Attack path restoration method and device, electronic equipment and storage medium

Abstract

This invention proposes an attack path reconstruction method, apparatus, electronic device, and storage medium, relating to the field of information security. The method constructs an original tracing graph containing operational events and their relationships, and generates a weighted tracing graph by assigning weights to the edges. Based on this, multiple semantically coherent candidate communities are formed through community partitioning and topology reconstruction. By identifying target communities highly correlated with attack behavior and based on the attack entities and their time-series relationships within these communities, a complete path representing the attack evolution process is reconstructed. This enhances the accuracy and interpretability of attack tracing, solving problems such as low analysis efficiency and difficulty in upstream and downstream correlation caused by dependency explosion and information fragmentation in traditional methods. This more efficiently supports security incident review and defense system optimization.

Description

Technical Field

[0001] This invention relates to the field of information security, specifically to an attack path reconstruction method, apparatus, electronic device, and storage medium. Background Technology

[0002] As information systems continue to expand in scale and cyberattack methods evolve, tracing and analyzing the origins of complex attacks has become a crucial aspect of cybersecurity protection. During security incident response, accurately reconstructing the attacker's behavioral path is essential for understanding attack intent, assessing the scope of impact, and strengthening defense systems.

[0003] In existing technologies, attack paths are typically deduced by collecting operation logs from hosts or network devices, extracting interaction behaviors between entities such as processes, files, and network connections, and constructing dependency graphs or source graphs that reflect the system's operational status. These methods can, to some extent, reveal the logical relationships of attack propagation, assisting security personnel in making judgments.

[0004] However, due to the large number of normal business activities within information systems, the operational events are dense and complex, and the resulting source graphs often contain massive amounts of nodes and edge relationships. In this context, key attack-related clues are easily buried in redundant information, leading to low analysis efficiency and difficulty in quickly locating truly suspicious behavioral sequences. Summary of the Invention

[0005] In view of this, the purpose of the present invention is to provide an attack path reconstruction method, apparatus, electronic device and storage medium.

[0006] To achieve the above objectives, the technical solutions adopted in the embodiments of the present invention are as follows: In a first aspect, the present invention provides an attack path reconstruction method, the method comprising: Based on multiple operational events generated during the operation of the information system and the relationships between these multiple operational events, an original source map is constructed. Assign weights to each edge in the original source graph to generate a weighted source graph; The weighted source graph is divided into communities and its topology is reconstructed to obtain multiple candidate communities; Identify the target communities associated with the attack behavior from the plurality of candidate communities; Based on the attacking entities in the target community, an attack path representing the attack evolution process is generated.

[0007] Optionally, the step of assigning weights to each edge in the original source graph to generate a weighted source graph includes: Extract the feature vector of each edge in the original source graph; The feature vector of each edge in the original source graph is input into the pre-trained regression model to obtain the weight vector; The weight of each edge in the original source graph is determined based on the weight vector and the feature vector of each edge in the original source graph, thus obtaining the weighted source graph.

[0008] Optionally, the step of performing community partitioning and topological reconstruction on the weighted source graph to obtain multiple candidate communities includes: Each node in the weighted sourcing graph is initialized as a community, and a queue of nodes to be processed is constructed; When the queue of nodes to be processed is not empty, calculate the migration gain corresponding to the community of each neighbor node of the current node in the queue of nodes to be processed. Based on the migration gain of each neighboring node in the community of the current node, perform a community migration operation on the current node; After completing the community migration operation for the current node, the current node is removed from the queue of nodes to be processed, and the process returns to the step of calculating the migration gain corresponding to the communities of each neighbor node of the current node in the queue of nodes to be processed, until the queue of nodes to be processed is empty, and the first community division result is obtained. A connectivity analysis is performed on each community in the first community division result, and based on the connectivity analysis result of each community, node re-migration processing is performed on each community to obtain the second community division result; The nodes of each community in the second community division result are aggregated to obtain multiple candidate communities.

[0009] Optionally, the step of performing a migration operation on the current node based on the migration gain corresponding to the communities where each of the current node's neighboring nodes is located further includes: If there is a reference community with positive migration gain among the communities of all the neighboring nodes of the current node, then the current node will be migrated to the reference community.

[0010] Optionally, the step of performing node re-migration processing on each community based on the connectivity analysis results of each community to obtain the second community division result includes: For each community in the first community partitioning structure, if there is a target node in the community that affects the connectivity of the community, then obtain the migration gain corresponding to the community where each neighbor node of the target node is located. Based on the migration gain corresponding to the community of each neighboring node of the target node, a community migration operation is performed on the target node; By iterating through each community in the first community division result, the second community division result is obtained.

[0011] Optionally, the step of identifying the target community associated with the attack from the plurality of candidate communities includes: Using known attack entities as symptom nodes, obtain the association score between each candidate community and the symptom node; Candidate communities whose association scores are greater than a preset threshold are selected as target communities.

[0012] Optionally, the step of generating an attack path characterizing the attack evolution process based on the attacking entities in the target community includes: Based on the neighborhood graph of each attacking entity in the target community, extract action events that are directly connected to each attacking entity and whose action type belongs to a preset attack mode; The attack path is generated by globally sorting each action event in ascending order based on its timestamp, thus representing the temporal evolution of the attack.

[0013] Secondly, the present invention provides an attack path reconstruction device, the device comprising: The construction module is used to construct the original traceability diagram based on multiple operation events generated during the operation of the information system and the relationships between these multiple operation events; The restoration module is used to assign weights to each edge in the original source graph to generate a weighted source graph; perform community division and topology reconstruction on the weighted source graph to obtain multiple candidate communities; identify target communities related to the attack behavior from the multiple candidate communities; and generate attack paths representing the attack evolution process based on the attack entities in the target communities.

[0014] Thirdly, the present invention provides an electronic device including a processor and a memory, wherein the memory stores machine-executable instructions that can be executed by the processor, and the processor can execute the machine-executable instructions to implement the attack path reconstruction method described in any of the foregoing embodiments.

[0015] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the attack path reconstruction method as described in any of the foregoing embodiments.

[0016] The attack path reconstruction method, apparatus, electronic device, and storage medium provided in this invention construct an original source graph based on multiple operational events generated during the operation of an information system and the relationships between these events. A weighted source graph is generated by assigning weights to each edge in the original source graph. The weighted source graph is then divided into communities and its topology is reconstructed to obtain multiple candidate communities. Target communities related to the attack behavior are identified from these candidate communities. Based on the attack entities within the target communities, an attack path representing the attack evolution process is generated. Because this invention constructs an original source graph containing operational events and their relationships, and assigns weights to the edges to generate a weighted source graph; based on this, multiple semantically coherent candidate communities are formed through community division and topology reconstruction; by identifying target communities highly related to the attack behavior, and based on the attack entities within these communities and their time-series relationships, a complete path representing the attack evolution process is reconstructed, thereby enhancing the accuracy and interpretability of attack tracing. This solves the problems of low analysis efficiency and difficulty in upstream and downstream correlation caused by dependency explosion and information fragmentation in traditional methods, thus more efficiently supporting security incident review and defense system optimization.

[0017] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This figure shows a schematic block diagram of an electronic device provided by an embodiment of the present invention; Figure 2 A flowchart illustrating an attack path reconstruction method provided by an embodiment of the present invention is shown. Figure 3 This diagram illustrates an example of a community division process provided by an embodiment of the present invention. Figure 4 An example diagram of an attack entity provided by an embodiment of the present invention is shown; Figure 5 An example diagram of an attack event provided by an embodiment of the present invention is shown; Figure 6 An example diagram of an attack path provided by an embodiment of the present invention is shown; Figure 7The diagram shows a functional block diagram of an attack path reconstruction device provided in an embodiment of the present invention.

[0020] Icons: 100 - Electronic device; 110 - Memory; 120 - Processor; 130 - Communication module; 200 - Attack path reconstruction device; 201 - Building module; 202 - Reconstruction module. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0022] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0023] It should be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0024] In the current field of information system security monitoring and threat attribution, with the increasing complexity of the network environment and the continuous evolution of attack methods, traditional log analysis and event correlation methods are no longer able to meet the needs of accurate attribution of complex attack behaviors such as advanced persistent threats.

[0025] In existing technologies, source graphs are typically constructed by collecting fine-grained operation events generated during the operation of hosts or network devices, such as system calls, process operations, file accesses, and network connections. These events are used to record and characterize the dynamic behavior evolution of the system. Nodes represent entities (e.g., processes, files, IP addresses) and edges represent operation relationships. However, in practical applications, due to the massive number of operation events generated per second by information systems, the original source graphs are often enormous and complex, containing numerous redundant dependencies arising from normal business activities, leading to a severe "dependency explosion" problem. This high-noise environment not only significantly increases the storage and computational overhead of graph data but also causes critical attack clues to be submerged in a sea of ​​unrelated activities, making it difficult to effectively correlate upstream and downstream attack actions.

[0026] To further enhance the analyzability of source graphs, some existing methods attempt to introduce edge weighting mechanisms, statically weighting edges in the graph based on event type, contextual semantics, or statistical frequency to distinguish the importance of different relationships. However, these methods often employ fixed rules or heuristic strategies, making it difficult to accurately reflect the dynamically changing strength of causal dependencies in real-world scenarios.

[0027] More importantly, most existing attack path reconstruction techniques rely on human experience to select the starting attack point and expand along the graph through methods such as depth-first search. This makes them highly susceptible to interference from irrelevant branches, resulting in false alarms. Furthermore, they are difficult to automatically identify covert attack springboard behaviors that cross hosts and processes.

[0028] Meanwhile, most methods fail to fully integrate temporal information, neglecting the temporal constraints of operation sequences in path ranking and causal inference, resulting in generated attack paths that do not conform to the actual attack timing logic. Therefore, how to effectively extract subgraph structures highly related to attack behavior from the noisy and strongly coupled original attribution graph, and reconstruct accurate and coherent attack evolution paths based on semantic aggregation and temporal evolution mechanisms, has become a pressing technical challenge in the field of cybersecurity attribution.

[0029] Therefore, embodiments of the present invention propose an attack path reconstruction method, apparatus, electronic device, and storage medium, which will be described below.

[0030] Please refer to Figure 1 This is a block diagram of electronic device 100. Electronic device 100 includes a memory 110, a processor 120, and a communication module 130. The memory 110, processor 120, and communication module 130 are electrically connected to each other directly or indirectly to realize data transmission or interaction. For example, these components can be electrically connected to each other through one or more communication buses or signal lines.

[0031] The memory 110 is used to store programs or data. The memory 110 may be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc.

[0032] The processor 120 is used to read / write data or programs stored in the memory 110 and to perform corresponding functions.

[0033] The communication module 130 is used to establish a communication connection between the electronic device 100 and other communication terminals via a network, and to send and receive data via the network.

[0034] It should be understood that, Figure 1 The structure shown is only a schematic diagram of the electronic device 100. The electronic device 100 may also include components that are larger than... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown. Figure 1 The components shown can be implemented using hardware, software, or a combination thereof.

[0035] Please refer to Figure 2 The attack path restoration method provided in this embodiment of the invention includes steps S101 to S105.

[0036] S101. Based on the multiple operation events generated during the operation of the information system and the relationships between these operation events, construct the original source map.

[0037] In this embodiment of the invention, atomic-level operation events that occur during the operation of the information system are first collected in real time by security probes (such as EDR agents, system audit modules, kernel-level Hook mechanisms, etc.) deployed on the host or network boundary.

[0038] Operation events include, but are not limited to: process creation, file reading and writing, registry modification, network connection establishment, code injection, privilege escalation, user account changes, etc.

[0039] Each operation event can be represented as a quintuple (s, o, p, d, t), where s represents the subject (e.g., a process), o represents the object (e.g., a file or socket), p represents the operation type (e.g., "read" or "execute"), d represents the data attribute, and t represents the timestamp of the event.

[0040] Based on the above event flow, a primordial source graph G=(V, E) in the form of a directed graph is constructed, where the set of nodes V represents entities in the system (such as processes, files, IP addresses, users, etc.), and the set of edges E represents causal or operational dependencies between entities. For example, "process A opened file B" will generate a directed edge from node A to node B.

[0041] The original source map fully records the historical trajectory of system behavior, but its large scale and the presence of numerous irrelevant dependencies introduced by normal business activities can easily lead to information overload in subsequent analysis processes.

[0042] S102 assigns weights to each edge in the original source graph to generate a weighted source graph.

[0043] In order to distinguish the semantic importance of different edges in the attack propagation process and reduce the interference of irrelevant dependencies on the analysis results, this embodiment of the invention performs dynamic weighting on each edge in the original source graph to generate a weighted source graph.

[0044] In a possible implementation, step S102 can be implemented as follows: S102-1, Extract the feature vector of each edge in the original source graph.

[0045] For each edge, a set of multi-dimensional feature vectors is extracted to characterize its behavioral properties and context. These features include, but are not limited to: operation type (e.g., "download", "execute", "remote login"), sensitivity level of the subject and object (e.g., whether it is a critical system process or a hidden file), whether it involves external IP communication, whether it triggers abnormal behavior rules, whether it occurs in a privileged context, and the sequence of events preceding and following the edge. These features collectively constitute the semantic representation of the edge, serving as the foundation for subsequent model inputs.

[0046] S102-2, input the feature vector of each edge in the original source graph into the pre-trained regression model to obtain the weight vector.

[0047] To further quantify the contribution of each feature to the attack relevance, this embodiment of the invention uses a supervised learning method to pre-train a regression model (optional linear regression, ridge regression, or lightweight neural network) to achieve the mapping from feature space to edge weights.

[0048] During the model training phase, a historical attack sample dataset is used, where each edge is labeled as a positive or negative sample based on whether the path it belongs to participates in the propagation of a real attack.

[0049] The positive samples come from confirmed attack dependency paths and belong to community A, which is strongly associated with the attack behavior.

[0050] Negative samples come from normal system behavior paths and belong to the non-attacking community B.

[0051] Simultaneously consider two types of boundary relationships: intra-community boundary... and With cross-community border .

[0052] The goal of the model is to learn an optimal weight vector. This ensures that the weighted average satisfies the following inequality:

[0053] Assume there is Training edge: , .in Indicates the first training vectors ,if but ,otherwise To prevent the use of If negative weights are obtained after weighting the edges, they will be resolved by... The function maps the weight range to [0,1]:

[0054] Constructor As shown below:

[0055] use express The probability, i.e. Given the probability of attacking the relevant path, its complement probability is... By using maximum likelihood estimation, the following log-likelihood cost function is constructed and minimized:

[0056] The loss function can be solved using gradient descent or other optimization algorithms to obtain the optimal weight vector. This vector reflects the relative importance of each feature dimension in determining whether an edge participates in attack propagation.

[0057] S102-3, Based on the weight vector and the feature vector of each edge in the original source graph, determine the weight of each edge in the original source graph to obtain the weighted source graph.

[0058] The weight vector is applied to the feature vectors of all edges to calculate the actual weight of each edge. Based on this, the original source graph is reconstructed into a weighted source graph, which significantly enhances attack-related dependencies while effectively suppressing redundant or noisy connections.

[0059] S103, community division and topology reconstruction are performed on the weighted source graph to obtain multiple candidate communities.

[0060] To further integrate semantically related operation fragments, eliminate noisy connections across functional domains, and improve the clustering quality of attack clues, this embodiment of the invention performs multi-level community division and topological reconstruction on the weighted source graph to generate a set of highly cohesive, well-connected, and semantically clear candidate communities, providing a high-quality analytical foundation for subsequent identification of attack-related subgraphs.

[0061] The implementation process of step S103 adopts a three-stage processing framework of "local motion", "partition refinement" and "node aggregation", which effectively overcomes the problems of slow convergence, modularity trap and generation of broken communities in the traditional Louvain algorithm, and significantly improves the accuracy and robustness of graph structure partitioning.

[0062] In a possible implementation, step S103 can be implemented as follows: S103-1 initializes each node in the weighted sourcing graph as a community and constructs a queue of nodes to be processed.

[0063] In the initialization phase, each node in the weighted sourcing graph G'=(V,E) independently forms an initial community, i.e., each node is a cluster. Subsequently, all nodes are added to a queue Q of nodes to be processed in a random order, serving as the data structure driving subsequent iterative optimization. This queue controls the processing order of nodes and dynamically updates the state of affected nodes, ensuring that local changes propagate globally.

[0064] S103-2, when the queue of nodes to be processed is not empty, calculate the migration gain corresponding to the community of each neighbor node of the current node in the queue of nodes to be processed.

[0065] Take the current node v from the head of the queue, traverse all its adjacent nodes u, calculate the total weight of the edges connected to v within the community C_u to which u belongs, and calculate the migration gain brought by moving v into C_u using the modularity change formula. This gain value measures the degree to which the migration operation improves the overall community structure quality.

[0066] The formula for the change in modularity is as follows:

[0067]

[0068] In the formula, For nodes and The weight of the edge between them. Indicates connection to node The sum of the weights of all edges, For nodes The community It is the sum of the weights of all edges.

[0069] S103-3, Perform community migration operation on the current node based on the migration gain corresponding to the community of each of the current node's neighboring nodes.

[0070] If there is a reference community with positive migration gain among the communities of all the neighboring nodes of the current node, then the current node will be migrated to the reference community.

[0071] Understandably, if there exists a community where at least one neighboring node has a positive migration gain, then the community that maximizes the migration gain is selected, and node v is moved out of its original community and joined to that community.

[0072] Due to the node When moving, The neighboring nodes are most affected, so they should be prioritized. Neighboring nodes are added to the queue. When a neighboring node leaves the queue, it is also necessary to consider the nodes in community A that are related to the neighboring nodes. The node connected to the neighboring node.

[0073] In this embodiment of the invention, there are four scenarios in which nodes may move within the community.

[0074] (1) Node The neighboring nodes are not in group B; (2) Node The neighboring nodes are within group B; (3) Group A without nodes Connected nodes; (4) Group B does not have nodes Connected nodes; Experiments revealed that only the first motion scenario can be considered when dealing with localized motion. This reduces computation time and has minimal impact on the partitioning effect.

[0075] S103-4 After completing the community migration operation for the current node, remove the current node from the queue of nodes to be processed, and return to the step of calculating the migration gain corresponding to the community of each neighbor node of the current node in the queue of nodes to be processed, until the queue of nodes to be processed is empty, and obtain the first community division result.

[0076] After node v completes its migration, it is removed from queue Q. Simultaneously, all neighboring nodes that may have been affected by v's movement are re-enqueued to trigger the next round of updates. This process continues until the queue is empty, ultimately yielding the preliminary partitioning result, i.e., the first community partitioning result.

[0077] The node movement algorithm flow is shown in the table below:

[0078] S103-5, perform connectivity analysis on each community in the first community division result, and based on the connectivity analysis result of each community, perform node re-migration processing on each community to obtain the second community division result.

[0079] In this embodiment of the invention, the implementation process of "performing node re-migration processing for each community based on the connectivity analysis results of each community to obtain the second community division result" can be as follows: For each community in the first community division structure, if there is a target node in the community that affects the connectivity of the community, then obtain the migration gain corresponding to the community where each neighbor node of the target node is located; perform community migration operation on the target node according to the migration gain corresponding to the community where each neighbor node of the target node is located; traverse each community in the first community division result to obtain the second community division result.

[0080] In other words, since the aforementioned local movement only considers the benefits of a single node, it may lead to sparse or even broken connections within some communities. Therefore, this embodiment of the invention evaluates connectivity metrics (such as the maximum connected subgraph percentage and average path length) between nodes within each divided community C_j. If the removal of a node n_k causes a community to split, it is determined to be the target node affecting connectivity.

[0081] Subsequently, the migration gain of n_k to the communities of its neighboring nodes is recalculated, and it is allowed to migrate to any community that can improve modularity, even if that community is not its original neighboring region. By traversing all communities and performing such reassignment operations, a more robust second community partitioning result is obtained.

[0082] To illustrate this process more clearly, refer to... Figure 3 and the node event mapping shown in the table below:

[0083] like Figure 3 As shown, thin edges represent weak dependencies, thick edges represent strong dependencies, and nodes of the same color belong to the same community. Nodes (1–5) describe a phishing email attack chain: a user opens a malicious email and downloads an attached document; nodes (6–9) represent normal document operations; and nodes (10–15) represent independent activities of other users.

[0084] Initially, nodes (1–5) are connected to nodes (6–9) via edges 3–0 and 7–0, forming a large community. If node 0's IP and process ID are closer to the members in the community below, it should be migrated to that community. However, performing only local moves without refining may result in a broken community between nodes (1–5) and (7–9).

[0085] Through the partitioning and refining mechanism, such problems can be identified and corrected before aggregation, avoiding information loss caused by erroneous aggregation.

[0086] The node movement algorithm during this process is shown in the table below:

[0087] Furthermore, the size of the recursive expansion of a set is defined as For example, sets The recursive expansion can be represented as:

[0088] And use the following relation to determine the connectivity between nodes and communities:

[0089] Nodes and communities that satisfy this formula are considered "well-connected nodes / communities". Such structures are prioritized for preservation, and unmerged nodes are selectively migrated to obtain a more robust second community partitioning result.

[0090] S103-6, perform node aggregation processing on each community in the second community division result to obtain multiple candidate communities.

[0091] After completing the fine-grained partitioning, a node aggregation operation is performed to achieve a high-level abstraction of the graph structure. For each optimized community, it is merged into a new supernode; the sum of the weights of all edges within the community is converted into the self-loop weight of the supernode; the original weighted edges between communities are retained as connecting edges between the new supernodes; all associated timestamp information is retained in the metadata for subsequent attack path recovery.

[0092] The aggregated graph structure significantly compresses the size of the original source graph while retaining key cross-community dependencies, forming a set of candidate communities with clear boundaries and semantic cohesion. This provides high-quality analysis units for the next step of identifying subgraphs related to attack behavior.

[0093] This three-stage architecture not only improves the rationality and stability of community division, but also enhances the scalability and automation of the entire attack path reconstruction system.

[0094] S104 identifies the target community associated with the attack from multiple candidate communities.

[0095] Based on obtaining multiple candidate communities, it is necessary to further filter out the core subgraphs most likely to contain attack behaviors.

[0096] In a possible implementation, step S104 can be implemented as follows: S104-1, using known attack entities as symptom nodes, obtain the association score between each candidate community and the symptom node.

[0097] If a malicious entity has been identified as the starting point of an attack through threat intelligence, alerts, or manual analysis, it is marked as a symptom node s.

[0098] In this embodiment of the invention, for each candidate community C_j, the association score Score(C_j) between the candidate community and the symptom node can be obtained by calculating the shortest path distance from s to any node in C_j (by hop count or weighted path length) and summing the weights of all edges on the path. The higher the score, the closer the semantic and topological association between the community and the known attack behavior.

[0099] S104-2, select candidate communities with association scores greater than a preset threshold as target communities.

[0100] Set a dynamic or static scoring threshold T, and select all candidate communities that satisfy Score(C_j)>T to form a target community set, which is used to narrow the scope of analysis and focus on key areas.

[0101] Furthermore, considering that modern attacks often exhibit cross-host characteristics, when an attack entity is identified on one host, it can be extended to the source graph of other hosts as a new symptom node, automatically uncovering remote host nodes that have interacted with it, thereby supporting scalable investigations in multi-host collaborative attack scenarios.

[0102] S105 generates an attack path that characterizes the attack evolution process based on the attacking entities in the target community.

[0103] Reconstruct the complete attack storyline based on the entities within the target community and their temporal relationships.

[0104] In a possible implementation, step S105 can be implemented as follows: S105-1, Based on the neighborhood graph of each attacking entity in the target community, extract action events that are directly connected to each attacking entity and whose action type belongs to the preset attack mode.

[0105] For each attack entity (such as malicious files or suspicious processes) in the target community, extract its neighborhood subgraph in the weighted source graph, that is, all its directly connected one-hop neighbor nodes and their corresponding edges.

[0106] For example, such as Figure 4 As shown, each identified attack entity, including the malicious file backdoor.exe, the suspicious process backdoor.exe_4, or the malicious host IP (1.2.3.4), is taken as the central node, and its one-hop neighborhood subgraph in the weighted source graph is extracted, that is, all the edges directly connected to it and the corresponding neighbor nodes.

[0107] Meanwhile, to prevent normal system behavior from being misjudged as part of an attack path, this embodiment of the invention further introduces a filtering mechanism to exclude non-malicious access behavior caused by system daemons.

[0108] For example, such as Figure 5 As shown, although the non-attacking entity SearchIndexer.exe_2 (a Windows NT system service process) did read the malicious file backdoor.exe (event (SearchIndexer.exe_2, Read, backdoor.exe, T11)), its subsequent actions (such as (SearchIndexer.exe_2, System Call Process Operation, ε, T12)) were routine file indexing operations and did not participate in the actual attack process. Therefore, although this event occurred close to the attack sequence in time, it should not be included in the final attack path.

[0109] like Figure 6 As shown, taking the attacking entity backdoor.exe as the starting point for tracing the source, if a process performs operations with malicious semantics on it (such as "creating a remote thread" or "injecting code"), then that process is considered a component of the attack chain; while processes that only perform normal reading but do not have subsequent malicious behavior are judged as irrelevant nodes. Through the above mechanism, accurate extraction of attack-related events can be achieved, avoiding path redundancy problems caused by topology diffusion.

[0110] S105-2, globally sort in ascending order based on the timestamp of each action event to generate an attack path that represents the time evolution sequence of the attack.

[0111] After filtering out valid attack events, in order to further reconstruct the actual operation sequence of the attacker, this embodiment of the invention adopts a timestamp-based global sorting mechanism to construct a complete attack path with causal logic.

[0112] All selected valid attack events are sorted in ascending order according to their occurrence timestamp 't' to generate an ordered sequence, thus obtaining the attack path. The attack path clearly presents the entire evolutionary logic of the attack from initial intrusion, privilege escalation, lateral movement, and data leakage, possessing strong interpretability and auditing value.

[0113] Optionally, this path can be visualized as a timeline graph using visualization tools to help security analysts quickly grasp the full picture of the attack and use it to review system weaknesses and optimize defense strategies.

[0114] To perform the corresponding steps in the above embodiments and various possible methods, an implementation of the attack path reconstruction device 200 is given below. Further, please refer to... Figure 7 , Figure 7 This is a functional block diagram of an attack path reconstruction device 200 provided in an embodiment of the present invention. It should be noted that the basic principle and technical effects of the attack path reconstruction device 200 provided in this embodiment are the same as those in the above embodiments. For the sake of brevity, any parts not mentioned in this embodiment can be referred to the corresponding content in the above embodiments. The attack path reconstruction device 200 includes: Module 201 is used to construct the original traceability diagram based on multiple operation events generated during the operation of the information system and the relationships between these operation events.

[0115] The restoration module 202 is used to assign weights to each edge in the original source graph to generate a weighted source graph; to perform community division and topology reconstruction on the weighted source graph to obtain multiple candidate communities; to identify target communities related to the attack behavior from the multiple candidate communities; and to generate attack paths that characterize the attack evolution process based on the attack entities in the target communities.

[0116] Optionally, the above modules can be stored in the form of software or firmware. Figure 1 The memory 110 shown is either stored in or embedded in the operating system (OS) of the electronic device 100, and can be used by... Figure 1 The processor 120 executes the program. Meanwhile, the data and program code required to execute the above modules can be stored in the memory 110.

[0117] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative; for example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0118] In addition, the functional modules in the various embodiments of the present invention can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0119] If the functionality is implemented as a software module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, electronic device 100, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0120] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An attack path reconstruction method, characterized in that, The method includes: Based on multiple operational events generated during the operation of the information system and the relationships between these multiple operational events, an original source map is constructed. Assign weights to each edge in the original source graph to generate a weighted source graph; The weighted source graph is divided into communities and its topology is reconstructed to obtain multiple candidate communities; Identify the target communities associated with the attack behavior from the plurality of candidate communities; Based on the attacking entities in the target community, an attack path representing the attack evolution process is generated.

2. The attack path reconstruction method as described in claim 1, characterized in that, The step of assigning weights to each edge in the original source graph to generate a weighted source graph includes: Extract the feature vector of each edge in the original source graph; The feature vector of each edge in the original source graph is input into the pre-trained regression model to obtain the weight vector; Based on the weight vector and the feature vector of each edge in the original source graph, the weight of each edge in the original source graph is determined, and the weighted source graph is obtained.

3. The attack path reconstruction method as described in claim 1, characterized in that, The step of performing community partitioning and topology reconstruction on the weighted source graph to obtain multiple candidate communities includes: Each node in the weighted sourcing graph is initialized as a community, and a queue of nodes to be processed is constructed; When the queue of nodes to be processed is not empty, calculate the migration gain corresponding to the community of each neighbor node of the current node in the queue of nodes to be processed. Based on the migration gain of each neighboring node in the community of the current node, perform a community migration operation on the current node; After completing the community migration operation for the current node, the current node is removed from the queue of nodes to be processed, and the process returns to the step of calculating the migration gain corresponding to the communities of each neighbor node of the current node in the queue of nodes to be processed, until the queue of nodes to be processed is empty, and the first community division result is obtained. A connectivity analysis is performed on each community in the first community division result, and based on the connectivity analysis result of each community, node re-migration processing is performed on each community to obtain the second community division result; The nodes of each community in the second community division result are aggregated to obtain multiple candidate communities.

4. The attack path reconstruction method as described in claim 3, characterized in that, The step of performing a migration operation on the current node based on the migration gain corresponding to the community where each of the current node's neighboring nodes is located further includes: If there is a reference community with positive migration gain among the communities of all the neighboring nodes of the current node, then the current node will be migrated to the reference community.

5. The attack path reconstruction method as described in claim 3, characterized in that, The step of performing node re-migration processing on each community based on the connectivity analysis results of each community to obtain the second community division result includes: For each community in the first community partitioning structure, if there is a target node in the community that affects the connectivity of the community, then obtain the migration gain corresponding to the community where each neighbor node of the target node is located. Based on the migration gain corresponding to the community of each neighboring node of the target node, a community migration operation is performed on the target node; By iterating through each community in the first community division result, the second community division result is obtained.

6. The attack path reconstruction method as described in claim 1, characterized in that, The step of identifying the target community associated with the attack behavior from the plurality of candidate communities includes: Using known attack entities as symptom nodes, obtain the association score between each candidate community and the symptom node; Candidate communities whose association scores are greater than a preset threshold are selected as target communities.

7. The attack path reconstruction method as described in claim 1, characterized in that, The step of generating an attack path representing the attack evolution process based on the attack entities in the target community includes: Based on the neighborhood graph of each attacking entity in the target community, extract action events that are directly connected to each attacking entity and whose action type belongs to a preset attack mode; The attack path is generated by globally sorting each action event in ascending order based on its timestamp, thus representing the temporal evolution of the attack.

8. An attack path reconstruction device, characterized in that, The device includes: The construction module is used to construct the original traceability diagram based on multiple operation events generated during the operation of the information system and the relationships between these multiple operation events; The restoration module is used to assign weights to each edge in the original source graph to generate a weighted source graph; perform community division and topology reconstruction on the weighted source graph to obtain multiple candidate communities; identify target communities related to the attack behavior from the multiple candidate communities; and generate attack paths representing the attack evolution process based on the attack entities in the target communities.

9. An electronic device, characterized in that, It includes a processor and a memory, the memory storing machine-executable instructions that can be executed by the processor, the processor executing the machine-executable instructions to implement the attack path reconstruction method according to any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the attack path restoration method as described in any one of claims 1-7.

Images