An apt real-time detection method and system based on multi-level traceability graph entity state monitoring

Abstract

This invention provides a real-time APT detection method and system based on multi-level source graph entity state monitoring. The method includes: collecting audit logs of the target system; converting the collected audit logs into a hierarchical process center graph (HPG), wherein the HPG includes an operation-level source graph and a control-level source graph; wherein the operation-level source graph describes the specific tasks executed by each process; and the control-level source graph describes the direct or indirect influence flow between processes; based on the hierarchical process center graph, using a graph learning model based on continuous-time dynamic graphs to capture the real-time state of system entities and extract abnormal operations; calculating the attack relevance score of processes associated with abnormal operations to identify malicious processes; and splicing discrete malicious processes according to the direct connectivity relationships in the graph to associate and integrate fragmented APT attack activity segments, thereby updating the operation-level malicious subgraph.

Description

Technical Field

[0001] This invention relates to the field of attack detection technology, and in particular to a real-time APT detection method and system based on multi-level source graph entity state monitoring. Background Technology

[0002] Currently, traditional intrusion detection systems mainly rely on malicious traffic detection, dynamic and static code analysis, Indicators of Compromise (IOC) detection, and vulnerability detection. However, these detection methods exhibit problems such as a scarcity of effective features, delayed detection results, and a lack of contextual understanding when dealing with APT attacks. Against this backdrop, APT attack detection technology based on Provenance Graphs has emerged. Provenance graphs are typically constructed based on system audit logs, with nodes and edges representing system entities (such as processes, files, registry entries, and sockets) and interaction events between entities recorded in the audit logs. This modeling approach transforms discrete log data into an interaction network in a graph space, intuitively presenting the rich contextual relationships during system operation.

[0003] Existing source graph-based detection methods can be broadly classified into three categories: label propagation-based detection methods, subgraph matching-based detection methods, and anomaly detection-based detection methods.

[0004] The basic idea behind label-based propagation methods is to first predefine labels for system entity associations, and then use a propagation algorithm to quickly identify suspicious graph elements. Label-based propagation methods are generally highly efficient due to their rule-driven detection mechanism. However, the limited label combination space makes it difficult to cover more complex attack activities. Therefore, such research mainly focuses on detecting attack patterns or stages with coarser granularity.

[0005] The basic idea behind subgraph matching-based methods is to search the source graph for subgraphs that match known attack patterns. A major drawback of subgraph matching-based methods is their heavy reliance on prior knowledge of APT patterns. This problem also exists in label-based propagation methods. Therefore, both types of methods struggle to effectively detect emerging APT attack campaigns. Furthermore, attackers can easily evade these detections by simply modifying their behavior.

[0006] Compared to the previous two types of methods, anomaly detection-based methods model the normal behavior patterns of the target system through learning or non-learning algorithms, and further identify attack-related anomalous substructures in the source graph. Therefore, this type of method can detect unknown malicious behavior without relying on prior knowledge. Based on the granularity of the final alarm substructure, this type of research can be further divided into three categories: graph-level, path-level, and element-level. However, existing anomaly detection-based methods struggle to balance detection granularity and real-time performance. This is because element-level methods can generate the finest-grained alarms, but considering computational overhead, solutions are often designed based on static graph representations or snapshot sequence representations. These methods require the entire APT attack activity to complete before constructing a complete graph, thus making them unsuitable for real-time detection. While snapshot-based solutions can periodically detect ongoing attacks, they still introduce latency and inevitably disrupt the continuity of long-term contextual information during system operation, thereby reducing the accuracy of detection results. Streaming graphs are typically used in graph-level methods, only able to perform Boolean judgments on the presence of attacks in the system, but unable to extract specific malicious fragments or entities. Summary of the Invention

[0007] To achieve fine-grained real-time APT attack detection, this invention proposes a real-time APT detection method and system based on multi-level source graph entity state monitoring.

[0008] In a first aspect, the present invention provides a real-time APT detection method based on multi-level source graph entity state monitoring, comprising:

[0009] Collect audit logs from the target system and convert them into a hierarchical process center graph (HPG). The HPG includes an operation-level source graph. and control level traceability diagram Among them, the operational-level traceability diagram Used to describe the specific tasks performed by each process; control-level source diagram Used to describe the direct or indirect influence flow between processes;

[0010] Based on the hierarchical process center diagram, a graph learning model based on continuous-time dynamic graphs is used to capture the real-time state of system entities and extract abnormal operations.

[0011] Calculate the attack relevance score of processes associated with anomalous operations to identify malicious processes, and based on... The direct connectivity relationships in the graph splice discrete malicious processes to correlate and integrate fragmented activity segments of APT attacks, thereby updating the operational-level malicious subgraph.

[0012] Furthermore, the process of converting the collected audit logs into a hierarchical process center diagram includes:

[0013] System entity and instruction event information is extracted from the audit log to generate an instruction event stream; the instruction event information includes the subject, object, instruction type, and timestamp of the instruction, and the type of the subject is a process entity;

[0014] For each pair of system entities that have instruction exchanges, a data structure is dynamically maintained. To record the operations that are taking place between two entities;

[0015] Traverse the instruction event stream;

[0016] According to the main body of the current instruction and object Update the corresponding data structure with this instruction. ;

[0017] The system identifies whether the current instruction is a boundary instruction based on preset boundary instruction determination rules. If not, it returns to the step of traversing the instruction event stream and processes the next instruction; if so, it updates the data structure. All instructions stored in the database are aggregated into a single operation, which is then used as an operation-level interaction edge. Increase to In the middle, set the category information and timestamp of the edge, and clear the data structure. For two entities and Prepare records for the next operation between them; the boundary instructions refer to instructions used to separate different operations;

[0018] Determine the object of the current instruction If it is a process entity, then treat the operation as a direct control relationship edge. Increase to And the timestamp of that side is middle If the corresponding timestamps match, then iterate through them. The object Find the first-order neighborhood of the region that is in the same neighborhood as the first-order neighborhood of the region. Edges that conform to the logic of information transmission, and their main body Add a set NE, and without generating multiple edges, find the principals in set NE. With the main body of the current instruction An indirect influence relationship is established between each of them. Increase to And the timestamp of that side is middle The corresponding timestamps are consistent;

[0019] Return to the step that traversed the instruction event stream, process the next instruction, and continue until all instructions have been traversed to obtain the final result. and .

[0020] Furthermore, the boundary instruction determination rules include semantic boundary rules and temporal boundary rules;

[0021] Semantic boundary rules refer to the rules that if the current instruction... Instruction categories If the end of a specific operation is explicitly indicated, then the current instruction... For boundary instructions;

[0022] Timing boundary rules refer to the rules that if the current instruction and the next instruction in the instruction event stream The time interval exceeds the preset operation interval threshold. Then the current instruction This is a boundary instruction.

[0023] Furthermore, the graph learning model includes an encoder and a decoder; the encoder is used to monitor the real-time state of system entities and maintain a state vector containing all their historical activity information; the decoder is used to detect abnormal operations in the system based on the state vector of the system entities; wherein, the encoder adopts a temporal graph network based on a continuous-time dynamic graph.

[0024] Correspondingly, based on the hierarchical process center graph, a graph learning model based on continuous-time dynamic graphs is used to capture the real-time state of system entities, including: when a new edge is added to... At the same time, the encoder is activated synchronously to update the state of the new edge endpoint according to the preset real-time state update process;

[0025] The real-time status update process includes:

[0026] Extract new edges Category features ;

[0027] Get new edge Endpoint and The temporal and spatial dimensions of information, combined with category features. Generating new edges using a multilayer perceptron To the endpoint and The transmitted edge message vector;

[0028] Based on endpoints and The state vector and its corresponding edge message vector are recorded in the memory structure, and endpoints are generated using the GRU network. and The real-time state vector.

[0029] Furthermore, the acquisition of new edges Endpoint and The time dimension information includes: calculating the new edge timestamp The time intervals between two directly related operations at each endpoint are used to obtain a vector representation of the time intervals using a time coding algorithm.

[0030] The acquisition of new edges Endpoint and Spatial dimensional information, including: extracting endpoints and After the update First-order egocentric graphs, using time-series graph attention networks to obtain endpoints and The node vector representation in their respective first-order egocentric graphs.

[0031] Furthermore, the decoder is used to detect abnormal operations in the system based on the state vectors of system entities, including: utilizing a multilayer perceptron based on endpoints and Predicting new edges from the state vector before update The probability of an anomaly, when the probability of an anomaly is greater than a preset anomaly threshold, the new edge... It has been marked as a potential anomalous operation.

[0032] Furthermore, the training process of the graph learning model includes:

[0033] Real-world operations during a period of healthy system operation are collected as negative samples representing normal behavior; the target node of a given negative sample is replaced with... Different types of nodes are randomly selected from the data to obtain positive samples representing abnormal operations;

[0034] The loss values ​​for all positive and negative sample pairs are calculated using binary cross-entropy loss to obtain the global loss. The global loss is then minimized to optimize the parameters of the encoder and decoder.

[0035] Furthermore, the calculation of the attack relevance score of processes associated with abnormal operations to identify malicious processes includes:

[0036] Mark the process associated with the abnormal operation as a suspicious process, and let Represents extracted and suspicious processes Related, in The highest probability of anomaly For each abnormal operation, calculate the suspicious process using the following formula. Suspiciousness of attacks based on its own abnormal operations :

[0037]

[0038] in, express The Middle The probability of an abnormal operation;

[0039] Suspicious processes are calculated using the following formula. Suspiciousness of attacks on related activities within the affected area :

[0040]

[0041] in, , and These represent the standard Sigmoid normalization function and its inverse function, respectively. represent China and Israel Let be the set of first-order reachable destination nodes from the source node;

[0042] according to and Calculate the suspicious process according to the following formula. Attack relevance score ,like When the maliciousness threshold δ is exceeded, the suspicious process is flagged. Malicious processes identified as being directly related to APT attack activities:

[0043]

[0044] in, For hyperparameters, .

[0045] Furthermore, the basis stated The direct connectivity relationships in the graph splice together discrete malicious processes to correlate and integrate fragmented activity segments of APT attacks, thereby updating the operational-level malicious subgraph, including:

[0046] along malicious processes The incoming edge direction is used to backpropagate through breadth-first traversal to update the attack relevance score of the traversed process, thereby identifying new malicious processes.

[0047] For each new malicious process With this new malicious process Starting from, in The system searches for other malicious processes that meet the preset time-series reachability criteria and adds them to the set. And identify the source of the new malicious process. arrive The shortest time-series reachable path for each node in the process. ; where, the temporally reachable path is defined as: for path If any one of the edges If the following timing constraints are satisfied, then the path... The attack affecting the control flow is considered reachable under this timing constraint.

[0048]

[0049] in, and Representing the edges respectively The source node and destination node, the symbol " in the above timing constraints "Indicates a subordinate relationship; ( )represent The smallest timestamp that an edge in a set has;

[0050] Shortest time reachable path All process nodes and associated abnormal operations are updated in the malicious subgraph.

[0051] Secondly, the present invention provides an APT real-time detection system based on multi-level source graph entity state monitoring, comprising:

[0052] The source graph construction module is used to collect audit logs from the target system and convert the collected audit logs into a hierarchical process center graph (HPG). The hierarchical process center graph includes an operation-level source graph. and control level traceability diagram Among them, the operational-level traceability diagram Used to describe the specific tasks performed by each process; control-level source diagram Used to describe the direct or indirect influence flow between processes;

[0053] An abnormal behavior detection module is used to capture the real-time state of system entities and extract abnormal operations based on the hierarchical process center graph using a graph learning model based on continuous-time dynamic graphs.

[0054] The attack clue filtering module is used to calculate the attack relevance score of processes associated with abnormal operations to identify malicious processes, and based on... The direct connectivity relationships in the graph splice discrete malicious processes to correlate and integrate fragmented activity segments of APT attacks, thereby updating the operational-level malicious subgraph.

[0055] The beneficial effects of this invention are as follows:

[0056] This invention can be applied to intrusion detection, forensic analysis, and other scenarios in the field of network security. The proposed real-time APT detection method and system address the problem primarily from two aspects: First, a novel, smaller-scale operational and control-level source graph is designed to represent activities in system logs; second, a learning architecture that does not require traversing the entire graph is employed to perform detection, continuously monitoring and recording changes in entity states over time within the source graph. Thus, while ensuring low latency and high accuracy, computational overhead is significantly reduced, achieving fine-grained real-time APT detection.

[0057] Compared to traditional event-level source graphs, which are large in scale, have high storage costs, and are prone to dependency explosion, this invention proposes operation-level and control-level source graphs. While retaining the key elements of detection dependencies, it significantly reduces storage and maintenance costs, providing a data foundation for combining the flow pattern method and the element-level method in this invention to achieve fine-grained real-time detection.

[0058] Compared to existing methods that only focus on the current state of entities in the system, which leads to a decrease in detection accuracy, this invention uses the TGN time graph network as the core of anomaly detection. By introducing a memory structure to dynamically maintain the state vector of each node in the source graph, it can model the long-term dependencies of continuously running systems, significantly improving the accuracy of discovering long-term, multi-stage APT attacks from large-scale source graphs.

[0059] Compared to existing methods that are prone to generating a large number of false alarms, this invention significantly alleviates the problem of alarm fatigue by employing an attack clue filtering mechanism based on influence control relationships. Simultaneously, it can reconstruct discrete alarm clues to fully describe the APT attack activity currently being suffered by the target system, effectively reflecting the current security posture of the host. Attached Figure Description

[0060] Figure 1 A framework diagram of an APT real-time detection method and system based on multi-level source graph entity state monitoring provided in this embodiment of the invention;

[0061] Figure 2 (a) A conventional event-level sourcing graph for an incentive example provided for embodiments of the present invention; (b) A schematic diagram of a hierarchical process center graph (HPG) for an incentive example. Detailed Implementation

[0062] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of the embodiments of this invention will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0063] Source graph: Let L and T represent the set of element categories and the set of times, respectively. The source graph can be represented as a directed acyclic graph (DAG). ;in, It is a set of vertices, and each vertex is usually distinguished by a semantic name (such as a file entity being identified by its filename). For an edge set, each edge Associate a pair of vertices (recorded as) These are referred to as the source point and the target point, respectively. These are labeling functions for vertices and edges, used to label the corresponding categories (e.g., process entities are labeled as "process", and read operation events are labeled as "read"). It is the timestamp function for edges, recording the time when an event occurs.

[0064] like Figure 1 As shown, this embodiment of the invention provides a real-time APT detection method based on multi-level source graph entity state monitoring, including the following steps:

[0065] S101: Collect audit logs from the target system and convert the collected audit logs into a hierarchical process center graph (HPG), wherein the hierarchical process center graph includes an operation-level tracing graph. and control level traceability diagram Among them, the operational-level traceability diagram Used to describe the specific tasks performed by each process; control-level source diagram Used to describe the direct or indirect influence flow between processes;

[0066] Specifically, embodiments of the present invention propose a Hierarchical Process-centric Graph (HPG). HPG is a two-layer flow-based source graph in which multiple events belonging to the same task are merged into a single edge. Figure 2(a) shows a traditional event-level sourcing graph constructed for the stimulus example; where A, RF, W, C, CO, S, U, M, EX, R, F, and O are abbreviations for the system calls Accept, Recvfrom, Write, Close, Connect, Sendto, Unlink, Modify_file_attributes, Execute, Read, Fork, and Open, respectively. Figure 2 (b) is the HPG constructed for the incentive example.

[0067] lower layer This describes the specific tasks performed by each process, while the upper layer... This focuses on the direct or indirect influence flow between processes. For ease of understanding, this invention uses diamonds and dashed boxes of the same color to represent the mapping relationship between a process and its executed task. This HPG can solve the graph scalability problem and highlight the role of process nodes in the source graph.

[0068] S102: Based on the hierarchical process center diagram, use a graph learning model based on continuous-time dynamic graphs to capture the real-time state of system entities and extract abnormal operations.

[0069] S103: Calculate the attack relevance score of processes associated with abnormal operations to identify malicious processes, and based on... The direct connectivity relationships in the graph splice discrete malicious processes to correlate and integrate fragmented activity segments of APT attacks, thereby updating the operational-level malicious subgraph.

[0070] The APT real-time detection method provided by the embodiments of the present invention has the following advantages: Compared with the traditional event-level source graph, which is large in scale, has high storage cost, and is prone to dependency explosion, the present invention proposes an operation-level and control-level source graph, which hierarchically displays the core information required for anomaly discovery and attack clue screening. At the same time, it effectively optimizes the overall scale of the source graph, and significantly reduces the storage and maintenance costs while retaining the key elements of detection dependence. This provides a data foundation for the combination of the flow pattern method and the element-level method in the present invention to achieve fine-grained real-time detection.

[0071] In one embodiment, the HPG build process mainly includes the following steps:

[0072] S1011: Extract system entity and instruction event information from the audit log and generate an instruction event stream; the instruction event information includes the subject, object, instruction type and timestamp of the instruction, and the type of the subject is a process entity;

[0073] Specifically, system entities include four main types: processes, files, sockets, and the registry. Furthermore, each instruction event will be parsed from the perspective of control flow, extracting four key pieces of information: the subject, the object, the instruction type, and the timestamp. The subject, as the initiator of the instruction, is strictly limited to a process entity.

[0074] It is worth noting that existing research typically restricts the types of instructions parsed in this step to reduce the edge size of the source graph. For example, the source graphs constructed by DISTDET and KAIROS contain only 8 and 9 common instructions, respectively, resulting in some key APT attack activities not being presented in the source graph. In contrast, this invention retains complete instruction interactions between four types of entities, and HPG provides a CTDG scenario with complete topological and temporal information, providing more comprehensive system activity information for subsequent clue discovery.

[0075] S1012: For each pair of system entities that have instruction exchanges, dynamically maintain a data structure. To record the operations that are taking place between two entities;

[0076] S1013: Traverse the instruction event stream;

[0077] S1014: Based on the subject of the current instruction and object Update the corresponding data structure with this instruction. ;

[0078] S1015: Identify whether the current instruction is a boundary instruction according to the preset boundary instruction determination rules. If not, return to the step of traversing the instruction event stream and process the next instruction; if yes, update the data structure. All instructions stored in the database are aggregated into a single operation, which is then used as an operation-level interaction edge. Increase to In the middle, set the category information and timestamp of the edge, and clear the data structure. For two entities and Prepare records for the next operation between them; the boundary instructions refer to instructions used to separate different operations;

[0079] Specifically, the purpose of identifying boundary instructions is to construct operational-level interaction relationships. This represents a sequence of instructions arranged in ascending order of timestamps between a pair of entities. The core of this partitioning lies in identifying the boundary instructions within the sequence used to separate different operations. Therefore, for the sequence... Instructions in This invention proposes the following two boundary determination rules (either one of which is sufficient): (1) Semantic boundary rule, Instruction categories Explicitly indicate the end of a specific operation (such as close, exit, etc.); (2) Timing boundary rules, and the next instruction in the sequence The time interval exceeds the preset operation interval threshold. ,Right now .

[0080] In the aforementioned rules, semantic boundary rules are based on the implicit termination semantics of some instruction categories. However, in actual operating systems, some operations (such as reusing heartbeat communication within the same connection) lack explicit termination instructions. To avoid excessive merging of unrelated operations, this section designs temporal boundary rules as a supplement, assuming that related instructions for the same operation will be generated in a concentrated manner within a short time window. Ultimately, through the precise definition of semantic boundary rules and the statistical supplementation of temporal boundary rules, robust partitioning of operation boundaries in the event stream is achieved.

[0081] S1016: Determine the object of the current instruction. If it is a process entity, then treat the operation as a direct control relationship edge. Increase to And the timestamp of that side is middle If the corresponding timestamps match, then iterate through them. The object Find the first-order neighborhood of the region that is in the same neighborhood as the first-order neighborhood of the region. Edges that conform to the logic of information transmission, and their main body Add a set NE, and without generating multiple edges, find the principals in set NE. With the main body of the current instruction An indirect influence relationship is established between each of them. Increase to And the timestamp of that side is middle The corresponding timestamps are consistent;

[0082] S1017: Return to the step in the instruction event stream, process the next instruction, and continue until all instructions have been traversed to obtain the final result. and .

[0083] As one possible implementation, Algorithm 1 shown in Table 1 illustrates the dynamic construction process of a multi-level source graph (HPG), with input parameters... This represents the command and event stream extracted from the log parsing. Similarly, they are sorted in ascending order by the timestamp of the instruction. Specifically, the algorithm will... Linear scan, synchronously updating the operational-level traceability graph and control level traceability diagram The former focuses on the specific activities of a process, with its edges representing the operational interactions performed by the process. Therefore, Algorithm 1 dynamically maintains a special data structure, Active, for each pair of system entities with instruction interactions, recording the operational information occurring between them.

[0084] Table 1 Algorithm 1: HPG Dynamic Generation Algorithm

[0085]

[0086] According to Algorithm 1, during the linear scan process, The dynamic update steps are as follows:

[0087] Step 1: For the newly parsed instruction Based on the subject and object information of the instruction (referred to as...) and Update the corresponding structure (Lines 3-4);

[0088] Step 2: Determine based on semantic and temporal boundary rules. Is it a boundary instruction (line 5)? If yes, continue to step 3; otherwise, return to step 1.

[0089] Step 3: Put All temporarily stored instruction events are aggregated into a single operation-level interaction. and add it to (Lines 6-9). This includes information about the operation category. Set as the statistical results and time information of the aggregated instruction events. This is the timestamp of the boundary event;

[0090] Step 4: Clear The information in the middle is and Prepare the record for the next operation (line 10). Then, return to step 1 to process subsequent instructions.

[0091] Through the above steps, the operational-level tracing graph was completed. The construction of.

[0092] In contrast, the control-level timing trace diagram The edges in the graph represent direct control or indirect influence relationships between process entities. To simplify the graph structure and improve the efficiency of the attack clue filtering module, the following is specified: There is at most one edge between each pair of process nodes.

[0093] According to Algorithm 1, Will follow It is dynamically maintained through updates. When Added In the context of the time, depending on the type of information it potentially conveys, The update mechanism will be discussed in the following two cases:

[0094] (1) Direct control relationship. If If it is a process entity, then the instruction represents the process. For processes The direct control behavior. Therefore, without generating repeated edges, a corresponding directed edge Will be added In it, its time information will be consistent with Keep it consistent (lines 11-14);

[0095] (2) Indirect Influence. In real APT attacks, besides direct control, the attacking process often uses non-process entities such as files and the registry as intermediate steps to implement indirect attack control. Based on this, when When the entity is not a process, this algorithm will traverse... middle Find the first-order neighborhood of the region that is in the same neighborhood as the first-order neighborhood of the region. Edges that conform to the logical order of information transmission (such as writing to the same file before reading it) are identified, and their source endpoints are collected to generate a New Element (NE) (line 16). Thus, processes within the NE... It is considered to be passable right Applying indirect influence. Therefore, without creating multiple edges, an edge representing an indirect influence relationship. It will be updated to In it, its timestamp is also the same as Maintain consistency to record the start time of potential influence relationships between two processes.

[0096] make This represents the total number of instruction events collected from the system audit logs. With the support of a graph database that has indexes such as hash tables, neighbor node queries (multiple edge checks can be considered a special type of neighbor query) can be completed in constant time. Therefore, the overall time complexity of Algorithm 1 is O(log n). .

[0097] In one embodiment, the graph learning model relies on an encoder-decoder architecture to detect anomalous operations suspected of being APT attack activities in the operational-level attribution graph. In this architecture, the encoder monitors the real-time state of system entities, maintaining a state vector containing information about all their historical activities; the decoder, based on this state vector, dynamically analyzes the rationality of system behavior, thereby detecting anomalous operations within the system. During the training phase, the encoder and decoder collaboratively train based on the benign initialization assumptions of the threat model to master the normal behavioral patterns of the target system.

[0098] Most existing encoders focus on the static information of entities, neglecting the dynamic evolution of entity states as the system operates. This limitation makes it difficult for existing methods to detect some highly covert attack patterns (such as transforming benign processes into carriers of malicious activity through process injection). To address this issue, this invention introduces a Temporal Graph Network (TGN) for continuous-time dynamic graph (CTDG) scenarios as the basic framework for the encoder. Compared to traditional static GNN models (such as GraphSAGE and GAT) used in existing anomaly detection methods, the core improvement of TGN is the introduction of a memory structure. This structure dynamically records the state vector (state), the timestamp of the latest operation, and the edge message vector (message) for each node in the source graph. This memory mechanism endows TGN with the ability to model long-term dependencies in continuously running systems, which is crucial for discovering long-term, multi-stage APT attack clues from large-scale source graphs.

[0099] In the operational-level traceability diagram During the dynamic update process, when the operation-level interaction edge Constructed by Algorithm 1 and added to the graph During this process, the encoder will be synchronously activated, updating the state of the new edge endpoint according to a preset real-time state update procedure. The real-time state update procedure includes:

[0100] S1021: Extract new edge Category features ;

[0101] S1022: Acquire new edge Endpoint and The temporal and spatial dimensions of information, combined with category features. Generating new edges using a multilayer perceptron To the endpoint and The transmitted edge message vector;

[0102] Specifically, the process of obtaining time dimension information includes: calculating new edges. timestamp The time intervals between directly related operations at each of the two endpoints are used to obtain vector representations of these time intervals using a time-coding algorithm. The process of obtaining spatial dimension information includes: extracting endpoints. and After the update First-order egocentric graphs, using time-series graph attention networks to obtain endpoints and The node vector representation in their respective first-order egocentric graphs.

[0103] S1023: Endpoint-based and The state vector and its corresponding edge message vector are recorded in the memory structure, and endpoints are generated using the GRU network. and The real-time state vector.

[0104] The real-time APT detection method provided in this invention has the following advantages: Compared to existing methods that only focus on the current state of entities in the system, leading to reduced detection accuracy, this invention uses a Time Graph Network (TGN) as the core of anomaly detection. By introducing a memory structure to dynamically maintain the state vector of each node in the source graph, it can model the long-term dependencies of continuously running systems, significantly improving the accuracy of detecting long-term, multi-stage APT attacks from large-scale source graphs. Simultaneously, by capturing subtle changes in entity states, it can promptly detect abnormal behaviors suspected of being attack activities without waiting for the accumulation of long-term malicious behavior, reducing detection latency and improving detection accuracy.

[0105] As one possible implementation method, Algorithm 2 shown in Table 2 provides a specific process for real-time state updates.

[0106] Table 2 Algorithm 2: Real-time State Update Algorithm

[0107]

[0108] Updated in real time according to the process described in Algorithm 2 The state vector of the endpoint. Let the symbol... Representative operation The time of construction represent The previous moment; The memory structure representing a node, with the index indicating its last update time. Overall, Algorithm 2's workflow consists of three stages: feature extraction, edge message computation, and node state update.

[0109] Among them, edge message computation aims to generate operations. To the endpoint and The vectorized representation of the transmitted message is represented by the following steps:

[0110] Step 1: Calculation Update time The time interval between a directly related operation on the two endpoints is used, and a vector representation of the interval is obtained using a time-coding algorithm. From this, the temporal dimension (historical activity sequence) information of the operation on the endpoints can be obtained (lines 4-5).

[0111] Step 2: Extraction and After the update The first-order egocentric graph is used, and the node vector representation of the endpoint in the corresponding subgraph is obtained using the Temporal Graph Attention Network (TGAT). Thus, the spatial dimension (local topology) information of the operation pairs at the endpoints can be obtained (lines 7-9).

[0112] Step 3: Combine the temporal and spatial dimension information obtained in the above steps, and Its own category statistical characteristics (|| represents vector concatenation operation), obtaining the message vector passed from the operation to the endpoints through a multilayer perceptron model MLP1 to be trained (lines 10-11). During the message vector calculation, the timestamp and message recorded in the memory structure of the operation-related endpoints will be updated synchronously (lines 6, 10-11). It is worth noting that due to the computational differences caused by message directionality, the edge message vectors generated by the two endpoints are not consistent.

[0113] Node state updates are modeled as based on The message being transmitted to the entity and This problem involves predicting the state of an endpoint. Given the high similarity between this scenario and sequence prediction tasks, this algorithm introduces the Gated Recurrent Unit (GRU) from the field of Recurrent Neural Networks (RNNs). Compared to other RNN models such as LSTM and BiLSTM, GRU requires a smaller parameter size and has higher inference efficiency for the same inference capability, thus better suited to the time-sensitive task requirements of the clue discovery stage. Specifically, for endpoints... and This algorithm will use the state vectors recorded in the memory structure respectively. The `.state` and its corresponding edge message vector serve as the hidden state and input of the GRU network. The hidden state updated by GRU is considered as the entity's experience. The subsequent state prediction results (lines 12-13). From the perspective of entity activity sequence, the above prediction process can be regarded as the iterative accumulation of the impact of all historical operations of the node, which is the updated state vector. .state. To facilitate computation, this subgraph retains up to 20 of the most recent interaction information, which can dynamically integrate information on the node's historical activities and current operations, effectively ensuring the detection of long-term, low-frequency APT attack activities.

[0114] In this embodiment, one-hot encoding ( and ) and time coding ( and The time complexity of the computation can be considered as The time complexity of TGAT updating the endpoint vector Z is O(n log n). ,in , and Let represent the number of attention heads, the edge size after sampling the first-order subgraph, and the number of layers in the model, respectively. The time complexity of the GRU update process is O(n). ,in and These represent the dimensions of the state vector and message vector, respectively. In summary, the entire process of entity state updating can be completed in constant time.

[0115] Existing detection methods often model the anomaly detection task handled by the decoder as a multi-class classification problem based on instruction categories. However, this approach is not applicable to the detection target of this invention—the operation-level source graph. Through in-depth statistical analysis of the data, this invention discovered that even operations representing the same task type can cover significantly different instruction categories and numbers. Based on this fact, this invention models the decoder as a probabilistic estimation problem of operational anomalies, that is, through nodes... and The state vector before the update ( .state and .state) evaluation operation At any moment The anomaly occurred. For efficiency reasons, the core model of the decoder also uses an MLP (denoted as MLP2). As shown below:

[0116]

[0117] in, This represents the probability of an abnormal operation.

[0118] It is worth noting that the latest state vector generated by Algorithm 2 .state contains The existence information (spatial dimension information calculation) is not applicable to the judgment of the current operation. It will be stored in the memory structure of the corresponding node and reserved for subsequent reasoning tasks.

[0119] During the training phase of the abnormal behavior detection module, negative samples representing normal behavior are collected from real operations during the benign operation period of the target system (benign initialization assumption). Based on this, this invention uses given negative samples... Replace the destination node with Different types of nodes are randomly selected from the data to construct positive samples representing abnormal behavior. Since the anomaly probability prediction of an operation is essentially a 0-1 binary classification problem, this invention introduces binary cross-entropy loss BCELoss for calculating the loss value during the training phase. In this process, thanks to the support of the memory structure, negative samples... and positive samples generated based on it Probabilistic predictions can be performed within the same historical operation context, as shown below:

[0120]

[0121] in, This represents the loss value for the current positive and negative sample pairs. Done. After calculation, to ensure that the information in the memory structure reflects the real-time activities of the system, only negative samples are used. The triggered information updates are synchronized, ensuring the reasonableness of the labels for subsequent sample pairs. Ultimately, by minimizing the global loss during training, the parameters of the encoder and decoder are optimized synchronously, and the trained decoder is able to output higher probability confidence for anomalous behavior.

[0122] During the specific detection phase, the abnormal behavior detection module will assess the probability of abnormalities in the target system's operational-level interactions in real time, and mark operations exceeding a preset anomaly threshold ϵ as potential attack clues. It is worth noting that this anomaly threshold is dynamically set to the average probability of all negative samples during the target host's training phase, in order to maximize coverage of potential APT attack activities.

[0123] By working together with an encoder for entity state tracking and a decoder for anomaly evaluation, the anomaly behavior detection module can detect anomalous activities suspected of being attacks in the target system and filter out attack-irrelevant parts of the tracing graph in the next module.

[0124] In one embodiment, this invention proposes a method for identifying malicious processes. Existing detection methods primarily screen malicious activities based on the frequency of abnormal activity or the community structure they form in the source graph. However, this invention finds that these screening mechanisms all have significant detection vulnerabilities; attackers can circumvent detection by simulating benign behavior or extending attack intervals. To improve anti-interference capabilities, this invention designs a clue screening mechanism based on the context of process influence relationships. Compared to traditional characteristics such as frequency, the influence propagation paths formed by attack activities between processes are more difficult to disguise and conceal. Therefore, to accurately identify malicious processes, this invention proposes an attack relevance score. This comprehensively assesses the probability of a process participating in APT attack activities. Specifically, it considers processes involving abnormal operations. The attack relevance score is calculated as follows:

[0125]

[0126] in, Sub-evaluation indicators and Separate quantization process The degree of suspicion of attacks based on its own abnormal behavior and related activities within its scope of influence; It is a hyperparameter that adjusts the weights of these two sub-indicators. When its value approaches 1, the overall index... Main focus The presented process directly involves activities; conversely, it focuses more on... Provided activity context.

[0127] make Represents a suspicious process exist The highest probability of anomaly Operation. The average anomaly probability of these operations is calculated to obtain:

[0128]

[0129] in, Evaluation reference range By screening for operations with high anomaly probability, the impact of most benign operations on this indicator is effectively filtered out, eliminating the high-frequency invalid updates they cause, thereby improving the efficiency of clue screening. Meanwhile, the overall averaging calculation strategy can effectively reduce the interference of occasional benign anomalies on malicious process identification.

[0130] And in In the calculation process, in order to comprehensively evaluate the progress The attack relevance information for other processes within the affected area is calculated using the recursive calculation method shown below:

[0131]

[0132] in, , and These represent the standard Sigmoid normalization function and its inverse function, respectively. represent China and Israel Let be the set of first-order reachable destination nodes from the source node.

[0133] Leveraging the monotonically increasing nature of the Sigmoid function, the impact of suspicious processes is amplified during recursive aggregation, while the impact of benign processes is mitigated. This represents truncation suppression. Based on the above attack correlation assessment model, when the process... Attack correlation index When the maliciousness threshold δ is exceeded (which is stricter than the anomaly threshold ϵ), the process is determined to be directly related to APT attack activities. Therefore, anomalous operations directly related to it are identified as genuine attack clues, and the time it takes for the process to transition to a malicious state is determined. It is then set as a set The minimum value of the operation timestamp.

[0134] In one embodiment, the invention decides to fully utilize The provided impact control relationships, combined with the malicious process identification method described above, dynamically maintain the operational-level malicious subgraph CRG through graph traversal. This mainly includes the following steps:

[0135] S1031: Along malicious processes The incoming edge direction is used to backpropagate through breadth-first traversal to update the attack relevance score of the traversed process, thereby identifying new malicious processes.

[0136] S1032: Targeting each new malicious process With this new malicious process Starting from, in The system searches for other malicious processes that meet the preset time-series reachability criteria and adds them to the set. And identify the source of the new malicious process. arrive The shortest time-series reachable path for each node in the process. ;

[0137] S1032: Find the shortest time-reachable path All process nodes and associated abnormal operations are updated in the malicious subgraph.

[0138] The APT real-time detection method provided in this invention has the following advantages: Compared with existing methods that are prone to generating a large number of false alarms, this invention, through an attack clue filtering mechanism based on influence control relationships, accurately distinguishes between benign anomalies and real attack activities, significantly alleviating the problem of alarm fatigue. Simultaneously, it can reconstruct discrete alarm clues to fully describe the APT attack activity currently being suffered by the target system, effectively reflecting the current security posture of the host.

[0139] As one possible implementation method, Algorithm 3 shown in Table 3 provides a specific CRG update process.

[0140] Table 3 Algorithm 3: CRG Update Process

[0141]

[0142] As shown in Algorithm 3, it specifically includes the following three stages: impact propagation, attack fragment association, and CRG update.

[0143] Impact on propagation: When the process Newly executed operations It was identified as highly anomalous by the anomaly detection module, resulting in an attack relevance score. When directly updated (line 2), the impact of this update will extend along the evaluation model of the clue filtering module. middle The incoming edge direction is propagated back through breadth-first traversal (lines 3-14). Specifically, the traversed process updates its relevance score according to the formula for calculating the relevance score (line 10). Due to sub-indices coefficient The impact diminishes with propagation distance. To avoid wasting computational resources and negatively impacting clue screening efficiency due to large-scale ineffective propagation, this algorithm sets a propagation termination mechanism for each traversal branch based on the process's malice and the magnitude of indicator updates (line 11). After the impact of all branches has propagated, processes with relevance indicators exceeding the threshold δ are marked as new malicious processes and recorded in variable V. mal (Line 13)

[0144] Attack Fragment Correlation: Based on the newly added malicious processes whose impact on propagation has been confirmed, this step will further correlate them with other attack clues within the scope of these processes' influence. To this end, the time-series reachable paths are defined as follows:

[0145] For path topology If the timing constraints of the following formula are satisfied, then the path The attack affecting the control flow is considered to be reachable under this timing constraint:

[0146]

[0147] in, and Representing the edges respectively The source node and destination node, the symbol " in the above timing constraints "Indicates a subordinate relationship; ( )represent The smallest timestamp that an edge in a set has.

[0148] Based on the above concepts, the linking process will be based on each newly added malicious process. Starting from the diagram The forward search in the text collects the following two pieces of information (line 16): (1) Affects the set of other malicious processes within the scope of control that meet the timing reachability condition. This represents a malicious process in the same attack event. (2) Subsequent attack activity nodes triggered by the node arrive The shortest (least hops) time-reachable path for each node in the process. This represents the attack control chain between these activities.

[0149] By employing a bidirectional search that influences propagation and the correlation of attack fragments, the filtering module enables dynamic discovery of attack-related processes and in-depth extraction of potential correlations.

[0150] CRG Update: Traversal due to abnormal operation The discovered attack chain set The process nodes along the path and their associated abnormal operations are added to the CRG (lines 17-18). Through this dynamic update method, the CRG can effectively preserve the malicious components in the operation-level timing tracing graph. Based on this, the node entities contained in the CRG can also effectively filter out subgraphs in the tracing graph that contain malicious behavior. Thus, effective filtering of the original tracing graph is achieved.

[0151] Based on the same inventive concept, combined with Figure 1 As shown, this embodiment of the invention also provides an APT real-time detection system based on multi-level source graph entity state monitoring, which mainly includes three modules: source graph construction module, abnormal behavior detection module, and attack clue screening module.

[0152] Specifically, firstly, the source graph construction module collects the audit logs of the target system and converts the collected audit logs into a hierarchical process center graph (HPG), which includes an operation-level source graph. and control level traceability diagram Among them, the operational-level traceability diagram Used to describe the specific tasks performed by each process; control-level source diagram This is used to describe the direct or indirect influence flow between processes; next, the abnormal behavior detection module, based on the hierarchical process center graph, uses a graph learning model based on continuous-time dynamic graph (CTDG) to capture the real-time state of system entities and extract abnormal operations; finally, the attack clue screening module calculates the attack relevance score of the processes associated with the abnormal operations to identify malicious processes, and based on... The direct connectivity relationships in the graph are used to piece together discrete malicious processes to correlate and integrate fragmented activity segments of APT attacks, thereby updating the operational-level malicious subgraph. In this embodiment, the filtering module uses the upper-layer HPG graph as a basis for its filtering. The provided inter-process influence control relationships enable in-depth screening of candidate clues output by the abnormal behavior detection module, accurately identifying valid clues that are truly related to APT attacks. The screened clues will be summarized in the form of a source tracing diagram.

[0153] It should be noted that the APT real-time detection system based on multi-level traceability graph entity state monitoring provided in this embodiment of the invention is for implementing the above method. Its specific functions can be referred to the above method embodiment, and will not be repeated here.

[0154] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A real-time APT detection method based on multi-level source graph entity state monitoring, characterized in that, include: Collect audit logs from the target system and convert them into a hierarchical process center graph (HPG). The HPG includes an operation-level source graph. and control level traceability diagram Among them, the operational-level traceability diagram Used to describe the specific tasks performed by each process; control-level source diagram Used to describe the direct or indirect influence flow between processes; Based on the hierarchical process center diagram, a graph learning model based on continuous-time dynamic graphs is used to capture the real-time state of system entities and extract abnormal operations. Calculate the attack relevance score of processes associated with anomalous operations to identify malicious processes, and based on... The direct connectivity relationships in the graph splice discrete malicious processes to correlate and integrate fragmented activity segments of APT attacks, thereby updating the operational-level malicious subgraph.

2. The APT real-time detection method based on multi-level source graph entity state monitoring according to claim 1, characterized in that, The process of converting collected audit logs into a hierarchical process center diagram includes: System entity and instruction event information is extracted from the audit log to generate an instruction event stream; the instruction event information includes the subject, object, instruction type, and timestamp of the instruction, and the type of the subject is a process entity; For each pair of system entities that have instruction exchanges, a data structure is dynamically maintained. To record the operations that are taking place between two entities; Traverse the instruction event stream; According to the main body of the current instruction and object Update the corresponding data structure with this instruction. ; The system identifies whether the current instruction is a boundary instruction based on preset boundary instruction determination rules. If not, it returns to the step of traversing the instruction event stream and processes the next instruction; if so, it updates the data structure. All instructions stored in the database are aggregated into a single operation, which is then used as an operation-level interaction edge. Increase to In the middle, set the category information and timestamp of the edge, and clear the data structure. For two entities and Prepare records for the next operation between them; the boundary instructions refer to instructions used to separate different operations; Determine the object of the current instruction If it is a process entity, then treat the operation as a direct control relationship edge. Increase to And the timestamp of that side is middle If the corresponding timestamps match; otherwise, iterate through them. The object Find the first-order neighborhood of the region that is in the same neighborhood as the first-order neighborhood of the region. Edges that conform to the logic of information transmission, and their main body Add a set NE, and without generating multiple edges, find the principals in set NE. With the main body of the current instruction An indirect influence relationship is established between each of them. Increase to And the timestamp of that side is middle The corresponding timestamps are consistent; Return to the step that traversed the instruction event stream, process the next instruction, and continue until all instructions have been traversed to obtain the final result. and .

3. The APT real-time detection method based on multi-level source graph entity state monitoring according to claim 2, characterized in that, The boundary instruction determination rules include semantic boundary rules and temporal boundary rules; Semantic boundary rules refer to the rules that if the current instruction... Instruction categories If the end of a specific operation is explicitly indicated, then the current instruction... For boundary instructions; Timing boundary rules refer to the rules that if the current instruction and the next instruction in the instruction event stream The time interval exceeds the preset operation interval threshold. Then the current instruction This is a boundary instruction.

4. The APT real-time detection method based on multi-level source graph entity state monitoring according to claim 1, characterized in that, The graph learning model includes an encoder and a decoder; the encoder is used to monitor the real-time state of system entities and maintain a state vector containing all their historical activity information; the decoder is used to detect abnormal operations in the system based on the state vector of the system entities; wherein, the encoder adopts a time graph network based on a continuous-time dynamic graph. Correspondingly, based on the hierarchical process center graph, a graph learning model based on continuous-time dynamic graphs is used to capture the real-time state of system entities, including: when a new edge is added to... At the same time, the encoder is activated synchronously to update the state of the new edge endpoint according to the preset real-time state update process; The real-time status update process includes: Extract new edges Category features ; Get new edge Endpoint and The temporal and spatial dimensions of information, combined with category features. Generating new edges using a multilayer perceptron To the endpoint and The transmitted edge message vector; Based on endpoints and The state vector and its corresponding edge message vector are recorded in the memory structure, and endpoints are generated using the GRU network. and The real-time state vector.

5. The APT real-time detection method based on multi-level source graph entity state monitoring according to claim 4, characterized in that, The acquisition of new edges Endpoint and The time dimension information includes: calculating the new edge timestamp The time intervals between two directly related operations at each endpoint are used to obtain a vector representation of the time intervals using a time coding algorithm. The acquisition of new edges Endpoint and Spatial dimensional information, including: extracting endpoints and After the update First-order egocentric graphs, using time-series graph attention networks to obtain endpoints and The node vector representation in their respective first-order egocentric graphs.

6. The APT real-time detection method based on multi-level source graph entity state monitoring according to claim 4, characterized in that, The decoder is used to detect abnormal operations in the system based on the state vectors of system entities, including: using a multilayer perceptron based on endpoints and Predicting new edges from the state vector before update The probability of an anomaly, when the probability of an anomaly is greater than a preset anomaly threshold, the new edge... It has been marked as a potential anomalous operation.

7. The APT real-time detection method based on multi-level source graph entity state monitoring according to claim 4, characterized in that, The training process of the graph learning model includes: Real-world operations during a period of healthy system operation are collected as negative samples representing normal behavior; the target node of a given negative sample is replaced with... Different types of nodes are randomly selected from the data to obtain positive samples representing abnormal operations; The loss values ​​for all positive and negative sample pairs are calculated using binary cross-entropy loss to obtain the global loss. The global loss is then minimized to optimize the parameters of the encoder and decoder.

8. The APT real-time detection method based on multi-level source graph entity state monitoring according to claim 6, characterized in that, The calculation of attack relevance scores of processes associated with abnormal operations to identify malicious processes includes: Mark the process associated with the abnormal operation as a suspicious process, and let Represents extracted and suspicious processes Related, in The highest probability of anomaly For each abnormal operation, calculate the suspicious process using the following formula. Suspiciousness of attacks based on its own abnormal operations : in, express The Middle The probability of an abnormal operation; Suspicious processes are calculated using the following formula. Suspiciousness of attacks on related activities within the affected area : in, , and These represent the standard Sigmoid normalization function and its inverse function, respectively. represent China and Israel Let be the set of first-order reachable destination nodes from the source node; according to and Calculate the suspicious process according to the following formula. Attack relevance score ,like When the maliciousness threshold δ is exceeded, the suspicious process is flagged. Malicious processes identified as being directly related to APT attack activities: in, For hyperparameters, .

9. The APT real-time detection method based on multi-level source graph entity state monitoring according to claim 8, characterized in that, The basis stated The direct connectivity relationships in the graph splice together discrete malicious processes to correlate and integrate fragmented activity segments of APT attacks, thereby updating the operational-level malicious subgraph, including: along malicious processes The incoming edge direction is used to backpropagate through breadth-first traversal to update the attack relevance score of the traversed process, thereby identifying new malicious processes. For each new malicious process With this new malicious process Starting from, in The system searches for other malicious processes that meet the preset time-series reachability criteria and adds them to the set. And identify the source of the new malicious process. arrive The shortest time-series reachable path for each node in the process. ; where, the temporally reachable path is defined as: for path If any one of the edges If the following timing constraints are satisfied, then the path... The attack affecting the control flow is considered reachable under this timing constraint. in, and Representing the edges respectively The source node and destination node, and the symbol in the above timing constraints. "Indicates a subordinate relationship; ( )represent The smallest timestamp that an edge in a set has; Shortest time reachable path All process nodes and associated abnormal operations are updated in the malicious subgraph.

10. A real-time APT detection system based on multi-level source graph entity state monitoring, characterized in that, include: The source graph construction module is used to collect audit logs from the target system and convert the collected audit logs into a hierarchical process center graph (HPG). The hierarchical process center graph includes an operation-level source graph. and control level traceability diagram Among them, the operational-level traceability diagram Used to describe the specific tasks performed by each process; control-level source diagram Used to describe the direct or indirect influence flow between processes; An abnormal behavior detection module is used to capture the real-time state of system entities and extract abnormal operations based on the hierarchical process center graph using a graph learning model based on continuous-time dynamic graphs. The attack clue filtering module is used to calculate the attack relevance score of processes associated with abnormal operations to identify malicious processes, and based on... The direct connectivity relationships in the graph splice discrete malicious processes to correlate and integrate fragmented activity segments of APT attacks, thereby updating the operational-level malicious subgraph.

Images