APT attack organization attribution method and system based on topic-enhanced heterogeneous hypergraph
By constructing a heterogeneous hypergraph structure and a topic-level semantic enhancement mechanism, the problems of sparse evidence and insufficient characterization of multi-entity collaborative relationships in the attribution of APT attack organizations are solved, and efficient attribution analysis of attack organizations is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- HAINAN NORMAL UNIV
- Filing Date
- 2026-03-13
- Publication Date
- 2026-07-07
AI Technical Summary
Existing technologies are insufficient to effectively characterize the multi-entity collaborative behavior and cross-event semantic relationships of APT attack groups, resulting in sparse and scattered attack evidence, which affects the accuracy and stability of attribution results.
A heterogeneous hypergraph structure for multi-entity collaborative behavior is constructed, and a topic-level semantic enhancement mechanism is introduced. Through joint modeling of topic modeling and a two-layer attention mechanism, high-order correlation analysis of attack behavior is achieved.
It improves the accuracy and stability of attribution results for APT attack groups and solves the problems of sparse evidence and insufficient characterization of multi-entity collaborative relationships in traditional methods.
Smart Images
Figure CN122348838A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of cyberspace security and threat intelligence analysis technology, specifically to an APT attack organization attribution method and system based on topic-enhanced heterogeneous hypergraphs. Background Technology
[0002] The value of cyber threat intelligence in the entire cybersecurity protection process is becoming increasingly prominent. Attack behavior patterns, as an advanced characteristic of attackers, are crucial for identifying and attributing APT attack organizations from threat intelligence, making proactive defense in the cyberspace security field an important aspect. Currently, with the increasingly severe cybersecurity situation, Advanced Persistent Threats (APTs) have become one of the main security threats targeting critical infrastructure, government agencies, and large enterprise network systems.
[0003] Based on the correlations among various elements in attack behavior, such as tactics, techniques, and procedures (TTPs), tools, infrastructure, and victim targets, automatically characterizing the behavioral features of attack organizations by jointly modeling the coordinated behavior of multiple elements is a prerequisite for the correlation analysis and organizational attribution of attack behavior patterns. However, evidence related to APT behavior is often highly abstract and usually exists in multi-source heterogeneous threat intelligence reports and security analysis texts, exhibiting characteristics such as sparse evidence, diverse entity types, dispersion across events, and complex correlations. This makes it difficult for traditional manual analysis methods and feature engineering-based machine learning methods to quickly and effectively extract stable organizational attribution evidence from threat intelligence and complete accurate attribution.
[0004] Unlike traditional machine learning, deep learning, through multi-layered processing, gradually transforms initial "low-level" text and behavioral feature representations into "high-level" semantic representations, enabling complex tasks such as identification and classification to be accomplished with "simple models." In unstructured threat intelligence text data processing tasks, deep learning can discover inherent connections within heterogeneous text data and extract implicit semantic features for downstream tasks such as attack behavior representation, attack organization classification, and attribution. Therefore, using deep learning algorithms to attribute threat intelligence to APT attack organizations is currently the mainstream solution. However, as the primary data source for APT attribution evidence, the diverse data formats and high-order correlation structures of multi-entity collaborative behavior in threat intelligence make it difficult to fully characterize the high-order relationships and cross-event semantic associations of multi-entity collaborative participation using only sequence modeling or pairwise relationship modeling methods, thus affecting the stability and generalization ability of attribution.
[0005] This invention discloses an attribution method for APT attack organizations based on a topic-enhanced heterogeneous hypergraph. Addressing the characteristics of sparse evidence and complex relationships in threat intelligence texts, this method constructs a heterogeneous hypergraph structure of multi-entity collaborative behavior and introduces a topic-level semantic enhancement mechanism to jointly model the relevant behavioral elements of attack organizations and their higher-order associations, thereby achieving effective attribution analysis of APT attack organizations. Summary of the Invention
[0006] The technical problem this invention aims to solve is the common problems in existing APT attack organization attribution methods during threat intelligence analysis, such as scattered and sparse attack evidence, difficulty in characterizing multi-entity collaborative behavior, and insufficient ability to correlate cross-event attack behaviors. This invention provides an APT attack organization attribution method and system based on topic-enhanced heterogeneous hypergraphs. By jointly modeling multiple types of entities related to attack behaviors in threat intelligence and their high-order collaborative behavior relationships, it achieves effective characterization of attack organization behavior patterns, thereby improving the accuracy and stability of APT attack organization attribution results. The technical solution is as follows:
[0007] An attribution method for APT attack groups based on topic-enhanced heterogeneous hypergraphs includes the following steps:
[0008] Step 1: Attack behavior element extraction: Obtain multi-source network threat intelligence text, extract attack behavior elements from the network threat intelligence text, perform semantic encoding processing on the extracted attack behavior elements, map each attack behavior element to a vector representation space, and form the initial semantic feature representation of the attack behavior elements.
[0009] Step 2: Topic-enhanced heterogeneous hypergraph construction: The attack behavior elements are used as behavior element nodes. Based on the co-occurrence relationship between multiple attack behavior elements in the same attack event, multiple behavior element nodes belonging to the same attack event are constructed as intra-event hyperedges. Topic modeling is performed on the semantic features of attack behavior elements in multiple attack events to obtain the topic representation vector corresponding to each attack event. Topic-level cross-event hyperedges are constructed according to the topic similarity between attack events. The intra-event hyperedges and topic-level cross-event hyperedges are modeled in a unified manner to form a topic-enhanced heterogeneous hypergraph structure containing multiple types of nodes and multiple types of hyperedges.
[0010] Step 3: Attack Organization Attribution: Intra-event hyperedges and cross-event hyperedges at the topic-enhanced heterogeneous hypergraph are subjected to feature aggregation processing to obtain hypergraph structural features reflecting the collaborative relationships of attack behaviors; behavioral features corresponding to different attack events and different hyperedges are fused to form a unified attack behavior feature representation; based on the fused attack behavior features, an organization-level feature representation is generated to characterize the overall behavioral pattern of the attack organization; based on the organization-level feature representation, the APT attack organization to which the attack behavior belongs is determined, and the attack organization attribution result is output.
[0011] An APT attack organization attribution system based on topic-enhanced heterogeneous hypergraphs includes:
[0012] The attack behavior element extraction module is used to acquire multi-source network threat intelligence text, extract attack behavior elements from the network threat intelligence text, and perform semantic encoding processing on the extracted attack behavior elements, mapping attack behavior elements from different sources and of different types to a unified vector representation space to form the initial semantic feature representation of the attack behavior elements.
[0013] The topic-enhanced heterogeneous hypergraph construction module is used to treat the attack behavior elements as behavior element nodes, and construct multiple behavior element nodes belonging to the same attack event as intra-event hyperedges based on the co-occurrence relationship between multiple attack behavior elements in the same attack event; perform topic modeling on the semantic features of attack behavior elements in multiple attack events to obtain the topic representation vector corresponding to each attack event; construct topic-level cross-event hyperedges according to the topic similarity between attack events; and perform unified modeling on the intra-event hyperedges and topic-level cross-event hyperedges to form a topic-enhanced heterogeneous hypergraph structure containing multiple types of nodes and multiple types of hyperedges.
[0014] The attack organization attribution module is used to perform feature aggregation processing on intra-event hyperedges and topic-level cross-event hyperedges in the topic-enhanced heterogeneous hypergraph to obtain hypergraph structural features reflecting the collaborative relationship of attack behaviors; to fuse the behavioral features corresponding to different attack events and different hyperedges to form a unified attack behavior feature representation; to generate an organization-level feature representation to characterize the overall behavioral pattern of the attack organization based on the fused attack behavior features; and to determine the APT attack organization to which the attack behavior belongs based on the organization-level feature representation, and output the attack organization attribution result.
[0015] The beneficial effects of this invention are: This invention constructs a high-order hypergraph structure of multi-entity collaborative behavior and introduces topic-level semantic enhancement and a two-layer attention mechanism to achieve joint modeling and aggregation analysis of semantic evidence of attack behavior, solving the problems of traditional APT attribution methods in terms of sparse evidence, insufficient characterization of multi-entity collaborative relationships and weak cross-event semantic association ability. Attached Figure Description
[0016] Figure 1 This is a schematic diagram of the overall structure of the method of the present invention.
[0017] Figure 2 This is a schematic diagram of the attack behavior element extraction module in this invention.
[0018] Figure 3 This is a schematic diagram of the structure of the topic-enhanced heterogeneous hypergraph construction module in this invention.
[0019] Figure 4 This is a schematic diagram of the attack organization attribution module in this invention. Detailed Implementation
[0020] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments.
[0021] The overall structure of the method of the present invention is as follows: Figure 1 As shown, the present invention provides an embodiment of an APT attack organization attribution method based on a topic-enhanced heterogeneous hypergraph. The method mainly consists of three parts: attack behavior element extraction, topic-enhanced heterogeneous hypergraph construction, and attack organization attribution. The parts cooperate with each other to achieve effective attribution analysis of APT attack organizations.
[0022] Step 1: Attack Behavior Element Extraction: Attack behavior element extraction is used to identify and extract various types of behavioral elements related to APT attack behaviors from multi-source network threat intelligence texts, and form a unified semantic representation. For example... Figure 2 As shown, the steps are as follows:
[0023] Step 1.1: Obtaining Network Threat Intelligence Text. Obtain multi-source network threat intelligence text data, including APT attack analysis reports, security bulletin texts, threat intelligence sharing platform data, or other unstructured threat intelligence text data.
[0024] Step 1.2: Text Preprocessing. The network threat intelligence text is preprocessed, including word segmentation, noise character removal, key information filtering, and context fragment segmentation to obtain text fragments related to attack behavior.
[0025] Step 1.3: Attack Behavior Element Identification. Based on a predefined attack behavior element type system, attack behavior elements are identified from the text fragments related to the attack behavior. These attack behavior elements include at least attack techniques, attack tools, attack infrastructure, and attack behavior description information.
[0026] Step 1.4: Semantic Representation of Attack Behavior Elements. The extracted attack behavior elements are semantically encoded, mapping attack behavior elements from different sources and of different types to a unified semantic representation space, forming the initial semantic feature representation of the attack behavior elements.
[0027] Step 2: Topic-Enhanced Heterogeneous Hypergraph Construction: Topic-enhanced heterogeneous hypergraph construction is used to jointly model the multi-entity collaborative behavior relationships and cross-event semantic association relationships among attack behavior elements, forming a topic-enhanced heterogeneous hypergraph capable of characterizing the high-order structural features of APT attack behavior. For example... Figure 3 As shown, the steps are as follows: Step 2.1: Construction of Behavioral Element Nodes. Using the attack behavior elements obtained in Step 1 as behavioral element nodes, construct a set of behavioral element nodes, which includes attack technology nodes, attack tool nodes, attack infrastructure nodes, and attack behavior description nodes.
[0028] Let the set of attack behavior element nodes be: ;
[0029] in, For a single behavioral element node, This includes attack technology nodes, attack tool nodes, attack infrastructure nodes, and attack behavior description nodes. This represents the total number of behavioral element nodes in all attack events.
[0030] For attack events Its set of behavioral element nodes is defined as follows: ; in, For attack events The number of behavioral element nodes in the data; .
[0031] Step 2.2: Construction of Intra-Event Hyperedge. Based on the co-occurrence relationship among multiple attack behavior elements in the same attack event, multiple behavior element nodes belonging to the same attack event are constructed into an intra-event hyperedge to represent the collaborative behavior relationship of multiple entities in the same attack event.
[0032] Let the set of attack behavior elements be... Then the set of superedges within the event is represented as: ; In each event, the superedge This represents the collaborative behavioral relationships among multiple attack elements within the same attack event. A heterogeneous hypergraph structure is constructed using a set of intra-event hyperedges to represent these collaborative behavioral relationships.
[0033] Step 2.3: Topic Modeling Processing. Topic modeling processing is performed on the semantic representations of attack behavior elements in multiple attack events. Specifically, this includes: (1) Construction of behavioral semantic feature vectors: For each attack event The set of behavioral element nodes in Each attack event Behavioral element nodes Represented as semantic embedding vector : ; in, To map behavioral element nodes to pre-trained semantic encoding functions 3D real-valued vector, Indicates an attack event The Middle Individual behavioral element nodes semantic embedding vector; .
[0034] Pre-trained language models (such as BERT encoding or Word2Vec) or embedding methods based on tag mapping based on attack techniques can be used to output the following: Dimensional semantic vector.
[0035] (2) Event-level topic vector generation: By aggregating the behavioral semantic vectors within the same attack event, the topic representation vector of the attack event is obtained.
[0036] Simple average aggregation method: ; in, .
[0037] Alternatively, a weighted attention aggregation method can be used: ; in, Attention weights, used to characterize the importance contribution of different attack behaviors to the event topic, are calculated as follows: ; in, Indicates the same attack event The Middle Semantic embedding vectors of each behavioral element node; This is a trainable attention parameter vector.
[0038] Obtain the set of topic representation vectors for all attack events: ; Constructing the initial set of nodes for a topic-enhanced heterogeneous hypergraph With the set of superedges within the event ,form: .
[0039] Step 2.4: Constructing Topic-Level Cross-Event Associations. Construct topic-level cross-event hyperedges based on the topic semantic similarity between attack events. For any two attack events... and The topic similarity is defined as cosine similarity: ; That is, the cosine similarity calculation method is used.
[0040] Alternatively, the similarity can be represented using Euclidean distance transformation as follows: ; When satisfied Establish topic-level cross-event hyperedges between behavioral element nodes corresponding to the attack event: It is used to characterize the high-order semantic cooperation relationships between different attack events.
[0041] Among them, threshold Determined in the following ways: ;
[0042] in, The average similarity across all topics. Standard deviation, To adjust the parameters.
[0043] Attack events that meet the conditions constitute a topic-level cross-event hyperedge set: ; Step 2.5: Topic Enhancement Heterogeneous Hypergraph Generation: Set of intra-event hyperedges With topic-level cross-event hyperedge sets A unified model was created, resulting in: ; This topic enhances heterogeneous hypergraphs to characterize: collaborative relationships among multiple entities within the same attack event, and semantic associations between different attack events.
[0044] Step 3: Attack Organization Attribution: The attack organization attribution module is used to aggregate and fuse attack behavior features based on topic-enhanced heterogeneous hypergraphs, and generate APT attack organization attribution results. Based on... Figure 4 As shown, the steps are as follows: Step 3.1: Hypergraph Feature Aggregation. Feature aggregation is performed on intra-event hyperedges and topic-level cross-event hyperedges in the topic-enhanced heterogeneous hypergraph to obtain hypergraph structural features reflecting the collaborative relationships of attack behaviors.
[0045] Specifically, it includes: (1) Node-level hypergraph feature update: for any behavioral element node Its representation vector passes through the set of its hyperedges. Perform aggregated updates: ; in, Let the hyperedge represent the vector; For node-hyperedge attention weights; It is a non-linear activation function; Indicates the presence of nodes The set of superedges; For nodes The first-level update representation.
[0046] (2) Hyperedge-level representation update: The hyperedge representation is generated by aggregating the features of its containing nodes: ; in, For super-edge The update indicates; For nodes The representation vector, Represents a node Belongs to superedge ; Let be the attention weight of a node to the hyperedge, used to characterize the degree of contribution of different nodes to the semantics of the hyperedge, expressed as: ; in, A trainable parameter vector; For the same superedge The Middle The representation vector of each node.
[0047] Step 3.2: Behavioral Feature Fusion. The behavioral features corresponding to different attack events and different hyperedges are fused to form a unified representation of attack behavior features.
[0048] The fusion method employs a two-layer attention mechanism: ; in, Indicates an attack event The fusion representation vector; For attack events In-event semantic representation obtained by aggregating the set of hyperedges within the event; For attack events Cross-event semantic representation obtained by aggregation of cross-event topic hyperedge sets; and These are the fusion weights for intra-event semantic representation and cross-event semantic representation, respectively, and are expressed as follows: ; ; in, This is a trainable attention parameter vector; Represents the hyperedge category index variable; Indicates an attack event In the Candidate representation vectors obtained by hyperedge aggregation; when hour, ;when hour, .
[0049] Step 3.3: Organization-level feature generation. Based on the fused attack behavior features, an organization-level feature representation is generated to characterize the overall behavioral patterns of the attacking organization.
[0050] Aggregate the attack event representation vectors from multiple attack organizations to generate an organization-level behavioral pattern representation. : ; in, Indicates attack organization The corresponding set of attack events; Indicates an attack event The fusion representation vector; Indicates the size of the set of attack events.
[0051] Alternatively, adaptive weighted aggregation can be used to generate organizational-level behavioral pattern representations. : ; in, Attack event weights, used to characterize the contribution of different attack events to the overall behavioral patterns of the organization, are represented as follows: ; in, This is a trainable attention parameter vector; Indicates an attack event The fusion representation vector; This is an event index variable used to normalize the calculation of all attack events within the same organization to obtain event weights. .
[0052] Step 3.4: Attack Organization Attribution Determination. Based on the organization-level feature representation, the APT attack organization to which the attack behavior belongs is determined, and the attack organization attribution result is output.
[0053] Organizational behavioral patterns are represented using a classification model. Input classification model: ; in, This is the predicted probability distribution vector for the attack organization category; This is the weight matrix for the classification model; It is the bias vector; Number of attack organization categories; Organizational-level behavior representation vector The dimension;
[0054] Output: Attacking organization category name, probability value of each category, and highest confidence value.
[0055] Another embodiment of the present invention: an APT attack organization attribution system based on topic-enhanced heterogeneous hypergraphs, comprising: (1) Attack behavior element extraction module: used to acquire multi-source network threat intelligence text, extract attack behavior elements from the network threat intelligence text, and perform semantic encoding processing on the extracted attack behavior elements, mapping attack behavior elements from different sources and of different types to a unified vector representation space to form the initial semantic feature representation of attack behavior elements.
[0056] (2) Topic-enhanced heterogeneous hypergraph construction module: It is used to take the attack behavior elements as behavior element nodes, and construct multiple behavior element nodes belonging to the same attack event as intra-event hyperedges based on the co-occurrence relationship between multiple attack behavior elements in the same attack event; perform topic modeling on the semantic features of attack behavior elements in multiple attack events to obtain the topic representation vectors corresponding to each attack event; construct topic-level cross-event hyperedges according to the topic similarity between attack events; and perform unified modeling on the intra-event hyperedges and topic-level cross-event hyperedges to form a topic-enhanced heterogeneous hypergraph structure containing multiple types of nodes and multiple types of hyperedges.
[0057] The topic-enhanced heterogeneous hypergraph building module includes: 1) Behavioral element node construction unit, used to construct a set of behavioral element nodes by taking the obtained attack behavior elements as behavioral element nodes, wherein the behavioral element nodes include attack technology nodes, attack tool nodes, attack infrastructure nodes and attack behavior description nodes.
[0058] 2) Intra-event hyperedge construction unit, used to construct an intra-event hyperedge by constructing multiple behavioral element nodes belonging to the same attack event based on the co-occurrence relationship between multiple attack behavioral elements in the same attack event, used to represent the collaborative behavior relationship of multiple entities in the same attack event, and obtain the intra-event hyperedge set.
[0059] 3) Topic modeling processing unit, used to perform topic modeling processing on the semantic representation of attack behavior elements contained in multiple attack events, to obtain the topic information corresponding to each attack event, and to characterize the overall semantic features of the attack event.
[0060] 4) Topic-level cross-event association construction unit: calculates the topic similarity between attack events based on the topic representation vectors corresponding to each attack event; when the topic similarity is greater than a preset threshold, constructs topic-level cross-event hyperedges between the corresponding behavioral element nodes for different attack events whose topic association meets the preset conditions, in order to characterize the semantic association between different attack events.
[0061] 5) Theme-enhanced heterogeneous hypergraph generation unit, used to uniformly model the intra-event hyperedges and theme-level cross-event hyperedges to form a theme-enhanced heterogeneous hypergraph structure containing multiple types of behavioral element nodes and multiple types of hyperedges.
[0062] (3) Attack organization attribution module: used to perform feature aggregation processing on the intra-event hyperedges and cross-event hyperedges of the topic-enhanced heterogeneous hypergraph to obtain hypergraph structure features that reflect the collaborative relationship of attack behavior; to fuse the behavioral features corresponding to different attack events and different hyperedges to form a unified attack behavior feature representation; to generate an organization-level feature representation to characterize the overall behavior pattern of the attack organization based on the fused attack behavior features; and to determine the APT attack organization to which the attack behavior belongs based on the organization-level feature representation and output the attack organization attribution result.
[0063] The attack organization attribution module includes: i. Hypergraph Feature Aggregation Unit: Used to perform feature aggregation processing on intra-event hyperedges and topic-level cross-event hyperedges in topic-enhanced heterogeneous hypergraphs to obtain hypergraph structural features that reflect the collaborative relationship of attack behaviors.
[0064] ii. Behavioral Feature Fusion Unit: Used to fuse the behavioral features corresponding to different attack events and different hyperedges to form a unified representation of attack behavioral features.
[0065] iii. Organization-level feature generation unit: Used to generate an organization-level feature representation that characterizes the overall behavior pattern of the attacking organization based on the fused attack behavior features.
[0066] iv. Attack Organization Attribution Determination Unit: Based on the organization-level feature representation, it determines the APT attack organization to which the attack behavior belongs and outputs the attack organization attribution result.
Claims
1. An attribution method for APT attack groups based on topic-enhanced heterogeneous hypergraphs, characterized in that, Includes the following steps: Step 1: Attack behavior element extraction: Obtain multi-source network threat intelligence text, extract attack behavior elements from the network threat intelligence text, perform semantic encoding processing on the extracted attack behavior elements, map each attack behavior element to a vector representation space, and form the initial semantic feature representation of the attack behavior elements. Step 2: Topic-enhanced heterogeneous hypergraph construction: The attack behavior elements are used as behavior element nodes. Based on the co-occurrence relationship between multiple attack behavior elements in the same attack event, multiple behavior element nodes belonging to the same attack event are constructed as intra-event hyperedges. Topic modeling is performed on the semantic features of attack behavior elements in multiple attack events to obtain the topic representation vector corresponding to each attack event. Topic-level cross-event hyperedges are constructed according to the topic similarity between attack events. The intra-event hyperedges and topic-level cross-event hyperedges are modeled in a unified manner to form a topic-enhanced heterogeneous hypergraph structure containing multiple types of nodes and multiple types of hyperedges. Step 3: Attack organization attribution: Perform feature aggregation processing on the intra-event hyperedges and topic-level cross-event hyperedges in the topic-enhanced heterogeneous hypergraph to obtain hypergraph structure features that reflect the collaborative relationship of attack behaviors; The behavioral characteristics corresponding to different attack events and different hyperedges are fused to form a unified attack behavior characteristic representation; based on the fused attack behavior characteristics, an organization-level characteristic representation is generated to characterize the overall behavior pattern of the attacking organization. Based on the organization-level feature representation, the APT attack organization to which the attack behavior belongs is determined, and the attack organization attribution result is output.
2. The APT attack organization attribution method based on topic-enhanced heterogeneous hypergraphs according to claim 1, characterized in that, The attack elements include at least attack techniques, attack tools, attack infrastructure, and attack behavior description information.
3. The APT attack organization attribution method based on topic-enhanced heterogeneous hypergraphs according to claim 1, characterized in that, Step 1 specifically includes: Step 1.1: Obtain multi-source network threat intelligence data, including APT attack analysis reports, security bulletin texts, threat intelligence sharing platform data, or unstructured threat intelligence text data; Step 1.2: Preprocess the network threat intelligence text. The preprocessing includes word segmentation, noise character removal, key sentence filtering, and context segmentation to obtain text fragments related to attack behavior. Step 1.3: Identify attack behavior elements from the text fragment based on a predefined attack behavior element type system; Step 1.4: Perform semantic encoding on the identified attack behavior elements, mapping attack behavior elements from different sources and of different types to a unified vector representation space to form the initial semantic feature representation of the attack behavior elements.
4. The APT attack organization attribution method based on topic-enhanced heterogeneous hypergraphs according to claim 1, characterized in that, Step 2 specifically includes: Step 2.1: Behavioral Element Node Construction: Using the obtained attack behavioral elements as behavioral element nodes, construct a global set of behavioral element nodes: ； in, For a single behavioral element node, ; This represents the total number of behavioral element nodes in all attack events. For attack events Its set of behavioral element nodes is defined as follows: ； in, For attack events The number of behavioral element nodes in the data; ; Step 2.2: Construction of Intra-Event Hyperedges: Based on the co-occurrence relationship among multiple attack behavior elements in the same attack event, multiple behavior element nodes belonging to the same attack event are constructed into an intra-event hyperedge to represent the collaborative behavior relationship of multiple entities in the same attack event, thus obtaining the set of intra-event hyperedges. ; Step 2.3: Topic Modeling Processing: Topic modeling processing is performed on the semantic representations of attack behavior elements in multiple attack events. Specifically, this includes: (1) Construction of behavioral semantic feature vectors: For each attack event The set of behavioral element nodes in Each attack event Behavioral element nodes Represented as semantic embedding vector : ； in, To map behavioral element nodes to pre-trained semantic encoding functions 3D real-valued vector, Indicates an attack event The Middle Individual behavioral element nodes semantic embedding vector; ; (2) Event-level topic vector generation: For the same attack event Aggregate and model the behavioral semantic vectors within the attack event to generate a topic representation vector for the attack event. : ； in, ; Alternatively, attention-weighted aggregation can be used to obtain the attack event. Topic Representation Vector :: ； in, The attention weights are calculated as follows: ； in, Indicates the same attack event The Middle The semantic embedding vector of each behavioral element node; This is a trainable attention parameter vector; (3) Construction of topic semantic space: set of topic representation vectors for all attack events This is constructed as a topic semantic representation space for subsequent cross-event correlation analysis; Step 2.4: Topic-level cross-event association construction: Construct topic-level cross-event hyperedges based on the semantic similarity between attack event topic vectors; specifically: (1) Calculation of topic similarity; for any two attack events and Theme similarity The cosine similarity is expressed as follows: ； in, Let j be the topic representation vector of attack event j; (2) Theme-level cross-event hyperedge generation rules; When topic similarity Then, in attack events that meet the conditions Establish topic-level cross-event hyperedges between them: This is used to characterize the high-order semantic collaboration relationships between different attack events and to form a topic-level cross-event hyperedge set: ； in, Indicates an attack event The set of behavioral element nodes in; The preset topic similarity threshold is adaptively set based on the statistical distribution of the data, as shown below: ； in, The average similarity across all topics. Standard deviation, To adjust the parameters; Step 2.5: Topic-enhanced heterogeneous hypergraph generation: Generate the set of intra-event hyperedges. With topic-level cross-event hyperedge sets Unified modeling enhances heterogeneous hypergraphs This forms a topic-enhanced heterogeneous hypergraph structure containing multiple types of behavioral nodes and multiple types of hyperedges.
5. The APT attack organization attribution method based on topic-enhanced heterogeneous hypergraphs according to claim 1, characterized in that, Step 3 specifically includes: Step 3.1: Hypergraph Feature Aggregation: Enhancing Heterogeneous Hypergraphs for Topics Structural feature aggregation is performed, specifically including: (1) Node-level hypergraph feature update: for any behavioral element node Its representation vector passes through the set of its hyperedges. Perform aggregated updates: ； in, Let the hyperedge represent the vector; For node-hyperedge attention weights; It is a non-linear activation function; Indicates the presence of nodes The set of superedges; For nodes The first-level update representation; (2) Hyperedge-level representation update: The hyperedge representation is generated by aggregating the features of its containing nodes: ； in, For super-edge The update indicates; For nodes The representation vector, Represents a node Belongs to superedge ; Let be the attention weight of a node to the hyperedge, used to characterize the degree of contribution of different nodes to the semantics of the hyperedge, expressed as: ； in, A trainable parameter vector; For the same superedge The Middle The representation vector of each node; Step 3.2: Behavioral Feature Fusion: After node-hyperedge aggregation, further fusion processing is performed on intra-event hyperedge features and cross-event theme hyperedge features; The fusion method employs a two-layer attention mechanism: ； in, Indicates an attack event The fusion representation vector; For attack events In-event semantic representation obtained by aggregating the set of hyperedges within the event; For attack events Cross-event semantic representation obtained by aggregation of cross-event topic hyperedge sets; and These are the fusion weights for intra-event semantic representation and cross-event semantic representation, respectively, and are expressed as follows: ； ； in, This is a trainable attention parameter vector; Represents the hyperedge category index variable; Indicates an attack event In the Candidate representation vectors obtained by hyperedge aggregation; when hour, ;when hour, ; Step 3.3: Organization-level feature generation: Aggregate the representation vectors of multiple attack events under the same attacking organization to generate an organization-level behavioral pattern representation. : ； in, Indicates attack organization The corresponding set of attack events; Indicates an attack event The fusion representation vector; Indicates the size of the set of attack events; Alternatively, adaptive weighted aggregation can be used to generate organizational-level behavioral pattern representations. : ； in, Attack event weights, used to characterize the contribution of different attack events to the overall behavioral patterns of the organization, are represented as follows: ； in, This is a trainable attention parameter vector; Indicates an attack event The fusion representation vector; Step 3.4: Attribution of Attack Organization: Organizational behavioral patterns are represented using a classification model. Input classification model: ； in, This is the predicted probability distribution vector for the attack organization category; This is the weight matrix for the classification model; It is the bias vector; Number of attack organization categories; Organizational-level behavior representation vector The dimension; Output: Attacking organization category name, probability value of each category, and highest confidence value.
6. An APT attack organization attribution system based on topic-enhanced heterogeneous hypergraphs, characterized in that, include: The attack behavior element extraction module is used to acquire multi-source network threat intelligence text, extract attack behavior elements from the network threat intelligence text, and perform semantic encoding processing on the extracted attack behavior elements, mapping attack behavior elements from different sources and of different types to a unified vector representation space to form the initial semantic feature representation of the attack behavior elements. The topic-enhanced heterogeneous hypergraph construction module is used to treat the attack behavior elements as behavior element nodes, and construct multiple behavior element nodes belonging to the same attack event as intra-event hyperedges based on the co-occurrence relationship between multiple attack behavior elements in the same attack event; perform topic modeling on the semantic features of attack behavior elements in multiple attack events to obtain the topic representation vector corresponding to each attack event; construct topic-level cross-event hyperedges according to the topic similarity between attack events; and perform unified modeling on the intra-event hyperedges and topic-level cross-event hyperedges to form a topic-enhanced heterogeneous hypergraph structure containing multiple types of nodes and multiple types of hyperedges. The attack organization attribution module is used to perform feature aggregation processing on intra-event hyperedges and topic-level cross-event hyperedges in the topic-enhanced heterogeneous hypergraph to obtain hypergraph structure features that reflect the collaborative relationship of attack behaviors. The behavioral characteristics corresponding to different attack events and different hyperedges are fused to form a unified attack behavior characteristic representation; based on the fused attack behavior characteristics, an organization-level characteristic representation is generated to characterize the overall behavior pattern of the attacking organization. Based on the organization-level feature representation, the APT attack organization to which the attack behavior belongs is determined, and the attack organization attribution result is output.
7. The APT attack organization attribution system based on topic-enhanced heterogeneous hypergraphs according to claim 6, characterized in that, The topic-enhanced heterogeneous hypergraph construction module includes: The behavior element node construction unit is used to construct a set of behavior element nodes by taking the obtained attack behavior elements as behavior element nodes. The behavior element nodes include attack technology nodes, attack tool nodes, attack infrastructure nodes, and attack behavior description nodes. The intra-event hyperedge construction unit is used to construct an intra-event hyperedge by combining multiple behavioral element nodes belonging to the same attack event based on the co-occurrence relationship between multiple attack behavioral elements in the same attack event. This hyperedge represents the collaborative behavior relationship of multiple entities in the same attack event, resulting in a set of intra-event hyperedges. The topic modeling processing unit is used to perform topic modeling processing on the semantic representation of attack behavior elements contained in multiple attack events, obtain topic information corresponding to each attack event, and use it to characterize the overall semantic features of the attack events. The topic-level cross-event association construction unit calculates the topic similarity between attack events based on the topic representation vectors corresponding to each attack event. When the topic similarity is greater than a preset threshold, topic-level cross-event hyperedges are constructed between the corresponding behavioral element nodes of different attack events whose topic association meets the preset conditions, in order to characterize the semantic association between different attack events. The topic-enhanced heterogeneous hypergraph generation unit is used to uniformly model the intra-event hyperedges and topic-level cross-event hyperedges to form a topic-enhanced heterogeneous hypergraph structure containing multiple types of behavioral element nodes and multiple types of hyperedges.
8. The APT attack organization attribution system based on topic-enhanced heterogeneous hypergraphs according to claim 6, characterized in that, The attack organization attribution module includes: The hypergraph feature aggregation unit is used to perform feature aggregation processing on intra-event hyperedges and topic-level cross-event hyperedges in the topic-enhanced heterogeneous hypergraph to obtain hypergraph structural features that reflect the collaborative relationship of attack behaviors. The behavior feature fusion unit is used to fuse the behavior features corresponding to different attack events and different hyperedges to form a unified attack behavior feature representation. The organization-level feature generation unit is used to generate an organization-level feature representation that characterizes the overall behavior pattern of the attacking organization based on the fused attack behavior features. The attack organization attribution determination unit is used to determine the APT attack organization to which the attack behavior belongs based on the organization-level feature representation, and output the attack organization attribution result.