A lightweight adaptive attack chain link extraction method and system across text-log heterogeneous data sources and a storage medium

Abstract

This invention provides a lightweight adaptive attack chain extraction method, system, and storage medium for cross-text-log heterogeneous data sources. The method includes: Step 1: Attack chain extraction across text-log heterogeneous data sources; automatically extracting standardized attack technique chains and tactical chains from unstructured CTI reports and structured network alarm logs; Step 2: Adaptive prediction of tactical chains based on TCKC graph constraints and multi-reward PPO; dynamically predicting the attacker's next tactic using reinforcement learning to generate a high-confidence tactical evolution path; Step 3: Attack technique chain prediction based on sequence modeling and dynamic filtering using mapping rules; guided by the tactical chains predicted in Step 2, using a Transformer model to predict the specific technique sequence the attacker will use. The beneficial effects of this invention are: improved automation capabilities for heterogeneous data sources and realization of high-confidence dynamic tactical prediction.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a lightweight adaptive attack chain extraction method, system, and storage medium for cross-text-log heterogeneous data sources. Background Technology

[0002] Currently, cyberattacks, represented by Advanced Persistent Threats (APTs), are characterized by multi-stage, highly covert, and long-term nature. Attackers typically combine various tactics, techniques, and procedures to form a complex attack chain in order to evade detection and achieve their ultimate goal.

[0003] To address such threats, security analysts rely on cyber threat intelligence (CTI) reports and massive amounts of network alert logs to understand and predict attack behavior. However, existing technologies face the following core challenges in processing this data and constructing a complete attack graph: Heterogeneous data sources are difficult to process: CTI reports are mostly unstructured text, while network alerts are structured or semi-structured logs. The two have very different formats and are noisy. Traditional methods are difficult to automatically extract and correlate attack behaviors from them, resulting in high cost and low efficiency of manual analysis.

[0004] Limitations of static analysis methods: Attack correlation methods based on static rules or traditional graph models rely heavily on expert knowledge and struggle to adapt to the rapid evolution of attack techniques. For novel or unknown combinations of attack techniques, these methods generally suffer from high false negative rates and weak adaptability.

[0005] Bottlenecks in machine learning models: While machine learning is used to automate TTP (tactical, technical, procedural) extraction, there is a serious class imbalance problem in CTI and alert data. Many key but low-frequency attack techniques have scarce samples, making it difficult for models to learn effectively, resulting in low recall and affecting the integrity of attack chain construction.

[0006] Lack of dynamic prediction capability: Cyberattacks are a dynamic and evolving process. Existing methods mostly focus on the static correlation and tracing of existing attacks, lacking the ability to dynamically and with high confidence predict the attacker's subsequent tactical intentions and specific technical steps, making it difficult to support truly proactive defense.

[0007] Therefore, there is a need for a system and method that can integrate heterogeneous data sources such as text and logs, effectively identify low-frequency attack behaviors, and dynamically and adaptively predict the evolution path of multi-step attack tactics and technologies.

[0008] The information disclosed in this background section is intended only to enhance understanding of the overall background of the invention and should not be construed as an admission or in any way implying that the information constitutes prior art known to those skilled in the art. Summary of the Invention

[0009] To address the problems in the prior art, this invention provides a lightweight adaptive attack chain extraction method, system, and storage medium for cross-text-log heterogeneous data sources.

[0010] This invention provides a lightweight adaptive attack chain extraction method for cross-text-log heterogeneous data sources, including: Step 1: Attack chain extraction across heterogeneous text-log data sources; automatically extract standardized attack technique chains and tactical chains from unstructured CTI reports and structured network alert logs; Step 2: Adaptive prediction of tactical chains based on TCKC graph constraints and multi-reward PPO; dynamically predict the attacker's next tactic using reinforcement learning, and generate tactical evolution paths with confidence levels higher than a preset threshold. Step 3: Attack technique chain prediction based on sequence modeling and dynamic filtering of mapping rules; under the guidance of the tactical chain predicted in Step 2, the Transformer model is used to predict the specific technique sequence that the attacker will use.

[0011] As a further improvement to the present invention, step 1, extracting attack technique links and tactical links from unstructured CTI reports, further includes: Step s1, Extraction of Technological and Temporal Relationships: Using the improved ChronoCTI model, the CTI report text is first analyzed sentence by sentence using a pre-trained language model to achieve multi-label classification, identify one or more ATT&CK technologies contained in the sentence, and then the textual features between the technology pairs are extracted and input into a gradient boosting decision tree or similar classifier to determine the temporal relationship between the technologies. Step s2, class imbalance optimization: For low-frequency class samples in the time-series relationship data whose frequency ratio is lower than a preset threshold, the low-frequency class samples are oversampled and the high-frequency class samples are undersampled before model training; at the same time, class weights are introduced into the loss function of the classification model, and preset weights are assigned to the low-frequency class, thereby improving the recognition accuracy of low-frequency time-series relationships. Step s3, Link Construction: Based on the identified technologies and temporal relationships, construct a directed acyclic graph to form the initial technology attack chain.

[0012] As a further improvement of the present invention, in step 1, the attack technique links and tactical links extracted from the structured network alarm logs further include: Step a1, Attacker Alarm Classification: Using the rule based on the same source IP address in the same C-segment, alarms from the same C-segment network are aggregated and regarded as the activities of the same attacker; Step a2, Alarm Deduplication and Sorting: To address the issue of duplicate technical attempts in alarms, the alarms are first deduplicated. Then, based on the tactical sequence logic defined by the tactical network kill chain model and combined with the timestamps of the alarm occurrences, the classified alarm sequences are sorted and filtered to construct a technical attack chain that conforms to the attack logic. Step a3, Link Unification: The technical links extracted from CTI reports and network alarm logs are converted into corresponding tactical links through a pre-set ATT&CK technical-tactical mapping table, providing input data in a unified format for subsequent prediction modules.

[0013] As a further improvement of the present invention, step 2 further includes: The steps for problem space modeling are as follows: Step b1, State: The currently known tactical sequence is taken as input and encoded into a fixed-dimensional state vector through an embedding layer and a temporal coding layer; Step b2, Action: Treat the action space as the set of all possible tactics in the ATT&CK framework; treat the output of the policy network as the probability distribution of selecting each tactic as the next action in the current state; Step b3, Reward Function: Design a multivariate composite reward function, the formula of which is as follows: r = w1 * R_acc + w2 * R_top3 + w3 * R_logic Where R_acc is the positive reward given when the predicted tactic is completely consistent with the true label; R_top3 is the secondary reward given when the true label appears in the top-3 candidate tactics with the highest predicted probability; R_logic is the logical conformity reward given when the predicted tactic conforms to the logic defined by the TCKC graph; w1, w2, w3 are adjustable weights. Model training steps: The Actor-Critic framework is trained using the Proximal Policy Optimization (PPO) algorithm. PPO limits the magnitude of each policy update by pruning the objective function to ensure the stability of the training process. The Critic network is used to evaluate the state value to reduce the variance of policy gradient estimation. Tactical chain generation steps: During the reasoning phase, starting from an initial tactical node, the following operations are performed iteratively: Step c1: Input the current tactical chain into the trained PPO model to obtain the probability distribution of the next tactic; Step c2: Select candidate tactics based on preset probability thresholds; Step c3: Use the TCKC diagram to perform logical filtering on candidate tactics, eliminating options that do not conform to the attack logic; Step c4: Select one or more of the remaining legal candidate tactics to expand until the preset maximum length or termination node is reached, thereby generating one or more tactic prediction chains.

[0014] As a further improvement of the present invention, step 3 further includes: Data preprocessing step: Decompose the technology chain extracted in step 1 into multiple input sub-chain-target technology data pairs; Transformer model construction steps: Sequence modeling is performed using the Seq2Seq Transformer architecture; Dynamic prediction and logical filtering steps: In the reasoning stage, a dynamic filtering mechanism is introduced.

[0015] As a further improvement of the present invention, the Transformer modeling step further includes: Step d1, Encoding: Capture long-range dependencies between various technologies within the input technology subchain using a multi-head self-attention mechanism; Step d2, Decoding: Combining the encoder output with the generated technique sequence, predict the next most likely technique; Step d3, Feature optimization: The model uses positional encoding to process the sequence order information and employs a regularization strategy to prevent overfitting.

[0016] As a further improvement of the present invention, the dynamic prediction and logical filtering steps further include: Step y1: Input the current technology chain into the trained Transformer model to obtain the probability distribution of all candidate technologies; Step y2: Based on the current tactical stage predicted in Step 2, query the ATT&CK technology-tactical mapping table; Step y3: Filter out all candidate technologies that do not belong to the current tactical scope; Step y4: From the remaining logically compatible candidate techniques, select the N techniques with the highest probability as the final prediction results.

[0017] This invention also discloses a lightweight adaptive attack link extraction system across text-log heterogeneous data sources, comprising: a memory, a processor, and a computer program stored on the memory, wherein the computer program is configured to implement the steps of the lightweight adaptive attack link extraction method described in this invention when invoked by the processor.

[0018] The present invention also discloses a computer-readable storage medium storing a computer program configured to implement the steps of the lightweight adaptive attack link extraction method described in the present invention when invoked by a processor.

[0019] The beneficial effects of this invention are: 1. Enhanced automated processing capabilities for heterogeneous data sources: This invention proposes a complete process that can automatically extract and correlate attack behaviors from unstructured CTI reports and massive alarm logs, overcoming the challenges brought by data heterogeneity and significantly reducing the cost and time of manual analysis.

[0020] 2. Achieved high-confidence dynamic tactical prediction: This invention is the first to combine PPO reinforcement learning with TCKC cybersecurity knowledge graph, and by designing a multi-reward function, the model not only pursues the accuracy of prediction, but also ensures the logical rationality of tactical evolution. The generated tactical prediction chain has higher credibility and practical guidance value.

[0021] 3. Ensures consistency and interpretability of prediction results: By introducing a tactical-based dynamic filtering mechanism in the technical prediction stage, it ensures that the specific technology predicted is consistent with the macro-tactical intent of the prediction, avoids logical contradictions, enhances the coherence and interpretability of the final prediction results, and facilitates understanding and decision-making by security personnel. Attached Figure Description

[0022] Figure 1 This is a diagram of the overall system framework of the present invention; Figure 2 This is a diagram of the Network Kill Chain (TCKC) of the tactics of this invention; Figure 3 This is a schematic diagram of the PPO model architecture of the present invention. Detailed Implementation

[0023] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings, but it should be understood that the scope of protection of the present invention is not limited to the specific embodiments.

[0024] Unless otherwise expressly stated, throughout the specification and claims, the term "comprising" or its variations such as "including" or "comprises" shall be understood to include the stated elements or components without excluding other elements or other components.

[0025] ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a model that describes the techniques used in each stage of an attack from the attacker's perspective. Common applications include network red team / blue team exercises, network security penetration testing, network defense gap assessment, and network threat intelligence gathering.

[0026] This invention relates to an AI-based Cyber ​​Threat Intelligence (CTI) analysis, Advanced Persistent Threat (APT) attack path analysis, and proactive defense decision support system. This invention can be applied to Intrusion Detection Systems (IDS), Security Information and Event Management (SIEM) platforms, threat intelligence platforms, and Automated Security Operations Centers (SOCs) to enhance the automated analysis, attribution, and prediction capabilities for complex, multi-stage network attacks.

[0027] like Figure 1 As shown, this invention discloses a lightweight adaptive attack chain extraction method for cross-text-log heterogeneous data sources. The system framework is as follows: Figure 1 As shown, this method integrates three major modules: attack chain extraction, reinforcement learning-based tactical chain prediction, and sequence modeling-based technical chain prediction, achieving end-to-end automated processing from raw data to attack path prediction.

[0028] The specific implementation process of this invention includes the following steps: Step 1: Extracting the attack chain across heterogeneous text-log data sources; This step aims to automatically extract standardized attack technique and tactical links from unstructured CTI reports and structured network alert logs.

[0029] Step s1, Technique and Temporal Relationship Extraction: Using an improved ChronoCTI model, a pre-trained language model (such as RoBERTa-CTI) is first used to analyze the CTI report text sentence by sentence to achieve multi-label classification and identify one or more ATT&CK techniques contained in the sentence. Subsequently, textual features (such as temporal semantics, syntactic associations, etc.) between technique pairs are extracted and input into a gradient boosting decision tree (GBDT) or similar classifier to determine the temporal relationship between techniques (such as BEFORE, SIMULTANEOUS, etc.).

[0030] Step s2, Class Imbalance Optimization: For all data with time-series relationships, the frequency percentage of each type of time-series relationship is statistically analyzed. Time-series relationship categories with a frequency percentage below 5% are called low-frequency samples, and those with a frequency percentage greater than or equal to 5% are called high-frequency samples. Samples corresponding to low-frequency categories are called low-frequency category samples, and samples corresponding to high-frequency categories are called high-frequency category samples. To address the issue that low-frequency category samples (e.g., BEFORE) are far fewer than high-frequency category samples (e.g., NULL) in the time-series relationship data, oversampling is performed on minority class samples (low-frequency samples) and undersampling is performed on majority class samples (high-frequency samples) before model training. Simultaneously, class weights are introduced into the loss function of the classification model (e.g., cross-entropy loss), assigning higher weights to minority class samples (low-frequency samples) (higher weights refer to dynamically calculating the weight ratio based on the inverse of the frequency of each category sample in the training set, assigning a weight 5 to 10 times), thereby significantly improving the accuracy of identifying low-frequency but crucial time-series relationships.

[0031] Step s3, Link Construction: Based on the identified technologies and temporal relationships, construct a directed acyclic graph to form the initial technology attack chain.

[0032] Real-world alarm handling: Step a1, Attacker Alarm Classification: Attacker alarm classification: Due to the difficulty of tracing the source, this invention adopts the rule based on the same source IP address C segment (first 24 bits) to aggregate alarms from the same C segment network segment and regard them as the activities of the same attacker.

[0033] Step a2, Alarm Deduplication and Sorting: To address the issue of numerous duplicate technical attempts in alarms, the alarms are first deduplicated. Then, based on the Tactical Kill Chain (TCKC) model (such as...), the alarms are sorted and ranked. Figure 2 Based on the tactical sequence logic defined (as shown), and combined with the timestamps of alarm occurrences, the categorized alarm sequences are sorted and filtered to construct a technical attack chain that conforms to the attack logic.

[0034] Step a3, Link Unification: The technical links extracted from CTI and alarms are converted into corresponding tactical links through a pre-set ATT&CK technology-tactical mapping table, providing input data in a unified format for subsequent prediction modules.

[0035] Step 2: Adaptive prediction of tactical chains based on TCKC graph constraints (i.e., tactical knowledge graph constraints) and multi-reward PPO; This step utilizes reinforcement learning to dynamically predict the attacker's next tactic, generating a high-confidence (≥0.9) tactical evolution path. The model architecture is as follows: Figure 3 As shown.

[0036] Problem space modeling: Step b1, State: The currently known tactical sequence (e.g., [TA0001, TA0002]) is taken as input and encoded into a fixed-dimensional state vector through an embedding layer and a temporal coding layer (e.g., LSTM or GRU).

[0037] Step b2, Action: The action space is the set of all possible tactics in the ATT&CK framework. The output of the policy network (Actor) is the probability distribution of choosing each tactic as the next action in the current state.

[0038] Step b3, Reward Function: To guide the model in generating both accurate and reasonable tactical chains, a multivariate composite reward function was designed: r = w1 * R_acc + w2 * R_top3 + w3 * R_logic Here, R_acc is the positive reward given when the predicted tactic is completely consistent with the true label; R_top3 is the secondary reward given when the true label appears in the top-3 candidate tactics with the highest predicted probability; R_logic is the logical compliance reward given when the predicted tactic conforms to the logic defined by the TCKC graph (e.g., the execution phase of TA0002 cannot be followed by the initial access phase of TA0001). w1, w2, and w3 are adjustable weights.

[0039] Model Training: The Actor-Critic framework is trained using the Proximal Policy Optimization (PPO) algorithm. PPO limits the magnitude of each policy update by pruning the objective function, ensuring the stability of the training process. The Critic network is used to evaluate state values ​​to reduce the variance of policy gradient estimation.

[0040] Tactical chain generation: During the reasoning phase, starting from an initial tactical node, the following operations are performed iteratively: Step c1: Input the current tactical chain into the trained PPO model to obtain the probability distribution of the next tactic; Step c2: Select high-probability candidate tactics based on preset probability thresholds; Step c3: Use the TCKC graph to perform logical filtering on candidate tactics, eliminating options that do not conform to the attack logic; Step c4: Select one (or more) of the remaining legal candidate tactics and expand them until the preset maximum length or termination node is reached, thereby generating one or more most likely tactic prediction chains.

[0041] Step 3: Attack technique chain prediction based on sequence modeling and dynamic filtering of mapping rules; This step, guided by the tactical chain predicted in step 2, uses the Transformer model to predict the specific sequence of techniques the attacker will use. Specifically, it includes: Data preprocessing step: Decompose the technology chain extracted in step 1 into multiple "input sub-chain - target technology" data pairs. For example, the technology chain [T1055, T1082, T1497] can be decomposed into: input [T1055], target T1082; input [T1055, T1082], target T1497.

[0042] Transformer model construction steps: Sequence modeling is performed using the Seq2Seq Transformer architecture. Details are as follows: Step d1, Encoder encoding: Captures long-range dependencies between various techniques within the input technique subchain using a multi-head self-attention mechanism.

[0043] Step d2, Decoder decoding: Combining the encoder's output with the generated sequence of techniques, predict the next most likely technique.

[0044] Step d3, Feature optimization: The model uses positional encoding to process the sequence order information and employs regularization strategies such as normalization and Dropout to prevent overfitting.

[0045] Dynamic Prediction and Logical Filtering: In the reasoning phase, to ensure consistency between technical and tactical prediction results, a dynamic filtering mechanism is introduced. Step y1: Input the current technology chain into the trained Transformer model to obtain the probability distribution of all candidate technologies.

[0046] Step y2: Based on the current tactical stage predicted in Step 2 (e.g., the current tactic is TA0005 defense and evasion), query the ATT&CK technology-tactical mapping table.

[0047] Step y3: Filter out all candidate technologies that do not belong to the current tactical scope.

[0048] Step y4: From the remaining logically compatible candidate technologies, select the top N with the highest probability as the final prediction results, where N is a preset positive integer.

[0049] Through the collaborative work of the above three steps, this invention realizes a complete framework for extracting attack patterns from heterogeneous data and combining domain knowledge (TCKC graph) for dynamic, hierarchical (tactical-technical) prediction.

[0050] The framework of this invention comprises three interconnected and interdependent modules: a module for extracting attack chains from heterogeneous data sources; a module based on PPO reinforcement learning for predicting macro-tactical evolution paths; and a module based on Transformer sequence models for predicting micro-technical sequences under tactical guidance.

[0051] The present invention discloses a PPO tactical prediction method based on TCKC graph constraints and multi-rewards. In the training and inference process of PPO reinforcement learning, TCKC knowledge graph is introduced as a hard logical constraint, and a multi-reward function including accuracy, Top-k coverage and logical compliance is designed.

[0052] The attack technique chain prediction method disclosed in this invention, based on sequence modeling and dynamic filtering of mapping rules, dynamically filters the candidate technique outputs of Transformer according to the current tactical stage output by the upstream tactical prediction module during the inference stage of technique chain prediction using the Transformer model.

[0053] This invention also discloses a lightweight adaptive attack link extraction system across text-log heterogeneous data sources, comprising: a memory, a processor, and a computer program stored on the memory, wherein the computer program is configured to implement the steps of the lightweight adaptive attack link extraction method described in this invention when invoked by the processor.

[0054] The present invention also discloses a computer-readable storage medium storing a computer program configured to implement the steps of the lightweight adaptive attack link extraction method described in the present invention when invoked by a processor.

[0055] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A lightweight adaptive attack chain extraction method for cross-text-log heterogeneous data sources, characterized in that, include: Step 1: Extracting the attack chain across heterogeneous text-log data sources; Automated extraction of standardized attack technique and tactical links from unstructured CTI reports and structured network alert logs; Step 2: Adaptive prediction of tactical chains based on TCKC graph constraints and multivariate reward PPO; By using reinforcement learning to dynamically predict the attacker's next tactic, a tactical evolution path with a confidence level higher than a preset threshold is generated. Step 3: Attack technique chain prediction based on sequence modeling and dynamic filtering of mapping rules; under the guidance of the tactical chain predicted in Step 2, the Transformer model is used to predict the specific technique sequence that the attacker will use.

2. The lightweight adaptive attack link extraction method according to claim 1, characterized in that, Step 1, extracting attack technique and tactical links from unstructured CTI reports, also includes: Step s1, Extraction of Technological and Temporal Relationships: Using the improved ChronoCTI model, the CTI report text is first analyzed sentence by sentence using a pre-trained language model to achieve multi-label classification, identify one or more ATT&CK technologies contained in the sentence, and then the textual features between the technology pairs are extracted and input into a gradient boosting decision tree or similar classifier to determine the temporal relationship between the technologies. Step s2, class imbalance optimization: For low-frequency class samples in the time-series relationship data whose frequency ratio is lower than a preset threshold, oversampling is performed on the low-frequency class samples and undersampling is performed on the high-frequency class samples before model training; at the same time, class weights are introduced into the loss function of the classification model to assign preset weights to the low-frequency class samples, thereby improving the recognition accuracy of low-frequency time-series relationships. Step s3, Link Construction: Based on the identified technologies and temporal relationships, construct a directed acyclic graph to form the initial technology attack chain.

3. The lightweight adaptive attack link extraction method according to claim 2, characterized in that, In step 1, the attack technique links and tactical links extracted from the structured network alarm logs also include: Step a1, Attacker Alarm Classification: Using the rule based on the same source IP address in the same C-segment, alarms from the same C-segment network are aggregated and regarded as the activities of the same attacker; Step a2, Alarm Deduplication and Sorting: To address the issue of duplicate technical attempts in alarms, the alarms are first deduplicated. Then, based on the tactical sequence logic defined by the tactical network kill chain model and combined with the timestamps of the alarm occurrences, the classified alarm sequences are sorted and filtered to construct a technical attack chain that conforms to the attack logic. Step a3, Link Unification: The technical links extracted from CTI reports and network alarm logs are converted into corresponding tactical links through a pre-set ATT&CK technical-tactical mapping table, providing input data in a unified format for subsequent prediction modules.

4. The lightweight adaptive attack link extraction method according to claim 1, characterized in that, Step 2 also includes: The steps for problem space modeling are as follows: Step b1, State: The currently known tactical sequence is taken as input and encoded into a fixed-dimensional state vector through an embedding layer and a temporal coding layer; Step b2, Action: Treat the action space as the set of all possible tactics in the ATT&CK framework; treat the output of the policy network as the probability distribution of selecting each tactic as the next action in the current state; Step b3, Reward Function: Design a multivariate composite reward function, the formula of which is as follows: r = w1 * R_acc + w2 * R_top3 + w3 * R_logic Where R_acc is the positive reward given when the predicted tactic is completely consistent with the true label; R_top3 is the secondary reward given when the true label appears in the top-3 candidate tactics with the highest predicted probability; R_logic is the logical conformity reward given when the predicted tactic conforms to the logic defined by the TCKC graph; w1, w2, w3 are adjustable weights. Model training steps: The Actor-Critic framework is trained using the proximal policy optimization algorithm. The PPO limits the magnitude of each policy update by pruning the objective function. The Critic network is used to evaluate the state value. Tactical chain generation steps: During the reasoning phase, starting from an initial tactical node, the following operations are performed iteratively: Step c1: Input the current tactical chain into the trained PPO model to obtain the probability distribution of the next tactic; Step c2: Select candidate tactics based on preset probability thresholds; Step c3: Use the TCKC diagram to perform logical filtering on candidate tactics, eliminating options that do not conform to the attack logic; Step c4: Select one or more of the remaining legal candidate tactics to expand until the preset maximum length or termination node is reached, thereby generating one or more tactic prediction chains.

5. The lightweight adaptive attack link extraction method according to claim 1, characterized in that, Step 3 also includes: Data preprocessing step: Decompose the technology chain extracted in step 1 into multiple input sub-chain-target technology data pairs; Transformer model construction steps: Sequence modeling is performed using the Seq2Seq Transformer architecture; Dynamic prediction and logical filtering steps: In the reasoning stage, a dynamic filtering mechanism is introduced.

6. The lightweight adaptive attack link extraction method according to claim 5, characterized in that, The Transformer model step also includes: Step d1, Encoding: Capture long-range dependencies between various technologies within the input technology subchain using a multi-head self-attention mechanism; Step d2, Decoding: Combining the encoder output with the generated technique sequence, predict the next most likely technique; Step d3, Feature optimization: The model uses positional encoding to process the sequence order information and employs a regularization strategy to prevent overfitting.

7. The lightweight adaptive attack link extraction method according to claim 5, characterized in that, The dynamic prediction and logical filtering steps also include: Step y1: Input the current technology chain into the trained Transformer model to obtain the probability distribution of all candidate technologies; Step y2: Based on the current tactical stage predicted in Step 2, query the ATT&CK technology-tactical mapping table; Step y3: Filter out all candidate technologies that do not belong to the current tactical scope; Step y4: From the remaining logically compatible candidate techniques, select the N techniques with the highest probability as the final prediction results.

8. A lightweight adaptive attack chain extraction system for cross-text-log heterogeneous data sources, characterized in that, include: A memory, a processor, and a computer program stored on the memory, the computer program being configured to implement the steps of the lightweight adaptive attack link extraction method according to any one of claims 1-7 when invoked by the processor.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program configured to implement the steps of the lightweight adaptive attack link extraction method according to any one of claims 1-7 when invoked by a processor.

Images