of determining the target terminal program corresponding to the network alarm event based on the terminal logs of the target terminal within the target time range includes: Based on the alarm trigger timestamp, a target time range is determined, and based on the target time range, it is determined whether there is target log information in the terminal log corresponding to the target terminal that is consistent with the source port, destination port and transport layer protocol in the five-tuple. If it exists, the corresponding target terminal program is determined based on the target log information; If it does not exist, then based on the target time range, search for target log information in the terminal log corresponding to the target terminal that is consistent with the target IP address and destination port in the five-tuple, and determine the corresponding target terminal program based on the target log information.

[0008] Optionally, the step of performing bidirectional traversal upwards and downwards on the anchor process based on the identifier information, and constructing a candidate attack chain set using the obtained traversal results, includes: The anchor process is determined as the first current process, and the parent process is obtained by traversing upwards based on the process identifier in the identifier information of the first current process. The parent process is determined as the new first current process, and then the process jumps to the step of traversing upwards based on the process identifier in the identifier information of the first current process until the first target stopping condition is met, so as to obtain each parent process. The anchor process is determined as the second current process, and the process identifier in the identifier information of the second current process is traversed downwards to obtain the child process; The subprocess is identified as the new second current process, and then the process is traversed downwards based on the process identifier in the identifier information of the second current process until the second target stopping condition is met, so as to obtain each subprocess. The child process and the parent process are pruned based on a preset pruning strategy and a whitelist of processes to obtain the target process; the whitelist of processes includes browser processes. Each candidate attack chain is constructed using the anchor process and the target process, and a candidate attack chain set is constructed based on each candidate attack chain.

[0009] Optionally, the step of performing multi-dimensional scoring on each candidate attack chain in the candidate attack chain set to obtain a basic score for each target includes: Threat level scores are assigned to each node in each candidate attack chain within the candidate attack chain set to obtain a first score result; the nodes include process nodes, file nodes, network connection nodes, and domain name nodes; Threat intelligence hit score is performed on each node in each of the candidate attack chains to obtain a second score result, and attack link depth score is performed on each node in each of the candidate attack chains to obtain a third score result. Based on the first scoring result, the second scoring result, and the third scoring result, and combined with the weights corresponding to each scoring result, each basic scoring result is determined, and each basic scoring result is normalized to obtain each target basic score.

[0010] Optionally, the attention enhancement of target nodes in the candidate attack chain that meet the target conditions to obtain corresponding attention enhancement scores includes: Attention enhancement is performed based on the indicator function and the target threat level and threat intelligence hit status of each node in the candidate attack chain to obtain the corresponding attention weights; The attention enhancement score is determined using the attention weights and the threat level weights corresponding to the target threat levels of each node.

[0011] Optionally, the combination of the base score and the attention enhancement score to obtain the target score for each candidate attack chain, the determination of the target attack path based on the candidate attack chain with the highest target score, and the construction of a corresponding attack tracing graph based on the target attack path, includes: The target score for each candidate attack chain is determined based on the base score, the attention enhancement score, and the preset global balance parameters. The candidate attack chain with the highest target score is identified as the target attack chain, and the corresponding target attack path is determined based on the target attack chain. A corresponding attack tracing graph is constructed based on the target attack path. The target score corresponding to the target attack chain is not less than the target threshold.

[0012] Secondly, this application provides a network attack attribution mapping construction device, comprising: The target terminal determination module is used to extract network alarm events to obtain alarm feature vectors, and determine the target terminal corresponding to the network alarm event based on the five-tuple in the alarm feature vector and using the enterprise asset management database; the alarm feature vector includes a five-tuple and an alarm trigger timestamp; The target program determination module is used to determine the target terminal program corresponding to the network alarm event based on the terminal logs of the target terminal within a target time range, identify the target terminal program as the anchor process, and record the identifier information corresponding to the anchor process; the identifier information includes a process identifier and a source identifier. The attack chain scoring module is used to perform bidirectional traversal of the anchor process upwards and downwards based on the identifier information, construct a candidate attack chain set using the obtained traversal results, perform multi-dimensional scoring on each candidate attack chain in the candidate attack chain set to obtain a basic score for each target, and perform attention enhancement on target nodes in the candidate attack chains that meet the target conditions to obtain a corresponding attention enhancement score; the multi-dimensional scoring includes threat level score, threat intelligence hit score, and attack chain depth score; The attack graph construction module is used to combine the basic score and the attention enhancement score to obtain the target score of each candidate attack chain, determine the target attack path based on the candidate attack chain with the highest target score, and construct the corresponding attack tracing graph based on the target attack path.

[0013] Thirdly, this application provides an electronic device, comprising: Memory, used to store computer programs; A processor is used to execute the computer program to implement the aforementioned method for constructing a network attack attribution map.

[0014] Fourthly, this application provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned method for constructing a network attack attribution map.

[0015] This application extracts network alarm events to obtain alarm feature vectors. Based on the five-tuple in the alarm feature vector and using an enterprise asset management database, it determines the target terminal corresponding to the network alarm event. The alarm feature vector includes a five-tuple and an alarm trigger timestamp. Based on the terminal logs of the target terminal within a target time range, it determines the target terminal program corresponding to the network alarm event, identifies the target terminal program as an anchor process, and records the identifier information corresponding to the anchor process. The identifier information includes a process identifier and a source identifier. Based on the identifier information, it performs bidirectional traversal upwards and downwards on the anchor process. A candidate attack chain set is constructed using the obtained traversal results. Each candidate attack chain in the set is then scored in multiple dimensions to obtain a basic target score. Attention enhancement is applied to target nodes in the candidate attack chains that meet the target conditions to obtain corresponding attention enhancement scores. The multi-dimensional scores include threat level score, threat intelligence hit score, and attack link depth score. The basic scores and attention enhancement scores are combined to obtain a target score for each candidate attack chain. The target attack path is determined based on the candidate attack chain with the highest target score, and a corresponding attack tracing graph is constructed based on the target attack path.

[0016] As can be seen from the above, this application's enterprise asset management database and five-tuple accurately locate the correct endpoints and processes. Based on the anchor process, it performs bidirectional traversal upwards and downwards to construct a set of candidate attack chains, reconstructing all possible attack processes. A multi-dimensional score is obtained by evaluating threat level, threat intelligence hit rate, and link depth to arrive at the target's basic score. Attention enhancement is then applied to target nodes that meet the target criteria to obtain an enhanced score. This precise scoring highlights attack chains containing core malicious nodes. The two scores are combined to obtain the target score. In this way, the target attack path is determined based on the candidate attack chain with the highest target score, thereby constructing an attack tracing graph. This makes the attack entry point, propagation path, malicious behavior, and attack endpoint a clear and visualized route, significantly improving the efficiency and accuracy of tracing, and making security incident response more efficient and precise. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0018] Figure 1 This application discloses a flowchart of a method for constructing a network attack attribution map. Figure 2 This is a schematic diagram of a network attack attribution mapping device disclosed in this application; Figure 3 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] Currently, existing technologies employ fuzzy matching schemes based on IP address and time. This means that if an IP address appears in the terminal logs at a similar time, these terminal events are associated with network alarms and displayed to the user. However, this approach has a high probability of incorrectly associating normal system process traffic with malicious attack traffic, leading to inaccurate attribution results. Additionally, there are schemes that group or collapse alarms according to preset fixed rules. Alarms within the same group are treated as a single security event, but there is a lack of further correlation between different groups, hindering in-depth attribution. To address this, this application provides a method for constructing a network attack attribution graph. Based on the candidate attack chain with the highest target score, the method determines the target attack path and then constructs an attack attribution graph. This creates a clear and visualized route for the attack's entry point, propagation path, malicious behavior, and attack endpoint, significantly improving attribution efficiency and accuracy, and making security emergency response more efficient and precise.

[0021] See Figure 1 As shown in the figure, an embodiment of the present invention discloses a method for constructing a network attack attribution map, including: Step S11: Extract network alarm events to obtain alarm feature vectors. Based on the five-tuple in the alarm feature vector and using the enterprise asset management database, determine the target terminal corresponding to the network alarm event. The alarm feature vector includes a five-tuple and an alarm trigger timestamp.

[0022] In this embodiment, when the network-side detection engine detects a threat and generates a corresponding network alarm event, a source tracing task is initiated. This involves extracting an alarm feature vector, including a five-tuple and an alarm trigger timestamp, from the network alarm event. Based on the source IP address in the five-tuple, the system determines whether a program identifier (AgentID) corresponding to the source IP address exists in the enterprise asset management database. If not, the network alarm event is marked as a pure network alarm, and terminal-side association and subsequent source tracing operations are stopped. If it exists, the system determines the specific source target terminal of the network alarm event based on the program identifier. The target terminal includes computers and servers.

[0023] Specifically, determining the target terminal corresponding to the network alarm event based on the five-tuple in the alarm feature vector and using the enterprise asset management database includes: obtaining the source IP address in the five-tuple of the alarm feature vector; determining whether a program identifier corresponding to the source IP address exists in the enterprise asset management database; if a program identifier corresponding to the source IP address exists, determining the target terminal based on the program identifier; if no program identifier corresponding to the source IP address exists, stopping the tracing operation for the network alarm event.

[0024] Step S12: Based on the terminal logs of the target terminal within the target time range, determine the target terminal program corresponding to the network alarm event, identify the target terminal program as the anchor process, and record the identifier information corresponding to the anchor process; the identifier information includes a process identifier and a source identifier.

[0025] In this embodiment, considering the potential delays in network transmission, a flexible time window, i.e., a target time range, is set, such as three minutes before and after the alarm trigger time, or it can be set according to the actual situation. Then, the terminal log corresponding to the target terminal is obtained. The terminal log can be an EDR (Endpoint Detection and Response) log library. It is determined whether the terminal log exists within the target time range and the target log information is consistent with the source port, destination port, and transport layer protocol in the five-tuple. In particular, for special cases such as possible port rewriting, the conditions can be appropriately relaxed, for example, whether the target log information is consistent with the destination port and destination IP in the five-tuple exists. If it exists, the corresponding target terminal program is determined based on the target log information. If it is still determined not to exist after relaxing the conditions, the reason for the source tracing failure is recorded, such as missing logs or no corresponding target terminal, for relevant maintenance personnel to troubleshoot. After obtaining the target terminal program, it is used as the anchor process, and the unique identifier information of the anchor process is recorded. The identifier information includes the process identifier ProcessGUID and the source tracing identifier TraceID.

[0026] Specifically, determining the target terminal program corresponding to the network alarm event based on the terminal logs of the target terminal within the target time range includes: determining the target time range based on the alarm trigger timestamp; determining whether there is target log information in the terminal logs corresponding to the target terminal that is consistent with the source port, destination port, and transport layer protocol in the five-tuple based on the target time range; if it exists, determining the corresponding target terminal program based on the target log information; if it does not exist, searching for target log information in the terminal logs corresponding to the target terminal that is consistent with the target IP address and destination port in the five-tuple based on the target time range, and determining the corresponding target terminal program based on the target log information.

[0027] Step S13: Based on the identifier information, the anchor process is traversed bidirectionally upwards and downwards, and a candidate attack chain set is constructed using the obtained traversal results. Each candidate attack chain in the candidate attack chain set is scored in multiple dimensions to obtain a basic target score. Attention enhancement is performed on target nodes in the candidate attack chains that meet the target conditions to obtain a corresponding attention enhancement score. The multi-dimensional scores include threat level score, threat intelligence hit score, and attack link depth score.

[0028] In this embodiment, after obtaining the identifier information corresponding to the anchor process, the process identifier of the anchor process is determined as the current process identifier. The terminal log is searched for records where "parent process identifier = current process identifier" to find the parent process. The process identifier corresponding to the found parent process is determined as the new current process identifier, and the search continues upwards until the target program is found, such as explorer.exe (Windows Explorer) or the system core program System; or if no new parent process is found after traversing a first preset number of layers, the first target stopping condition is met, thus obtaining all parent processes. The first preset number of layers can be set according to actual conditions. It is worth mentioning that if log gaps cause interruptions in the backtracking process, the backtracking operation will not stop. Instead, a virtual node marked "Unknown" is inserted as a placeholder, and the process chain is attempted to continue upwards by crossing this process node to ensure the integrity of the attack chain. The virtual node can be represented by a dashed line on the interface.

[0029] Understandably, the process identifier of the anchor process is used as the current process identifier, and a downward traversal is performed to obtain each child process corresponding to the anchor process. Simultaneously, the sensitive behavior logs of the anchor process are searched, including operations highly related to security events such as file creation / modification, registry modification, and DNS queries (Domain Name System). For each child process, it is used as the new current process identifier, and the downward traversal continues to search for the corresponding child process and the corresponding sensitive behavior log, until the traversal depth reaches a second preset level or no sensitive behavior log is found. This indicates that the second target stopping condition is met, thus obtaining each child process. To prevent irrelevant branches from causing the attack chain to become too large, a whitelist of processes can be pre-defined. The whitelist of processes can include browser processes and update programs. If the anchor process belongs to any of the whitelisted processes, only processes that meet the target high-risk conditions are retained from the child processes and the parent process to obtain the target process. The target process can include abnormal processes or processes loading sensitive / malicious behaviors. Based on the target process and the anchor process, multiple candidate attack chains centered on the anchor process are constructed, thereby constructing a candidate attack chain set.

[0030] Specifically, the step of performing bidirectional upward and downward traversal of the anchor process based on the identifier information and constructing a candidate attack chain set using the obtained traversal results includes: determining the anchor process as the first current process, traversing upward based on the process identifier in the identifier information of the first current process to obtain the parent process; determining the parent process as the new first current process, and then jumping to the step of traversing upward based on the process identifier in the identifier information of the first current process until the first target stopping condition is met to obtain each parent process; determining the anchor process as the second current process, traversing downward based on the process identifier in the identifier information of the second current process to obtain the child process; determining the child process as the new second current process, and then jumping to the step of traversing downward based on the process identifier in the identifier information of the second current process until the second target stopping condition is met to obtain each child process; pruning the child process and the parent process based on a preset pruning strategy and a whitelist process to obtain the target process; the whitelist process includes browser processes; constructing each candidate attack chain using the anchor process and the target process, and constructing a candidate attack chain set based on each candidate attack chain.

[0031] In this embodiment, each node in each candidate attack chain in the candidate attack chain set can be a process node, file node, network connection node, or domain name node, and includes the following attributes: threat level; whether it hits threat intelligence, i.e., whether it is an existing malicious IP / domain; node timestamp; and node type (process / file / network / domain). Threat level scores are applied to each node in each candidate attack chain to obtain a first score result. In one specific implementation, if the threat level of a node is divided into three levels—high-risk, medium-risk, and low-risk—the corresponding level weights can be: high-risk weight 100, medium-risk weight 50, and low-risk weight 10. The formula for the threat level score is as follows: ; in, This is the i-th candidate attack chain; Threat level of the node The corresponding weights; if there is a high-risk node in the candidate attack chain, the second score of the candidate attack chain is calculated according to the high-risk level.

[0032] It is understandable that a threat intelligence hit score is calculated for each node in each of the candidate attack chains, and the corresponding formula is as follows: ; in, The second score result corresponds to the threat intelligence hit score; if there is a node in the candidate attack chain that hits an IOC (Indicators of Compromise, i.e., intrusion indicators in threat intelligence), the second score result is 1; otherwise, it is 0. Then, an attack link depth score is performed on each node in each candidate attack chain, using the following formula: ; in, Let i be the i-th candidate attack chain; the third score obtained is determined based on the number of nodes in the candidate attack chain. The more nodes there are, the higher the score corresponding to the third score.

[0033] Furthermore, based on the first scoring result, the second scoring result, and the third scoring result, and in combination with the weights corresponding to each scoring result, a basic scoring result is determined, and the corresponding formula is as follows: ; in, This is the first scoring result; This is the second scoring result; This is the third scoring result; , , These represent the weights corresponding to each scoring result. After obtaining the basic scoring results, considering the significant differences in log density and alarm quantity under different security environments, and to avoid any one dimension naturally dominating, the basic scoring results are normalized. The corresponding formula is as follows: ; in, The basic scoring result; To prevent extremely small constants with a denominator of zero, the above normalization process does not rely on the alarm value system of a specific vendor, but is based solely on relative sorting. Therefore, it can be adapted to data from different vendors or types of network security tools.

[0034] Specifically, the step of performing multi-dimensional scoring on each candidate attack chain in the candidate attack chain set to obtain a basic score for each target includes: scoring each node in each candidate attack chain in the candidate attack chain set with a threat level to obtain a first scoring result; the nodes include process nodes, file nodes, network connection nodes, and domain name nodes; scoring each node in each candidate attack chain with a threat intelligence hit rate to obtain a second scoring result; scoring each node in each candidate attack chain with an attack link depth to obtain a third scoring result; determining each basic scoring result based on the first scoring result, the second scoring result, and the third scoring result, combined with the weights corresponding to each scoring result; and normalizing each basic scoring result to obtain a basic score for each target.

[0035] In this embodiment, after obtaining the target base score, in order to further distinguish candidate attack chains with similar scores, a corresponding attention weight is defined for each node in each candidate attack chain, and the corresponding formula is as follows: ; in, Let be the attention weight of the j-th node in the i-th candidate attack chain; Threat level of the node The corresponding weights; For nodes Corresponding threat level; A configurable threat level attention coefficient; Configurable threat intelligence hit attention coefficient; This is the IOC indicator function; it is 1 if the threat intelligence is accurate, and 0 otherwise. The score for each candidate attack chain is re-determined based on the attention weights, i.e., the attention enhancement score, and the corresponding formula is as follows: ; in, The attention weights; Threat level of the node The corresponding weights.

[0036] Specifically, the step of enhancing the attention of target nodes in the candidate attack chain that meet the target conditions to obtain a corresponding attention enhancement score includes: enhancing the attention based on the indicator function and the target threat level and threat intelligence hit status of each node in the candidate attack chain to obtain a corresponding attention weight; and determining the attention enhancement score using the attention weight and the threat level weight corresponding to the target threat level of each node.

[0037] Step S14: Combine the basic score and the attention enhancement score to obtain the target score of each candidate attack chain, determine the target attack path based on the candidate attack chain with the highest target score, and construct the corresponding attack tracing map based on the target attack path.

[0038] In this embodiment, after obtaining the attention enhancement score, the base score and the attention enhancement score are combined to obtain the target score for each candidate attack chain, and the corresponding formula is as follows: ; in, The preset global balance parameter is set to 0.6 under the default configuration; Assign a basic score to the target; The normalized attention enhancement score is used. After obtaining the target scores corresponding to each of the candidate attack chains, the target attack chain is determined using the following formula: ; in, This refers to the target attack chain; This represents the maximum value of the function; The target score is determined by the above formula, which must satisfy two objective constraints. The first objective constraint is that the target score is not less than a target threshold, where the target threshold is a minimum confidence threshold and can be set according to actual conditions. The second objective constraint is that if the difference between the target scores of two or more candidate attack chains is less than a preset difference threshold, then the candidate attack chain with the earliest node timestamp is determined as the target attack chain. The node timestamp is the start timestamp of the candidate attack chain. The preset difference threshold can be set according to actual conditions.

[0039] Specifically, the step of combining the base score and the attention enhancement score to obtain the target score for each candidate attack chain, determining the target attack path based on the candidate attack chain with the highest target score, and constructing a corresponding attack tracing graph based on the target attack path includes: determining the target score for each candidate attack chain based on the base score, the attention enhancement score, and a preset global balance parameter; determining the candidate attack chain with the highest target score as the target attack chain, determining the corresponding target attack path based on the target attack chain, and constructing a corresponding attack tracing graph based on the target attack path; the target score corresponding to the target attack chain is not less than a target threshold.

[0040] It is understood that after obtaining the target attack chain, the corresponding target attack path is determined. The target attack path can be confirmed or corrected to obtain corresponding feedback results, and the scoring weights and attention coefficients are adjusted based on the feedback results. In one specific implementation, regarding the attention coefficients... The corresponding adjustment formula is as follows: ; in, This is the adjusted attention coefficient; Let be the attention coefficient for the t-th round of scoring; The learning rate; The feedback result takes a value of 0 or 1; The prediction confidence level is the degree of confidence in the target attack chain.

[0041] In this embodiment, after determining the target attack path, a corresponding attack tracing graph is constructed based on the target attack path and presented in the front-end 3D attack graph interface. In one specific implementation, the left panel displays a network topology overview, i.e., network relationships such as attack source, victim host, command and control nodes, and the right panel displays the detailed process tree of the selected terminal, i.e., the attack chain. When the user clicks on an attack connection line in the left network topology, such as the connection from host A to a malicious IP, the 3D process tree view on the right will automatically focus on the corresponding anchor process node and highlight the entire main tracing chain. The user can drag and zoom the 3D view to view node details. At the same time, a timeline control is provided, allowing users to replay the entire attack chain in chronological order, such as dynamically presenting the sequence from parent process startup to child process execution and then to network external connections, helping to understand the order of attacks. Additionally, hovering over any node on the user's device will display a details card for that entity, including the process's complete command-line arguments, file hash value, owner user, and process permission level. Hovering over a network node will display a summary of its IP address's geographic location, open ports, and communication traffic. For attack chains other than the target attack chain, a corresponding association list will be provided on the side of the interface, allowing users to view details of each attack chain to avoid missing any suspicious traces. Notably, machine learning models can be used to learn normal network and process behavior patterns, automatically clustering related events when abnormal patterns occur, without the need for preset association rules.

[0042] Furthermore, to illustrate the workflow of this solution more intuitively, a hypothetical attack scenario is used to demonstrate the construction process of the source map. In one specific implementation, an employee receives a phishing email containing a malicious macro. Upon opening it, the email triggers the execution of Office macro code. The macro releases a Trojan program locally and launches powershell.exe via the command line. At 16:05:00, the powershell.exe process then attempts to connect to a malicious domain name, evil.example.com, controlled by an attacker, and downloads more malicious payloads via HTTP. The network traffic detection module detects suspicious communication from the employee's host (IP: 10.0.0.5) to the malicious domain name and generates a high-risk alert at 16:05:02 (containing information such as source IP: 10.0.0.5, destination domain name: evil.example.com, destination IP: 8.8.8.8, destination port: 80, etc.). After the alarm was triggered, the aforementioned 5-tuple and timestamp features were extracted, and the asset database was queried to confirm that 10.0.0.5 corresponds to a host with EDR agent installed, AgentID=HOST123. Subsequently, the network connection records of HOST123 around 16:05 were searched in the EDR logs, and a log of an HTTP outbound connection initiated by the powershell.exe process at 16:05:00 was successfully found. Based on this, powershell.exe was determined to be the anchor process of this alarm. Starting from the anchor process GUID_abc123, its parent process chain was traced back: its parent process was found to be WINWORD.EXE (Word program, ProcessGUID=GUID_def456), and its parent process further back was explorer.exe (GUID=GUID_ghijk); traversing downwards, it was found that powershell.exe subsequently created a malicious file payload.exe and launched this executable file (child process GUID=GUID_xyz789). This completes the process chain: explorer.exe - WINWORD.EXE - powershell.exe - payload.exe, and records the important actions of each node, such as WINWORD launching PowerShell via a macro, and PowerShell downloading and launching the payload.

[0043] Additionally, around the same time, other network connection alerts appeared on the host, such as DNS queries in the operating system background, each anchoring to a process chain. However, scoring revealed that these chains only involved normal system behavior (low-risk alerts, no IOC, shallow chain depth), thus scoring significantly lower than the main chain mentioned above. Based on this, the system identified the malicious chain containing WINWORD-powershell as the primary source chain, and collapsed and hid other irrelevant chains, listing them only as reference clues in the sidebar. 3D Attack Graph: The left side highlights the network connection between the host (10.0.0.5) and the malicious domain (evil.example.com) in red; the right side displays the process tree on host HOST123, arranged sequentially from explorer.exe-WINWORD.EXE-powershell.exe-payload.exe, with key events marked, such as macros, external links, and file writes. Details of each node can be viewed along the chain, such as the name of the opened document pointed to by the command line of WINWORD.EXE, and the file hash value of payload.exe.

[0044] As can be seen from the above, this application's enterprise asset management database and five-tuple accurately locate the correct endpoints and processes. Based on the anchor process, it performs bidirectional traversal upwards and downwards to construct a set of candidate attack chains, reconstructing all possible attack processes. A multi-dimensional score is obtained by evaluating threat level, threat intelligence hit rate, and link depth to arrive at the target's basic score. Attention enhancement is then applied to target nodes that meet the target criteria to obtain an enhanced score. This precise scoring highlights attack chains containing core malicious nodes. The two scores are combined to obtain the target score. In this way, the target attack path is determined based on the candidate attack chain with the highest target score, thereby constructing an attack tracing graph. This makes the attack entry point, propagation path, malicious behavior, and attack endpoint a clear and visualized route, significantly improving the efficiency and accuracy of tracing, and making security incident response more efficient and precise.

[0045] Accordingly, see Figure 2 As shown, this application also provides a network attack attribution mapping construction device, comprising: The target terminal determination module 11 is used to extract network alarm events to obtain alarm feature vectors, and determine the target terminal corresponding to the network alarm event based on the five-tuple in the alarm feature vector and using the enterprise asset management database; the alarm feature vector includes a five-tuple and an alarm trigger timestamp; The target program determination module 12 is used to determine the target terminal program corresponding to the network alarm event based on the terminal log of the target terminal within the target time range, determine the target terminal program as the anchor process, and record the identifier information corresponding to the anchor process; the identifier information includes a process identifier and a source identifier. The attack chain scoring module 13 is used to perform bidirectional traversal of the anchor process upwards and downwards based on the identifier information, construct a candidate attack chain set using the obtained traversal results, perform multi-dimensional scoring on each candidate attack chain in the candidate attack chain set to obtain a basic score for each target, and perform attention enhancement on target nodes in the candidate attack chains that meet the target conditions to obtain a corresponding attention enhancement score; the multi-dimensional scoring includes threat level score, threat intelligence hit score, and attack chain depth score; The attack graph construction module 14 is used to combine the basic score and the attention enhancement score to obtain the target score of each candidate attack chain, determine the target attack path based on the candidate attack chain with the highest target score, and construct the corresponding attack tracing graph based on the target attack path.

[0046] In some specific embodiments, the target terminal determination module 11 may specifically include: The identifier determination unit is used to obtain the source IP address in the five-tuple of the alarm feature vector and determine whether there is a program identifier corresponding to the source IP address in the enterprise asset management database. A target terminal determination unit is configured to determine a target terminal based on a program identifier if a program identifier corresponding to the source IP address exists. The tracing operation unit is used to stop the tracing operation for the network alarm event if there is no program identifier corresponding to the source IP address.

[0047] In some specific embodiments, the target program determination module 12 may specifically include: The log information judgment unit is used to determine the target time range based on the alarm trigger timestamp, and to determine whether there is target log information in the terminal log corresponding to the target terminal that is consistent with the source port, destination port and transport layer protocol in the five-tuple based on the target time range. The target program determination unit is used to determine the corresponding target terminal program based on the target log information if the target program exists. The target information lookup unit is used to, if not found, search for target log information in the terminal log corresponding to the target terminal based on the target time range that is consistent with the target IP address and destination port in the five-tuple, and determine the corresponding target terminal program based on the target log information.

[0048] In some specific embodiments, the attack chain scoring module 13 may specifically include: The first identifier traversal unit is used to determine the anchor process as the first current process, and traverse upwards based on the process identifier in the identifier information of the first current process to obtain the parent process. The second identifier traversal unit is used to determine the parent process as the new first current process, and then jump to the step of traversing the process identifier upward based on the identifier information of the first current process until the first target stopping condition is met, so as to obtain each parent process. The third identifier traversal unit is used to determine the anchor process as the second current process, and traverse downwards based on the process identifier in the identifier information of the second current process to obtain the child process. The subprocess determination unit is used to determine the subprocess as a new second current process, and then jump to the step of traversing downwards based on the process identifier in the identifier information of the second current process until the second target stopping condition is met, so as to obtain each subprocess. A process pruning unit is used to prune the child process and the parent process based on a preset pruning strategy and a whitelist of processes to obtain the target process; the whitelist of processes includes browser processes. An attack chain set construction unit is used to construct each candidate attack chain using the anchor process and the target process, and to construct a candidate attack chain set based on each candidate attack chain.

[0049] In some specific embodiments, the attack chain scoring module 13 may specifically include: The first node scoring unit is used to score the threat level of each node in each candidate attack chain in the candidate attack chain set to obtain a first scoring result; the nodes include process nodes, file nodes, network connection nodes and domain name nodes; The second node scoring unit is used to perform threat intelligence hit scoring on each node in each of the candidate attack chains to obtain a second scoring result, and to perform attack link depth scoring on each node in each of the candidate attack chains to obtain a third scoring result. The scoring result normalization unit is used to determine each basic scoring result based on the first scoring result, the second scoring result, and the third scoring result, combined with the weights corresponding to each scoring result, and to normalize each basic scoring result to obtain each target basic score.

[0050] In some specific embodiments, the attack chain scoring module 13 may specifically include: The attention weight determination unit is used to perform attention enhancement based on the indicator function and the target threat level and threat intelligence hit status of each node in the candidate attack chain, so as to obtain the corresponding attention weight; The attention scoring determination unit is used to determine the attention enhancement score by using the attention weight and the threat level weight corresponding to the target threat level of each node.

[0051] In some specific embodiments, the attack graph construction module 14 may specifically include: The target scoring determination unit is used to determine the target score of each of the candidate attack chains based on the base score, the attention enhancement score, and the preset global balance parameters. The graph construction unit is used to identify the candidate attack chain with the highest target score as the target attack chain, determine the corresponding target attack path based on the target attack chain, and construct a corresponding attack tracing graph based on the target attack path; the target score corresponding to the target attack chain is not less than the target threshold.

[0052] Furthermore, embodiments of this application also disclose an electronic device, Figure 3 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the network attack attribution mapping construction method disclosed in any of the foregoing embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0053] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0054] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0055] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the network attack attribution mapping construction method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0056] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned method for constructing a network attack attribution map. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0057] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0058] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0059] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0060] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0061] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for constructing a network attack attribution map, characterized in that, include: Network alarm events are extracted to obtain alarm feature vectors. Based on the five-tuple in the alarm feature vector and using the enterprise asset management database, the target terminal corresponding to the network alarm event is determined. The alarm feature vector includes a five-tuple and an alarm trigger timestamp. Based on the terminal logs of the target terminal within the target time range, the target terminal program corresponding to the network alarm event is determined, the target terminal program is identified as the anchor process, and the identifier information corresponding to the anchor process is recorded; the identifier information includes a process identifier and a source identifier. Based on the identifier information, the anchor process is traversed bidirectionally upwards and downwards, and a candidate attack chain set is constructed using the obtained traversal results. Each candidate attack chain in the candidate attack chain set is scored in multiple dimensions to obtain a basic score for each target. Attention enhancement is performed on target nodes in the candidate attack chains that meet the target conditions to obtain a corresponding attention enhancement score. The multi-dimensional scores include threat level score, threat intelligence hit score, and attack link depth score. The base score and the attention enhancement score are combined to obtain the target score for each candidate attack chain. The target attack path is determined based on the candidate attack chain with the highest target score, and the corresponding attack tracing graph is constructed based on the target attack path.

2. The method for constructing a network attack attribution map according to claim 1, characterized in that, The step of determining the target terminal corresponding to the network alarm event based on the five-tuple in the alarm feature vector and using the enterprise asset management database includes: Obtain the source IP address from the quintuple in the alarm feature vector, and determine whether there is a program identifier corresponding to the source IP address in the enterprise asset management database; If a program identifier corresponding to the source IP address exists, the target terminal is determined based on the program identifier; If no program identifier exists corresponding to the source IP address, the tracing operation for the network alarm event is stopped.

3. The method for constructing a network attack attribution map according to claim 1, characterized in that, The procedure for determining the target terminal corresponding to the network alarm event based on the terminal logs of the target terminal within the target time range includes: Based on the alarm trigger timestamp, a target time range is determined, and based on the target time range, it is determined whether there is target log information in the terminal log corresponding to the target terminal that is consistent with the source port, destination port and transport layer protocol in the five-tuple. If it exists, the corresponding target terminal program is determined based on the target log information; If it does not exist, then based on the target time range, search for target log information in the terminal log corresponding to the target terminal that is consistent with the target IP address and destination port in the five-tuple, and determine the corresponding target terminal program based on the target log information.

4. The method for constructing a network attack attribution map according to claim 1, characterized in that, The step of performing a bidirectional traversal of the anchor process upwards and downwards based on the identifier information, and constructing a candidate attack chain set using the obtained traversal results, includes: The anchor process is determined as the first current process, and the parent process is obtained by traversing upwards based on the process identifier in the identifier information of the first current process. The parent process is determined as the new first current process, and then the process jumps to the step of traversing upwards based on the process identifier in the identifier information of the first current process until the first target stopping condition is met, so as to obtain each parent process. The anchor process is determined as the second current process, and the process identifier in the identifier information of the second current process is traversed downwards to obtain the child process; The subprocess is identified as the new second current process, and then the process is traversed downwards based on the process identifier in the identifier information of the second current process until the second target stopping condition is met, so as to obtain each subprocess. The child process and the parent process are pruned based on a preset pruning strategy and a whitelist of processes to obtain the target process; the whitelist of processes includes browser processes. Each candidate attack chain is constructed using the anchor process and the target process, and a candidate attack chain set is constructed based on each candidate attack chain.

5. The method for constructing a network attack attribution map according to claim 1, characterized in that, The process of performing multi-dimensional scoring on each candidate attack chain in the candidate attack chain set to obtain a basic score for each target includes: Threat level scores are assigned to each node in each candidate attack chain within the candidate attack chain set to obtain a first score result; the nodes include process nodes, file nodes, network connection nodes, and domain name nodes; Threat intelligence hit score is performed on each node in each of the candidate attack chains to obtain a second score result, and attack link depth score is performed on each node in each of the candidate attack chains to obtain a third score result. Based on the first scoring result, the second scoring result, and the third scoring result, and combined with the weights corresponding to each scoring result, each basic scoring result is determined, and each basic scoring result is normalized to obtain each target basic score.

6. The method for constructing a network attack attribution map according to claim 5, characterized in that, The process of enhancing the attention of target nodes in the candidate attack chain that meet the target conditions to obtain corresponding attention enhancement scores includes: Attention enhancement is performed based on the indicator function and the target threat level and threat intelligence hit status of each node in the candidate attack chain to obtain the corresponding attention weights; The attention enhancement score is determined using the attention weights and the threat level weights corresponding to the target threat levels of each node.

7. The method for constructing a network attack attribution map according to any one of claims 1 to 6, characterized in that, The process involves combining the base score and the attention enhancement score to obtain a target score for each candidate attack chain, determining the target attack path based on the candidate attack chain with the highest target score, and constructing a corresponding attack tracing graph based on the target attack path, including: The target score for each candidate attack chain is determined based on the base score, the attention enhancement score, and the preset global balance parameters. The candidate attack chain with the highest target score is identified as the target attack chain, and the corresponding target attack path is determined based on the target attack chain. A corresponding attack tracing graph is constructed based on the target attack path. The target score corresponding to the target attack chain is not less than the target threshold.

8. A network attack attribution mapping construction device, characterized in that, include: The target terminal determination module is used to extract network alarm events to obtain alarm feature vectors, and determine the target terminal corresponding to the network alarm event based on the five-tuple in the alarm feature vector and using the enterprise asset management database; the alarm feature vector includes a five-tuple and an alarm trigger timestamp; The target program determination module is used to determine the target terminal program corresponding to the network alarm event based on the terminal logs of the target terminal within a target time range, identify the target terminal program as the anchor process, and record the identifier information corresponding to the anchor process; the identifier information includes a process identifier and a source identifier. The attack chain scoring module is used to perform bidirectional traversal of the anchor process upwards and downwards based on the identifier information, construct a candidate attack chain set using the obtained traversal results, perform multi-dimensional scoring on each candidate attack chain in the candidate attack chain set to obtain a basic score for each target, and perform attention enhancement on target nodes in the candidate attack chains that meet the target conditions to obtain a corresponding attention enhancement score; the multi-dimensional scoring includes threat level score, threat intelligence hit score, and attack chain depth score; The attack graph construction module is used to combine the basic score and the attention enhancement score to obtain the target score of each candidate attack chain, determine the target attack path based on the candidate attack chain with the highest target score, and construct the corresponding attack tracing graph based on the target attack path.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the network attack attribution mapping construction method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store computer programs, wherein the computer programs, when executed by a processor, implement the network attack attribution mapping construction method as described in any one of claims 1 to 7.

Images