An APT attack mail automatic analysis method, device, equipment and medium

Abstract

The application discloses an APT attack mail automatic analysis method and device, equipment and medium, and relates to the technical field of APT attack analysis, and the method comprises the steps of obtaining a to-be-analyzed mail with an encrypted attachment, and generating a candidate password list through OCR identification and natural language reasoning to decrypt the encrypted attachment and obtain a first decrypted file; if the first decrypted file is a script file, a second LLM model is used to perform anti-obfuscation processing on the first decrypted file to obtain a second decrypted file; the Hamming distance of the binary fingerprint of the second decrypted file and each historical fingerprint in a historical threat fingerprint library is calculated respectively, and if the minimum Hamming distance is less than a preset threshold, it is determined that the to-be-analyzed mail belongs to a known threat variant. The application can automatically cope with the countermeasures such as semantic encryption attachments and anti-sandbox obfuscated codes in APT mails in the analysis process without relying on dynamic execution and accurate hash matching.

Description

Technical Field

[0001] This invention relates to the field of APT attack analysis technology, and in particular to an automatic analysis method, apparatus, device, and medium for APT attack emails. Background Technology

[0002] Advanced Persistent Threat (APT) attacks often use phishing emails as the initial intrusion vehicle. Attackers bypass traditional security measures and penetrate target networks by sending emails with malicious attachments. Due to the highly targeted and stealthy nature of APT attacks, a successful intrusion can lead to serious data breaches or system damage. Therefore, automated analysis of APT attack emails to quickly identify malicious behavior and trace the source of the attack has become an important technical requirement in the field of cybersecurity.

[0003] In existing technologies, automated analysis of APT attack emails typically follows this process: First, emails are received through an email gateway, and regular expressions or weak password dictionaries are used to attempt to decrypt encrypted attachments. If decryption is successful and a malicious script-like payload is obtained, it is sent to a dynamic sandbox environment for execution, its behavior is monitored, and network communication indicators are extracted. Finally, the MD5 hash value or communication IP address of the sample is extracted and precisely compared with a threat intelligence database to determine whether it belongs to a known attack organization. However, the above-mentioned existing technologies heavily rely on dynamic sandbox execution code and precise hash matching for attribution. This makes the automated analysis link prone to interruption when facing semantically encrypted attachments (such as presenting passwords as images or using natural language descriptions) and anti-sandbox obfuscation code (such as hibernating or performing harmless operations after detecting a virtual environment) commonly found in APT attacks. Either the attachment cannot be decrypted, or the malicious code does not trigger malicious behavior in the sandbox. At the same time, hash matching becomes ineffective when fine-tuning the code, making it difficult to effectively complete intelligent attribution analysis of APT attack emails. Summary of the Invention

[0004] This invention provides an automatic analysis method, apparatus, device, and medium for APT attack emails. It can automatically deal with countermeasures such as semantically encrypted attachments and anti-sandbox obfuscation code in APT emails without relying on dynamic execution and precise hash matching, and realize intelligent source tracing analysis of APT attack emails.

[0005] In a first aspect, embodiments of the present invention provide an automatic analysis method for APT attack emails, including: The process involves acquiring an email with an encrypted attachment and inputting it into a pre-trained first LLM model. The first LLM model then generates a candidate password list for the encrypted attachment through OCR recognition and natural language inference. The encrypted attachment is then decrypted using the candidate password list to obtain a first decrypted file, and the file type of the first decrypted file is determined. The file type includes script files or executable files. If the first decrypted file is a script file, then the first decrypted file is input into the pre-trained second LLM model so that the second LLM model can deobfuscate the first decrypted file to obtain the second decrypted file. The binary fingerprint of the second decrypted file is generated using the SimHash algorithm, and the Hamming distance between the binary fingerprint and each historical fingerprint in the pre-built historical threat fingerprint database is calculated. If the minimum Hamming distance is less than a preset distance threshold, the email to be analyzed is determined to belong to a known threat variant, and a first analysis result containing the variant to which the email to be analyzed belongs is output.

[0006] This invention leverages the visual recognition and natural language reasoning capabilities of a multimodal large-scale model to crack encrypted passwords described by images or semantics, solving the entry point problem that traditional methods cannot automatically decrypt. By utilizing static analysis of the large model, the true logic of obfuscated code can be restored without dynamic sandbox operation, circumventing anti-sandbox attacks. By converting unstructured code into a computable fixed-length fingerprint, it resists fine-tuning (solving the MD5 failure problem), achieves dimensionality reduction clustering, automatically identifies known family variants, and quickly outputs attribution results, significantly reducing the cost of manual analysis. Compared to existing technologies that rely on dynamic execution and precise hash matching, this invention can automatically address adversarial techniques in APT emails, such as semantically encrypted attachments and anti-sandbox obfuscated code, achieving intelligent source tracing analysis of APT attack emails.

[0007] Among the preferred options in the first aspect are: If the minimum Hamming distance is greater than or equal to the preset distance threshold, the second decrypted file is input into the pre-trained third LLM model so that the third LLM model generates a semantic profile vector of the second decrypted file, and the source attack organization of the email to be analyzed is determined based on the semantic profile vector.

[0008] This invention achieves semantic-level attribution of the attacking organization by performing deep semantic understanding on outliers (unknown threats), extracting behavioral features for source tracing, and determining the source attacking organization of the email to be analyzed based on semantic profile vectors, rather than relying on MD5 precise matching.

[0009] In some preferred embodiments of the first aspect, the email to be analyzed is input into a pre-trained first LLM model, so that the first LLM model generates a list of candidate passwords for the encrypted attachment through OCR recognition and natural language inference, specifically: From the email to be analyzed, extract email metadata, body text, and embedded images, and construct prompt words based on the email metadata, body text, and embedded images; The prompt words are input into a pre-trained first LLM model, so that the first LLM model can obtain an explicit password string and an implicit password generation instruction through OCR recognition and natural language reasoning; wherein, the implicit password generation instruction is obtained by recognizing statements with password prompt semantics; Based on the aforementioned metadata, the implicit password generation instruction is logically mapped and variable-substituted to generate an inferred password string; The explicit password string and the inferred password string are merged and duplicates are removed to obtain a candidate password list.

[0010] This invention captures both the directly given password and the password description that needs to be deduced using a large model, and converts natural language (such as "sender's pinyin") into a specific password string. Finally, it merges the explicit password and the deduced password and removes duplicates, ensuring comprehensive password coverage and improving the decompression success rate.

[0011] In some preferred embodiments of the first aspect, the second LLM model deobfuscates the first decrypted file to obtain a second decrypted file, including: The first decrypted file is cleaned to obtain a standard script code stream, and the standard script code stream is semantically reconstructed to obtain a second decrypted file; wherein, the code cleansing includes the removal of invalid comments, the deletion of meaningless character blocks, and the format standardization; the semantic reconstruction includes variable renaming mapping and control flow flattening.

[0012] The embodiments of the present invention remove interference items through code cleaning, reduce the context length of large models, and improve the accuracy of analysis; through semantic reconstruction, the obfuscated code is transformed into human-readable pseudocode, preserving behavioral semantics.

[0013] In some preferred embodiments of the first aspect, the binary fingerprint of the second decrypted file is generated using the SimHash algorithm, specifically as follows: The second decrypted file is segmented using the N-gram algorithm to obtain several feature segments, and weights are assigned to each feature segment to obtain several feature word vectors. Each feature segment in the feature word vector is hashed to obtain a binary string, and the binary string is weighted, projected and accumulated according to the weight corresponding to the feature segment to obtain a unique real number vector; The real number vector is binarized to obtain the binary fingerprint of the second decrypted file.

[0014] This invention preserves the contextual sequence features of the code and gives higher sensitivity to high-risk behaviors, and finally generates a fixed-length fingerprint, supporting fast calculation of Hamming distance.

[0015] In some preferred embodiments of the first aspect, determining the source attack organization of the email to be analyzed based on the semantic profile vector includes: Using the semantic profile vector as a query, retrieve the historical profile record with the highest cosine similarity to the semantic profile vector in the pre-built threat intelligence vector database; If the cosine similarity is greater than a preset similarity threshold, then the attacking organization corresponding to the historical profile record is determined to be the source attacking organization.

[0016] This invention achieves semantic-level matching, rather than hash matching, by retrieving historical data using semantic profile vectors and calculating cosine similarity. By calculating similarity, it identifies attacking organizations and associates unknown threats with historical APT group behaviors.

[0017] Among the preferred options in the first aspect are: Extract the C2 address from the second decrypted file; If the minimum Hamming distance is greater than or equal to the preset distance threshold, then a tracing operation is performed based on the C2 address to obtain the tracing analysis result of the email to be analyzed; wherein, the tracing operation includes one or more combinations of the following: binary fingerprint server scanning, reverse DNS lookup, or URL path construction pattern analysis.

[0018] This invention extracts C2 addresses to obtain clues about attack infrastructure, and expands the discovery of associated malicious domains, IPs, and certificates by performing a traceability operation, thus enriching the source tracing intelligence.

[0019] Secondly, embodiments of the present invention provide an automatic APT attack email analysis device, including a file type determination module, a deobfuscation processing module, and a variant analysis module, wherein... The file type determination module is used to acquire an email with an encrypted attachment to be analyzed, and input the email to be analyzed into a pre-trained first LLM model, so that the first LLM model generates a candidate password list for the encrypted attachment through OCR recognition and natural language inference; decrypts the encrypted attachment through the candidate password list to obtain a first decrypted file, and determines the file type of the first decrypted file; wherein, the file type includes a script file or an executable file; The deobfuscation processing module is used to input the first decrypted file into a pre-trained second LLM model if the file type of the first decrypted file is a script file, so that the second LLM model can perform deobfuscation processing on the first decrypted file to obtain a second decrypted file. The variant analysis module is used to generate a binary fingerprint of the second decrypted file using the SimHash algorithm, and calculate the Hamming distance between the binary fingerprint and each historical fingerprint in the pre-built historical threat fingerprint database. If the minimum Hamming distance is less than a preset distance threshold, the email to be analyzed is determined to belong to a known threat variant, and a first analysis result containing the variant to which the email to be analyzed belongs is output.

[0020] This invention utilizes a file type determination module, leveraging the visual recognition and natural language reasoning capabilities of a multimodal large model, to crack encrypted passwords described by images or semantics, thus solving the entry point problem where traditional methods cannot automatically decrypt. A deobfuscation module, employing static analysis of a large model, restores the true logic of obfuscated code without requiring dynamic sandbox operation, circumventing anti-sandbox attacks. A variant analysis module transforms unstructured code into a computable fixed-length fingerprint, resisting fine-tuning (solving the MD5 failure problem), achieving dimensionality reduction clustering, and automatically identifying known family variants, quickly outputting attribution results and significantly reducing manual analysis costs.

[0021] Thirdly, embodiments of the present invention provide a terminal device, including: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other through the communication bus; The memory is used to store at least one executable instruction that causes the processor to perform the operation of the APT attack email automatic analysis method as described in any of the above.

[0022] Fourthly, embodiments of the present invention provide a computer-readable storage medium, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device or apparatus where the computer-readable storage medium is located to perform the automatic analysis method for APT attack emails as described in any of the above.

[0023] The above description is merely an overview of the technical solutions of the embodiments of the present invention. In order to better understand the technical means of the embodiments of the present invention and to implement them in accordance with the contents of the specification, and to make the above and other objects, features and advantages of the embodiments of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0024] Figure 1 This is a schematic diagram of an automatic APT attack email analysis method provided in an embodiment of the present invention; Figure 2 This is a schematic diagram illustrating an automated APT attack email analysis process, as exemplified by an embodiment of the present invention. Figure 3 This is a structural diagram of an automatic APT attack email analysis device provided in an embodiment of the present invention. Detailed Implementation

[0025] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] Example 1: like Figure 1 As shown, an embodiment of the present invention provides an automatic analysis method for APT attack emails, comprising: S101, Obtain the email to be analyzed with encrypted attachments, and input the email to be analyzed into a pre-trained first LLM model, so that the first LLM model generates a candidate password list for the encrypted attachments through OCR recognition and natural language inference; Decrypt the encrypted attachments through the candidate password list to obtain a first decrypted file, and determine the file type of the first decrypted file; wherein, the file type includes script files or executable files; In this embodiment, the email to be analyzed is input into a pre-trained first LLM model, enabling the first LLM model to generate a candidate password list for the encrypted attachment through OCR recognition and natural language inference. Specifically, this involves: extracting email metadata, body text, and embedded images from the email to be analyzed, and constructing prompt words based on the email metadata, body text, and embedded images; inputting the prompt words into the pre-trained first LLM model, enabling the first LLM model to obtain an explicit password string and an implicit password generation instruction through OCR recognition and natural language inference; wherein, the implicit password generation instruction is obtained by recognizing statements with password hint semantics; combining the metadata, the implicit password generation instruction is logically mapped and variable-substituted to generate an inferred password string; merging the explicit password string and the inferred password string and removing duplicates yields the candidate password list.

[0027] In one specific embodiment, email metadata, body text, and embedded images are extracted from the emails to be analyzed. Based on the email metadata, body text, and embedded images, prompt words are constructed. Specifically, the scattered email data is integrated into a standard instruction format readable by a large model, and the following data is extracted from each email: Email metadata (Header): Contains key-value pairs such as sender (From), time (Date), and subject (Subject); Unstructured body: The text content of the email; Image data: Image attachments embedded in the text; Furthermore, a formatted concatenation operation is performed to fill the three types of data mentioned above according to the predefined "Prompt Template".

[0028] For example, the system constructs an input stream with the following structure: [Context Information] Sender: Wang; Date Sent: 20260101... [Image Content] <Insert Image Data>... [Task Instruction] Please analyze the characters in the above image or deduce the password of the compressed file based on the context.

[0029] In one specific embodiment, the first LLM model performs OCR recognition and natural language inference, specifically: the large model performs the following two extraction operations in parallel: Visual character recognition (OCR): Scans an image region in an input stream, identifies handwritten or printed character sequences (such as "123456" in an image), and converts them into computer text strings; Key instruction location: Scan the email body text, match statements with "password hint" semantics (such as "password is..." "unzip password is..."), and extract key descriptive fields.

[0030] For example, the output of the first LLM model is as follows: Explicit cue set: such as ["123456","Pass@word"]; Implicit instruction set: such as ["Instruction: full spelling of sender's name", "Instruction: last four digits of the sending date"].

[0031] In one specific embodiment, the implicit password generation instruction is logically mapped and variable-substituted in conjunction with the metadata to generate an inferred password string, including: Parameter anchoring: Locate the corresponding value in the email metadata based on keywords in the instruction (such as "sender" or "date"); Logical transformation: Processing values ​​according to instruction requirements.

[0032] Example 1 (Pinyin Conversion): The system recognizes that "sender's name in pinyin" is a password in the text -> reads metadata From: "Zhang San" -> calls the pinyin conversion logic -> generates "zhangsan".

[0033] Example 2 (String Truncation): The text mentions "last four digits of the date" as a password -> reads the metadata Date: "2025-11-20" -> performs string truncation operation -> generates "1120".

[0034] Example 3 (Multimodal Extraction): The text mentions "6 characters in the image" as a password -> reads the metadata image: "abcdef" -> performs text extraction -> generates "abcdef". Finally, the inferred password set is obtained, such as ["zhangsan","1120","abcdef"].

[0035] In one specific embodiment, the explicit password string and the inferred password string are merged and deduplicated to obtain a candidate password list, including: (1) Set merging: Merging the data from the two sets mentioned above; (2) Data cleaning: removing empty strings and duplicates; (3) Priority sorting: prioritize “explicit clues” (directly stated in pictures or texts) and then “inferred clues” (derived from logical calculations) to improve the efficiency of subsequent decompression attempts.

[0036] S102, if the file type of the first decrypted file is a script file, then the first decrypted file is input into the pre-trained second LLM model so that the second LLM model can perform deobfuscation processing on the first decrypted file to obtain the second decrypted file; In this embodiment, the second LLM model performs deobfuscation on the first decrypted file to obtain a second decrypted file, including: cleaning the code of the first decrypted file to obtain a standard script code stream, and performing semantic reconstruction on the standard script code stream to obtain the second decrypted file; wherein, the code cleaning includes removing invalid comments, deleting meaningless character blocks, and format standardization; the semantic reconstruction includes variable renaming mapping and control flow flattening.

[0037] In one specific embodiment, the code cleaning includes: Invalid comment removal: Identifies and removes all comment lines (such as non-command lines starting with # or / / ); Garbage fill filter: Identify randomly inserted blocks of meaningless characters (such as consecutive useless variable declarations) and replace them with empty strings; Standardize the format: Remove unnecessary line breaks and indentation to compress the code into a compact format.

[0038] In one specific embodiment, the semantic reconstruction includes: Variable renaming mapping: Establish a mapping table to replace meaningless random variable names (such as $x1a) with concrete semantic names (such as $target_url); Control flow flattening: Parse GOTO jumps or complex switch nesting in the code and rewrite them into linear sequential logic.

[0039] S103, generate the binary fingerprint of the second decrypted file using the SimHash algorithm, and calculate the Hamming distance between the binary fingerprint and each historical fingerprint in the pre-built historical threat fingerprint database. If the minimum Hamming distance is less than a preset distance threshold, determine that the email to be analyzed belongs to a known threat variant, and output the first analysis result containing the variant to which the email to be analyzed belongs.

[0040] In this embodiment, the binary fingerprint of the second decrypted file is generated using the SimHash algorithm. Specifically, the second decrypted file is segmented using the N-gram algorithm to obtain several feature segments, and weights are assigned to each feature segment to obtain several feature word vectors. Each feature segment in the feature word vector is hashed to obtain a binary string, and the binary string is weighted and projected according to the weights corresponding to the feature segments to obtain a unique real number vector. The real number vector is binarized to obtain the binary fingerprint of the second decrypted file.

[0041] In one specific embodiment, the second decrypted file is segmented using the N-gram algorithm to obtain several feature segments, and weights are assigned to each feature segment to obtain several feature word vectors, specifically: N-gram sliding window segmentation: Set the window size $N=3$ and slide the code text into segments. Example: Invoke-WebRequest -> segmented into [Invoke, -, Web], [-, Web, Request], which preserves the word order.

[0042] Feature weighting calculation: Assigning values ​​to the segmented fragments: High weight (Weight=10): Hits malicious functions (such as ShellExecute, DownloadString) or hard-coded IPs; Low weight (Weight=1): Hits common syntax structures (such as If, For, Echo).

[0043] The final output is a list of feature word vectors with weighted values.

[0044] In one specific embodiment, generating the binary fingerprint of the second decrypted file using the SimHash algorithm includes: Hash mapping: Perform a hash operation on each feature word to generate a 64-bit binary string; Weighted projection: If the binary bit is 1, add the weight value of the word; if it is 0, subtract the weight value. Vector summation: Summing the projections of all words yields a 64-dimensional real vector; Dimensionality reduction binarization: Traverse the real number vector, marking the bits greater than 0 as 1 and the bits less than or equal to 0 as 0.

[0045] The final output is a unique 64-bit SimHash fingerprint of the sample (e.g., 100101...).

[0046] In this embodiment, the method further includes: if the minimum Hamming distance is greater than or equal to the preset distance threshold, the second decrypted file is input into a pre-trained third LLM model so that the third LLM model generates a semantic profile vector of the second decrypted file, and the source attack organization of the email to be analyzed is determined based on the semantic profile vector.

[0047] In one specific embodiment, Hamming distance clustering and outlier screening include: Distance calculation: Calculate the Hamming distance between the current fingerprint and the historical fingerprint, which is the number of different bits in the two binary strings; Threshold determination: If the distance is <3 (adjustable): it is determined as a "known family variant" and assigned to the corresponding cluster (known feature library). If the distance is ≥ 3 (adjustable): it is determined as an "outlier", i.e. a potential new threat or unknown attack (updated with new features).

[0048] In this embodiment, determining the source attack organization of the email to be analyzed based on the semantic profile vector includes: using the semantic profile vector as a query, retrieving historical profile records with the highest cosine similarity to the semantic profile vector in a pre-built threat intelligence vector database; if the cosine similarity is greater than a preset similarity threshold, then determining the attack organization corresponding to the historical profile record as the source attack organization.

[0049] In one specific embodiment, the selected outlier samples are submitted to the LLM to generate a new structured "behavioral profile", and the generated profile is stored in a vector database.

[0050] For example, each historical profile record contains the following key dimensions: JSON { "pattern_name":"PowerShell Obfuscated Download-Execute Cradle", "behavior_description": "Describes how an attacker uses PowerShell as LOLBins to download and execute malicious payloads by obfuscating commands..." "abstraction_logic":"powershell [Vars]; [ObfuscatedInvokeWebRequest][RemoteURL] -OutFile [Path]; [ObfuscatedStartProcess] [Path];", "attack_technique":"T1105", "high_value_keywords": ["powershell","iw''r","s''a''p''s","-OutFile"], "cluster_size": 13, "attribution": {"suspected_actor":"APT-Lazarus"} } In one specific embodiment, the process of identifying the source attack organization includes: Vector Search: Retrieves the historical records with the highest semantic similarity to the current profile in the "Threat Intelligence Vector Database"; Similarity comparison: If the cosine similarity exceeds 0.85, it is determined to be a new variant of the organization.

[0051] For example, the attack organization attribution result and reason output are as follows: "Suspected APT-29 organization, the reason is that its attack methods are: 1. It used obfuscation techniques such as "iw''r" and "s''a''p''s"; 2. It used PowerShell to download a secondary payload; 3. xxxx.

[0052] In this embodiment, the method further includes: extracting the C2 address from the second decrypted file; if the minimum Hamming distance is greater than or equal to the preset distance threshold, then performing a tracing operation based on the C2 address to obtain the tracing analysis result of the email to be analyzed; wherein the tracing operation includes one or more combinations of the following: binary fingerprint server scanning, reverse DNS lookup, or URL path construction pattern analysis.

[0053] In one specific embodiment, extracting the C2 address and attack indicators from the second decrypted file includes: using a large model to act as an "interpreter" and performing virtual stack calculations. String concatenation calculation: Identifies concatenation characters (such as + or &) in the code and merges scattered string fragments (such as "htt", "p: / / ") into a complete string; Encoding Reverse Operation: Identify common encoding functions (such as Base64, XOR), perform static decoding operations on the ciphertext string according to the key defined in the code, and directly calculate the plaintext result.

[0054] Furthermore, a "regular expression check" is added after the LLM output to confirm that the output conforms to the URL format, thus confirming that the URL is real code logic rather than an illusion.

[0055] The output data includes attack indicators (IOCs), such as extracted complete URLs, IP addresses, and structured behavioral descriptions, such as logical tags for "download and execute files".

[0056] For example, for string concatenation like "h" + "tt" + "p: / / "..., LLM directly outputs the complete concatenated URL.

[0057] In one specific embodiment, the topology operation is performed by using C2 as the fulcrum and performing an association graph query: Fingerprint matching: Obtain the SSL certificate fingerprint and web service characteristics of this C2 server, and scan the entire network for servers with the same fingerprint; Passive DNS reverse lookup: Queries all domain names that this IP has historically resolved, or all IPs that this domain name has historically resolved; Pattern analysis: Analyze the path construction patterns of URLs (such as / admin / login.php?id=) to find other unknown links that match the pattern.

[0058] To better illustrate the working principle and implementation process of the embodiments of the present invention, please refer to... Figure 2 , Figure 2 This is a schematic diagram illustrating an automatic analysis process for APT attack emails, as exemplified by an embodiment of the present invention.

[0059] This invention leverages the visual recognition and natural language reasoning capabilities of a multimodal large-scale model to crack encrypted passwords described by images or semantics, solving the entry point problem that traditional methods cannot automatically decrypt. By utilizing static analysis of the large model, the true logic of obfuscated code can be restored without dynamic sandbox operation, circumventing anti-sandbox attacks. By converting unstructured code into a computable fixed-length fingerprint, it resists fine-tuning (solving the MD5 failure problem), achieves dimensionality reduction clustering, automatically identifies known family variants, and quickly outputs attribution results, significantly reducing the cost of manual analysis. Compared to existing technologies that rely on dynamic execution and precise hash matching, this invention can automatically address adversarial techniques in APT emails, such as semantically encrypted attachments and anti-sandbox obfuscated code, achieving intelligent source tracing analysis of APT attack emails.

[0060] Example 2: like Figure 3 As shown, this embodiment provides an automatic APT attack email analysis device, including a file type determination module 201, a deobfuscation processing module 202, and a variant analysis module 203, wherein... The file type determination module 201 is used to acquire an email with an encrypted attachment to be analyzed, and input the email to be analyzed into a pre-trained first LLM model, so that the first LLM model generates a candidate password list for the encrypted attachment through OCR recognition and natural language inference; decrypts the encrypted attachment through the candidate password list to obtain a first decrypted file, and determines the file type of the first decrypted file; wherein, the file type includes a script file or an executable file; In this embodiment, the file type determination module 201 inputs the email to be analyzed into a pre-trained first LLM model, so that the first LLM model generates a candidate password list for the encrypted attachment through OCR recognition and natural language inference. Specifically, the file type determination module 201 extracts email metadata, body text, and embedded images from the email to be analyzed, and constructs prompt words based on the email metadata, body text, and embedded images; inputs the prompt words into the pre-trained first LLM model, so that the first LLM model obtains an explicit password string and an implicit password generation instruction through OCR recognition and natural language inference; wherein, the implicit password generation instruction is obtained by recognizing statements with password hint semantics; combined with the metadata, the implicit password generation instruction is logically mapped and variable-substituted to generate an inferred password string; the explicit password string and the inferred password string are merged and deduplicated to obtain a candidate password list.

[0061] The deobfuscation processing module 202 is used to input the first decrypted file into a pre-trained second LLM model if the file type of the first decrypted file is a script file, so that the second LLM model can perform deobfuscation processing on the first decrypted file to obtain a second decrypted file. In this embodiment, the second LLM model performs deobfuscation on the first decrypted file to obtain a second decrypted file. This includes: the deobfuscation module 202 cleans the code of the first decrypted file to obtain a standard script code stream, and performs semantic reconstruction on the standard script code stream to obtain the second decrypted file; wherein, the code cleansing includes removing invalid comments, deleting meaningless character blocks, and format standardization; the semantic reconstruction includes variable renaming mapping and control flow flattening.

[0062] The variant analysis module 203 is used to generate a binary fingerprint of the second decrypted file using the SimHash algorithm, and calculate the Hamming distance between the binary fingerprint and each historical fingerprint in the pre-built historical threat fingerprint database. If the minimum Hamming distance is less than a preset distance threshold, the email to be analyzed is determined to belong to a known threat variant, and a first analysis result containing the variant to which the email to be analyzed belongs is output.

[0063] In this embodiment, the variant analysis module 203 generates the binary fingerprint of the second decrypted file using the SimHash algorithm. Specifically, the variant analysis module 203 segments the second decrypted file using the N-gram algorithm to obtain several feature segments, assigns weights to each feature segment to obtain several feature word vectors, performs hash mapping on each feature segment in the feature word vectors to obtain a binary string, and performs weighted projection accumulation on the binary string according to the weights corresponding to the feature segments to obtain a unique real number vector. The real number vector is then binarized to obtain the binary fingerprint of the second decrypted file.

[0064] For a more detailed explanation of the working principle and procedures of this embodiment, please refer to the relevant description in Embodiment 1.

[0065] This invention, through a file type determination module 201, utilizes the visual recognition and natural language reasoning capabilities of a multimodal large model to crack encrypted passwords described by images or semantics, solving the entry point problem where traditional methods cannot automatically decrypt; through an anti-obfuscation processing module 202, it uses static analysis of a large model to restore the true logic of obfuscated code without dynamic sandbox operation, avoiding anti-sandbox attacks; through a variant analysis module 203, it transforms unstructured code into a computable fixed-length fingerprint, resisting fine-tuning (solving the MD5 failure problem), achieving dimensionality reduction clustering, automatically identifying known family variants, and quickly outputting attribution results, significantly reducing the cost of manual analysis.

[0066] Example 3: This embodiment provides a terminal device, including: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other through the communication bus; The memory is used to store at least one executable instruction that causes the processor to perform the operation of the APT attack email automatic analysis method as described in any of the above.

[0067] Example 4: This invention provides a computer-readable storage medium comprising a stored computer program, wherein, when the computer program is executed, it controls the device or apparatus containing the computer-readable storage medium to perform the APT attack email automatic analysis method as described above.

[0068] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0069] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. In particular, it should be noted that any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention for those skilled in the art.

Claims

1. A method for automatically analyzing APT attack emails, characterized in that, include: The process involves acquiring an email with an encrypted attachment and inputting it into a pre-trained first LLM model. The first LLM model then generates a candidate password list for the encrypted attachment through OCR recognition and natural language inference. The encrypted attachment is then decrypted using the candidate password list to obtain a first decrypted file, and the file type of the first decrypted file is determined. The file type includes script files or executable files. If the first decrypted file is a script file, then the first decrypted file is input into the pre-trained second LLM model so that the second LLM model can deobfuscate the first decrypted file to obtain the second decrypted file. The binary fingerprint of the second decrypted file is generated using the SimHash algorithm, and the Hamming distance between the binary fingerprint and each historical fingerprint in the pre-built historical threat fingerprint database is calculated. If the minimum Hamming distance is less than a preset distance threshold, the email to be analyzed is determined to belong to a known threat variant, and a first analysis result containing the variant to which the email to be analyzed belongs is output.

2. The method for automatically analyzing APT attack emails as described in claim 1, characterized in that, Also includes: If the minimum Hamming distance is greater than or equal to the preset distance threshold, the second decrypted file is input into the pre-trained third LLM model so that the third LLM model generates a semantic profile vector of the second decrypted file, and the source attack organization of the email to be analyzed is determined based on the semantic profile vector.

3. The method for automatically analyzing APT attack emails as described in claim 2, characterized in that, The email to be analyzed is input into a pre-trained first LLM model, which then generates a candidate password list for the encrypted attachment through OCR recognition and natural language inference. Specifically: From the email to be analyzed, extract email metadata, body text, and embedded images, and construct prompt words based on the email metadata, body text, and embedded images; The prompt words are input into a pre-trained first LLM model, so that the first LLM model can obtain an explicit password string and an implicit password generation instruction through OCR recognition and natural language reasoning; wherein, the implicit password generation instruction is obtained by recognizing statements with password prompt semantics; Based on the aforementioned metadata, the implicit password generation instruction is logically mapped and variable-substituted to generate an inferred password string; The explicit password string and the inferred password string are merged and duplicates are removed to obtain a candidate password list.

4. The method for automatically analyzing APT attack emails as described in claim 3, characterized in that, The second LLM model deobfuscates the first decrypted file to obtain a second decrypted file, which includes: The first decrypted file is cleaned to obtain a standard script code stream, and the standard script code stream is semantically reconstructed to obtain a second decrypted file; wherein, the code cleansing includes the removal of invalid comments, the deletion of meaningless character blocks, and the format standardization; the semantic reconstruction includes variable renaming mapping and control flow flattening.

5. The method for automatically analyzing APT attack emails as described in claim 4, characterized in that, The binary fingerprint of the second decrypted file is generated using the SimHash algorithm, specifically as follows: The second decrypted file is segmented using the N-gram algorithm to obtain several feature segments, and weights are assigned to each feature segment to obtain several feature word vectors. Each feature segment in the feature word vector is hashed to obtain a binary string, and the binary string is weighted, projected and accumulated according to the weight corresponding to the feature segment to obtain a unique real number vector; The real number vector is binarized to obtain the binary fingerprint of the second decrypted file.

6. The method for automatically analyzing APT attack emails as described in claim 2, characterized in that, Based on the semantic profile vector, the source attack organization of the email to be analyzed is determined, including: Using the semantic profile vector as a query, retrieve the historical profile record with the highest cosine similarity to the semantic profile vector in the pre-built threat intelligence vector database; If the cosine similarity is greater than a preset similarity threshold, then the attacking organization corresponding to the historical profile record is determined to be the source attacking organization.

7. The method for automatically analyzing APT attack emails as described in claim 2, characterized in that, Also includes: Extract the C2 address from the second decrypted file; If the minimum Hamming distance is greater than or equal to the preset distance threshold, then a tracing operation is performed based on the C2 address to obtain the tracing analysis result of the email to be analyzed; wherein, the tracing operation includes one or more combinations of the following: binary fingerprint server scanning, reverse DNS lookup, or URL path construction pattern analysis.

8. An automatic analysis device for APT attack emails, characterized in that, It includes a file type identification module, a deobfuscation processing module, and a variant analysis module, among which, The file type determination module is used to acquire an email with an encrypted attachment to be analyzed, and input the email to be analyzed into a pre-trained first LLM model, so that the first LLM model generates a candidate password list for the encrypted attachment through OCR recognition and natural language inference; decrypts the encrypted attachment through the candidate password list to obtain a first decrypted file, and determines the file type of the first decrypted file; wherein, the file type includes a script file or an executable file; The deobfuscation processing module is used to input the first decrypted file into a pre-trained second LLM model if the file type of the first decrypted file is a script file, so that the second LLM model can perform deobfuscation processing on the first decrypted file to obtain a second decrypted file. The variant analysis module is used to generate a binary fingerprint of the second decrypted file using the SimHash algorithm, and calculate the Hamming distance between the binary fingerprint and each historical fingerprint in the pre-built historical threat fingerprint database. If the minimum Hamming distance is less than a preset distance threshold, the email to be analyzed is determined to belong to a known threat variant, and a first analysis result containing the variant to which the email to be analyzed belongs is output.

9. A terminal device, characterized in that, include: The processor, memory, communication interface, and communication bus are provided, wherein the processor, memory, and communication interface communicate with each other via the communication bus. The memory is used to store at least one executable instruction that causes the processor to perform the operation of the APT attack email automatic analysis method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device or apparatus containing the computer-readable storage medium to perform the APT attack email automatic analysis method as described in any one of claims 1 to 7.

Images