Attack attribution method and device, structured knowledge graph construction method, electronic device, medium and product

Abstract

This application discloses an attack attribution method, apparatus, structured knowledge graph construction method, electronic device, medium, and product. The method includes: matching real-time behavioral data of a monitored environment with a pre-defined attack behavior knowledge base to obtain hit attack techniques; using the hit attack techniques as query keywords, searching for the target attack entity corresponding to the hit attack techniques in the structured knowledge graph; if a target attack entity is found, generating an attack attribution report based on the target attack entity and the hit attack techniques. This method transforms attack attribution from manual experience-based judgment to automated, precise matching based on a structured knowledge graph, thereby significantly improving attribution efficiency and accuracy.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, specifically to an attack attribution method, apparatus, method for constructing a structured knowledge graph, electronic device, readable storage medium, and computer program product. Background Technology

[0002] In today's increasingly complex cybersecurity landscape dominated by Advanced Persistent Threat (APT) attacks, enterprise security operations centers need to quickly identify attackers and trace attacks from massive amounts of endpoint behavior data. Existing technologies primarily rely on pre-defined threat signature databases, comparing endpoint behavior data with known threat signatures to determine the presence of attack activity. However, these existing technologies can only detect matched threat signatures. Even after detecting an attack, the source still requires manual experience or searching through scattered threat intelligence to infer the attack's origin, resulting in a lengthy and inefficient attribution process. Summary of the Invention

[0003] In view of the above problems, this application provides an attack attribution method, apparatus, method for constructing a structured knowledge graph, electronic device, readable storage medium, and computer program product, which can solve the problems of long cycle and low efficiency caused by relying on human experience to consult threat intelligence for attribution after detecting attack behavior in the prior art.

[0004] Firstly, this application provides an attack attribution method, including: The real-time behavioral data of the monitored environment is matched with a pre-set attack behavior knowledge base to obtain the hit attack techniques; wherein, the attack behavior knowledge base is an attack tactical techniques and general knowledge base. Using the hit attack technique as the query keyword, the target attack entity corresponding to the hit attack technique is queried in the structured knowledge graph; wherein, the structured knowledge graph includes multiple nodes and multiple edges, the nodes are used to represent attack entities or attack techniques, and the edges are used to represent the association between attack entities and attack techniques or between attack entities. If the target attack entity is found, an attack attribution report is generated based on the target attack entity and the hit attack technique.

[0005] In the above technical solution, the method can automate the entire process from attack behavior matching to attacker identification without the need for manual review of scattered threat intelligence, thereby effectively shortening the response cycle of attack attribution and improving security operation efficiency. At the same time, by accurately associating attack technical points with attack entities through structured knowledge graphs, it can also reduce the subjectivity and error of human judgment, thereby improving the accuracy and traceability of attribution results and providing a clear basis for subsequent emergency response and forensic analysis.

[0006] In some implementations, after generating an attack attribution report based on the target attack entity and the hit attack technique points, the method further includes: Acquire threat level data corresponding to the target attack entity and harm level data corresponding to the hit attack technique; wherein, the target attack entity includes one or more of the following: attack tools and attack organizations; Based on the threat level data and the hazard level data, determine the attack risk level corresponding to the current monitoring environment; Output corresponding alarm information based on the attack risk level.

[0007] In the above technical solution, the method dynamically assesses the actual attack risk level based on the dual risk dimensions of attack entities and attack techniques, avoiding false alarms or missed alarms from a single dimension. At the same time, by outputting alarm information in a differentiated manner, security personnel can prioritize the handling of high-risk threats, rationally allocate emergency response resources, and improve the accuracy and timeliness of security operations.

[0008] In some embodiments, the method further includes: When no target attack entity corresponding to the hit attack technique point is found in the structured knowledge graph, the hit attack technique point is marked as an unknown attack, and an alarm message to indicate the unknown attack is output.

[0009] In the above technical solution, the method can fill the gap in attack response under the coverage blind spot of structured knowledge graph, and transform unknown attacks from "no results to follow" to "traceable and recordable", thereby reducing the risk of losing attack clues.

[0010] In some implementations, the output is used to alert users of unknown attacks, including: Calculate the target feature vector of the hit attack technique in the attack behavior knowledge base; Obtain a technical feature library associated with the structured knowledge graph; wherein, the technical feature library includes the feature vector corresponding to each node in the structured knowledge graph; The target feature vector is matched with the technical point feature library to obtain a matching result; wherein, the matching result includes multiple candidate feature vectors in the technical point feature library that have the highest similarity to the target feature vector and multiple similarity values ​​that correspond one-to-one with the multiple candidate feature vectors; Based on the structured knowledge graph, obtain multiple candidate attack techniques corresponding to the multiple candidate feature vectors and multiple candidate attack entities corresponding to the multiple candidate attack techniques. Based on the multiple candidate attack techniques, the multiple candidate attack entities, the multiple similarities, and the hit attack techniques, a suspected attribution report is generated, and alarm information including the suspected attribution report is output.

[0011] In the above technical solution, the method can transform a completely unknown attack into a suspected attribution result with a reference direction, thereby significantly reducing the difficulty and time consumption of manual judgment of unknown attacks.

[0012] Secondly, this application provides a method for constructing a structured knowledge graph, wherein the structured knowledge graph is applied in the attack attribution method described in any one of the first aspects, and the construction method includes: Obtain the first APT security analysis report; Using the first APT security analysis report as input, the extraction module of the AI ​​large model is called to extract entity relationships and obtain the first entity relationship information; wherein, the first entity relationship information includes the first attack entity, the first attack technique point, and the first association relationship, and the first association relationship includes one or more of the association relationship between the first attack entity and the first attack technique point, and the association relationship between the first attack entities; The first entity relationship information is normalized to obtain the first standardized data; Construct a structured knowledge graph based on the first standardized data; Wherein, the nodes of the structured knowledge graph represent the first attack entity or the first attack technique, and the edges of the structured knowledge graph represent the first association relationship.

[0013] In the above technical solution, the method can automatically transform scattered and unstructured security text information into structured data, significantly reducing the cost of manual sorting and annotation; at the same time, it eliminates entity naming conflicts and redundancy through normalization processing, ensuring the consistency of knowledge; the final output graph format is easy to store, update and reuse, providing a standardized knowledge input basis for subsequent attack attribution tasks.

[0014] In some implementations, after constructing the structured knowledge graph based on the first standardized data, the method further includes: Obtain the new second APT security analysis report; Using the second APT security analysis report as input, the extraction module of the AI ​​large model is called to extract entity relationships and obtain the second entity relationship information; The second entity relationship information is normalized to obtain second standardized data; wherein, the second entity relationship information includes a second attack entity, a second attack technique, and a second association relationship, and the second association relationship includes one or more of the association relationship between the second attack entity and the second attack technique, and the association relationship between the second attack entities; The structured knowledge graph is updated based on the second standardized data.

[0015] In the above technical solution, the method can realize incremental and automated updates of the structured knowledge graph, so that the knowledge graph continues to evolve with the acquisition of new APT reports, thereby maintaining the timeliness and integrity of the knowledge base on which the attack attribution method depends.

[0016] In some implementations, updating the structured knowledge graph based on the second standardized data includes: Determine whether there is a target node in the structured knowledge graph that corresponds to the second attack entity or the second attack technique; If so, the node attributes and associated edges of the target node in the structured knowledge graph are updated according to the second standardized data.

[0017] In the above technical solution, the method can perform targeted updates on node attributes and associated edges only for existing target nodes in the graph, avoiding full reconstruction, thereby improving update efficiency while ensuring knowledge accuracy.

[0018] In some embodiments, the method further includes: When the target node corresponding to the second attack entity and the second attack technique does not exist in the structured knowledge graph, the node to be added and the edge to be added are generated according to the second standardized data. The structured knowledge graph is updated based on the nodes to be added and the edges to be added.

[0019] In the above technical solution, the method can achieve incremental expansion of nodes and edges in the graph, thereby enabling the knowledge graph to absorb new attack entities and technical points, and thus maintain the continuous growth of knowledge coverage.

[0020] In some embodiments, the method further includes: When a version update of the preset attack behavior knowledge base is detected, the update technology points of the attack behavior knowledge base are obtained; wherein, the update technology points include newly added or revised attack technology points; Using the aforementioned version update technology points as query keywords, a pre-query is performed in the structured knowledge graph to obtain pre-query results; If no attack entity corresponding to the version update technology point is found in the structured knowledge graph, then the step of obtaining a new second APT security analysis report is executed.

[0021] In the above technical solution, the method can proactively sense version changes of the knowledge base of external attack behaviors, and use newly added or revised technical points as a driving force to pre-determine whether relevant entities are missing in the graph, thereby triggering the acquisition of new reports and graph updates in a targeted manner, and thus maintaining the synchronization between the structured knowledge graph and the latest external attack knowledge.

[0022] Thirdly, this application provides an attack attribution apparatus, comprising: The matching unit is used to match real-time behavioral data of the monitoring environment with a preset attack behavior knowledge base to obtain the hit attack technique points; wherein, the attack behavior knowledge base is an attack tactical technique and general knowledge base. The judgment unit is used to determine whether the target attack entity corresponding to the hit attack technique point is found in the structured knowledge graph, using the hit attack technique point as the query keyword; wherein, the structured knowledge graph includes multiple nodes and multiple edges, the nodes are used to represent attack entities or attack techniques points, and the edges are used to represent the association relationship between attack entities and attack techniques points or between attack entities. The generation unit is used to determine that when the target attack entity corresponding to the hit attack technique point is found in the structured knowledge graph, it generates an attack attribution report based on the target attack entity corresponding to the hit attack technique point and the hit attack technique point.

[0023] In the above technical solution, the device can automatically complete the entire process from attack behavior matching to attacker identification without the need for manual review of scattered threat intelligence, thereby effectively shortening the response cycle of attack attribution and improving security operation efficiency. At the same time, by accurately associating attack technical points with attack entities through structured knowledge graphs, it can also reduce the subjectivity and error of human judgment, thereby improving the accuracy and traceability of attribution results and providing a clear basis for subsequent emergency response and forensic analysis.

[0024] Fourthly, this application provides an electronic device including a memory and a processor, the memory storing a computer program, and the processor running the computer program to cause the electronic device to perform the attack attribution method described in any one of the first aspects.

[0025] Fifthly, this application provides a readable storage medium storing a computer program, which, when executed by a processor, performs the attack attribution method described in any one of the first aspects.

[0026] Sixthly, this application provides a computer program product comprising a computer program that, when executed by a processor, performs the attack attribution method described in any one of the first aspects.

[0027] The beneficial effects of this application are as follows: It enables automated extraction using a finely tuned DeepSeek model in the APT (Advanced Persistent Threat) domain, significantly improving the extraction efficiency and accuracy of attack entities and ATT&CK (Adversarial Tactics & Techniques and General Knowledge Base) technical points, thereby reducing false negatives and false positives. Furthermore, it ensures that threat information is synchronized with the ATT&CK framework version by constructing and dynamically updating a structured knowledge graph based on Neo4J (graph database), promptly meeting the attribution needs of new APT attacks. It also establishes a precise correlation mechanism between ATT&CK hit results and the structured knowledge graph, enabling rapid matching of attack organizations and tools based on hit technical points, achieving automatic attribution and shortening the tracing cycle. Moreover, it integrates full-process automated linkage, completing the entire process from report processing to attack attribution without manual intervention. Finally, by optimizing model fine-tuning, expanding the report collection scope, and adapting to ATT&CK framework versions, the method possesses good scalability and universality, making it applicable to various APT attack tracing scenarios. Attached Figure Description

[0028] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 This is a flowchart illustrating the attack attribution method in some embodiments of this application; Figure 2 This is a flowchart illustrating the method for constructing a structured knowledge graph in some embodiments of this application; Figure 3 This is a schematic flowchart illustrating an example of an attack attribution method in some embodiments of this application; Figure 4 This is a schematic diagram of the attack attribution device in some embodiments of this application; Figure 5 This is a schematic diagram of the structure of an electronic device in some embodiments of this application. Detailed Implementation

[0030] The embodiments of the technical solution of this application will now be described in detail with reference to the accompanying drawings. These embodiments are only used to more clearly illustrate the technical solution of this application and are therefore merely examples, and should not be used to limit the scope of protection of this application.

[0031] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms “comprising” and “having”, and any variations thereof, in the specification, claims, and foregoing description of the drawings are intended to cover non-exclusive inclusion.

[0032] In the description of the embodiments of this application, technical terms such as "first" and "second" are used only to distinguish different objects and should not be construed as indicating or implying relative importance or implicitly specifying the number, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, "multiple" means two or more (including two), similarly, "multiple sets" refers to two or more sets (including two sets), and "multiple pieces" refers to two or more pieces (including two pieces) unless otherwise explicitly defined.

[0033] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0034] In the description of the embodiments in this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0035] Existing technologies for attributing attacks typically rely on security experts manually reviewing scattered threat intelligence and correlating the identified ATT&CK techniques with known attack groups and tools. Consequently, they inevitably suffer from low attribution efficiency, high subjectivity, and difficulty in establishing standardized processes.

[0036] To address the aforementioned technical problems, this application provides an attack attribution method.

[0037] The core of this method lies in moving away from the traditional approach of "finding matches based on threat intelligence" and instead leveraging the inherent property that "there is a stable and reusable correlation between attacking organizations and ATT&CK techniques" to pre-construct a structured knowledge graph indexed by attack techniques. Then, the real-time detected hit attack techniques are used as direct query keys, and the target attack entity is quickly located through the graph's correlation query mechanism. This transforms the attribution problem into a deterministic graph query problem, thereby achieving a shift from manual experience-based judgment to automated and accurate matching.

[0038] like Figure 1 As shown, some embodiments of this application provide an attack attribution method, which includes: S110. Match the real-time behavioral data of the monitored environment with the preset attack behavior knowledge base to obtain the hit attack technique points.

[0039] In this embodiment, the execution entity of the attack attribution method is an attack attribution device. Generally, the attack attribution device deploys a security monitoring system or an automatic attribution system, and may include an ATT&CK hit detection module and an automatic attribution module. Specifically, the attack attribution device may be a standalone hardware security gateway, a server integrating an EDR (Endpoint Detection and Response) module, a software platform deployed in an enterprise security operations center, a containerized service instance running in a cloud-native form on a security cloud platform, or a unified security operations platform.

[0040] In this embodiment, the attack behavior knowledge base is an attack tactics, techniques, and common knowledge base (MITRE ATT&CK framework), which covers a standardized knowledge set of various attack tactics, techniques, sub-techniques and their detection rules.

[0041] In this embodiment, the attack behavior knowledge base can be the official version of the MITRE ATT&CK framework (such as V16.0), which should at least include information such as defined technical point IDs, names, tactical affiliations, detection methods, and mitigation measures.

[0042] In this embodiment, the monitoring environment refers to the IT assets such as terminal devices, servers, and network devices covered by the endpoint security monitoring system or security operations center deployed within an enterprise or organization. For example, it may include devices with different business roles, such as domain controller servers, development terminals, and financial terminals.

[0043] In this embodiment, matching refers to comparing the collected real-time behavioral data (such as process operations, network connections, permission changes, scheduled task creation, etc.) with the preset ATT&CK technical point detection rules in the attack behavior knowledge base to determine whether the behavioral characteristics meet the definition or indicator characteristics of a certain technical point.

[0044] In this embodiment, the hit attack technique point refers to the ATT&CK technique point corresponding to the real-time behavioral data after matching. The hit attack technique point may include the tactical, technical, and sub-technical description of the technique point and the corresponding technique point ID (such as T1053, T1055, T1041, etc.).

[0045] In this embodiment, step S110 can be executed by the ATT&CK hit detection module.

[0046] In this embodiment, the ATT&CK hit detection module is used to monitor terminal behavior and network behavior in real time. It can identify and extract hit ATT&CK technical points based on the detection rules preset in the MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework.

[0047] In this embodiment, the ATT&CK hit detection module can collect behavioral data such as terminal process operations, network connections, permission changes, and scheduled task creation in real time, and match them with technical points in the ATT&CK framework. During the matching process, if the behavioral data is detected to hit a certain ATT&CK technical point, the complete information of that ATT&CK technical point (including tactical, technical, and sub-technical descriptions) is extracted and sent as the hit attack technical point to the automatic attribution module.

[0048] S120. Using the hit attack technique point as the query keyword, query the target attack entity corresponding to the hit attack technique point in the structured knowledge graph.

[0049] In this embodiment, the query keywords refer to the hit attack techniques obtained in step S110. Specifically, the query keywords may include the technique ID (such as T1053, T1055, T1041, etc.), technique name, and related descriptive information of the technique, so as to facilitate retrieval and matching in the structured knowledge graph.

[0050] In this embodiment, the structured knowledge graph refers to an APT (Advanced Persistent Threat) knowledge graph built based on the Neo4J graph database, hereinafter also referred to as the Neo4J APT knowledge graph. It uses attack entities (such as attack organizations, attack tools, malicious samples, IOCs, etc.) and ATT&CK techniques as nodes, and the relationships between entities (such as "use," "execution," "association," etc.) as edges, forming a structured, queryable knowledge network. The structured knowledge graph includes multiple nodes and multiple edges. Nodes represent attack entities or attack techniques, and edges represent the relationships between attack entities and attack techniques or between attack entities. In this embodiment, the target attack entity refers to the attack organization (such as the Patchwork organization), attack tool (such as the BADNEWS Trojan), malicious sample, or IOC (Indicator of Compromise) that is associated with the hit attack technique. It is the ultimate target of attack attribution.

[0051] In this embodiment, step S120 can be executed by the automatic attribution module.

[0052] In this embodiment, the automatic attribution module is linked with the ATT&CK hit detection module and the Neo4J APT (Advanced Persistent Threat) knowledge graph construction and update module, respectively, to establish a graph query and matching mechanism with ATT&CK technical points as the core. This enables the rapid association between ATT&CK hit results and attack entities (Patchwork organization, BADNEWS Trojan) in the structured knowledge graph, breaking the barrier of the disconnect between ATT&CK hits and attribution in the prior art.

[0053] In this embodiment, after receiving the complete information of the hit ATT&CK technical points sent by the ATT&CK hit detection module, the automatic attribution module can use the hit ATT&CK technical points as core query keywords to perform related queries in the Neo4J APT knowledge graph, thereby accurately matching the target attack entities such as attack tools (such as the BADNEWS Trojan) and attack organizations (such as the Patchwork organization) corresponding to the ATT&CK technical points.

[0054] In this embodiment, the attack behavior knowledge base and the structured knowledge graph have a collaborative relationship: all technical points defined in the attack behavior knowledge base can be used as query entry points to access the structured knowledge graph, but not all technical points have corresponding entities in the graph. Only technical points that have been verified by actual attack activities will appear in the graph.

[0055] S130. If the target attack entity is found, generate an attack attribution report based on the target attack entity and the hit attack technique.

[0056] In this embodiment, if no target attack entity is found, step S170 can be executed.

[0057] In this embodiment, the attack attribution report refers to the structured report document generated by the automatic attribution module based on the graph matching results.

[0058] For example, an attack attribution report may include: the hit attack technique (including technique ID, name, tactical affiliation and description information), the matched target attack entity (such as the Patchwork organization, BADNEWS Trojan, and other attack organizations and tools), the association between the attack entity and the attack technique (such as "an organization used a tool to execute a technique"), and the attack risk level automatically determined based on the threat level of the attack organization and the severity of the ATT&CK technique.

[0059] In this embodiment, the attack attribution report is pushed to the alarm module or the enterprise security management platform, thereby providing security personnel with traceable and understandable attribution basis, which facilitates subsequent emergency response and forensic analysis.

[0060] In this embodiment, the automatic attribution module can also automatically generate an attack attribution report based on the graph matching results, thereby clarifying the ATT&CK technical points, attack organization (Patchwork organization), attack tools (BADNEWS Trojan) and related threat information corresponding to the attack behavior.

[0061] In this embodiment, after each attack attribution report is generated, the association between the hit attack techniques and the target attack entity in this attribution can be sent back to the knowledge graph repository as feedback information. If the association already exists in the structured knowledge graph, the hit frequency or confidence weight of its association edge is updated; if it is a potential association discovered for the first time, it is marked as a hypothesis to be verified for reference in subsequent attribution processes.

[0062] In the above embodiments, the method can automate the entire process from attack behavior matching to attacker identification without requiring manual review of scattered threat intelligence, thereby effectively shortening the response cycle of attack attribution and improving security operation efficiency. At the same time, by accurately associating attack techniques with attack entities through structured knowledge graphs, it can also reduce the subjectivity and error of human judgment, thereby improving the accuracy and traceability of attribution results and providing a clear basis for subsequent emergency response and forensic analysis.

[0063] In some embodiments, after step S130, the method may further include: S140. Obtain threat level data corresponding to the target attack entity and harm level data corresponding to the hit attack technical points; wherein, the target attack entity includes one or more of the attack tools and attack organizations.

[0064] In this embodiment, threat level data refers to the threat level identifier pre-assigned to the target attack entity (such as the Patchwork organization or the BADNEWS Trojan).

[0065] In this embodiment, threat level data is used to characterize the harmfulness, activity level, and attack capabilities of the attacking entity's past activities, and is usually divided into three levels: high, medium, and low.

[0066] In this embodiment, the hazard level data refers to the hazard level identifier preset in the MITRE ATT&CK framework for hitting attack technical points (such as T1053, T1055, T1041, etc.).

[0067] In this embodiment, the hazard level data is used to characterize the system impact that may be caused by the successful exploitation of this technology (such as privilege escalation, persistence, command execution, etc.), and is usually divided into three levels: high, medium and low.

[0068] S150. Based on threat level data and hazard level data, determine the attack risk level corresponding to the current monitoring environment.

[0069] In this embodiment, the attack risk level refers to the overall risk label of the current attack behavior obtained by combining the threat level of the target attack entity and the harm level of the hit attack technical point through preset risk assessment rules (such as taking the highest level of the two, weighted calculation, or matrix mapping).

[0070] In this embodiment, the attack risk level is used to guide the selection of subsequent alarm strategies, and is usually divided into three levels: high, medium, and low.

[0071] S160. Output corresponding alarm information according to the attack risk level.

[0072] In this embodiment, since it has been previously explained that the automatic attribution module will automatically determine the attack risk level based on the threat level of the attacking organization and the degree of harm of the ATT&CK technical points, steps S140-S160 are a further detailed explanation of this determination.

[0073] In this embodiment, the automatic attribution module can push the attribution report to the alarm module or the enterprise security management platform to trigger alarm notifications to security personnel.

[0074] At the same time, when the alarm module receives the attribution report output by the automatic attribution module, it will push the report to the enterprise security management platform, thereby triggering the corresponding level of alarm, which will facilitate security personnel to quickly view the source and carry out defense measures.

[0075] In the above embodiments, the method dynamically assesses the actual attack risk level based on the dual risk dimensions of the attack entity and the attack technique, avoiding false alarms or missed alarms from a single dimension. At the same time, by outputting alarm information in a differentiated manner, security personnel can prioritize the handling of high-risk threats, rationally allocate emergency response resources, and improve the accuracy and timeliness of security operations.

[0076] In some embodiments, after step S120, the method may further perform step S170: S170. When no target attack entity corresponding to the hit attack technique point is found in the structured knowledge graph, the hit attack technique point is marked as an unknown attack, and an alarm message is output to indicate the unknown attack.

[0077] In this embodiment, the method can mark the hit ATT&CK technical point as an "unknown attack" when no relevant attack entity is matched in the structured knowledge graph, and only trigger basic alarm operations without feedback updates.

[0078] In this embodiment, if the similarity between an "unknown attack" and a candidate attack entity exceeds a threshold, a "potential association suggestion" will be generated and stored in the verification area of ​​the knowledge graph. If this technical point appears multiple times in the future and always matches the same candidate attack entity, the knowledge graph will be updated, and the association will be included in the knowledge graph.

[0079] In this embodiment, after step S120, when no target attack entity is found in the structured knowledge graph, steps S171 to S175 can transform a completely unknown attack into a suspected attribution result with a reference direction, specifically including the following steps: S171. Calculate the target feature vector of the hit attack technique point in the attack behavior knowledge base.

[0080] In this embodiment, computation refers to mapping the text description of the hit attack technique point (including the technique point name, tactical affiliation, detection rule description, etc.) into a numerical vector representation in a high-dimensional vector space through a preset feature extraction algorithm (such as TF-IDF, Word2Vec, BERT and other embedding models).

[0081] In this embodiment, the target feature vector refers to the numerical vector obtained after feature extraction of the hit attack technique point, which is used to characterize the position of the technique point in the semantic space, so as to facilitate the subsequent similarity comparison with the feature vectors of existing techniques points in the structured knowledge graph.

[0082] S172. Obtain the technical point feature library associated with the structured knowledge graph; wherein, the technical point feature library includes the feature vector corresponding to each node in the structured knowledge graph.

[0083] In this embodiment, the technical point feature library refers to a pre-constructed set of feature vectors that correspond one-to-one with each attack technical point node in the structured knowledge graph. Each feature vector is generated using the same feature extraction algorithm as in step S171 to ensure the consistency of the vector space and to support similarity matching queries.

[0084] S173. Match the target feature vector with the technical point feature library to obtain the matching result; wherein, the matching result includes multiple candidate feature vectors with the highest similarity to the target feature vector in the technical point feature library, as well as multiple similarities corresponding one-to-one with the multiple candidate feature vectors.

[0085] In this embodiment, similarity refers to the distance metric (such as cosine similarity, Euclidean distance, etc.) between the target feature vector and the candidate feature vector in the vector space. It is used to measure the semantic similarity between the hit attack technique and the existing attack technique in the structured knowledge graph. The higher the similarity value, the closer the two are.

[0086] S174. Based on the structured knowledge graph, obtain multiple candidate attack techniques that correspond one-to-one with multiple candidate feature vectors and multiple candidate attack entities that correspond one-to-one with multiple candidate attack techniques.

[0087] In this embodiment, the structured knowledge graph pre-stores the association edges (such as "execution", "use" etc.) between attack technology point nodes and attack entity nodes (such as attack organizations, attack tools), and the attack entity nodes directly connected to the candidate attack technology point nodes can be queried along the association edges, thereby establishing the attribution link of "technology point - attack tool - attack organization".

[0088] In this embodiment, the correspondence between candidate attack techniques and candidate attack entities is specifically embodied in this attribution chain. This correspondence is extracted and stored by the AI ​​large model from the APT security analysis report during the construction of the structured knowledge graph.

[0089] S175. Based on multiple candidate attack techniques, multiple candidate attack entities, multiple similarities, and hit attack techniques, generate a suspected attribution report and output alarm information including the suspected attribution report.

[0090] In this embodiment, the suspected attribution report refers to a reference attribution document with confidence (represented by similarity) generated based on the semantic similarity matching results when the hit attack technique cannot be matched with an exact attack entity in the structured knowledge graph.

[0091] In this embodiment, the suspected attribution report may include: the original hit attack technique, multiple candidate attack techniques with the highest similarity, the candidate attack entities (attack organizations, attack tools, etc.) corresponding to each candidate technique, and the corresponding similarity value.

[0092] The suspected attribution report is used to provide security personnel with suspected attribution clues that provide a direction for reference, rather than a definitive attribution conclusion.

[0093] In this embodiment, outputting alarm information including suspected attribution reports refers to pushing suspected attribution reports to the alarm system of the enterprise security management platform or security operations center for security analysts to conduct manual assessment, further source tracing analysis, or to supplement the threat intelligence database.

[0094] In this embodiment, if an automated response mechanism is configured, it can also be synchronously pushed to the SOAR (Secure Orchestration Automation and Response) platform to trigger low-confidence recording or observation strategies.

[0095] In the above embodiments, the method can utilize the inherent static properties of ATT&CK techniques to achieve approximate attribution of unknown attacks.

[0096] Specifically, each attack technique output by the ATT&CK hit detection module strictly follows the numbering and definition of the MITRE ATT&CK framework. Therefore, each technique has definite static attributes such as tactical affiliation, hierarchical structure, and platform association within the framework.

[0097] Constructing feature vectors based on these static attributes ensures that even if the technique does not yet exist in a structured knowledge graph, a standardized and computable feature representation can still be obtained.

[0098] Furthermore, this method calculates the similarity between the feature vector and the isomorphic feature vector of existing technical points in the structured knowledge graph, thereby achieving an approximate mapping from "unknown technical points" to "known technical points," ultimately providing valuable reference suggestions for security analysts.

[0099] In some embodiments, when multiple terminal devices need to be monitored, the method can introduce a dynamic behavior baseline to prioritize different scenarios (different business roles). Specifically, step S110 may include: S111: Collect multiple real-time behavioral data corresponding to multiple terminal devices in the monitoring environment.

[0100] In this embodiment, real-time behavioral data refers to behavioral logs generated during the operation of the terminal device, such as process operations, network connections, permission changes, and planned task creation.

[0101] In this embodiment, each terminal device corresponds to a set of independently collected real-time behavioral data.

[0102] S112. Obtain multiple business role types that correspond one-to-one with multiple terminal devices; wherein, the business role type includes one of the following: domain controller server, development terminal, and financial terminal.

[0103] In this embodiment, the business role type refers to the business function label that the terminal device undertakes in an enterprise or organization, which is used to distinguish the criticality and risk exposure of different devices.

[0104] In this embodiment, the domain controller server carries the core functions of identity authentication and access control, and therefore poses the highest risk. Financial terminals involve fund transfers and sensitive financial data, thus posing the second highest risk. The development terminal has a high-privilege operating environment for code compilation and debugging, which poses a risk of code injection and supply chain attacks.

[0105] S113. Assign multiple dynamic behavior baselines to multiple terminal devices based on multiple business role types.

[0106] In this embodiment, the dynamic behavior baseline refers to the pre-establishment and allocation of differentiated behavior baselines for terminal devices of different business roles based on multiple business role types. This includes the statistical range of behavioral indicators such as process startup frequency, network connection destination, permission change patterns, and planned task creation cycle of the role type under normal operating conditions.

[0107] In this embodiment, different business role types correspond to different dynamic behavior baselines (such as the baseline of the domain controller server focusing on account permission changes and domain policy modifications, and the baseline of the financial terminal focusing on database connection and payment interface calls).

[0108] S114. Based on multiple real-time behavioral data and multiple dynamic behavioral baselines, perform one-to-one correspondence calculations to obtain multiple deviations that correspond one-to-one with the multiple real-time behavioral data.

[0109] In this embodiment, the deviation refers to the quantitative value of the difference between real-time behavior data and the corresponding dynamic behavior baseline, which is used to measure the degree of abnormality in the behavior of the current terminal device.

[0110] In this embodiment, the higher the deviation, the more the real-time behavior deviates from the normal pattern, and the greater the potential threat.

[0111] In this embodiment, the deviation can be calculated using statistical distance (such as Mahalanobis distance), probability density comparison (such as Gaussian distribution model), or anomaly scoring based on machine learning.

[0112] S115. Set multiple priorities for multiple real-time behavioral data based on multiple deviations.

[0113] In this embodiment, priority refers to the processing order identifier for real-time behavioral data allocation based on the degree of deviation.

[0114] In this embodiment, real-time behavioral data with higher deviation has higher priority and will be prioritized for attack behavior knowledge base matching and detection. The lower the deviation (the more normal the behavior) of real-time behavioral data, the lower its priority and the later it will be processed.

[0115] In this embodiment, priorities are typically divided into three levels: high, medium, and low, or a numerical sorting method may be used.

[0116] S116. According to multiple priorities from high to low, multiple real-time behavioral data are matched sequentially through a preset attack behavior knowledge base to obtain multiple hit attack technology points that correspond one-to-one with the multiple real-time behavioral data.

[0117] In this embodiment, sequential matching refers to sending high-priority real-time behavioral data into the attack behavior knowledge base for ATT&CK technical point matching and detection in descending order of priority, while low-priority data is queued for processing.

[0118] In this embodiment, this processing method can ensure that the abnormal behavior of high-risk business roles is not overwhelmed by low-priority data, and can prioritize the threat detection of critical equipment when computing resources are limited.

[0119] In the above embodiments, the method can allocate differentiated dynamic behavior baselines according to the business role type of the terminal device, and automatically divide the processing priority by calculating the deviation between the real-time behavior and the baseline, so as to ensure that the abnormal behavior of high-risk business roles (such as domain control servers and financial terminals) is matched and detected first, thereby reasonably allocating computing resources when the monitoring scale expands, and avoiding the flooding of critical threats by massive amounts of low-priority data.

[0120] In some embodiments, this method can upgrade isolated single-point hits to chain matching. When a historical chain is matched, the confidence level of the attribution report becomes higher, and it can also "predict" the attacker's next move, thus upgrading the attribution report from "post-event summary" to "in-process warning."

[0121] Specifically, after step S130, the method may further include: S131. Obtain multiple hit attack points that occur consecutively within a preset time window.

[0122] In this embodiment, the preset time window refers to a pre-set time period (such as 30 minutes, 1 hour, 24 hours, etc.) used to limit the collection range of continuously hit attack points.

[0123] In this embodiment, multiple consecutive hit attack points refer to multiple ATT&CK attack points detected sequentially within a preset time window in the same monitoring environment or on the same terminal device. These attack points may come from different stages of the same attack chain.

[0124] S132. Construct a short-term attack chain pattern based on the order and frequency of occurrence of multiple hit attack techniques in the time series.

[0125] In this embodiment, the short-term attack chain pattern refers to a local attack behavior sequence template abstracted based on the time sequence characteristics of consecutively hitting attack points (including the order of appearance of the points, adjacent time intervals, repetition frequency, etc.). It is used to characterize the behavior pattern of the current attack in a short period of time, such as an ordered sequence like "T1053 (scheduled task creation), T1055 (process injection), T1041 (C2 communication)".

[0126] S133. Determine whether the short-term attack chain pattern hits the preset historical attack chain pattern library. If yes, proceed to steps S134~S136; otherwise, end the process.

[0127] In this embodiment, the historical attack chain pattern library refers to a pre-built knowledge set that stores typical attack chain patterns of known APT attack groups. Each pattern contains a complete sequence of technical points and the corresponding information on the attack group and the attribution of the attack tools.

[0128] In this embodiment, the library can be continuously accumulated based on historical APT security analysis reports, publicly available threat intelligence, and historical attribution results.

[0129] In this embodiment, a hit refers to a short-term attack chain pattern and a certain pattern in the historical attack chain pattern library reaching a preset similarity threshold in terms of sequence order and technical point composition (such as a complete match or a sequence alignment match that allows for a small number of insertions / deletions).

[0130] S134. Increase the confidence level of the attack attribution report according to the preset rules.

[0131] In this embodiment, the confidence level refers to the quantitative indicator of the reliability of the attribution conclusions in the attack attribution report.

[0132] In this embodiment, when an isolated single technical point matches a historical attack chain pattern, the confidence level of the attribution is low; when multiple consecutive technical points form a sequence that matches a historical attack chain pattern, it indicates that the current attack behavior is highly consistent with the TTP (tactics, techniques and processes) of a known attack organization. Therefore, the confidence level is increased according to preset rules (such as increasing the confidence level by one confidence level for each additional technical point in the matching chain). For example, the confidence level is increased from "low confidence" to "medium confidence" or "high confidence".

[0133] S135. Extract the hit attack chain corresponding to the short-term attack chain pattern from the historical attack chain pattern library.

[0134] In this embodiment, a hit attack chain refers to a complete attack chain pattern in the historical attack chain pattern library that successfully matches a short-term attack chain pattern.

[0135] In this embodiment, the hit attack chain refers to the attack organization corresponding to the pattern, the information on the ownership of the attack tools, and the complete sequence of technical points (including the currently occurring part and the subsequent part in the historical record).

[0136] S136. Obtain the sequence of historical subsequent attack techniques following the short-term attack chain pattern based on the hit attack chain, and attach the sequence of historical subsequent attack techniques as predicted attack steps to the attack attribution report.

[0137] In this embodiment, the historical subsequent attack technique sequence refers to the attack technique sequence that is located after the short attack chain pattern in the hit attack chain and has not yet been detected in the current monitoring environment (e.g., the short chain pattern includes T1053-T1055, and the complete hit attack chain sequence is T1053-T1055-T1041-T1071, then T1041-T1071 is the predicted attack step).

[0138] In this embodiment, adding these prediction steps to the attack attribution report means supplementing the original attribution report with "predicting the next attack" or "suggesting key points to focus on", so that the report is upgraded from a simple "post-event attribution" to a comprehensive judgment document that includes "in-event warning".

[0139] As an optional implementation, the method further includes: If the predicted attack steps include other attack techniques besides the multiple hit attack techniques, then a warning message is generated to alert users to these other attack techniques.

[0140] Implementing this method allows security personnel to specifically monitor predicted attack steps.

[0141] like Figure 2As shown, some embodiments of this application provide a method for constructing a structured knowledge graph, which is applied in the aforementioned attack attribution method. The method for constructing the structured knowledge graph includes: S210. Obtain the first APT security analysis report.

[0142] In this embodiment, the execution entity of the structured knowledge graph construction method is a knowledge graph construction device, which may include an APT report collection module, an AI large model automated extraction module, and a Neo4J APT knowledge graph construction and update module. Specifically, the knowledge graph construction device may be a unified security operations platform, an AI inference server, a security data analysis appliance, or a cloud-native knowledge graph construction server. The knowledge graph construction device and the aforementioned attack attribution device can be deployed on the same physical device, for example, both on a unified security operations platform; alternatively, they can be deployed on different devices, for example, the knowledge graph construction device can be deployed on a central-side knowledge graph construction server, while the attack attribution device can be deployed on a user-side endpoint security detection server or security operations center server.

[0143] In this embodiment, the first APT security analysis report refers to the original security analysis document obtained from the official blogs of mainstream security vendors, which contains descriptions of APT attack events, information on attack organizations, characteristics of attack tools, IOC indicators, and ATT&CK technical points.

[0144] In this embodiment, the method can automatically collect APT security analysis reports published on the official blogs of mainstream security vendors (including but not limited to Kaspersky and ESET) through the APT report collection module.

[0145] The APT report acquisition module supports real-time report capture, scheduled acquisition (such as once a day), and batch import, and is compatible with multiple report formats such as PDF, HTML, and plain text.

[0146] In this embodiment, the APT report acquisition module can also preprocess the acquired reports simultaneously, removing redundant information, unifying the text format, and cleaning the text, thereby providing high-quality input data for subsequent automated extraction of large AI models.

[0147] In addition, the APT report collection module can also record metadata such as report source and release time, so as to facilitate the subsequent updating and tracing of the structured knowledge graph.

[0148] S220. Using the first APT security analysis report as input, call the extraction module of the AI ​​large model to extract entity relationships and obtain the first entity relationship information; wherein, the first entity relationship information includes the first attack entity, the first attack technique point and the first association relationship, and the first association relationship includes one or more of the association relationship between the first attack entity and the first attack technique point, and the association relationship between the first attack entities.

[0149] In this embodiment, step S220 is executed by the DeepSeek large model automated extraction module, which is linked with the APT report acquisition module.

[0150] In this embodiment, the AI ​​large model automated extraction module uses DeepSeek, a fine-tuned AI large model specifically for the APT field, as the core extraction engine to achieve automated and high-precision extraction of attack entities and ATT&CK technical points, thereby replacing traditional NLP technology and manual extraction, and solving the problems of low efficiency and insufficient accuracy of traditional extraction.

[0151] In this embodiment, the specific tasks of the AI ​​large model automated extraction module mainly include: (1) Model configuration This module uses the DeepSeek large model as the base model and performs specific fine-tuning on it in the APT field (in some optimized embodiments, the DeepSeek-V2 large model can be used for fine-tuning to improve the extraction accuracy of attack entities and ATT&CK technical points).

[0152] The training dataset includes a large number of APT security analysis reports, the MITRE ATT&CK framework technical manual, and a library of known APT attack entities. This optimizes the model's recognition accuracy for APT-specific entities and ATT&CK technical points, ensuring the accuracy and standardization of the extraction results.

[0153] (2) Automated extraction By inputting preprocessed APT report text into the DeepSeek large model, two types of core information are accurately extracted through the model's natural language understanding and entity recognition capabilities: The first category is attack entities, including attack organizations (such as the Patchwork group), attack tools (such as the BADNEWS Trojan), malicious samples (containing MD5 / SHA256 hash values), and IOCs (Indicators of Compromise).

[0154] The second category is ATT&CK technical points, which strictly correspond to the tactics, techniques, and sub-techniques in the MITRE ATT&CK framework. Based on the attack characteristics of the BADNEWS Trojan, the following technical points are extracted: T1053 (scheduled tasks / jobs), T1055 (process injection), T1041 (command and control), T1083 (file and directory discovery), T1071 (application layer protocols), T1027 (code obfuscation), etc.

[0155] S230. Normalize the first entity relationship information to obtain the first standardized data.

[0156] In this embodiment, step S230 describes the process of standardizing the extraction results.

[0157] In this embodiment, step S230 mainly includes the following three steps: (1) Eliminate ambiguity in expression.

[0158] A unified name should be adopted for the same entity from different sources and with different representations.

[0159] For example, "BADNEWS malicious Trojan" is standardized to "BADNEWS Trojan"; "ATT&CK T1053" is standardized to "MITRE ATT&CK V16.0 T1053 Scheduled Task / Operation".

[0160] (2) Establish preliminary relationships.

[0161] The standardized attack entities are associated with ATT&CK technical points.

[0162] For example, establish relationships such as "Patchwork organization uses BADNEWS Trojan" and "BADNEWS Trojan executes technical points such as T1053 and T1055".

[0163] (3) Output standardized data.

[0164] The above processing results will be used as standardized data output to provide a unified and standardized data foundation for the subsequent construction of structured knowledge graphs.

[0165] S240. Construct a structured knowledge graph based on the first standardized data; wherein, the nodes of the structured knowledge graph represent the first attack entity or the first attack technique, and the edges of the structured knowledge graph represent the first association relationship.

[0166] In this embodiment, step S240 is executed by the Neo4J APT knowledge graph construction and update module.

[0167] In this embodiment, the Neo4J APT knowledge graph construction and update module is implemented using the Neo4J graph database.

[0168] In this embodiment, the Neo4J APT knowledge graph construction and update module works in conjunction with the AI ​​large model automated extraction module to construct an APT knowledge graph that includes the association between attack entities and ATT&CK technical points.

[0169] In this embodiment, the structure design of the structured knowledge graph is as follows: The attack entities extracted from the AI ​​large model and the ATT&CK technical points are used as core nodes. The relationships between entities and technical points are used as edges; The core node types and their relationships fall into three categories: (1) Establish a “use” connection edge between the attack organization node and the attack tool node. For example, the Patchwork organization node and the BADNEWS Trojan node are connected by a “use” edge.

[0170] (2) An "execution" connection edge is established between the attack tool node and the ATT&CK technical point node. For example, the BADNEWS Trojan node is connected to technical point nodes such as T1053 and T1055 through an "execution" edge.

[0171] (3) Establish "association" edges between ATT&CK technical point nodes and malicious samples and IOC nodes. Among them, IOC (Indicator of Compromise) refers to intrusion indicators.

[0172] In some embodiments, the method can also add attribute nodes such as attack time and attack scenario to the structured knowledge graph, so that the attribution results include historical attack scenario information and improve the comprehensiveness of the attribution.

[0173] In the above embodiments, the method can automatically transform scattered, unstructured security text information into structured data, significantly reducing the cost of manual sorting and annotation; at the same time, it eliminates entity naming conflicts and redundancy through normalization processing, ensuring the consistency of knowledge; the final output graph format is easy to store, update and reuse, providing a standardized knowledge input foundation for subsequent attack attribution tasks.

[0174] In some embodiments, after step S240, the method for constructing the structured knowledge graph may further include: S250, Obtain the new second APT security analysis report.

[0175] In this embodiment, the second APT security analysis report refers to the newly acquired APT security analysis report after the initial construction of the structured knowledge graph.

[0176] In this embodiment, the report is obtained in the same way as the first APT security analysis report, both of which are automatically collected by the APT report acquisition module.

[0177] In this embodiment, the second APT security analysis report may include new attack groups, new attack tools, new ATT&CK techniques, or new association information of existing attack entities, which is used to incrementally update the existing structured knowledge graph.

[0178] To specifically trigger the acquisition of new reports and map updates, prior to step S250, the method further includes: S247. When a preset attack behavior knowledge base version update is detected, the update technology points of the attack behavior knowledge base are obtained; wherein, the update technology points include newly added or revised attack technology points.

[0179] In this embodiment, the version update technical points refer to the ATT&CK technical points added or revised when the MITRE ATT&CK framework version is updated (such as upgrading from V16.0 to V17.0).

[0180] In this embodiment, these technical points may include entirely new technical point IDs, revisions to existing technical point descriptions, adjustments to tactical attribution, etc.

[0181] In this embodiment, the detection method can be to periodically poll the official version release page of ATT&CK, or to subscribe to the version update notification interface.

[0182] S248. Using version update technology points as query keywords, perform a pre-query in the structured knowledge graph to obtain the pre-query results.

[0183] S249. If no attack entity corresponding to the version update technology point is found in the structured knowledge graph, then proceed to step S250.

[0184] In this embodiment, steps S247 to S249 describe a triggering prerequisite process for step S250.

[0185] The core logic is as follows: when the ATT&CK framework version is updated, it proactively checks whether the current structured knowledge graph has covered the newly added or revised technical points. If the graph does not yet contain the attack entities corresponding to these technical points (i.e., no APT report has yet associated the new technical points with known attack groups and tools), it triggers the retrieval of a new APT security analysis report in order to extract supplementary information from the latest report and maintain the synchronization between the graph and the ATT&CK framework version.

[0186] S260. Using the second APT security analysis report as input, call the extraction module of the AI ​​large model to extract entity relationships and obtain the second entity relationship information.

[0187] In this embodiment, steps S260 and S220 use the same AI large model automated extraction module and extraction process, which will not be described again here.

[0188] S270. Normalize the second entity relationship information to obtain second standardized data; wherein, the second entity relationship information includes the second attack entity, the second attack technique point, and the second association relationship, and the second association relationship includes one or more of the association relationship between the second attack entity and the second attack technique point, and the association relationship between the second attack entities.

[0189] In this embodiment, steps S270 and S230 adopt the same normalization process, including eliminating ambiguity in expression and establishing preliminary correlation, which will not be described in detail here.

[0190] S280. Update the structured knowledge graph based on the second standardized data.

[0191] In this embodiment, the update mechanism of step S280 is as follows: When the APT report acquisition module obtains a new APT security analysis report, and the AI ​​large model automated extraction module extracts new attack entities, ATT&CK techniques, and related relationships from it, the system automatically performs the following update operations in the Neo4J graph database: (1) Adding new nodes and edges: For attack entities or ATT&CK technology points that do not yet exist in the structured knowledge graph, create corresponding new nodes directly and create corresponding edges according to the association relationship.

[0192] (2) Supplementing existing node information: For existing nodes in the structured knowledge graph (such as the Patchwork organization), if supplementary association information of the node is extracted (such as the newly added ATT&CK technology points of the organization), the attributes and associated edges of the node will be automatically updated.

[0193] By implementing this method, the structured knowledge graph can be synchronized with the latest APT threat information in real time through the above mechanism, and supports dynamic version adaptation of the MITRE ATT&CK framework, thereby ensuring the accuracy of attribution.

[0194] Therefore, the core of this mechanism lies in realizing the automatic updating of the structured knowledge graph to ensure its timeliness and adapt to the update requirements of new APT attacks and ATT&CK framework versions.

[0195] In the above embodiments, the method can achieve incremental and automated updates to the structured knowledge graph, so that the structured knowledge graph continues to evolve as new APT reports are acquired, thereby maintaining the timeliness and integrity of the knowledge base on which the attack attribution method depends.

[0196] In some embodiments, step S280 may include: S281. Determine whether there is a target node in the structured knowledge graph that corresponds to the second attack entity or the second attack technique. If yes, proceed to step S282; otherwise, proceed to steps S283-S284.

[0197] In this embodiment, the target node refers to a node that already exists in the structured knowledge graph and matches the second attack entity or the second attack technique.

[0198] In this embodiment, the determination criteria may be the node name, standardized ID, or other unique identifier.

[0199] S282. Update the node attributes and associated edges of the target node in the structured knowledge graph based on the second standardized data, and end this process.

[0200] In this embodiment, updating refers to adding new attribute information (such as a new alias for the attacking organization, a new version number of the attacking tool, etc.) to the existing nodes, or adding new associated edges (such as adding ATT&CK technical points associated with existing attacking tools).

[0201] In this embodiment, the above method does not require adding new nodes; it only requires incremental modification of existing nodes.

[0202] S283. Generate new nodes and new edges based on the second standardized data.

[0203] In this embodiment, the node to be added refers to an attack entity or ATT&CK technique point contained in the second standardized data but not present in the current structured knowledge graph. The edges to be added refer to the associations associated with these new nodes.

[0204] In this embodiment, the generation method is to construct new nodes and edges that conform to the structured knowledge graph specification based on the entity information and association information in the second standardized data.

[0205] S284. Update the structured knowledge graph based on the nodes and edges to be added, and then end this process.

[0206] In this embodiment, "updating" refers to writing the nodes and edges to be added into the Neo4J graph database to complete the expansion of the structured knowledge graph.

[0207] In this embodiment, this method is used to handle newly emerging attack entities or ATT&CK techniques, ensuring that the structured knowledge graph can cover newly emerging threat information.

[0208] In the above embodiments, the method can perform targeted updates on node attributes and associated edges only for existing target nodes in the graph, avoiding full reconstruction, thereby improving update efficiency while ensuring knowledge accuracy.

[0209] In some embodiments, please refer to Figure 3 , Figure 3 A flowchart illustrating an example of an attack attribution method is shown. An example of this attack attribution method is as follows: (1) Structured knowledge graph construction stage (providing a knowledge base for attribution) First, configure the APT report collection module: set the collection frequency to 2 AM daily, automatically capturing the latest APT security analysis reports (PDF format) published by Kaspersky and the ESET official blog. Use a text parsing tool to remove redundant information such as images and advertisements from the reports, convert the text content to TXT format, and store the cleaned text in a local database, recording the report source and publication time.

[0210] Secondly, configure an AI large model automated extraction module: use a DeepSeek large model finely tuned in the APT field to automatically extract data from preprocessed APT reports.

[0211] The extraction results are shown below: Attacking group: Patchwork group; Attack tool: BADNEWS Trojan; ATT&CK technical points: T1053 (Scheduled Tasks / Jobs), T1055 (Process Injection), T1041 (Command and Control), T1083 (File and Directory Discovery), T1071 (Application Layer Protocols). Malicious sample, IOC: IP address 192.168.1.100 (example only), domain name badnews-malware.com (example only).

[0212] After standardization, a preliminary association is established: the Patchwork organization uses the BADNEWS Trojan, which executes techniques such as T1053, T1055, and T1041. The extraction results are then sent to the structured knowledge graph.

[0213] Finally, a Neo4J APT knowledge graph (i.e., a structured knowledge graph) is constructed: using Neo4J version 5.0 graph database, deployed on a server, and stored in the Neo4J APT knowledge graph repository. Attack entities and ATT&CK technical points extracted from the DeepSeek large model are used as nodes to construct the following relationships: Patchwork Group (attack group) - uses BADNEWS Trojan (attack tool); BADNEWS Trojan - Execution - T1053; BADNEWS Trojan - Execution - T1055; BADNEWS Trojan - Execution - T1041.

[0214] When a new APT report is collected the next day, and the DeepSeek large model extracts the newly associated ATT&CK technical point T1027 (code obfuscation) from the Patchwork organization, it automatically adds a T1027 node and establishes an association edge between the BADNEWS Trojan-Execution-T1027, and synchronously updates it to the Neo4J APT knowledge graph repository to complete the incremental update of the structured knowledge graph.

[0215] (2) Attack Attribution Execution Phase Configure the ATT&CK hit detection module: Deploy this module in the enterprise security operations center to collect terminal behavior data in real time.

[0216] When a terminal is detected to be performing "malicious process injection into system processes", the T1055 technical point in the MITRE ATT&CK V16 framework is matched, the complete information of the technical point is extracted (tactic: defense and avoidance; technology: process injection; sub-technology: none) and sent to the automatic attribution module.

[0217] The automatic attribution module executes the attribution process: it receives T1055 technical point information, uses the technical point as the query keyword, and performs a query in the Neo4J APT knowledge graph repository.

[0218] The query results show that the attack tool associated with T1055 is the BADNEWS Trojan, and the associated attack organization is the Patchwork organization.

[0219] Based on this, an attribution report is automatically generated, which includes: attack time, terminal IP, ATT&CK technical point (T1055), attack organization (Patchwork organization), attack tool (BADNEWS Trojan), and risk level (high).

[0220] The report is then pushed to the alarm module and security management platform, triggering a high-risk alarm.

[0221] After the attribution is completed, the attribution conclusion (the association between T1055 and the Patchwork organization and the BADNEWS Trojan) will be used as feedback information to update the Neo4J APT knowledge graph repository and accumulate the number of hits or confidence weights of the association.

[0222] (3) Handling unknown attacks If the ATT&CK technical point T1234.001 (unknown technical point) is detected, and no related attack entity is matched in the structured knowledge graph, the technical point will be marked as "unknown attack", triggering only a basic alarm and without updating the structured knowledge graph.

[0223] like Figure 4 As shown, some embodiments of this application provide a structural schematic diagram of an attack attribution device. It should be understood that this device is related to... Figure 1 The method executed in the middle corresponds to the steps involved in the aforementioned method. The specific functions and effects of the device can be found in the description above. To avoid repetition, detailed descriptions are omitted here.

[0224] The attack attribution device includes: The matching unit 310 is used to match real-time behavioral data of the monitoring environment with a preset attack behavior knowledge base to obtain the hit attack technique points; wherein, the attack behavior knowledge base is an attack tactical technique and general knowledge base. The judgment unit 320 is used to query the target attack entity corresponding to the hit attack technique point in the structured knowledge graph using the hit attack technique point as the query keyword; wherein, the structured knowledge graph includes multiple nodes and multiple edges, the nodes are used to represent attack entities or attack techniques points, and the edges are used to represent the association relationship between attack entities and attack techniques points or between attack entities. The generation unit 330 is used to generate an attack attribution report based on the target attack entity and the hit attack technique points if a target attack entity is found.

[0225] In some embodiments, the attack attribution device further includes: The acquisition unit 340 is used to acquire threat level data corresponding to the target attack entity and hazard level data corresponding to the hit attack technology point after the generation unit 330 generates an attack attribution report based on the target attack entity and the hit attack technology point; wherein, the target attack entity includes one or more of the attack tools and attack organizations. The determination unit 350 is used to determine the attack risk level corresponding to the current monitoring environment based on threat level data and hazard level data. The output unit 360 is used to output corresponding alarm information according to the attack risk level.

[0226] In some embodiments, the output unit 360 is further configured to mark the hit attack technique as an unknown attack when no target attack entity corresponding to the hit attack technique is found in the structured knowledge graph, and output alarm information to indicate the unknown attack.

[0227] In some embodiments, the output unit 360 includes: Computational subunit 361 is used to calculate the target feature vector of the hit attack technique in the attack behavior knowledge base; Acquire subunit 362, used to acquire the technical point feature library associated with the structured knowledge graph; wherein, the technical point feature library includes the feature vector corresponding to each node in the structured knowledge graph; Matching subunit 363 is used to match the target feature vector with the technical point feature library to obtain the matching result; wherein, the matching result includes multiple candidate feature vectors with the highest similarity to the target feature vector in the technical point feature library, as well as multiple similarity values ​​corresponding one-to-one with the multiple candidate feature vectors; The acquisition subunit 362 is also used to acquire multiple candidate attack points corresponding to multiple candidate feature vectors and multiple candidate attack entities corresponding to multiple candidate attack points based on the structured knowledge graph. The generation subunit 364 is used to generate a suspected attribution report based on multiple candidate attack techniques, multiple candidate attack entities, multiple similarities, and hit attack techniques, and output alarm information including the suspected attribution report.

[0228] It is understood that the attack attribution method provided in this application embodiment can be applied to electronic devices, including terminals and servers; the terminal can specifically be a smartphone, tablet computer, computer, personal digital assistant (PDA), etc.; the server can specifically be an application server or a web server. Furthermore, the multi-scale template generation method can be executed by a large model, neural network model, or reinforcement learning model loaded in the electronic device, and the large model can be based on a transformer architecture.

[0229] like Figure 5As shown, this application provides an electronic device 400, which includes a processor 401 and a memory 402. The processor 401 and the memory 402 are interconnected and communicate with each other through a communication bus 403 and / or other forms of connection mechanism (not shown). The memory 402 stores a computer program that can be executed by the processor 401. When the computing device is running, the processor 401 executes the computer program to perform the method in any of the aforementioned optional implementations.

[0230] This application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the method in any of the aforementioned optional implementations.

[0231] The computer-readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0232] This application provides a computer program product, which includes a computer program that, when run by a processor, executes the method in any of the aforementioned optional implementations.

[0233] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and not to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. These modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application, and they should all be covered within the scope of the claims and specification of this application. In particular, as long as there is no conflict, the various technical features mentioned in the embodiments can be combined in any way. This application is not limited to the specific embodiments disclosed herein, but includes all technical solutions falling within the scope of the claims.

Claims

1. An attack attribution method, characterized in that, include: The real-time behavioral data of the monitored environment is matched with a pre-set attack behavior knowledge base to obtain the hit attack techniques; wherein, the attack behavior knowledge base is an attack tactical techniques and general knowledge base. Using the hit attack technique as the query keyword, the target attack entity corresponding to the hit attack technique is queried in the structured knowledge graph; wherein, the structured knowledge graph includes multiple nodes and multiple edges, the nodes are used to represent attack entities or attack techniques, and the edges are used to represent the association between attack entities and attack techniques or between attack entities. If the target attack entity is found, an attack attribution report is generated based on the target attack entity and the hit attack technique.

2. The attack attribution method according to claim 1, characterized in that, After generating an attack attribution report based on the target attack entity and the hit attack technique points, the method further includes: Acquire threat level data corresponding to the target attack entity and harm level data corresponding to the hit attack technique; wherein, the target attack entity includes one or more of the following: attack tools and attack organizations; Based on the threat level data and the hazard level data, determine the attack risk level corresponding to the current monitoring environment; Output corresponding alarm information based on the attack risk level.

3. The attack attribution method according to claim 1, characterized in that, The method further includes: When no target attack entity corresponding to the hit attack technique point is found in the structured knowledge graph, the hit attack technique point is marked as an unknown attack, and an alarm message to indicate the unknown attack is output.

4. The attack attribution method according to claim 3, characterized in that, The output is used to alert users of unknown attacks, including: Calculate the target feature vector of the hit attack technique in the attack behavior knowledge base; Obtain a technical feature library associated with the structured knowledge graph; wherein, the technical feature library includes the feature vector corresponding to each node in the structured knowledge graph; The target feature vector is matched with the technical point feature library to obtain a matching result; wherein, the matching result includes multiple candidate feature vectors in the technical point feature library that have the highest similarity to the target feature vector and multiple similarity values ​​that correspond one-to-one with the multiple candidate feature vectors; Based on the structured knowledge graph, obtain multiple candidate attack techniques corresponding to the multiple candidate feature vectors and multiple candidate attack entities corresponding to the multiple candidate attack techniques. Based on the multiple candidate attack techniques, the multiple candidate attack entities, the multiple similarities, and the hit attack techniques, a suspected attribution report is generated, and alarm information including the suspected attribution report is output.

5. A method for constructing a structured knowledge graph, characterized in that, The structured knowledge graph is applied in the attack attribution method according to any one of claims 1 to 4, and the construction method includes: Obtain the first APT security analysis report; Using the first APT security analysis report as input, the extraction module of the AI ​​large model is called to extract entity relationships and obtain the first entity relationship information; wherein, the first entity relationship information includes the first attack entity, the first attack technique point, and the first association relationship, and the first association relationship includes one or more of the association relationship between the first attack entity and the first attack technique point, and the association relationship between the first attack entities; The first entity relationship information is normalized to obtain the first standardized data; Construct a structured knowledge graph based on the first standardized data; Wherein, the nodes of the structured knowledge graph represent the first attack entity or the first attack technique, and the edges of the structured knowledge graph represent the first association relationship.

6. The method for constructing a structured knowledge graph according to claim 5, characterized in that, After constructing the structured knowledge graph based on the first standardized data, the method further includes: Obtain the new second APT security analysis report; Using the second APT security analysis report as input, the extraction module of the AI ​​large model is called to extract entity relationships and obtain the second entity relationship information; The second entity relationship information is normalized to obtain second standardized data; wherein, the second entity relationship information includes a second attack entity, a second attack technique, and a second association relationship, and the second association relationship includes one or more of the association relationship between the second attack entity and the second attack technique, and the association relationship between the second attack entities; The structured knowledge graph is updated based on the second standardized data.

7. The method for constructing a structured knowledge graph according to claim 6, characterized in that, The step of updating the structured knowledge graph based on the second standardized data includes: Determine whether there is a target node in the structured knowledge graph that corresponds to the second attack entity or the second attack technique; If so, the node attributes and associated edges of the target node in the structured knowledge graph are updated according to the second standardized data.

8. The method for constructing a structured knowledge graph according to claim 7, characterized in that, The method further includes: When the target node corresponding to the second attack entity and the second attack technique does not exist in the structured knowledge graph, the node to be added and the edge to be added are generated according to the second standardized data. The structured knowledge graph is updated based on the nodes to be added and the edges to be added.

9. The method for constructing a structured knowledge graph according to claim 6, characterized in that, The method further includes: When a version update of the preset attack behavior knowledge base is detected, the update technology points of the attack behavior knowledge base are obtained; wherein, the update technology points include newly added or revised attack technology points; Using the aforementioned version update technology points as query keywords, a pre-query is performed in the structured knowledge graph to obtain pre-query results; If no attack entity corresponding to the version update technology point is found in the structured knowledge graph, then the step of obtaining a new second APT security analysis report is executed.

10. An attack attribution device, characterized in that, The attack attribution device includes: The matching unit is used to match real-time behavioral data of the monitoring environment with a preset attack behavior knowledge base to obtain the hit attack technique points; wherein, the attack behavior knowledge base is an attack tactical technique and general knowledge base. The judgment unit is used to query the target attack entity corresponding to the hit attack technique point in the structured knowledge graph using the hit attack technique point as the query keyword; wherein, the structured knowledge graph includes multiple nodes and multiple edges, the nodes are used to represent attack entities or attack techniques points, and the edges are used to represent the association relationship between attack entities and attack techniques points or between attack entities; The generation unit is used to generate an attack attribution report based on the target attack entity and the hit attack technique points if the target attack entity is found.

11. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory storing a computer program and the processor running the computer program to cause the electronic device to perform the method of any one of claims 1 to 9.

12. A readable storage medium, characterized in that, The readable storage medium stores a computer program, which, when executed by a processor, performs the method according to any one of claims 1 to 9.

13. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, performs the method according to any one of claims 1 to 9.

Images