Traceability graph construction method and device, storage medium and electronic equipment

Abstract

This application provides a method, apparatus, storage medium, and electronic device for constructing a source tracing graph, relating to the field of network security. The electronic device acquires a log set to be analyzed; based on the tensor decomposition results of the log set, it obtains log subsets corresponding to multiple potential attack events; based on the saliency score of the log subset corresponding to each potential attack event, it extracts a first entity relationship; based on network threat intelligence, it extracts a second entity relationship; it merges the first and second entity relationships to obtain a target source tracing subgraph; and it merges the first and second entity relationships to obtain the target source tracing graph. This allows both high-frequency routine behaviors and low-frequency abnormal behaviors to be retained in the target source tracing graph, thereby overcoming the limitations of simply relying on template matching.

Description

Technical Field

[0001] This application relates to the field of cybersecurity, and more specifically, to a method, apparatus, storage medium, and electronic device for constructing a traceability graph. Background Technology

[0002] Cyberattacks, especially advanced persistent threats (APS), often employ highly concealed and complex jump-board information. Attackers deliberately distribute their attacks across multiple system components and at different times, making it difficult to fully reconstruct the attack chain by relying on only one data source such as audit logs, malware analysis reports, or traffic analysis results. Therefore, only by conducting collaborative analysis of audit logs, malware analysis reports, and traffic analysis results can we overcome the information blind spots of a single data source and effectively identify dismantled, disguised, or delayed-triggered jump-board nodes.

[0003] Current mainstream log analysis methods mainly include machine learning and tensor decomposition. Machine learning methods automatically learn event patterns and identify attack behaviors from raw audit logs, malware analysis reports, traffic analysis results, and Cyber ​​Threat Intelligence (CTI) data (such as APT analysis reports, vulnerability announcements, malware technical blogs, and other unstructured text) by building classification or sequence models. However, these methods require a large number of labeled samples for training, the model training cycle is long, and they are highly dependent on professional knowledge in the cybersecurity field, resulting in high deployment thresholds and limited generalization capabilities.

[0004] In contrast, tensor decomposition does not rely on pre-defined labels and training sets. Instead, it directly mines the implicit event structure through mathematical decomposition. Therefore, tensor decomposition can be used to extract events from various raw logs without the need to import training sets or related expertise.

[0005] Research revealed that tensor decomposition is a template matching mechanism based on high-frequency co-occurrence patterns. It tends to prioritize capturing regular behavior combinations that repeatedly appear in audit logs, malware analysis reports, and traffic analysis results. Therefore, it easily overlooks low-frequency but critical abnormal behaviors. Summary of the Invention

[0006] To overcome at least one deficiency in the prior art, the present application aims to provide a source graph construction method, apparatus, storage medium, and electronic device, which can first find recurring behavior combinations in logs through tensor decomposition to form a first source graph; then identify log elements that deviate significantly from the norm to construct a second source graph; and finally merge the two to ensure that both high-frequency regular behaviors and low-frequency abnormal behaviors are retained in the target source graph, thereby overcoming the limitations of simply relying on template matching.

[0007] Firstly, this application provides a method for constructing a source graph, the method comprising: Obtain a log set to be analyzed, wherein the log set to be analyzed includes multiple logs, and each log includes log elements consisting of a subject and an object operated on by the subject; Based on the tensor decomposition results of the log set to be analyzed, log subsets corresponding to multiple potential attack events are obtained respectively; Based on the significance score of the log subset corresponding to each potential attack event, a first entity relation is extracted, wherein the significance score characterizes the difference in the frequency of occurrence of anomalous elements between the log subset and the log set to be analyzed, and the anomalous elements represent log elements with a significance score greater than an anomalous threshold. Based on cyber threat intelligence, extract the second entity relationship; The first entity relationship and the second entity relationship are merged to obtain the target tracing graph.

[0008] Secondly, this application discloses a source map construction apparatus, the apparatus comprising: The log collection module is used to acquire a log set to be analyzed, wherein the log set to be analyzed includes multiple logs, and each log includes log elements consisting of a subject and an object operated by the subject; The log decomposition module is used to obtain log subsets corresponding to multiple potential attack events based on the tensor decomposition results of the log set to be analyzed. The log decomposition module is used to extract a first entity relation based on the saliency score of the log subset corresponding to each potential attack event, wherein the saliency score characterizes the difference in the frequency of occurrence of abnormal elements between the log subset and the log set to be analyzed, and the abnormal elements represent log elements with a saliency score greater than an abnormal threshold. The intelligence analysis module is used to extract second entity relationships from network threat intelligence. The graph analysis module is used to merge the first entity relationship with the second entity relationship to obtain the target source map.

[0009] Thirdly, this application provides a storage medium storing a computer program that, when executed by a processor, implements the source graph construction method.

[0010] Fourthly, this application provides an electronic device, which includes a processor and a memory, wherein the memory stores a computer program, and the computer program, when executed by the processor, implements the source map construction method.

[0011] Compared with the prior art, this application has the following beneficial effects: The source map construction method, apparatus, storage medium, and electronic device provided in this application involve the electronic device acquiring a log set to be analyzed. This log set includes multiple log entries, each containing log elements consisting of a subject and an object manipulated by that subject. Based on the tensor decomposition results of the log set, log subsets corresponding to multiple potential attack events are obtained. A first entity relation is extracted based on the saliency score of the log subset corresponding to each potential attack event. The saliency score characterizes the frequency difference of abnormal elements between the log subset and the log set to be analyzed, and abnormal elements represent log elements with saliency scores greater than an abnormal threshold. A second entity relation is extracted based on network threat intelligence. The first and second entity relations are then fused to obtain the target source map.

[0012] In this way, tensor decomposition is used to find recurring behavioral combinations in the logs, then log elements that deviate significantly from the norm are identified to generate the first entity relationship; and based on network threat intelligence, the second entity relationship is extracted from it; finally, the two are merged, thereby making up for the limitations of simply relying on template matching. Attached Figure Description

[0013] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0014] Figure 1 A flowchart illustrating the source map construction method provided in this application embodiment; Figure 2 A schematic diagram illustrating the principle of third-order tensor modeling provided in the embodiments of this application; Figure 3 A pseudocode diagram illustrating the saliency scoring algorithm provided in the embodiments of this application; Figure 4 A schematic diagram of the model structure of the threat relationship identifier provided in the embodiments of this application; Figure 5 A pseudocode diagram illustrating the attack chain extraction algorithm provided in an embodiment of this application; Figure 6 This is a schematic diagram of the traceability map construction device provided in the embodiments of this application; Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0015] To make the objectives, technical solutions, and advantages of the embodiments of this application (hereinafter referred to as "the embodiments") clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0016] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0017] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0018] In the description of this application, it should be noted that the terms "first," "second," "third," etc., are used only for distinguishing descriptions and should not be construed as indicating or implying relative importance. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0019] Based on the above statement, as introduced in the background section, tensor decomposition tends to overlook low-frequency but critical anomalous behaviors due to its inherent high-frequency template matching mechanism.

[0020] It should be noted that the defects in the solutions in the prior art are the result of practice and careful research. Therefore, the discovery process of the above problems and the solutions proposed by the embodiments of this application in the following text should be regarded as contributions to this application in the process of invention and creation, and should not be understood as technical content known to those skilled in the art.

[0021] Based on the discovery of the above-mentioned technical problems, this embodiment provides a method for constructing a source graph. For example... Figure 1 As shown, the method includes: S1, obtain the log set to be analyzed.

[0022] The log set to be analyzed includes multiple logs, each log consisting of a subject and an object operated on by the subject.

[0023] S2, Based on the tensor decomposition results of the log set to be analyzed, obtain the log subsets corresponding to multiple potential attack events respectively; S3, extract the first entity relation based on the salience score of the log subset corresponding to each potential attack event.

[0024] The significance score represents the difference in frequency of occurrence of anomalous elements between the log subset and the log set to be analyzed, and anomalous elements are log elements whose significance scores are greater than the anomalous threshold.

[0025] S4 extracts the second entity relationship based on cyber threat intelligence.

[0026] S5 merges the first entity relationship with the second entity relationship to obtain the target tracing graph.

[0027] In this way, tensor decomposition is used to find recurring behavioral combinations in the logs, then log elements that deviate significantly from the norm are identified to generate the first entity relationship; and based on network threat intelligence, the second entity relationship is extracted from it; finally, the two are merged, thereby making up for the limitations of simply relying on template matching.

[0028] It should be understood that electronic devices capable of implementing this source map construction method include, but are not limited to, servers in security operations centers, analysis nodes in network security situation awareness platforms, threat detection and response system hosts deployed on enterprise intranets, and high-performance workstations or virtualized servers with corresponding software modules installed.

[0029] Wherein, when referring to a server, it can be a single server or a group of servers. A server group can be centralized or distributed (e.g., the servers can be a distributed system). In some embodiments, the server can be local or remote relative to the user terminal. In some embodiments, the server can be implemented on a cloud platform; by way of example only, a cloud platform can include private cloud, public cloud, hybrid cloud, community cloud, distributed cloud, inter-cloud, multi-cloud, etc., or any combination thereof. In some embodiments, the server can be implemented on an electronic device having one or more components.

[0030] To make the solution provided in this embodiment clearer, a server is used as the implementation device below, and in conjunction with... Figure 1Each step of the method is described in detail. However, it should be understood that the operations in the flowchart may not be implemented in sequence, and steps without logical contextual relationships may be reversed in order or performed simultaneously. Furthermore, those skilled in the art, guided by the content of this application, may add one or more other operations to the flowchart, or remove one or more operations from the flowchart. See also... Figure 1 The method includes: S1, obtain the log set to be analyzed.

[0031] The log set to be analyzed includes multiple logs, each log consisting of a subject and an object operated on by the subject.

[0032] In this embodiment, the log set to be analyzed can be obtained by performing three steps: log collection, parsing, and preprocessing on the server.

[0033] Specifically, the server first connects to system auditing tools and network packet capture tools to collect system logs and network communication logs generated during system operation in real time. The network logs cover types such as HTTP requests, DNS queries, and UDP / TCP connections. These raw logs all contain basic fields such as timestamps, process names, and program execution paths. During this process, the server calls preset regular expression rules to identify and extract key fields from each log entry, transforming the unstructured raw logs into a structured data cluster in a unified format. Subsequently, the server preprocesses the structured data, including but not limited to annotating the process identifier (PID), source port and destination port, and the parent-child process relationship for each log entry, and setting time interval thresholds.

[0034] Thus, the log set to be analyzed is not the raw text directly input, but a standardized data set with subject-object correspondence formed after being collected by the server, having fields extracted and features configured.

[0035] Based on the description of the log set to be analyzed in the above embodiments, the following will continue to discuss... Figure 1 Step S2 will be explained below: S2, based on the tensor decomposition results of the log set to be analyzed, obtain log subsets corresponding to multiple potential attack events respectively.

[0036] Optionally, in this embodiment, the server performs third-order tensor modeling and iterative decomposition operations on the acquired log set to be analyzed, thereby identifying a set of logs corresponding to each of the multiple potential attack events, i.e., log subsets.

[0037] In practical applications, the server first abstracts each log entry in the log set to be analyzed into a message template according to a fixed format. These templates represent the smallest repeatable atomic behaviors in the logs. For example, the "restart_pc, Delete_app, screenShot, Kill_process" (remote control classes) or "updateAPP, DownAPP, RequestTimer" (computer timer classes) listed in Table 1 below.

[0038] Table 1

[0039] Based on this message template, the server identifies which message templates frequently appear in groups concurrently within the same process, thus forming process message groups. For example, a remote control process may simultaneously generate multiple logs such as "restart_pc", "screenShot", and "Kill_process", while a software update process may also contain "restart_pc". Therefore, the same message template can be reproduced in different processes and needs to be distinguished through process context.

[0040] In addition, it should be understood that multiple process message groups corresponding to different processes, if they occur in a coordinated manner according to the actual execution order (for example, the timer process first triggers "updateAPP", and then the remote control process executes "restart_pc" and calls "screenShot"), together constitute a higher-level event.

[0041] like Figure 2 As shown, to automatically identify this cross-process, time-dependent, and non-simple co-occurrence event structure, the server constructs a three-dimensional tensor:

[0042] In the formula, dimension Indicates the message template type (e.g., restart_pc belongs to a coordinate in T). Indicates the process ID (e.g., the process with pid=1234). Represents a time window (e.g., the period from 10:00 to 10:05 on January 10, 2026); each position in the tensor The value represents the process. In the time window The message template was called internally. The number of times, and this value is never less than zero, that is This can be understood as a three-dimensional tensor that is essentially a digital cube formed by stacking all the logs in layers, with each layer corresponding to a time window and each face reflecting the frequency of a certain type of process using a certain type of template.

[0043] The server then performs a mathematical decomposition on the tensor, approximating it as the product of three low-dimensional matrices or tensors:

[0044] For each element in the above matrices, the relationship can be expressed as:

[0045] In the formula, the matrix (dimension is) ) is used to describe which message templates belong to which process message group; tensor (dimension is) This is used to describe which process message groups were jointly involved in which potential attack event; matrix (dimension is) This is used to describe the time windows in which each potential attack event mainly occurs.

[0046] Process message group matrix (in (A set of process message groups), used to describe the proportion of each type of message template in a given process message group, its elements... If a message template of a certain type belongs to a process message group, then And when the process message group is It consists of a message template, where the message template is... Appear Next time ; Event Tensor Matrix (in (An event set), used to describe the frequency percentage of a process's message group in a specific target event, its elements... If the message group occurs in the process Belongs to the event ,but And when the event There are a total of Each process message group, including message groups Appear Next time ; Time matrix This describes the time windows in which each event occurs, reflecting the temporal relationships between events. Its elements... Indicates an event In the time window The intensity that occurs in the middle.

[0047] It is worth noting that the events here are not pre-set attack patterns, but rather data-driven, automatically discovered behavioral units, representing multiple process message groups linked together in the actual execution order. For example, the timer process first triggers "updateAPP", then the remote control process executes "restart_pc" and calls "screenShot", together constituting a higher-level attack event.

[0048] To achieve the above decomposition, the server continuously adjusts its configuration using an iterative optimization approach. , , The value of the product is such that it approximates the original tensor as closely as possible. Each iteration is based on the evaluation function:

[0049] In this evaluation function, the server needs to calculate the sum of squared errors between the current decomposition result and the original data. In practice, it was found that repeatedly calculating this formula incurs significant overhead. Therefore, this embodiment further introduces an auxiliary function. To accelerate convergence, the complete expression is:

[0050] In the formula, the scaling factor Defined as:

[0051] The server respectively about , , Taking the partial derivatives, we obtain three update formulas:

[0052]

[0053]

[0054]

[0055] The server repeatedly performs the above update until the evaluation function is executed. When the value is below the preset threshold, the decomposition is complete. At this point, the server can then... and Extracting events With process Time window The correspondence is then mapped in reverse to... Which specific logs, i.e. which The combined logs support this event, resulting in log subsets corresponding to multiple potential attack events. Each subset can be understood as consisting of several real log entries, exhibiting clear synergy in terms of template type, process attribution, and time window.

[0056] For example, suppose a server detects an Advanced Persistent Threat (APT) attack where process A (pid=1001) frequently calls "Delete_app" and "Kill_process" within the window from 09:32 to 09:35, process B (pid=1002, a child process of A) calls "screenShot" in the same window, and process C (pid=2001, belonging to another user session) calls "DownAPP" and "restart_pc" from 09:36 to 09:38. Tensor decomposition identifies these three sets of behaviors as components of the same potential attack event.

[0057] This can be understood as follows: the log subset includes both multiple templated logs within a single process (e.g., 5 logs generated by a remote control operation) and a complete chain of behaviors completed in chronological order between multiple processes. Its composition logic is obtained through tensor decomposition.

[0058] Based on the above description of tensor decomposition of the log set to be analyzed in the embodiments, the following will continue to discuss... Figure 1 Step S3 will be explained below: S3, extract the first entity relation based on the salience score of the log subset corresponding to each potential attack event.

[0059] Optionally, in this embodiment, the subjects, objects, and their interactions extracted from the logs are used as the first entity relationship and then used to construct a source graph.

[0060] It should be understood that this embodiment does not simply arrange the logs in chronological order or list fields, but rather defines a source graph to describe the subset of logs corresponding to each potential attack event:

[0061] In the formula, A collection of entities (processes or threads), including process ID, PID, command line, owner, code, and data tags.

[0062] This represents a collection of objects (such as files, pipes, network connections, etc.), where each object includes a name, type, owner, and tag. This represents a set of system call event methods, such as read, write, fork, open, create, etc., which refer to the interaction methods between entities (subject and object); Indicates a timestamp, which refers to the access time of the subject and object; Indicates location, referring to the place visited by the subject and object.

[0063] Based on the definition of a source graph, the server first needs to identify the subject (e.g., a process or thread) and object (e.g., an opened file, an established network connection, an operation on a pipe, etc.) contained in each log entry, and then treat these subjects and objects as nodes in the graph. Next, based on the specific system call type recorded in the log (e.g., read, write, fork, open, create, etc.), the server abstracts the call behavior as an edge connecting two vertices. This edge represents the information flow or control flow between the subject and object, and its type is a set of system call event modes. One of the specific elements.

[0064] Each edge in the graph can also carry a timestamp. and places to visit Attributes such as timestamp and location. The timestamp represents the exact moment when the subject operates on the object, while the location represents the physical or logical location where the operation occurs (e.g., a host, a container, a memory address, or a network domain). Since the same subject and object may interact multiple times at different times, multiple edges can exist between two vertices under different timestamps, with each edge corresponding to an independent operation event.

[0065] Based on the above description of the source tracing subgraph in the embodiments, it should be understood that when constructing the source tracing graph, relying solely on frequently occurring routine behaviors in the logs (e.g., system restarts, software updates, etc.) can easily bury real attack clues among a large number of normal operations, causing critical jump server information to be overlooked. Therefore, this embodiment provides... Figure 1 The following are optional implementations of step S3: S3-1, for each log subset, identify the abnormal elements from the log subset.

[0066] This embodiment can be understood as follows: by comparing and identifying, the server automatically determines which log elements stand out in a suspicious event but are extremely rare in the overall log, thereby extracting these truly alarming elements and their related relationships to form the first entity relationship.

[0067] Specifically, this embodiment does not view each log field (such as process name, port number, file path, etc.) in isolation. Instead, it treats each log subset obtained through tensor decomposition as a suspicious event scenario, also known as the foreground set; simultaneously, it treats all logs to be analyzed as the background set reflecting the system's daily operating status. Based on this, the server calculates the frequency of occurrence of each log element (e.g., port "4444") within each log subset.

[0068] Frequency of occurrence throughout the entire log set to be analyzed;

[0069] In the formula, This indicates the number of times the element appears in the current log subset. This indicates the total number of times it appears in the entire log set to be analyzed. This represents the total number of log entries in the corresponding set. Subsequently, the server uses the given formula:

[0070] In the formula, Indicates significance score, This indicates the frequency of occurrence of the corresponding log element within its respective log subset. This indicates the frequency of occurrence in the log set to be analyzed.

[0071] For the calculated significance score, only when the score is greater than the preset anomaly threshold is the element identified as an anomalous element and it is treated as a graph node in the second source subgraph.

[0072] Based on the above description of abnormal elements, step S3 further includes: S3-2, based on the co-occurrence frequency of each pair of anomalous elements between the log subset and the log set to be analyzed.

[0073] S4-3 If the co-occurrence frequency is greater than the co-occurrence threshold, then establish the first entity relationship between the two abnormal elements.

[0074] This can be understood as the server further examining whether any two such anomalous elements frequently co-occur in the same subset of logs. If their co-occurrence frequency in that subset is significantly higher than their co-occurrence frequency in the entire log set, then the significance score between them will be higher. Once this score exceeds another preset co-occurrence threshold, the server constructs the first entity relationship between the two anomalous elements. For details of this algorithm, please refer to [link to algorithm documentation]. Figure 3 This embodiment will not be described in detail.

[0075] It should be noted that multiple potential attack events identified solely through server log analysis are actually a set of actions that are close in time, involve interconnected processes, and exhibit abnormal behavior. For example, "one process downloads a file -> another process executes the file -> then initiates an external connection." However, this cannot automatically determine whether it constitutes a ransomware attack, an APT infiltration, or cryptocurrency mining. Therefore, if... Figure 1 As shown, the source map construction method provided in this embodiment also includes: S4 extracts the second entity relationship based on cyber threat intelligence.

[0076] It should be understood that for a server to accurately identify potential attack events, it must first obtain authoritative, structured threat knowledge. However, this type of knowledge is scattered throughout unstructured or semi-structured network threat intelligence. Therefore, this embodiment provides the following optional methods for step S4: S4-1, for obtaining cyber threat intelligence.

[0077] This network threat intelligence can include unstructured or semi-structured text such as APT analysis reports, vulnerability announcements, and malware technical blogs.

[0078] S4-2 performs semantic analysis on network threat intelligence to extract multiple threat entities.

[0079] It should be understood that in the field of cybersecurity, the same threat often has multiple names. For example, "EternalBlue" and "CVE-2017-0144" both point to the same vulnerability, while "Sodinokibi" and "REvil" are actually the same ransomware. Therefore, servers can use pre-trained entity extraction models to process network threat intelligence, obtaining multiple raw entities; and then use a pre-defined thesaurus to merge identical entities from these raw entities, resulting in multiple threat entities.

[0080] In practical applications, because raw network threat intelligence (e.g., vulnerability announcements, attack reports, technical blogs) is mostly unstructured text, containing a large number of technical terms, abbreviations, colloquial expressions, and even spelling variations, general Named Entity Recognition (NER) models cannot accurately identify entities specific to APT attack scenarios (e.g., EternalBlue). Furthermore, even if multiple names are successfully identified, the server still needs to determine whether they refer to the same real object. For example, "Sodinokibi" and "REvil" are actually the same ransomware, and "CVE-2017-0144" and "EternalBlue" describe the same vulnerability.

[0081] To address this, this embodiment provides a model called Threat Entity Identifier (TEI) for APT attack scenarios. For example... Figure 4 As shown, this model is based on the Bidirectional Encoder Representations from Transformers (BERT) language model, which can dynamically learn the true semantics of a word in the current sentence by utilizing the contextual information on the left and right sides of each word in the text.

[0082] In practice, the server segments the input network threat intelligence (e.g., vulnerability announcement PDFs, malware analysis blogs) into sentences. For each sentence, it first converts it into a token sequence conforming to the BERT format. Each of them It is a word segment after WordPiece word segmentation. The BERT model generates a final hidden state vector containing contextual semantics for each word segment.

[0083] See also Figure 4 The hidden state vector is fed into a Bidirectional Long Short-Term Memory (BiLSTM) layer, which extracts sequence features from both the forward and backward directions to more comprehensively capture the grammatical relationships between technical terms (e.g., the word "exploitation" followed by "CVE-2017-0144" implies that the latter is a vulnerability type).

[0084] See also Figure 4 The output of BiLSTM is then fed into a Conditional Random Field (CRF) layer. The CRF layer comprehensively considers the label constraints of the entire sequence (e.g., the "vulnerability" label is usually not directly appended to the "tool" label) and decodes the globally optimal label sequence.

[0085] In the formula, each It was determined to fall under one of the following seven categories of labels: "attack method, attack vector, vulnerability, platform, algorithm, tool, or others." The "other" label is specifically used to identify general terms that do not belong to the aforementioned six categories of cybersecurity entities.

[0086] Thus, the server accurately locates and categorizes all original entities from each sentence; for example, it marks the original entity represented by the string "EternalBlue" as "vulnerability".

[0087] However, the current TEI model can only distinguish based on name strings and cannot understand the actual meaning behind the names. Yet, multiple entities represented by different names are extremely common in the cybersecurity field. For example, "Revil" and "Sodinokibi" are different names for the same ransomware; "EternalBlue" and "CVE-2017-0144" describe the same vulnerability. Because the TEI model only identifies by strings, it will classify "Revil" and "Sodinokibi" as two completely unrelated entities, thus affecting the analysis of the attack chain.

[0088] Therefore, in the embodiments, a structured thesaurus is also pre-constructed, which is a dictionary of different names for the same object. The authoritative thesaurus, in which yes Alternative names (e.g., (Revil, Sodinokibi), (EternalBlue, CVE-2017-0144)); this thesaurus is manually compiled and continuously updated. For each pair of alternative names in the thesaurus... The server explicitly adds a record named [Entity Name] between two entities with corresponding names in the knowledge base. The relationship.

[0089] This can be understood as all the methods used in this embodiment... All connected entities are logically treated as the same object by the server and merged into a standard name (e.g., uniformly denoted as "REvil" or "EternalBlue"). This ultimately forms a set of deduplicated, unified threat entities that can be directly used for entity alignment. This solves the domain adaptation problem and naming ambiguity problem of the general named entity recognition model.

[0090] It should also be noted that after identifying threat entities from cyber threat intelligence, it is also necessary to obtain the ways in which they interact. Therefore, step S4 also includes: S4-3, based on the interaction between multiple threat entities, obtain the second entity relationship.

[0091] Specifically, the TEI model has identified multiple threat entities from the same sentence and labeled their threat types. However, at this point, there is no semantic relationship between these entities; the server needs to further determine their actual interaction methods. For example, REvil launches an attack using CVE-2017-0144.

[0092] To address this, the server provides a model called Threat Relation Identifier (TRI). This model is a specially fine-tuned Relation Extraction (RE) model, whose input is a complete sentence and any pair of identified entities within it. The output is the label representing the most likely semantic relationship between the two entities. Like the TEI model, the TRI model is also based on the BERT language model, inserting special markers (i.e., <) at the beginning and end of the two entities in the input sentence before training. >、 < / >、< >and < / >) This allows the model to precisely focus on the pair of entities and their context. In addition, the two entities themselves are replaced with their type names (e.g., the string "REvil" is masked as "ransomware", and "CVE-2017-0144" is masked as "vulnerability"), preventing the model from relying too much on the entity surface names and ignoring their functional roles, thereby improving generalization ability.

[0093] The preprocessed sentence is segmented into a word sequence by the WordPiece tokenizer, with a [CLS] token added at the beginning. TRI then inputs the entire sequence into the BERT model to obtain the hidden state vector for each word. The [CLS] vector carries the semantics of the entire sentence, while the vectors corresponding to each of the two entities are compressed into a single vector through an averaging operation. Finally, the server feeds the [CLS] vector and the average vectors of the two entity types (a total of three vectors) sequentially into a fully connected layer, another fully connected layer, and then a softmax layer to output a probability distribution, thereby determining the interaction mode of the entity pair. In this embodiment, the interaction modes that TRI can identify include: ( yes (variant) ( yes (variant) (Transmitted through a certain medium) (Exploiting a vulnerability) (Targeting a specific platform or system) (Encrypt a file or data) (Using a certain tool or algorithm) (Other relationships that do not belong to the aforementioned seven categories).

[0094] It is worth noting that the above-mentioned mode of action It is divided into two directions because it only applies to the same type of threat entity (such as two "ransomware" programs), and different directions represent different evolutionary paths. For example, "Sodinokibi is a variant of Revil" and "Revil is a variant of Sodinokibi" have completely opposite semantics.

[0095] This enables the inference of the actual interaction patterns between threat entities from natural language descriptions.

[0096] Based on the first entity relationship and the second entity relationship obtained in the above embodiments, see below. Figure 1 Next, we will continue with... Figure 1 The steps are explained below: S5 merges the first entity relationship with the second entity relationship to obtain the target tracing graph.

[0097] Optionally, when merging the first entity relationship and the second entity relationship, the server uses a unified graph model structure. Based on this, semantic alignment and structural integration are performed on both. The first entity relationship originates from the log set to be analyzed, and is identified by applying a saliency score to the log subset obtained by log tensor decomposition to identify strong associations between anomalous elements; the second entity relationship originates from network threat intelligence, and is obtained by named entity recognition and relation extraction from the intelligence text, reflecting relevant knowledge about attack behavior.

[0098] In practical applications, when the server performs the fusion operation, it does not simply splice and superimpose the two types of relationships. Instead, it uses a pre-defined source graph structure model as a unified framework to map the two types of relationships to the same graph space. This graph space strictly follows the definition of a spatiotemporal source graph, meaning that its vertex set includes subjects (such as processes and threads) and objects (such as files, network connections, and pipes), and its edge set represents system call event types (such as read, write, fork, and open). Each edge carries two dimensions: timestamp (T) and access location (W). Therefore, in this process, when an abnormal element in the first entity relationship is parsed into a specific subject or object and transformed into a directed edge with time constraints, the threat entity and its semantic relationships (such as exploit and spread via) in the second entity relationship are embedded into the same graph as supplementary attributes, auxiliary edges, or new vertices after entity alignment. Simultaneously, redundancy compression is further performed (e.g., unifying the same process with multiple implementations into a standard identifier) ​​to ensure consistent graph structure logic and clear semantics.

[0099] Based on the constructed target source map, this embodiment also provides a source map construction method that further includes: S6, based on the target source graph, matches and analyzes the log elements in the log subsets corresponding to multiple potential attack events with preset behavioral features, and extracts the attack chain from the target source graph.

[0100] As an optional implementation, step S6 is specifically implemented as follows: S6-1. For any two events in the target tracing graph, if the process identifiers of the two events have a parent-child process relationship, or if the two events operate on the same object in sequence, then mark a directed edge between the two events, where the directed edge points from the event that occurs first to the event that occurs later.

[0101] Optionally, this embodiment abstracts multiple potential attack events into nodes and compares their commonalities one by one according to thirteen preset behavioral characteristics, enabling the server to automatically construct an attack chain that reflects the logical relationship between events.

[0102] In practical applications, the server performs systematic matching analysis on each pair of potential attack events (denoted as event u and event v) based on the thirteen-dimensional structured behavioral characteristics listed in Table 2.

[0103] Table 2

[0104] exist Dimension, if the absolute value of the difference between the timestamps of two events is less than a preset threshold (Right now If the time proximity is specified, then it is considered "time proximity" and a marker is established. The edge.

[0105] exist In terms of dimensions, if u.Pid equals v.Pid, meaning both events are triggered by the same process, then a dimension is established. side.

[0106] exist In terms of dimensions, if the source IP, destination IP, source port, or destination port of the two are completely identical, then separate connections will be established. side.

[0107] exist Dimension: If u.Objname and v.Objname are the same (for example, u downloaded malware.exe, and v executed a file with the same name), then a new dimension is created. side.

[0108] exist In terms of dimensions, if u.Path (e.g., C:\temp\downloader.exe) equals v.Pname (e.g., downloader.exe), it indicates that the path matches the process name, and a process is established. side; exist In terms of dimensions, if u.Path (e.g., C:\temp\payload.bin) equals v.Objname (e.g., payload.bin), it indicates that the process accessed the file it downloaded and established... side.

[0109] Based on the aforementioned pre-defined behavioral characteristics, an undirected graph-like event tracing graph is constructed. In this event sourcing diagram, the server treats all events as a set of nodes. Treat all valid dimensional relationships as edge sets. And all thirteen dimensions constitute a feature relationship set. This forms a three-dimensional correlation matrix. , where matrix elements Indicates the first The event and the first An event is correlated on the k-th dimension feature; otherwise, the correlation is 0. The complete representation is It clearly records the specific combination of dimensions on which the connection is based.

[0110] Based on the above description of the event sourcing diagram, the method further includes: S6-2: Based on the marked directed edges, sort the corresponding events in chronological order to obtain the attack chain.

[0111] Optionally, for any two events in the event sourcing graph, if the process identifiers of the two events have a parent-child process relationship, or if the two events operate on the same object in sequence, then the server marks a directed edge between the two events, wherein the directed edge points from the earlier event to the later event; based on the marked directed edge, the corresponding events are sorted in chronological order to obtain the attack chain.

[0112] This embodiment can be understood as follows: by organizing the control logic of the process according to the time sequence based on the undirected edges of the event tracing graph, the server can identify the attack behavior chain with causal relationship.

[0113] Specifically, the specific algorithm is as follows: Figure 5 As shown, the server first traverses any two events in the event source graph (denoted as events). With the event ), determine whether each of them satisfies any of the following conditions: First, process identifiers have parent-child process relationships, i.e., events. The corresponding process is an event. The parent process of the corresponding process, at which point the server recognizes the event. Logically precedes and triggers the event. ; Secondly, two events operate on the same object sequentially, that is, events... Creating, downloading, or writing to an object, events Subsequently, the same object is executed, read, or connected, and the event... The timestamp is earlier than the event timestamp (i.e.) At this point, the server recognizes the event. For the event The pre-event actions. Once any condition is met, the server will... With the event Mark a directed edge between them, with its direction strictly pointing from the earlier event to the later event.

[0114] The server sorts the event nodes based on all labeled directed edges, that is, it arranges the events sequentially according to the dependencies indicated by each directed edge; the final output attack chain is an ordered sequence of events. Each of them All of these were among the original potential attack events. Therefore, the attack chain was identified from the event source map.

[0115] Based on the same inventive concept as the source map construction method provided in this embodiment, this embodiment also provides a source map construction apparatus. This apparatus includes at least one processor that can be stored in software form in a memory or embedded in an electronic device for executing executable modules stored in the memory. For example, the apparatus includes software functional modules and computer programs, etc. Please refer to... Figure 6 Functionally, the device may include: The log collection module is used to obtain the log set to be analyzed. The log set to be analyzed includes multiple logs, and each log includes log elements consisting of a subject and an object operated on by the subject. The log decomposition module is used to obtain log subsets corresponding to multiple potential attack events based on the tensor decomposition results of the log set to be analyzed. The log decomposition module is used to extract the first entity relation based on the significance score of the log subset corresponding to each potential attack event. The significance score represents the difference in the frequency of occurrence of abnormal elements between the log subset and the log set to be analyzed. Abnormal elements are log elements with a significance score greater than the abnormal threshold. The intelligence analysis module is used to extract second entity relationships from network threat intelligence. The graph analysis module is used to merge the first entity relationship with the second entity relationship to obtain the target source map.

[0116] In this embodiment, the log collection module is used to implement Figure 1 In step S1, the log decomposition module is used to implement... Figure 1 Steps S2 and S3 in the process are implemented by the intelligence analysis module. Figure 1 In step S4, the spectral analysis module is used to implement... Figure 1 Step S4 in the above process. Therefore, for a detailed description of each of the above modules, please refer to the specific implementation of the corresponding step.

[0117] Optionally, the log decomposition module extracts the first entity relationship based on the salience score of the log subset corresponding to each potential attack event in the following ways: For each subset of logs, identify the anomalous elements within that subset. Based on the co-occurrence frequency of each pair of anomalous elements between the log subset and the log set to be analyzed; If the co-occurrence frequency is greater than the co-occurrence threshold, then a first entity relationship is established between the two anomalous elements.

[0118] Optionally, the spectral analysis module is also used for: Based on the target source graph, log elements in the log subsets corresponding to multiple potential attack events are matched and analyzed with preset behavioral features to extract the attack chain from the target source graph.

[0119] Optionally, the graph analysis module, based on the target source graph, matches and analyzes log elements in log subsets corresponding to multiple potential attack events with preset behavioral features. The methods for extracting attack chains from the target source graph include: For any two events in the target tracing graph, if the process identifiers in the two events have a parent-child process relationship, or if the two events operate on the same object in sequence, then mark a directed edge between the two events, where the directed edge points from the event that occurs first to the event that occurs later. Based on the marked directed edges, the corresponding events are sorted in chronological order to obtain the attack chain.

[0120] Optionally, the intelligence analysis module may extract second entity relationships from network threat intelligence in the following ways: Obtain cyber threat intelligence; Semantic analysis is performed on network threat intelligence to extract multiple threat entities; The second entity relationship is obtained based on the interaction between multiple threat entities.

[0121] Optionally, the intelligence analysis module performs semantic analysis on network threat intelligence to obtain multiple threat entities in the following ways: The network threat intelligence is processed using a pre-trained entity extraction model to obtain multiple raw entities; Multiple threat entities are obtained by merging identical entities from multiple original entities using a pre-defined thesaurus.

[0122] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0123] It should also be understood that if the above embodiments are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application.

[0124] Therefore, this embodiment also provides a storage medium, which is a computer-readable storage medium. This storage medium stores a computer program, which, when executed by a processor, implements the traceability graph construction method provided in this embodiment. The storage medium can be any medium capable of storing program code, such as a USB flash drive, external hard drive, read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0125] Please refer to Figure 7 This is a schematic diagram of the hardware structure of the electronic device provided in this embodiment, which is used to implement the traceability map construction method. The electronic device may include a processor 22 and a memory 21. The memory 21 stores a computer program, and the processor implements the traceability map construction method provided in this embodiment by reading and executing the computer program in the memory 21 corresponding to the above-described embodiments.

[0126] See also Figure 7 The electronic device also includes a communication unit 23. The memory 21, processor 22 and communication unit 23 are electrically connected to each other directly or indirectly through system bus 24 to realize data transmission or interaction.

[0127] The memory 21 can be an information recording device based on any electronic, magnetic, optical, or other physical principles, used to record execution instructions, data, etc. In some embodiments, the memory 21 can be, but is not limited to, volatile memory, non-volatile memory, memory drive, etc.

[0128] In some embodiments, the volatile memory may be random access memory (RAM); in some embodiments, the non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), flash memory, etc.; in some embodiments, the storage drive may be a disk drive, solid-state drive, any type of storage disk (such as optical disc, DVD, etc.), or similar storage media, or a combination thereof.

[0129] The communication unit 23 is used to send and receive data over a network. In some embodiments, the network may include a wired network, a wireless network, a fiber optic network, a telecommunications network, an intranet, the Internet, a local area network (LAN), a wide area network (WAN), a wireless local area network (WLAN), a metropolitan area network (MAN), a public switched telephone network (PSTN), a Bluetooth network, a ZigBee network, or a near field communication (NFC) network, or any combination thereof. In some embodiments, the network may include one or more network access points. For example, the network may include wired or wireless network access points, such as base stations and / or network switching nodes, through which one or more components of the service request processing system can connect to the network to exchange data and / or information.

[0130] The processor 22 may be an integrated circuit chip with signal processing capabilities, and may include one or more processing cores (e.g., a single-core processor or a multi-core processor). By way of example only, the processor described above may include a Central Processing Unit (CPU), an Application Specific Integrated Circuit (ASIC), an Application Specific Instruction-set Processor (ASIP), a Graphics Processing Unit (GPU), a Physics Processing Unit (PPU), a Digital Signal Processor (DSP), a Field Programmable Gate Array (FPGA), a Programmable Logic Device (PLD), a controller, a microcontroller unit, a Reduced Instruction Set Computing (RISC) computer, or a microprocessor, or any combination thereof.

[0131] Understandable. Figure 7 The structure shown is for illustrative purposes only. Electronic devices may also have more advanced features. Figure 7 Showing more or fewer components, or having with Figure 7 The different configurations shown. Figure 7 The components shown can be implemented using hardware, software, or a combination thereof.

[0132] It should be understood that the apparatus and methods disclosed in the above embodiments can also be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0133] The above descriptions are merely various embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for constructing a source graph, characterized in that, The method includes: Obtain a log set to be analyzed, wherein the log set to be analyzed includes multiple logs, and each log includes log elements consisting of a subject and an object operated on by the subject; Based on the tensor decomposition results of the log set to be analyzed, log subsets corresponding to multiple potential attack events are obtained respectively; Based on the significance score of the log subset corresponding to each potential attack event, a first entity relation is extracted, wherein the significance score characterizes the difference in the frequency of occurrence of anomalous elements between the log subset and the log set to be analyzed, and the anomalous elements represent log elements with a significance score greater than an anomalous threshold. Based on cyber threat intelligence, extract the second entity relationship; The first entity relationship and the second entity relationship are merged to obtain the target tracing graph.

2. The source map construction method according to claim 1, characterized in that, Based on the saliency score of the log subset corresponding to each potential attack event, the first entity relation is extracted, including: For each of the log subsets, identify the anomalous elements from the log subsets; Based on the co-occurrence frequency of every two of the aforementioned anomalous elements between the log subset and the log set to be analyzed; If the co-occurrence frequency is greater than the co-occurrence threshold, then a first entity relationship is established between the two abnormal elements.

3. The source map construction method according to claim 1, characterized in that, The abnormal element is identified from the log subset, expressed as follows: In the formula, This represents the saliency score of a log element. If the value exceeds the aforementioned abnormal threshold, the corresponding log element is considered an abnormal element. This indicates the frequency of occurrence of the corresponding log element within its respective log subset. This indicates the frequency of occurrence in the log set to be analyzed.

4. The source map construction method according to claim 1, characterized in that, The method further includes: Based on the target source map, log elements in the log subsets corresponding to multiple potential attack events are matched and analyzed with preset behavioral features to extract the attack chain from the target source map.

5. The source map construction method according to claim 4, characterized in that, Based on the target source map, log elements in the log subsets corresponding to multiple potential attack events are matched and analyzed with preset behavioral features to extract attack chains from the target source map, including: For any two events in the target tracing graph, if the process identifiers in the two events have a parent-child process relationship, or if the two events operate on the same object in sequence, then a directed edge is marked between the two events, wherein the directed edge points from the event that occurs first to the event that occurs later. Based on the marked directed edges, the corresponding events are sorted in chronological order to obtain the attack chain.

6. The source map construction method according to claim 1, characterized in that, Based on cyber threat intelligence, second entity relationships are extracted, including: Obtain cyber threat intelligence; The network threat intelligence is semantically analyzed to obtain multiple threat entities. The second entity relationship is obtained based on the interaction between the multiple threat entities.

7. The source map construction method according to claim 6, characterized in that, Semantic analysis is performed on the network threat intelligence to extract threat entities, including: The network threat intelligence is processed using a pre-trained entity extraction model to obtain multiple raw entities; By using a preset thesaurus to merge identical entities from the multiple original entities, the multiple threat entities are obtained.

8. A source map construction device, characterized in that, The device includes: The log collection module is used to acquire a log set to be analyzed, wherein the log set to be analyzed includes multiple logs, and each log includes log elements consisting of a subject and an object operated by the subject; The log decomposition module is used to obtain log subsets corresponding to multiple potential attack events based on the tensor decomposition results of the log set to be analyzed. The log decomposition module is used to extract a first entity relation based on the saliency score of the log subset corresponding to each potential attack event, wherein the saliency score characterizes the difference in the frequency of occurrence of abnormal elements between the log subset and the log set to be analyzed, and the abnormal elements represent log elements with a saliency score greater than an abnormal threshold. The intelligence analysis module is used to extract second entity relationships from network threat intelligence. The graph analysis module is used to merge the first entity relationship with the second entity relationship to obtain the target source map.

9. A storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the source map construction method according to any one of claims 1-7.

10. An electronic device, characterized in that, The electronic device includes a processor and a memory, the memory storing a computer program, which, when executed by the processor, implements the source map construction method according to any one of claims 1-7.

Images