Network attack tracing method, device and electronic equipment

Abstract

The application discloses a network attack tracing method and device and electronic equipment. The method comprises the following steps: extracting a plurality of selected attack events occurred in a target network from log data of the target network; determining a plurality of operation objects from the plurality of selected attack events; determining reverse dependency relationships and forward dependency relationships between the plurality of operation objects; constructing a reverse dependency graph by taking the plurality of operation objects as first nodes and the reverse dependency relationships between the plurality of operation objects as first edges, and constructing a forward dependency graph by taking the plurality of operation objects as second nodes and the forward dependency relationships between the plurality of operation objects as second edges; obtaining a target dependency graph by taking the intersection between the reverse dependency graph and the forward dependency graph; and tracing the network attack based on the target dependency graph. The application solves the technical problem of inaccurate network attack tracing in the related art.

Description

Technical Field

[0001] This invention relates to the field of network technology, and more specifically, to a method, apparatus, and electronic device for tracing network attacks. Background Technology

[0002] In the field of network security protection, when a network attack occurs, it is necessary to trace the source of the network attack in order to respond to and deal with the network attack effectively. However, in the relevant technologies, there is a technical problem of inaccurate network attack tracing.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This invention provides a method, apparatus, and electronic device for tracing network attacks, which at least solves the technical problem of inaccurate network attack tracing in related technologies.

[0005] According to one aspect of the present invention, a network attack tracing method is provided, comprising: extracting multiple candidate attack events occurring in the target network from log data of the acquired target network; determining multiple operation objects from the multiple candidate attack events; determining reverse dependencies and forward dependencies among the multiple operation objects, wherein the reverse dependency represents the operation dependency relationship between two corresponding operation objects in the order of operation causal backtracking, and the forward dependency represents the operation dependency relationship between two corresponding operation objects in the order of operation causal occurrence; constructing a reverse dependency graph with the multiple operation objects as first nodes and the reverse dependencies among the multiple operation objects as first edges, and constructing a forward dependency graph with the multiple operation objects as second nodes and the forward dependencies among the multiple operation objects as second edges; obtaining a target dependency graph by taking the intersection of the reverse dependency graph and the forward dependency graph; and performing network attack tracing based on the target dependency graph.

[0006] Optionally, constructing a reverse dependency graph using the plurality of operation objects as first nodes and the reverse dependencies between the plurality of operation objects as first edges includes: constructing an initial reverse graph using the plurality of operation objects as first nodes and the reverse dependencies between the plurality of operation objects as first edges; performing an edge merging operation on the initial reverse graph to obtain the reverse dependency graph, wherein the edge merging operation includes any of the following: when there is only one first edge between two corresponding first nodes in the plurality of first nodes, the first edge is taken as the edge between the two corresponding first nodes; when there are multiple first edges between two corresponding first nodes in the plurality of first nodes, the operation time interval between the operation behaviors corresponding to the multiple first edges is determined; and first edges with operation time intervals less than an interval threshold are merged into one edge.

[0007] Optionally, the step of performing an edge merging operation on the initial reverse graph to obtain a reverse dependency graph includes: performing an edge merging operation on the initial reverse graph to obtain a merged dependency graph, wherein the merged dependency graph includes multiple third edges, wherein the multiple third edges are edges obtained after performing an edge merging operation on multiple first edges in the initial reverse graph; clustering the multiple third edges based on the edge features corresponding to each of the multiple third edges to obtain multiple fourth edges, wherein the multiple fourth edges are first nodes whose abnormal correlation index is greater than or equal to an abnormal correlation threshold, and the abnormal correlation index represents the degree of correlation between the operation event corresponding to the corresponding third edge and the target attack event; and constructing a reverse dependency graph based on the multiple fourth edges and the multiple fourth nodes, wherein the multiple fourth nodes are first nodes in the merged dependency graph that correspond to each of the multiple fourth edges.

[0008] Optionally, constructing the reverse dependency graph based on the plurality of fourth edges and the plurality of fourth nodes includes: constructing a filtering dependency graph based on the plurality of fourth edges and the plurality of fourth nodes; determining the reverse dependency chains corresponding to the plurality of fourth nodes based on the plurality of fourth nodes and the plurality of fourth edges in the filtering dependency graph, wherein the reverse dependency chain includes at least one associated node, and the associated node is connected to other fourth nodes through at least one fourth edge; determining the node weights corresponding to the plurality of fourth nodes based on the edge features corresponding to the plurality of fourth edges and the reverse dependency chains corresponding to the plurality of fourth nodes; and constructing the reverse dependency graph based on the node weights corresponding to the plurality of fourth nodes and the filtering dependency graph.

[0009] Optionally, the edge features include: time-related features, data flow-related features, topological-related features, and anomaly-related features, wherein: the time-related features characterize the correlation between the occurrence time of the operation event corresponding to the corresponding third edge and the occurrence time of the reference attack event, wherein the reference attack event is the source event of the operation event; the data flow-related features characterize the correlation between the data flow of the operation event corresponding to the corresponding third edge and the data flow of the target attack event; the topological-related features characterize the importance of the topological structure of the corresponding third edge; and the anomaly-related features characterize the degree of correlation between the operation event corresponding to the corresponding third edge and historical attack events.

[0010] Optionally, obtaining the target dependency graph by taking the intersection of the reverse dependency graph and the forward dependency graph includes: taking the intersection of the reverse dependency graph and the forward dependency graph to obtain a shared dependency graph; identifying redundant edges from the shared dependency graph, wherein the redundant edges are edges in the shared dependency graph whose corresponding operation events are non-attack events in a predetermined non-attack event library; and deleting the redundant edges and the isolated nodes corresponding to the redundant edges from the shared dependency graph to obtain the target dependency graph.

[0011] Optionally, extracting multiple candidate attack events occurring in the target network from the acquired log data of the target network includes: extracting multiple candidate operation events occurring in the target network from the log data; determining anomaly probability values ​​corresponding to the multiple candidate operation events, wherein the anomaly probability value represents the probability that the corresponding candidate operation event is a target attack event; and determining multiple candidate attack events from the multiple candidate operation events based on the anomaly probability values ​​corresponding to the multiple candidate operation events, wherein the multiple candidate attack events are candidate operation events whose corresponding anomaly probability values ​​are greater than an anomaly probability threshold.

[0012] According to one aspect of the present invention, a network attack tracing device is provided, comprising: a first determining module, configured to extract multiple candidate attack events occurring in the target network from log data of the acquired target network; a second determining module, configured to determine multiple operation objects from the multiple candidate attack events; a third determining module, configured to determine the reverse dependency relationship and the forward dependency relationship between the multiple operation objects, wherein the reverse dependency relationship represents the operation dependency relationship between two corresponding operation objects in the operation causal backtracking order, and the forward dependency relationship represents the operation dependency relationship between two corresponding operation objects in the operation causal occurrence order; a fourth determining module, configured to construct a reverse dependency graph with the multiple operation objects as first nodes and the reverse dependency relationship between the multiple operation objects as first edges, and construct a forward dependency graph with the multiple operation objects as second nodes and the forward dependency relationship between the multiple operation objects as second edges; a fifth determining module, configured to obtain a target dependency graph by taking the intersection between the reverse dependency graph and the forward dependency graph; and a sixth determining module, configured to perform network attack tracing based on the target dependency graph.

[0013] According to one aspect of the present invention, an electronic device is provided, comprising: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to execute the instructions to implement the network attack tracing method described in any of the preceding embodiments.

[0014] According to one aspect of the present invention, a computer-readable storage medium is provided, wherein when the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to perform the network attack attribution method described above.

[0015] In this embodiment of the invention, by extracting candidate attack events and determining the operation objects from the log data of the target network, the original logs can be transformed into a semantic set of entities. By determining the reverse dependencies (in causal backtracking order) and forward dependencies (in causal occurrence order) between the operation objects, bidirectional dependency graphs for tracing the attack source and tracking the attack spread can be constructed respectively. By taking the intersection of the reverse dependency graph and the forward dependency graph to obtain the target dependency graph, irrelevant causal edges that are only valid in a single direction can be filtered out, retaining the core paths that can both trace back to the source and explain the attack consequences. Attack tracing based on this target dependency graph can ensure that the tracing results focus on the key attack chain, avoiding causal explosion and path redundancy problems, thereby improving the accuracy of network attack tracing and solving the technical problem of inaccurate network attack tracing in related technologies. Attached Figure Description

[0016] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0017] Figure 1 This is a flowchart of a network attack attribution method according to an embodiment of the present invention;

[0018] Figure 2 This is a schematic diagram of a network attack tracing architecture in an optional embodiment of the present invention;

[0019] Figure 3 This is a structural block diagram of a network attack tracing device according to an embodiment of the present invention. Detailed Implementation

[0020] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0021] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0022] Example 1

[0023] According to an embodiment of the present invention, an embodiment of a network attack tracing method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0024] Figure 1 This is a flowchart of a network attack attribution method according to an embodiment of the present invention, such as... Figure 1As shown, the method includes the following steps:

[0025] S102, extract multiple potential attack events that occurred in the target network from the obtained log data of the target network;

[0026] This involves target networks, which are the networks / systems to be detected for network attack detection and source tracing analysis, such as enterprise intranets, industrial control networks, and cloud service platforms.

[0027] This includes log data, which is a record file generated by device operation, program operation, network access, system call and other behaviors in the target network. It completely preserves information such as the subject, behavior, time and traffic of various operations in the network.

[0028] This includes potential attack events, which are initially selected from the target network log data and have the potential to be used for network attacks.

[0029] S104, identify multiple targets for operation from multiple candidate attack events;

[0030] This involves multiple operation objects, which are entities that participate in various operations in the corresponding operation events, such as processes, files, and scripts, and are used to represent the participating subjects and objects in the corresponding operation events.

[0031] S106, determine the reverse dependency and forward dependency between multiple operation objects, wherein the reverse dependency represents the operation dependency between two corresponding operation objects in the operation causal backtracking order, and the forward dependency represents the operation dependency between two corresponding operation objects in the operation causal occurrence order;

[0032] This involves positive dependencies, which represent the operational dependencies between two corresponding operation objects in the order of their causal occurrence. It describes the relationship between operation objects in the order of their causal occurrence, from cause to effect. For example, a process reading a file can be used to reconstruct the complete process of an attack occurring and spreading sequentially.

[0033] This involves reverse dependencies, which are the relationships between operational objects obtained according to the causal backtracking order of source tracing analysis (from effect to cause), such as a file being read exclusively by a process, used to trace the source of the attack from the current attack behavior.

[0034] S108. Construct a reverse dependency graph with multiple operation objects as the first node and the reverse dependency relationship between multiple operation objects as the first edge. Construct a forward dependency graph with multiple operation objects as the second node and the forward dependency relationship between multiple operation objects as the second edge.

[0035] This involves the first node, which is the node used when constructing the reverse dependency graph. It is an abstract representation of the corresponding operation object and represents the entity participating in network behavior.

[0036] This involves the first edge, which is the directed connection used when constructing the reverse dependency graph. It represents the corresponding reverse dependency relationship and is used to reflect the causal backtracking logic between entities (nodes).

[0037] This involves a reverse dependency graph, which is a topology graph constructed with multiple operation objects as the first node and the reverse dependency relationships between the multiple operation objects as the first edge. It is used to reverse trace the source and link of network attacks.

[0038] This involves a second node, which is used when constructing the positive dependency graph. It is an abstract representation of the corresponding operation object and represents the entity participating in network behavior.

[0039] This involves a second side, which is a directed connection used when constructing a positive dependency graph. It represents the corresponding positive dependency relationship and is used to reflect the causal relationship between entities.

[0040] This involves a forward dependency graph, which is a topology graph constructed with multiple operation objects as second nodes and the forward dependencies between multiple operation objects as second edges. It is used to reconstruct the occurrence and spread of network attacks in a forward manner.

[0041] S110, take the intersection between the reverse dependency graph and the forward dependency graph to obtain the target dependency graph;

[0042] This involves a target dependency graph, which is a topological graph obtained by finding the intersection of two dependency graphs.

[0043] S112, based on the target dependency graph, performs network attack attribution.

[0044] This involves network attack attribution, which is a process of analyzing network attack operations based on target dependency graphs (including finding the source of the attack, reconstructing the attack path, and determining the attack account identifier or entry point) to fully reconstruct the entire network attack process.

[0045] Through steps S102-S112 above, by extracting candidate attack events and identifying the targets from the target network's log data, the original logs can be transformed into a semantically meaningful set of entities. By determining the reverse dependencies (in causal backtracking order) and forward dependencies (in causal occurrence order) between the targets, bidirectional dependency graphs can be constructed for tracing the attack source and tracking the attack spread. By taking the intersection of the reverse dependency graph and the forward dependency graph to obtain the target dependency graph, irrelevant causal edges that only hold in a single direction can be filtered out, retaining the core paths that can both trace back to the source and explain the attack consequences. Attack tracing based on this target dependency graph ensures that the tracing results focus on the key attack chain, avoiding causal explosion and path redundancy problems, thereby improving the accuracy of network attack tracing and solving the technical problem of inaccurate network attack tracing in related technologies.

[0046] As an optional embodiment, a reverse dependency graph is constructed using multiple operation objects as first nodes and the reverse dependencies between multiple operation objects as first edges. This includes: constructing an initial reverse graph using multiple operation objects as first nodes and the reverse dependencies between multiple operation objects as first edges; performing an edge merging operation on the initial reverse graph to obtain the reverse dependency graph, wherein the edge merging operation includes any of the following: if there is only one first edge between corresponding two first nodes among the multiple first nodes, the first edge is used as the edge between the corresponding two first nodes; if there are multiple first edges between corresponding two first nodes among the multiple first nodes, the operation time interval between the operation behaviors corresponding to the multiple first edges is determined; and first edges with operation time intervals less than an interval threshold are merged into one edge.

[0047] This involves the initial reverse graph, which is the original topology graph directly constructed from the first node and the first edge, without any optimization processing, and contains all original reverse dependency associations.

[0048] This involves an edge merging operation, which merges multiple edges of the same type between the same pair of nodes to alleviate the dependency explosion problem.

[0049] This involves the operation time interval, which is the time difference between the operations corresponding to multiple edges between the same pair of nodes, and is the basis for determining whether to merge the connections.

[0050] This involves an interval threshold, which is a pre-set time criterion used to distinguish between continuous dense operations and independent scattered operations, serving as a condition for edge merging.

[0051] For example, when copying a 100MB file, the operating system will not copy the entire 100MB at once, but will divide it into thousands of small read / write operations (each a few KB). Thousands of parallel edges will appear between two nodes (the same process repeatedly reads and writes the same file), making the graph extremely large. This results in slow analysis, large storage requirements, and even memory overflow (i.e., the dependency explosion problem). To address this, an interval threshold, such as 1 second, is set to merge multiple edges of the same type between the same pair of nodes within 1 second into a single logical edge. The amount of data transferred each time is then added up to obtain the total transfer amount.

[0052] By first constructing an initial reverse graph with all nodes and reverse dependent edges, all original causal relationships can be fully preserved. Subsequently, a merging operation is performed on multiple edges between the same pair of nodes, merging edges with operation intervals less than a threshold into a single edge. This compresses parallel edges generated by fragmented calls from the operating system into logical edges, avoiding graph size explosion, thereby reducing the computational complexity of subsequent analysis while preserving key dependency information.

[0053] As an optional embodiment, an edge merging operation is performed on the initial reverse graph to obtain a reverse dependency graph, including: performing an edge merging operation on the initial reverse graph to obtain a merged dependency graph, wherein the merged dependency graph includes multiple third edges, wherein the multiple third edges are edges obtained after performing an edge merging operation on multiple first edges in the initial reverse graph; clustering the multiple third edges based on the edge features corresponding to each of the multiple third edges to obtain multiple fourth edges, wherein the multiple fourth edges are first nodes whose abnormal correlation index is greater than or equal to the abnormal correlation threshold, and the abnormal correlation index represents the degree of correlation between the operation event corresponding to the corresponding third edge and the target attack event; and constructing a reverse dependency graph based on the multiple fourth edges and the multiple fourth nodes, wherein the multiple fourth nodes are first nodes in the merged dependency graph that correspond to each of the multiple fourth edges.

[0054] This involves merging dependency graphs, which are topological graphs formed after the initial reverse graph completes edge merging operations, achieving graph size compression while preserving key causal logic.

[0055] This involves a third edge, which is a directed edge in the merged dependency graph used to represent the reverse dependency relationship between nodes.

[0056] This involves edge features, which are the attribute data of the merged edges, serving as the basis for cluster analysis.

[0057] This involves clustering, which is the process of classifying edges into different categories based on edge features.

[0058] This includes an anomaly correlation index, which measures the degree of correlation between the operation events corresponding to the edges in the merged dependency graph and the target attack events. The target attack events can be represented using a predefined attack event library.

[0059] This involves an abnormal association threshold, which is a pre-set judgment standard value used to filter edges that are highly associated with attack events. Its main function is to distinguish the boundary between retained edges and discarded edges.

[0060] This involves a fourth side, which is the third side after clustering screening, whose abnormal association index is not lower than the abnormal association threshold.

[0061] This involves a fourth node, which is the first node in the merge dependency graph that matches the fourth edge.

[0062] By performing edge merging operations on the initial reverse graph to generate a merged dependency graph with a third edge, the original topology can be simplified first. Then, clustering can be carried out based on the edge features of the third edge, and the fourth edge can be selected by combining the abnormal correlation index and the abnormal correlation threshold. This can eliminate redundant connections with low correlation. Finally, the reverse dependency graph can be built using the fourth edge and the corresponding fourth node, which can retain high-value attack correlation links and improve the accuracy of subsequent source tracing analysis.

[0063] As an optional embodiment, a reverse dependency graph is constructed based on multiple fourth edges and multiple fourth nodes, including: constructing a filtering dependency graph based on multiple fourth edges and multiple fourth nodes; determining the reverse dependency chains corresponding to the multiple fourth nodes based on the multiple fourth nodes and multiple fourth edges in the filtering dependency graph, wherein the reverse dependency chain includes at least one associated node, and the associated node is connected to other fourth nodes through at least one fourth edge; determining the node weights corresponding to the multiple fourth nodes based on the edge features corresponding to the multiple fourth edges and the reverse dependency chains corresponding to the multiple fourth nodes; and constructing the reverse dependency graph based on the node weights corresponding to the multiple fourth nodes and the filtering dependency graph.

[0064] This involves a filtering dependency graph, which is a graph with the fourth node as the vertex and the fourth edge as the directed edge. The filtering dependency graph includes the high-abnormal correlation edges retained after clustering and the operation object nodes they connect.

[0065] This involves a reverse dependency chain, which is a link formed by tracing back along the reverse dependency direction (from result to cause) starting from the corresponding fourth node (that is, the complete path that traces back upstream to the potential attack entry point), and is used to reflect the dependency relationship between nodes by tracing back layer by layer.

[0066] This involves associated nodes, which are other fourth nodes connected to the corresponding fourth node through at least one fourth edge, including the upstream node (cause node) of the corresponding fourth node. For example, the associated node includes the parent process that started the current process. Its main function is to expand the coverage of the reverse dependency chain and ensure that the calculation of node weights can comprehensively consider the local topology.

[0067] This involves node weights, which are used to characterize the importance of the corresponding node in attack attribution.

[0068] By constructing a dependency graph, edges and nodes with high anomaly associations can be retained as the basis for analysis. Based on this graph, the reverse dependency chains corresponding to each node can be determined, connecting scattered nodes into a complete upstream tracing path. Combining edge features and reverse dependency chains to calculate node weights allows for the quantification of the importance of each node in the causal chain. Constructing a reverse dependency graph based on node weights ensures that high-scoring nodes (i.e., key upstream nodes) stand out in the graph structure, thus focusing on the core tracing path.

[0069] As an optional embodiment, the edge features include: time-related features, data flow-related features, topological-related features, and anomaly-related features, wherein: the time-related features characterize the correlation between the occurrence time of the operation event corresponding to the corresponding third edge and the occurrence time of the reference attack event, wherein the reference attack event is the source event of the operation event; the data flow-related features characterize the correlation between the data flow of the operation event corresponding to the corresponding third edge and the data flow of the target attack event; the topological-related features characterize the importance of the topological structure of the corresponding third edge; and the anomaly-related features characterize the degree of correlation between the operation event corresponding to the corresponding third edge and historical attack events.

[0070] This involves historical attack events, which are records of various network attack behaviors captured and retained in the past. These can be used as target attack events, that is, attack events in a predetermined attack event database, as a reference for anomaly judgment.

[0071] By defining temporal correlation features, we can quantify the proximity of operational events to reference attack events in terms of occurrence time, ensuring that edges closer to anomalies in the temporal dimension receive higher attention. By defining data flow correlation features, we can assess the matching degree between the data flow of operational events and the traffic scale of target attack events, ensuring that edges whose data volume characteristics match attack characteristics receive higher weight. By defining topological correlation features, we can measure the structural importance of nodes connected by third edges in the graph, ensuring that edges in critical positions are effectively identified. By defining anomaly correlation features, we can correlate and match operational events with historical attack records, ensuring that edges with known attack characteristics receive higher anomaly scores. Therefore, combining these four dimensions of features allows for a comprehensive characterization of the operational time characteristics corresponding to edges, providing a reliable data foundation for subsequent analysis.

[0072] As an optional embodiment, the target dependency graph is obtained by taking the intersection between the reverse dependency graph and the forward dependency graph, including: taking the intersection between the reverse dependency graph and the forward dependency graph to obtain a common dependency graph; identifying redundant edges from the common dependency graph, wherein the redundant edges are edges in the common dependency graph whose corresponding operation events are non-attack events in a predetermined non-attack event library; and deleting the redundant edges and the isolated nodes corresponding to the redundant edges from the common dependency graph to obtain the target dependency graph.

[0073] This involves a shared dependency graph, which is a topological graph obtained by finding the intersection of the reverse dependency graph and the forward dependency graph, and retains all the nodes and connections shared by the two graphs.

[0074] This involves redundant edges, which are edges in the shared dependency graph that need to be removed. The operation events corresponding to these redundant edges belong to normal system activities in the predefined non-attack event library. In other words, the lines in the shared dependency graph whose corresponding operation events belong to normal events are used as objects to be removed for noise filtering.

[0075] This involves a non-attack event database, which is a pre-built database that stores the characteristics of normal system activity events. For example, the pre-built non-attack event database includes records of normal operating system process behavior, benign system service call patterns, and allowed file access records. Its main function is to serve as a reference for determining redundant edges.

[0076] This involves isolated nodes, which are nodes that are no longer connected to any edge after redundant edges have been removed.

[0077] By generating a shared dependency graph through the intersection of the reverse dependency graph and the forward dependency graph, we can filter out the links where both bidirectional causality is valid. By identifying redundant edges in the shared dependency graph based on a non-attack event database, we can accurately distinguish the connections corresponding to normal operations. By deleting redundant edges and their corresponding isolated nodes, we can further simplify the topology structure, ensuring that the final target dependency graph retains only valid attack links, thus improving the efficiency and accuracy of source tracing analysis.

[0078] As an optional embodiment, multiple candidate attack events occurring in the target network are extracted from the acquired log data of the target network, including: extracting multiple candidate operation events occurring in the target network from the log data; determining the anomaly probability value corresponding to each of the multiple candidate operation events, wherein the anomaly probability value represents the probability that the corresponding candidate operation event is a target attack event; and determining multiple candidate attack events from the multiple candidate operation events based on the anomaly probability values ​​corresponding to each of the multiple candidate operation events, wherein the multiple candidate attack events are candidate operation events whose corresponding anomaly probability values ​​are greater than an anomaly probability threshold.

[0079] This includes candidate operation events, which are all network operation behaviors initially extracted from log data, including normal behavior and suspected attack behavior.

[0080] This includes an anomaly probability value, which is a quantified value used to indicate the likelihood that a single candidate operation event belongs to the target attack event (such as belonging to a predetermined attack event set / library).

[0081] This involves an anomaly probability threshold, which is a pre-set judgment standard used to distinguish between normal operations and suspected attack operations.

[0082] By extracting candidate operation events from log data and calculating the anomaly probability value corresponding to each event, the raw logs can be transformed into quantifiable indicators of suspiciousness. Based on an anomaly probability threshold, candidate attack events exceeding the threshold can be filtered out from massive operations, thus narrowing the target scope of subsequent source tracing analysis and reducing computational load.

[0083] Based on the above embodiments and optional embodiments, an optional implementation method is provided, which is described in detail below.

[0084] In the field of network security protection, when a network attack occurs, it is necessary to trace the source of the network attack in order to respond to and deal with the network attack effectively. However, in the relevant technologies, there is a technical problem of inaccurate network attack tracing.

[0085] There is currently no effective solution to the above problems.

[0086] In view of this, an optional embodiment of the present invention provides a network attack tracing method, which can effectively solve the above-mentioned technical problems.

[0087] S1, extract multiple potential attack events that occurred in the target network from the obtained log data of the target network;

[0088] Specifically, from the acquired log data of the target network, multiple candidate attack events occurring in the target network are extracted, including: extracting multiple candidate operation events occurring in the target network from the log data; determining the anomaly probability value corresponding to each of the multiple candidate operation events, wherein the anomaly probability value represents the probability that the corresponding candidate operation event is a target attack event (that is, the probability that the corresponding candidate operation event belongs to the attack operation library); based on the anomaly probability values ​​corresponding to each of the multiple candidate operation events, determining multiple candidate attack events from the multiple candidate operation events, wherein the multiple candidate attack events are candidate operation events whose corresponding anomaly probability values ​​are greater than the anomaly probability threshold.

[0089] For example, a dynamically updated attack operation library (used to store various target attack events) is constructed, which transforms various target attack events into machine-readable "subject-predicate-object" triple structures that can describe behavioral logic such as "network attackers scan browser configuration files through scripts". This representation method greatly improves the recognition rate of network attack variants, enabling the identification of similar attacks through behavioral characteristics even when the specific identifiers change.

[0090] When processing real-time system audit logs (i.e., log data), semantic enhancement techniques are introduced to bridge the semantic gap between low-level kernel logs and high-level intelligence. Specifically, the system audit logs are preprocessed, mapping specific system paths to semantic tags and expanding abbreviated system calls into natural language actions. Subsequently, a pre-trained semantic-aware embedding model is used to transform the enhanced system events and triple structures in the knowledge base into high-dimensional numerical vectors. By calculating the cosine similarity between these vectors, "fuzzy event matching" can be achieved, that is, identifying attack operations that are semantically similar but whose texts are not entirely consistent.

[0091] Specifically, this refers to each candidate operation event captured in the system audit log (i.e., log data). (in, As the main body, As an object, For operation, (This is done over time). Determine the anomaly probability values ​​(which can be represented by initial anomaly scores) corresponding to each of the multiple candidate operation events. The formula is:

[0092]

[0093] in, , , These are the weighting coefficients; For candidate operation events The degree of matching with the target attack event; For candidate operation events The degree of matching between the operation mode and the attack mode; For candidate operation events Based on the degree of anomaly at the baseline (such as rare process startup); For candidate operation events The probability value of anomalies. Among them, the degree of anomaly based on the baseline is used to determine the candidate operation events. The degree of deviation compared to a pre-established operational baseline.

[0094] For a match with the target attack event: if or Attributes such as Internet Protocol (IP) and filenames that indicate a target attack event, i.e., that it exists in the attack operation database, will be assigned a high score.

[0095] For matching attack patterns, if the operation pattern matches a known attack pattern, a medium to high score is assigned.

[0096] Setting a threshold for tracing the seed node set Select all that satisfy The candidate operation events constitute multiple candidate attack events, which are also known as the source tracing seed node set. This set of seed nodes allows the tracing process to be driven by a set of high-confidence "surfaces" rather than relying on a single "point".

[0097] S2 identifies multiple targets for operation from a variety of potential attack events;

[0098] S3, determine the reverse dependency and forward dependency between multiple operation objects, where the reverse dependency represents the operation dependency between the two corresponding operation objects in the operation causal backtracking order, and the forward dependency represents the operation dependency between the two corresponding operation objects in the operation causal occurrence order;

[0099] S4. Construct a reverse dependency graph with multiple operation objects as the first node and the reverse dependency relationship between multiple operation objects as the first edge. Construct a forward dependency graph with multiple operation objects as the second node and the forward dependency relationship between multiple operation objects as the second edge.

[0100] Specifically, a reverse dependency graph is constructed using multiple operation objects as first nodes and the reverse dependencies between multiple operation objects as first edges. This includes: constructing an initial reverse graph using multiple operation objects as first nodes and the reverse dependencies between multiple operation objects as first edges; performing an edge merging operation on the initial reverse graph to obtain the reverse dependency graph, wherein the edge merging operation includes any of the following: when there is only one first edge between corresponding two first nodes among the multiple first nodes, the first edge is used as the edge between the corresponding two first nodes; when there are multiple first edges between corresponding two first nodes among the multiple first nodes, the operation time interval between the operation behaviors corresponding to the multiple first edges is determined; and first edges whose operation time interval is less than the interval threshold are merged into one edge.

[0101] For example, after obtaining the set of source-tracing seed nodes selected in the previous stage... Then, the dependency graph construction and feature quantization process officially commenced. First, the system sequentially... Starting with each abnormal event in descending order of its anomaly score, reverse causal analysis is used to recursively retrieve entities and interactions with causal relationships from massive system audit logs, thereby constructing the original dependency graph (i.e., the initial reverse graph). .

[0102] In this initial reverse graph, nodes Representing the core entities (i.e., operational events) in the system, this includes processes that execute instructions, files that serve as storage media, and network connections that establish remote interactions. This accurately depicts the dynamic interactions between entities, such as a process reading a file, spawning a child process, or sending data through a programming interface, with the direction of the edges strictly following the data flow (from the subject to the object).

[0103] To mitigate the "dependency explosion" problem caused by the operating system breaking down large input / output (I / O) tasks into multiple fragmented system calls, edge merging is performed in advance (i.e., edge merging is performed on the initial reverse graph). By setting a time threshold, parallel edges that occur consecutively between two nodes within a short period are merged into a single logical edge, and the data transfer volume is accumulated. This significantly compresses the initial size of the graph while preserving critical logic. Specifically, when there are multiple first edges between corresponding first nodes, the operation time interval between the operations corresponding to the multiple first edges is determined; first edges with operation time intervals less than the interval threshold are merged into a single edge, and the data transfer volume corresponding to the multiple first edges is accumulated.

[0104] Specifically, an edge merging operation is performed on the initial reverse graph to obtain a reverse dependency graph, including: performing an edge merging operation on the initial reverse graph to obtain a merged dependency graph, wherein the merged dependency graph includes multiple third edges, wherein the multiple third edges are edges obtained after performing an edge merging operation on multiple first edges in the initial reverse graph; based on the edge features corresponding to the multiple third edges, the multiple third edges are clustered to obtain multiple fourth edges, wherein the multiple fourth edges are first nodes whose abnormal correlation index is greater than or equal to the abnormal correlation threshold, and the abnormal correlation index represents the degree of correlation between the operation event corresponding to the corresponding third edge and the target attack event; based on the multiple fourth edges and the multiple fourth nodes, a reverse dependency graph is constructed, wherein the multiple fourth nodes are first nodes in the merged dependency graph corresponding to the multiple fourth edges respectively.

[0105] Specifically, edge features include: time-related features. Data flow correlation characteristics Topological association features Abnormal correlation features .

[0106] For example, the feature vector of edge features The representation is as follows:

[0107]

[0108] Based on the above, after generating a compact original dependency graph (i.e., a merged dependency graph), the core multidimensional feature extraction step is performed, which extracts features from each edge in the merged dependency graph. Construct a feature vector that can reflect the relevance of its attack. .

[0109] in:

[0110] Time-related features (i.e., time-dependent features) The correlation between the occurrence time of the operation event corresponding to the third side and the occurrence time of the reference attack event is represented by the following formula:

[0111]

[0112] in, For operation events (i.e., edge) The occurrence time of the corresponding operation event; For reference, the time of the attack occurred; It is a constant, specifically a very small positive number, used to handle operation events. This is a special case for tracing the seed node event—in which case the characteristic value of the operation event is the highest.

[0113] Based on the above formula, the edge is reflected The degree of proximity between the time of the corresponding operation event and the time of the source seed node event (i.e., the reference attack event).

[0114] Data flow correlation features (also known as data flow relevance features) characterize the correlation between the data flow of the corresponding third-side operation event and the data flow of the target attack event. The formula is:

[0115]

[0116] in, For the edge The corresponding data flow of the operation event; Data traffic for the targeted attack event; It is a constant, specifically a very small positive number.

[0117] Based on the above reflection edge The similarity between the amount of data involved in the corresponding operation event and the size of the attack target (such as the stolen file).

[0118] Topological association features characterize the topological importance of the corresponding third edge, as shown in the formula:

[0119]

[0120] in, For the edge The out-degree of the corresponding node v; For the edge The in-degree of the corresponding node v.

[0121] Based on the above, the structural importance of the nodes in the graph is reflected.

[0122] Anomaly correlation features are the degree of correlation between the corresponding operation event on the third side and historical attack events, and the formula is:

[0123]

[0124] in, For the edge The anomaly probability value of the corresponding node u; For the edge The anomaly probability value of the corresponding node v.

[0125] Based on the above, the anomaly score (i.e., the anomaly probability value) is propagated to the edges.

[0126] Then, clustering is performed on multiple third edges to obtain multiple fourth edges, including:

[0127] edge features The weights are fused into a single edge weight using a mathematical model, and this weight is used to calculate the influence contribution of all network nodes on the attack event. To avoid the reliance on manual weight setting by traditional methods, a clustering algorithm is first used to perform unsupervised classification of the feature vectors of all edges in the graph.

[0128] Clustering algorithms divide edges into a set of potential key edges (i.e., multiple fourth edges). (typically, the eigenvalues ​​are high and the number of eigenvalues ​​is small) and the set of noisy edges ( (This corresponds to a massive amount of normal system activity).

[0129] Specifically, based on multiple fourth edges and multiple fourth nodes, a reverse dependency graph is constructed, including: constructing a filtering dependency graph based on multiple fourth edges and multiple fourth nodes; determining the reverse dependency chains corresponding to multiple fourth nodes based on multiple fourth nodes and multiple fourth edges in the filtering dependency graph, wherein each reverse dependency chain includes at least one associated node, and the associated node is connected to other fourth nodes through at least one fourth edge; determining the node weights corresponding to multiple fourth nodes based on the edge features corresponding to the multiple fourth edges and the reverse dependency chains corresponding to the multiple fourth nodes; and constructing the reverse dependency graph based on the node weights corresponding to the multiple fourth nodes and the filtering dependency graph.

[0130] For example, linear discriminant analysis is introduced to find the optimal projection vector. To maximize the separation of the two types of edges after projection, the optimal projection vector is obtained by solving the problem. .

[0131] The original weight of each edge (i.e., each fourth edge) is:

[0132]

[0133] in, Let e ​​be the original weight of edge e; For weight vector (optimal projection vector); Let e ​​be the edge feature; The weights of the time-related features (i.e., the corresponding optimal projection coefficients). The weights of the data flow association features (i.e., the corresponding optimal projection coefficients); The weights of the topological association features (i.e., the corresponding optimal projection coefficients). The weights of the abnormal correlation features (i.e., the corresponding optimal projection coefficients); It is a time-related feature; For data stream correlation features; It is a topological association feature; This is an abnormal association feature.

[0134] If the mean of the critical class after projection is less than that of the noise class, then for Invert the values ​​to ensure that the critical edge has a higher weight.

[0135] After obtaining the original weights, local weight normalization is performed to address the potential attenuation of global weights during long-path propagation.

[0136] For any node Normalization is performed based on the sum of the weights of all its outgoing edges, i.e.:

[0137]

[0138] in, These are the original weights after normalization; For nodes and nodes The original weights of the edges between them; For nodes Other nodes corresponding to all edges (e.g., all outgoing edges) (including nodes) A set of ) For nodes The sum of the original weights of all corresponding edges.

[0139] By normalizing, it is ensured that the influence score will not expand indefinitely during the transmission process, nor will it be lost prematurely on the path far from the source seed node.

[0140] Specifically, based on multiple fourth nodes and multiple fourth edges in the filtering dependency graph, the reverse dependency chains corresponding to the multiple fourth nodes are determined, wherein each reverse dependency chain includes at least one associated node, and the associated node is connected to other fourth nodes through at least one fourth edge; based on the edge features corresponding to the multiple fourth edges and the reverse dependency chains corresponding to the multiple fourth nodes, the node weights corresponding to the multiple fourth nodes are determined; based on the node weights corresponding to the multiple fourth nodes and the filtering dependency graph, the reverse dependency graph is constructed.

[0141] For example, based on multiple fourth nodes and multiple fourth edges in the filtering dependency graph, the reverse dependency chains corresponding to the multiple fourth nodes are determined. The reverse dependency chains are the links in the filtering dependency graph obtained by tracing the corresponding nodes (i.e., the corresponding fourth nodes).

[0142] Based on the edge features corresponding to multiple fourth edges and the reverse dependency chains corresponding to multiple fourth nodes, the node weights corresponding to multiple fourth nodes are determined. The formula is:

[0143]

[0144] in, For nodes The node weight (i.e., influence score) represents the degree of causal contribution of the node to the reverse dependency chain (specifically, the set of source seed nodes); For nodes The node weight (i.e., influence score); These are the original weights after normalization.

[0145] Based on the above formula, the influence score of each node on the set of source seed nodes is obtained through iteration. During initialization, The score of a node in the algorithm is set to 1.0, and the scores of all other nodes are set to 0. This process continues to iterate until convergence. Table 1 is a schematic table of the backpropagation algorithm based on influence. As shown in Table 1, the nodes at the source of the critical attack path accumulate higher scores, which can retain the scores on the long-range causal path, until the influence scores of all nodes reach a stable convergence state.

[0146] Table 1

[0147]

[0148] S5, take the intersection between the reverse dependency graph and the forward dependency graph to obtain the target dependency graph;

[0149] Specifically, the target dependency graph is obtained by taking the intersection between the reverse dependency graph and the forward dependency graph, including: taking the intersection between the reverse dependency graph and the forward dependency graph to obtain a common dependency graph; identifying redundant edges from the common dependency graph, wherein the redundant edges are edges in the common dependency graph whose corresponding operation events are non-attack events in a predetermined non-attack event library; and deleting the redundant edges and the isolated nodes corresponding to the redundant edges from the common dependency graph to obtain the target dependency graph.

[0150] For example, the forward dependency graph can be determined after the reverse dependency graph is constructed, based on the node weights corresponding to the reverse dependency graph. The nodes in the reverse dependency graph are sorted, and the top N (Top-N) high-scoring nodes are selected as the entry points for inferring attacks (such as network connection start points or process initiation points) to construct a forward dependency graph. Specifically, forward causal analysis is performed starting from the Top-N entry points. This forward analysis aims to trace the spread of the attack payload within the system, record all subsequent behaviors triggered from the entry points, and construct a forward dependency graph. .

[0151] Furthermore, by calculating the reverse dependency graph With positive dependency graph The intersection of these elements can precisely pinpoint the core component diagrams that can both trace back to the source of the attack and logically explain its consequences. The formula is:

[0152]

[0153] in, This is a shared dependency graph.

[0154] After performing structured pruning by taking the intersection, a multi-dimensional semantic noise filtering mechanism is further introduced to solve the problem of redundant underlying system activities in traditional source graphs and improve analysis efficiency.

[0155] First, implement global high-frequency filtering to remove requests whose access frequency across the entire network exceeds a threshold. Furthermore, the nodes were not marked as abnormal files or configurations in the attack event database. Secondly, a predefined event list (including multiple allowed execution processes) was used to filter out background edges caused by benign auxiliary system processes, unless the edge exhibited significant anomalous characteristics.

[0156] In addition, to enhance the readability of the graph, path compression was performed, merging long causal chains without branches, other interactions, and semantic state transitions into a single step (e.g., A1->B1->C1->D1 compressed into A1->D1), transforming the tracing results from the low-level "system call sequence" to the high-level "action flow" to simplify the graph structure.

[0157] Based on the above, by using the techniques of "bidirectional constraint" and "semantic pruning", a concise, intuitive and highly interpretable key attack subgraph, namely the target dependency graph, is extracted from the complex causal network.

[0158] S6, based on the target dependency graph, performs network attack attribution.

[0159] The following is a further description based on the steps described above.

[0160] Figure 2 This is a schematic diagram of a network attack attribution architecture in an optional embodiment of the present invention, such as... Figure 2As shown, a collaborative deployment architecture of "edge awareness and cloud decision-making" is adopted to achieve real-time processing and in-depth analysis of massive audit data (i.e., log data) through distributed deployment. Specifically, the audit data collection and preprocessing module is deployed on various key host entities at the edge, such as servers, workstations, and key business terminals. These edge probes operate in a low-power mode, continuously detecting and recording the interaction behavior, call sequences, and resource access status between the subject and object. Here, preliminary semantic enhancement and data aggregation are performed, transforming fragmented underlying logs into standardized events with basic semantic information, and caching frequently occurring benign behavior fingerprints locally to ensure that only key feature data is excluded, thereby reducing network bandwidth pressure.

[0161] The preprocessed feature data is securely transmitted to a security analysis platform located at a central node. This platform aggregates heterogeneous audit data from edge nodes across the entire network and centrally runs an intelligence-driven anomaly scoring module, a causal graph construction module, and a multi-dimensional feature fusion algorithm. This deployment model places computationally intensive graph analysis tasks and large-scale influence propagation operations in a centralized environment with elastically scalable resources, effectively overcoming the bottleneck of uneven computing power on front-end devices and achieving real-time, centralized intelligent attribution of long-term, cross-host attacks in complex network environments. The specific steps are as follows:

[0162] St1: Anomaly Scoring and Input Construction:

[0163] Intelligence is transformed into machine-readable triples to construct a dynamically pre-defined attack event database (i.e., an anomaly event database). By semantic enhancement and embedding models, the fuzzy matching degree between logs and intelligence is calculated. Combined with behavioral patterns and statistical anomalies, a set of high-confidence anomaly events is selected, realizing the transformation from "single-point driven" to "multi-dimensional driven".

[0164] St2: Dependency Graph Generation and Feature Extraction

[0165] We construct the original dependency graph using reverse causal analysis and extract four-dimensional features—time, data flow, topological concentration, and anomaly score—for interaction edges to provide a data foundation for accurate weighting.

[0166] St3: Weight Fusion and Influence Propagation: Utilizing clustering and linear discriminant analysis to calculate the optimal projection vector, it automatically fuses multi-dimensional features into edge weights, eliminating reliance on manual experience. It prioritizes potential attack sources by backpropagating anomalous influence.

[0167] St4: Two-way analysis and noise filtering:

[0168] Top-N high-scoring nodes are selected for forward causal analysis, and structured pruning is performed by calculating the intersection of forward and reverse graphs. Finally, a multi-dimensional semantic filter is applied to remove low-level noise, outputting a concise and highly interpretable attack tracing graph.

[0169] The above optional implementation methods can achieve at least the following beneficial effects:

[0170] (1) Compared with related technologies, this invention extracts candidate attack events from the log data of the target network and determines the operation objects, thereby transforming the original logs into a semantic set of entities. By determining the reverse dependency relationship (in causal backtracking order) and the forward dependency relationship (in causal occurrence order) between the operation objects, bidirectional dependency graphs for tracing the attack source and tracking the attack spread can be constructed respectively. By taking the intersection of the reverse dependency graph and the forward dependency graph to obtain the target dependency graph, irrelevant causal edges that are only valid in a single direction can be filtered out, retaining the core path that can both trace back to the source and explain the attack consequences. Attack tracing based on this target dependency graph can ensure that the tracing results focus on the key attack chain, avoid causal explosion and path redundancy problems, thereby improving the accuracy of network attack tracing, and thus solving the technical problem of inaccurate network attack tracing in related technologies.

[0171] (2) Compared with related technologies, this invention incorporates “anomaly score” as an independent feature dimension into the weight calculation. This makes it no longer necessary to rely solely on topology or temporal coincidence to determine importance. For attacks that are highly disguised (long time span, small data volume) but cross security red lines (such as accessing sensitive files, hitting threat intelligence), it can assign them higher propagation weight, thereby significantly reducing the false negative rate.

[0172] (3) Compared with related technologies, this invention introduces the construction of an abnormal event set. Even if an attack point is missed, it can be automatically compensated by other high-scoring events in the set, ensuring that the starting point of tracing covers multiple links of the attack chain and avoiding single point failure.

[0173] (4) Compared with related technologies, this invention solves the problem of traditional causal analysis graphs being "containing a lot of system-irrelevant information even though they contain attack paths" by introducing a final semantic noise filtering module. The filtered graph nodes are more concise and help to focus on attack operations, greatly reducing the burden of subsequent review.

[0174] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0175] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0176] Example 2

[0177] According to embodiments of the present invention, an apparatus for implementing the above-described network attack tracing method is also provided. Figure 3 This is a structural block diagram of a network attack tracing device according to an embodiment of the present invention, such as... Figure 3 As shown, the device includes: a first determining module 302, a second determining module 304, a third determining module 306, a fourth determining module 308, a fifth determining module 310, and a sixth determining module 312. The device will be described in detail below.

[0178] The first determining module 302 is used to extract multiple candidate attack events that have occurred in the target network from the log data of the acquired target network;

[0179] The second determining module 304 is connected to the first determining module 302 and is used to determine multiple operation objects from multiple candidate attack events;

[0180] The third determining module 306, connected to the second determining module 304, is used to determine the reverse dependency and forward dependency between multiple operation objects. The reverse dependency represents the operation dependency between two corresponding operation objects in the operation causal backtracking order, and the forward dependency represents the operation dependency between two corresponding operation objects in the operation causal occurrence order.

[0181] The fourth determining module 308, connected to the third determining module 306, is used to construct a reverse dependency graph with multiple operation objects as first nodes and the reverse dependency relationship between multiple operation objects as first sides, and to construct a forward dependency graph with multiple operation objects as second nodes and the forward dependency relationship between multiple operation objects as second sides.

[0182] The fifth determining module 310, connected to the fourth determining module 308, is used to obtain the target dependency graph by taking the intersection between the reverse dependency graph and the forward dependency graph.

[0183] The sixth determining module 312, connected to the fifth determining module 310, is used to perform network attack tracing based on the target dependency graph.

[0184] It should be noted that the first determining module 302, the second determining module 304, the third determining module 306, the fourth determining module 308, the fifth determining module 310, and the sixth determining module 312 mentioned above correspond to steps S102 to S112 in the network attack tracing method. The instances and application scenarios implemented by multiple modules and corresponding steps are the same, but are not limited to the content disclosed in the above embodiment 1.

[0185] Example 3

[0186] According to another aspect of the present invention, an electronic device is also provided, comprising: a processor; and a memory for storing processor-executable instructions, wherein the processor is configured to execute instructions to implement the network attack tracing method described above.

[0187] Example 4

[0188] According to another aspect of the present invention, a computer-readable storage medium is also provided, which, when the instructions in the computer-readable storage medium are executed by a processor of an electronic device, enables the electronic device to perform any of the network attack tracing methods described above.

[0189] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0190] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0191] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0192] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0193] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0194] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0195] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for tracing the source of a network attack, characterized in that, include: From the acquired log data of the target network, extract multiple potential attack events that occurred in the target network; From the multiple candidate attack events, multiple targets for operation are identified; Determine the reverse dependency and forward dependency relationships among the multiple operation objects, wherein the reverse dependency relationship represents the operation dependency relationship between the two corresponding operation objects in the operation causal backtracking order, and the forward dependency relationship represents the operation dependency relationship between the two corresponding operation objects in the operation causal occurrence order; Using the plurality of operation objects as first nodes and the reverse dependency relationship between the plurality of operation objects as first edges, a reverse dependency graph is constructed; and using the plurality of operation objects as second nodes and the forward dependency relationship between the plurality of operation objects as second edges, a forward dependency graph is constructed. The target dependency graph is obtained by taking the intersection between the reverse dependency graph and the forward dependency graph; Based on the target dependency graph, network attack attribution is performed.

2. The method according to claim 1, characterized in that, The step of constructing a reverse dependency graph, using the plurality of operation objects as first nodes and the reverse dependencies between the plurality of operation objects as first edges, includes: An initial reverse graph is constructed using the plurality of operation objects as the first node and the reverse dependency relationship between the plurality of operation objects as the first edge. Perform an edge merging operation on the initial reverse graph to obtain a reverse dependency graph, wherein the edge merging operation includes any of the following: If there is only one first edge between two corresponding first nodes in a plurality of first nodes, then the first edge is taken as the edge between the two corresponding first nodes. When there are multiple first edges between two corresponding first nodes, determine the operation time interval between the operation behaviors corresponding to the multiple first edges; merge the first edges whose operation time interval is less than the interval threshold into one edge.

3. The method according to claim 2, characterized in that, The step of performing edge merging on the initial reverse graph to obtain a reverse dependency graph includes: An edge merging operation is performed on the initial reverse graph to obtain a merged dependency graph, wherein the merged dependency graph includes multiple third edges, and the multiple third edges are edges obtained by performing an edge merging operation on multiple first edges in the initial reverse graph; Based on the edge features corresponding to the multiple third edges, the multiple third edges are clustered to obtain multiple fourth edges. The multiple fourth edges are the first nodes whose abnormal correlation index is greater than or equal to the abnormal correlation threshold. The abnormal correlation index represents the degree of correlation between the operation event corresponding to the third edge and the target attack event. Based on the plurality of fourth edges and the plurality of fourth nodes, a reverse dependency graph is constructed, wherein the plurality of fourth nodes are the first nodes in the merged dependency graph that correspond to the plurality of fourth edges respectively.

4. The method according to claim 3, characterized in that, The construction of the reverse dependency graph based on the plurality of fourth edges and the plurality of fourth nodes includes: Based on the multiple fourth edges and multiple fourth nodes, a filtering dependency graph is constructed; Based on the multiple fourth nodes and multiple fourth edges in the filtering dependency graph, the reverse dependency chains corresponding to the multiple fourth nodes are determined respectively, wherein the reverse dependency chain includes at least one associated node, and the associated node is connected to other fourth nodes through at least one fourth edge. Based on the edge features corresponding to the plurality of fourth edges and the reverse dependency chains corresponding to the plurality of fourth nodes, the node weights corresponding to the plurality of fourth nodes are determined. Based on the node weights corresponding to the multiple fourth nodes, and by filtering the dependency graph, a reverse dependency graph is constructed.

5. The method according to claim 3, characterized in that, The edge features include: time-related features, data flow-related features, topological-related features, and anomaly-related features, wherein: The time correlation feature represents the correlation between the occurrence time of the operation event corresponding to the third side and the occurrence time of the reference attack event, wherein the reference attack event is the source event of the operation event; The data flow association feature represents the association between the data flow of the operation event corresponding to the third side and the data flow of the target attack event. The topological association feature represents the importance of the topological structure of the corresponding third edge; The abnormal correlation feature is the degree of correlation between the operation event corresponding to the third side and the historical attack event.

6. The method according to claim 1, characterized in that, The step of obtaining the target dependency graph by taking the intersection between the reverse dependency graph and the forward dependency graph includes: The intersection of the reverse dependency graph and the forward dependency graph is used to obtain the common dependency graph; From the shared dependency graph, redundant edges are identified, wherein the redundant edges are the edges in the shared dependency graph whose operation events are the corresponding non-attack events in the predetermined non-attack event library. From the shared dependency graph, the redundant edges and the isolated nodes corresponding to the redundant edges are deleted to obtain the target dependency graph.

7. The method according to any one of claims 1 to 6, characterized in that, The step of extracting multiple potential attack events occurring in the target network from the acquired log data of the target network includes: From the log data, extract multiple candidate operation events that occurred in the target network; Determine the anomaly probability value corresponding to each of the plurality of candidate operation events, wherein the anomaly probability value represents the probability that the corresponding candidate operation event is a target attack event; Based on the anomaly probability values ​​corresponding to the multiple candidate operation events, multiple candidate attack events are determined from the multiple candidate operation events, wherein the multiple candidate attack events are candidate operation events whose corresponding anomaly probability values ​​are greater than the anomaly probability threshold.

8. A network attack tracing device, characterized in that, include: The first determining module is used to extract multiple candidate attack events occurring in the target network from the acquired log data of the target network; The second determining module is used to determine multiple operation targets from the multiple candidate attack events; The third determining module is used to determine the reverse dependency and forward dependency among the multiple operation objects, wherein the reverse dependency represents the operation dependency of the two corresponding operation objects in the operation causal backtracking order, and the forward dependency represents the operation dependency of the two corresponding operation objects in the operation causal occurrence order. The fourth determining module is used to construct a reverse dependency graph with the plurality of operation objects as first nodes and the reverse dependency relationship between the plurality of operation objects as first edges, and to construct a forward dependency graph with the plurality of operation objects as second nodes and the forward dependency relationship between the plurality of operation objects as second edges. The fifth determining module is used to obtain the target dependency graph by taking the intersection between the reverse dependency graph and the forward dependency graph; The sixth determination module is used to trace the source of network attacks based on the target dependency graph.

9. An electronic device, characterized in that, include: processor; Memory used to store the processor's executable instructions; The processor is configured to execute the instructions to implement the network attack attribution method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, When the instructions in the computer-readable storage medium are executed by the processor of the electronic device, the electronic device is able to perform the network attack attribution method as described in any one of claims 1 to 7.

Images