Large model assisted trace evidence method for network security analysis

Abstract

The application discloses a large model assisted trace evidence collection method for network security analysis, relates to the technical field of trace evidence collection, and comprises the following steps: collecting fragmented evidence from logs, traffic, terminals and threat intelligence, and performing data cleaning and preprocessing to obtain attack evidence collection data; based on the attack evidence collection data, attack tool information and attack action information are extracted by using a large model, and matching analysis is performed; based on the attack evidence collection data, time information of attack operations is extracted by using a large model, and activity period analysis is performed; the identity and attribution profile of the attacker is constructed, and the corresponding period is investigated and the evidence is collected; the application is used to solve the problem that the existing trace evidence collection technology cannot analyze the attacker profile according to the attack tool, action and time, and the evidence collection is manually guided, the attack chain restoration is incomplete, the time window analysis is rough, and the identity and attribution inference is not reliable.

Description

Technical Field

[0001] This invention relates to the field of source tracing and evidence collection technology, specifically a large-model-assisted source tracing and evidence collection method for network security analysis. Background Technology

[0002] Source tracing and forensics technology is a comprehensive technical system that deeply integrates digital forensics and network attack tracing and source tracing. It refers to a set of technical methods that, after a network security incident occurs, scientifically identify, fix, associate and analyze multi-source digital evidence such as terminals, networks and cloud platforms in accordance with the law, reverse reconstruct the entire attack behavior trajectory, accurately locate the source of the attack, the identity of the attacker and the motive of the attack, and finally form a complete chain of evidence.

[0003] Existing forensic techniques primarily analyze attacker profiles from three dimensions: attack tool characteristics, attack action sequences, and attack time distribution. This typically involves extracting malware hash values ​​and PE header features and matching them with a malware sample database to determine the attacker's origin; collecting multi-source logs from terminals and networks and listing attack events chronologically to reconstruct the attack process; and statistically analyzing the frequency of attack operations to roughly infer the attacker's active periods. However, the core analysis and processing often still require manual intervention. For example, current attack action analysis requires manually listing isolated system events chronologically, failing to automatically establish causal relationships between events. Attack chain reconstruction relies entirely on the security analyst's experience, which is not only time-consuming and labor-intensive but also prone to overlooking critical attack links, especially for attacks without files or memory access that leave no obvious traces. The analysis of attack methods and attack time windows often relies on human intervention. Analysts typically only count the number of attack operations, neglecting the duration of the attack. This results in the analysis failing to accurately reflect the attacker's activity level. Furthermore, the window boundaries depend entirely on manually set fixed thresholds, which are poorly adaptable and prone to significant errors in the analysis results. Consequently, the attacker profiling is not accurate or reliable, affecting the overall forensic investigation. Moreover, human-led analysis struggles to handle the rapid processing of massive amounts of fragmented evidence, leading to delays in forensic investigation. Therefore, existing forensic investigation technologies, when analyzing attacker profiles and collecting evidence based on attack tools, actions, and time, suffer from incomplete attack chain reconstruction and coarse time window analysis due to human intervention, resulting in unreliable inferences about identity and attribution. Summary of the Invention

[0004] This invention aims to at least partially address one of the technical problems in existing technologies. It obtains attack forensics data by collecting fragmented evidence from logs, traffic, endpoints, and threat intelligence, performing data cleaning and preprocessing; extracting attack tool and attack action information using a large-scale model, and performing matching analysis; extracting attack operation time information using the large-scale model, and performing activity period analysis to obtain attacker activity time period information; constructing an attacker's identity and attribution profile, and conducting investigations and evidence collection within the corresponding time periods; thereby solving the problem that existing source tracing and forensics technologies, when analyzing attacker profiles based on attack tools, actions, and time for evidence collection, suffer from incomplete attack chain reconstruction and coarse time window analysis due to the manual analysis and processing, leading to unreliable inferences about identity and attribution.

[0005] To achieve the above objectives, this application provides a large-scale model-assisted forensic tracing method for network security analysis, comprising the following steps:

[0006] Collect fragmented evidence from logs, traffic, endpoints, and threat intelligence, and perform data cleaning and preprocessing to obtain attack forensics data;

[0007] Based on attack forensics data, large models are used to extract attack tool information and attack action information, and matching analysis is performed to obtain attacker tool action matching information.

[0008] Based on attack forensics data, the timing information of attack operations is extracted using a large model, and the activity period analysis is performed to obtain the attacker's activity period information.

[0009] Based on the attacker's tool action matching information and activity time period information, an attacker's identity and attribution profile are constructed, and investigation and evidence collection are carried out in the corresponding time period.

[0010] Furthermore, fragmented evidence from logs, traffic, endpoints, and threat intelligence is collected, and data cleaning and preprocessing are performed to obtain attack forensics data, including the following sub-steps:

[0011] For attack activities, data from endpoint logs, network traffic, and threat intelligence are collected, and data about attack activities are recorded as raw fragmented evidence data;

[0012] By removing invalid evidence such as those with format errors, abnormal timestamps, missing fields, and duplicates from the original fragmented evidence data, denoised fragmented evidence data is obtained.

[0013] Furthermore, collecting fragmented evidence from logs, traffic, endpoints, and threat intelligence, and performing data cleaning and preprocessing to obtain attack forensics data also includes the following sub-steps:

[0014] The unstructured data in the denoised fragmented evidence data is structured, and the data of the same type but different sources and different formats in the denoised fragmented evidence data are converted into a unified format to obtain standard fragmented evidence data.

[0015] Standard fragmented evidence data is uniformly feature-encoded, mapping all evidence into a form that can be directly used by a large model, and is denoted as attack forensics data.

[0016] Furthermore, based on the attack forensics data, large-scale models are used to extract attack tool information and attack action information, and matching analysis is performed to obtain the attacker's tool action matching information, including the following sub-steps:

[0017] Based on attack forensics data, the core identifying features of the attacker's attack tools are extracted using a large model and then fuzzy matched with a malware sample library to obtain the matched malware families, which are recorded as attack tool matching information.

[0018] For attack tools that cannot be matched with malicious families through core identifier features and malware sample libraries, the corresponding code is extracted, and similarity calculation is performed with the code feature libraries of known threat organizations to match the corresponding threat organizations. After completion, the attacker's attack tool matching information is obtained.

[0019] Furthermore, based on the attack forensics data, the large model is used to extract attack tool information and attack action information, and matching analysis is performed to obtain the attacker's tool action matching information. This also includes the following sub-steps:

[0020] It also uses a large model to extract all the attacker's attack actions, arranges the extracted attack actions in chronological order, and obtains continuous attack actions with causal relationships based on the executor, time and target of the attack actions.

[0021] The system maps consecutive attack actions with causal relationships to the corresponding tactical phases of the MITRE ATT&CK framework and constructs a complete attack chain. It then performs similarity calculations with a known threat organization's TTPs vector library, outputs the attacker's identity matching ranking and confidence level, and infers the attacker's identity to obtain attack action matching information.

[0022] The attacker's tool matching information and attack action matching information are recorded as attacker's tool action matching information.

[0023] Furthermore, based on the attack forensics data, the time information of the attack operations is extracted using a large model, and the activity period analysis is performed to obtain the attacker's activity period information, which also includes the following sub-steps:

[0024] Based on attack forensics data, a large model is used to extract the time when all attack operations by the attacker occurred, which is recorded as the attack operation time; and the duration of all attack operations is counted and recorded as the attack duration, ensuring that the attack operation time and attack duration are accurate to the second. After completion, the attack time data is obtained.

[0025] Divide a 24-hour day into 86,400 time periods, each of which is 1 second, and denote them as second-level time periods; denote any second-level time period as the first time period;

[0026] Based on the attack time data, the number of attack operations in progress within the first time period is counted and recorded as the energy density of the first time period; the energy density of each second-level time period is repeatedly obtained every day.

[0027] Furthermore, based on the attack forensics data, the timing information of the attack operations is extracted using a large model, and the activity period analysis is performed to obtain the attacker's activity period information, including the following sub-steps:

[0028] The 24 hours of a day are divided into 1440 time periods, each lasting 1 minute, denoted as a minute time period. For any minute time period, the energy density of the 60 second-level time periods contained within it is summed to obtain the minute energy corresponding to the minute time period. The minute energy of each minute time period is repeatedly obtained every day and arranged in chronological order to obtain the minute energy sequence for each day.

[0029] Record the minute energy sequence of any day as the first energy sequence, set the sliding window size to 30 minutes and the sliding step size to 1 minute; start from the beginning of the first energy sequence and slide it sequentially to obtain multiple windows;

[0030] For each window, calculate the minute energy for all minute periods within the window and record it as the window's integrated energy; count the integrated energies of all windows and arrange them in order of the windows to record the integrated energy sequence; calculate the median of the integrated energy sequence and record it as the background energy baseline BH.

[0031] Furthermore, based on the attack forensics data, the time information of the attack operations is extracted using a large model, and the activity period analysis is performed to obtain the attacker's activity period information, which also includes the following sub-steps:

[0032] Let HF be any integral energy in the integral energy sequence; based on the change of HF compared to the previous integral energy, determine the trend of HF, which includes an upward trend, a downward trend, and a stable trend.

[0033] If HF shows an upward trend and HF is greater than k1×BH, then HF is marked as an upward abrupt change point; if HF shows a downward trend and HF is less than k1×BH, then HF is marked as a downward abrupt change point; otherwise, it is not marked, where k1 is the first proportional coefficient set.

[0034] Repeatedly mark all integral energies in the integral energy sequence; mark the first of a series of consecutive rising abrupt change points as the start point and the first of a series of consecutive falling abrupt change points as the end point; mark a single consecutive rising abrupt change point as the start point and a single consecutive falling abrupt change point as the end point;

[0035] Record the start time of the window corresponding to the start point as the attack start time, and the end time of the window corresponding to the end point as the attack end time; obtain all attack start times and attack end times, and mark them in the first energy sequence; record the time period formed with the attack start time as the start time and the attack end time as the attack concentration period.

[0036] Furthermore, based on the attack forensics data, the time information of the attack operations is extracted using a large model, and the activity period analysis is performed to obtain the attacker's activity period information, which also includes the following sub-steps:

[0037] For any two adjacent attack concentration periods, obtain the corresponding interval period. If the duration of the interval period is less than 30 minutes; or if the duration of the interval period is not less than 30 minutes but less than 60 minutes, and there is a window with an integral energy greater than k2×BH completely within the window of the interval period; then merge the two adjacent attack concentration periods and the interval period into one attack concentration period; where k2 is the set second proportional coefficient.

[0038] The attack duration of all attack operations corresponding to the date of the first energy sequence is counted, and the proportion of all attack durations falling within the attack concentration period is calculated and recorded as the period coverage.

[0039] If the time period coverage is less than k3, then all attack-concentrated time periods are expanded to both sides with an expansion step size of k4. The time period coverage is recalculated after each expansion until the time period coverage is not less than k3. The attack-concentrated time period at this time is recorded as the attack activity period of the corresponding date, where k3 is the set threshold and k4 is the set duration.

[0040] Repeatedly obtain the attacker's daily attack activity time periods to obtain the attacker's activity time period information.

[0041] Furthermore, based on the attacker's tool action matching information and activity time period information, an attacker's identity and attribution profile are constructed, and investigation and evidence collection are carried out in the corresponding time period, including the following sub-steps:

[0042] Based on the attacker's activity time period information, a large model is used to analyze and determine which time zone the work schedule matches, and to infer the attacker's location; then, combined with tool action matching information, the attacker's organizational background and identity are inferred; and based on the inferred attacker's location, organizational background and identity, a corresponding natural language description is generated, which is recorded as the attacker's identity and attribution profile.

[0043] Based on the attacker's identity and attribution profile, as well as the corresponding activity time period information, we will focus on investigating and collecting evidence from relevant logs, traffic, and terminals.

[0044] The beneficial effects of this invention are as follows: This invention collects fragmented evidence from logs, traffic, terminals, and threat intelligence, and performs data cleaning and preprocessing to obtain attack forensics data; based on the attack forensics data, it uses a large model to extract attack tool information and attack action information, and performs matching analysis to obtain attacker tool action matching information; based on the attack forensics data, it uses a large model to extract attack operation time information, and performs activity period analysis to obtain attacker activity period information; based on the attacker's tool action matching information and activity period information, it constructs an attacker's identity and attribution profile, and conducts investigation and evidence collection in the corresponding time period; when analyzing the attacker profile and collecting evidence based on attack tools, actions, and time, the large model can be used to reconstruct the attack chain for matching analysis, and the attack time window can be analyzed in conjunction with the attack duration, improving the reliability and accuracy of identity and attribution inference;

[0045] This invention improves the coverage and accuracy of attack tool attribution identification by extracting core identifying features from large models and performing matching. Furthermore, it enhances the completeness and automation of attack chain reconstruction by constructing a complete attack chain based on attack actions and matching it with a known threat organization's TTPs vector library, reducing reliance on human experience and improving the efficiency and reliability of identity inference. By constructing energy density based on the occurrence time and duration of attack operations, calculating integral energy through a sliding window, and identifying the attack start and end points based on the abrupt change trend of integral energy, the attacker's activity period can be obtained. This more realistically reflects the attacker's active period, reduces errors caused by fixed thresholds, improves the adaptability, continuity, and accuracy of time window segmentation, and avoids bias caused by ignoring duration while only considering frequency. Attached Figure Description

[0046] Figure 1 This is a flowchart illustrating the steps of the method of the present invention;

[0047] Figure 2 This is a diagram illustrating the acquisition of tool action matching information according to the present invention.

[0048] Figure 3 This is a flowchart illustrating the process of obtaining the attack activity period according to the present invention.

[0049] Figure 4 This is a schematic diagram of the electronic device of the present invention. Detailed Implementation

[0050] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0051] Example 1, please refer to Figure 1 As shown, this application provides a large-scale model-assisted source tracing and forensics method for network security analysis, including the following steps:

[0052] Step S1 involves collecting fragmented evidence from logs, traffic, endpoints, and threat intelligence, and performing data cleaning and preprocessing to obtain attack forensics data. Step S1 includes the following sub-steps:

[0053] Step S101: For attack activities, collect data from terminal logs, network traffic, and threat intelligence, and record the data about the attack activities as raw fragmented evidence data.

[0054] Step S102: Remove invalid evidence from the original fragmented evidence data, such as those with format errors, abnormal timestamps, missing fields, and duplicates, to obtain denoised fragmented evidence data. For example, normal business traffic may be misjudged as an attack. This reduces the interference of noise on subsequent analysis, improves the quality of evidence, and avoids erroneous data affecting the identification of attack tools, the correlation of attack actions, and the results of time analysis.

[0055] Step S103: Structure the unstructured data in the denoised fragmented evidence data, and convert the data of the same type but different sources and different formats in the denoised fragmented evidence data into a unified format to obtain standard fragmented evidence data; solve the problem that multi-source heterogeneous data are difficult to directly correlate, improve the comparability and fusion of evidence, and make subsequent model analysis more stable and accurate;

[0056] Step S104: Standard fragmented evidence data is uniformly feature-encoded, and all evidence is mapped into a form that can be directly used by the large model, which is recorded as attack evidence data; this improves the adaptability of the data to the large model, facilitates the subsequent automatic extraction of attack tools, attack actions and time information, and enhances the automation and analysis efficiency of the overall evidence collection process.

[0057] In practical implementation, unstructured data structuring refers to transforming unstructured data that lacks a fixed format and cannot be directly analyzed by machines into standardized semantic tags or structured fields with unified specifications, machine parsing capabilities, and cross-source association capabilities through semantic understanding and information extraction.

[0058] Step S2 involves extracting attack tool information and attack action information based on the attack forensics data using a large model, and performing matching analysis to obtain the attacker's tool action matching information. Step S2 includes the following sub-steps:

[0059] For step S201, please refer to... Figure 2 As shown, based on attack forensics data, a large model is used to extract the core identifying features of the attacker's attack tools, such as file hashes, PE header features, compilation timestamps, import tables, export tables, string constants, and icon resources. These features are then matched with a malware sample library to obtain the matching malware families, which are recorded as the attack tool matching information. The large model supports feature fuzzy matching, so even if the attacker modifies individual bytes of the malicious file, the large model can still identify the same malware family through features such as PE headers, strings, and import tables.

[0060] Step S202: For attack tools that cannot be matched with a malicious family through core identifier features and malware sample library, extract the corresponding code, calculate the similarity with the code feature library of known threat organizations, match the corresponding threat organization, and obtain the attacker's attack tool matching information after completion; when the attack tool cannot be directly classified into a certain malicious family, further use the code for matching, avoid the limitations of simply relying on attack features, improve the ability to identify customized tools, and enhance the accuracy of inferring the attacker's organizational background;

[0061] Large models can disassemble or decompile unknown tools to extract code-level features, such as function call graphs, basic block sequences, encryption algorithm implementations, code reuse fragments, comment styles, and variable naming habits. The large model transforms these code features into vector representations and performs similarity calculations with code feature databases of known APT organizations and criminal groups worldwide to obtain matching information.

[0062] Step S203: Extract all attack actions of the attacker using a large model, arrange the extracted attack actions in chronological order, and obtain continuous attack actions with causal relationship based on the executing subject, time and operation object of the attack actions.

[0063] Step S204: Map the continuous attack actions with causal relationship to the corresponding tactical phases of the MITRE ATT&CK framework and construct a complete attack chain; calculate the similarity with the TTPs vector library of known threat organizations, output the attacker identity matching ranking and confidence, and infer the attacker identity to obtain attack action matching information.

[0064] Manual analysis or traditional security tools can only be based on rule matching, but they cannot distinguish between normal operations and attack operations, nor can they connect multiple actions into a logical attack chain. The core advantage of large-scale models lies in understanding the context and causal relationship of attack actions. Large-scale models can analyze the contextual information of each action, map continuous and causally related action combinations to the corresponding tactical phases of the ATT&CK framework, construct a complete attack chain, and perform analysis and matching. This transforms attacker identification from experience-based judgment to data-based judgment, enabling a more comprehensive characterization of attacker behavior, matching and inferring attacker identity, and improving the automation level and reliability of source tracing and forensics.

[0065] Step S205: Record the attacker's attack tool matching information and attack action matching information as the attacker's tool action matching information;

[0066] In the actual implementation process, for large models, you can choose to use them according to the actual application scenario, or you can use multiple models at the same time and perform different analysis and processing according to their own advantages.

[0067] Step S3: Based on the attack forensics data, extract the time information of the attack operations using a large model, and perform activity period analysis to obtain the attacker's activity period information; Step S3 includes the following sub-steps:

[0068] For step S301, please refer to... Figure 3 As shown, based on attack forensics data, the large model is used to extract the time when all attack operations by the attacker occurred, which is recorded as the attack operation time; and the duration of all attack operations is counted and recorded as the attack duration, ensuring that the attack operation time and attack duration are accurate to the second, and the attack time data is obtained after completion.

[0069] Step S302: Divide a 24-hour day into 86,400 time periods, each time period being 1 second, denoted as a second-level time period; denot any second-level time period as the first time period;

[0070] Step S303: Based on the attack time data, count the number of attack operations in progress within the first time period, and record it as the energy density of the first time period; repeatedly obtain the energy density of each second-level time period every day. For example, if there are 3 attack operations in progress within the first time period, then the energy density of the first time period is 3.

[0071] The essence of energy density is to treat each of the attacker's actions as an energy block on the timeline. The longer the operation lasts, the stronger the energy. The more energy blocks are superimposed in the same period, the higher the energy density of the area. The attack time window is essentially a high-energy band on the timeline with energy density significantly higher than the background and continuous. This can more realistically reflect the intensity of the attack activity.

[0072] Step S304: Divide the 24 hours of a day into 1440 time periods, each time period being 1 minute, denoted as a minute time period; for any minute time period, sum the energy densities of the 60 second-level time periods contained within it to obtain the minute energy corresponding to the minute time period; repeatedly obtain the minute energy of each minute time period every day, and arrange them in chronological order to obtain the minute energy sequence for each day; convert the second-level energy density into a more stable minute-level trend, which not only preserves the temporal distribution characteristics of the attack activity, but also reduces the interference of second-level noise on the overall judgment, making it easier to discover local peaks and sustained periods of the attack activity.

[0073] Step S305: Record the minute energy sequence of any day as the first energy sequence, set the sliding window size to 30 minutes and the sliding step size to 1 minute; slide sequentially from the starting position of the first energy sequence to obtain multiple windows; the size of the sliding window can be flexibly set.

[0074] Step S306: For each window, calculate the minute energy of all minute time periods within the window and record it as the window's integrated energy; count the integrated energy of all windows and arrange them in the order of the windows, recording them as the integrated energy sequence; calculate the median of the integrated energy sequence and record it as the background energy baseline BH.

[0075] The window's integrated energy is achieved by locally integrating the minute energy sequence using a sliding window, thereby measuring the overall activity over a certain period of time and more clearly displaying continuous active areas. Using the median as the background energy baseline allows for an adaptive background level based on the data itself, which can adapt to different attack intensities, dates, and attack habits, offsetting the interference of occasional peaks on the threshold and providing a stable reference for subsequent identification of mutation points.

[0076] Step S307: Denote any integral energy in the integral energy sequence as HF; Based on the change of HF compared to the previous integral energy, determine the trend of HF. The trend includes an upward trend, a downward trend, and a stable trend. For example, if HF is greater than the previous integral energy, then HF shows an upward trend; if HF is less than the previous integral energy, then HF shows a downward trend.

[0077] Step S308: If HF shows an upward trend and HF is greater than k1×BH, then HF is marked as an upward abrupt change point; if HF shows a downward trend and HF is less than k1×BH, then HF is marked as a downward abrupt change point; otherwise, it is not marked, where k1 is the first proportional coefficient set; in this embodiment, k1=1.2, which can be flexibly set according to the actual application scenario, generally [0.8, 1.5].

[0078] An upward breakout point usually indicates that the attack activity is beginning to intensify, while a downward breakout point usually indicates that the activity is weakening or ending. The role of k1×BH is to make the judgment not only look at the trend, but also to exceed the background level by a certain proportion, so as to avoid misjudging ordinary fluctuations as boundaries.

[0079] Step S309: Repeat the judgment and marking of all integral energies in the integral energy sequence; mark the first of the consecutive rising mutation points as the start point and the first of the consecutive falling mutation points as the end point; mark the individually consecutive rising mutation points as the start point and the individually consecutive falling mutation points as the end point; for example, if three consecutive integral energies in the integral energy sequence are rising mutation points, then mark the first of the three consecutive integral energies as the start point; avoid treating multiple consecutive mutations of the same wave of attack as multiple independent boundaries;

[0080] Step S310: Record the start time of the window corresponding to the start point as the attack start time, and record the end time of the window corresponding to the end point as the attack end time; obtain all attack start times and attack end times, and mark them in the first energy sequence; record the time period formed with the attack start time as the start time and the attack end time as the attack concentrated time period; that is, the period from the attack start time to the attack end time is a continuous interval, representing a segment of active attack.

[0081] Step S311: For any two adjacent attack concentration periods, obtain the corresponding interval period. If the duration of the interval period is less than 30 minutes; or if the duration of the interval period is not less than 30 minutes but less than 60 minutes, and there is a window with an integral energy greater than k2×BH completely within the window of the interval period; then merge the two adjacent attack concentration periods and the interval period into one attack concentration period; where k2 is the set second proportional coefficient; in this embodiment, k2=1.5, which can be flexibly set, generally [1.2, 3];

[0082] If the interval between two adjacent attack periods is short enough, or even if the interval is slightly longer, there is still a high energy window within the interval, then merging them can combine fragments that should belong to the same attack cycle, reduce excessive segmentation, and improve the integrity of the attack period.

[0083] Step S312: Calculate the attack duration of all attack operations on the date corresponding to the first energy sequence, and calculate the proportion of all attack durations falling within the attack concentration period, which is recorded as the period coverage.

[0084] The calculation is performed separately for each attack operation, and then the proportions are summed. For example, if there are 5 attack operations on the same date, each lasting 4 minutes, the total duration is 5 × 4 = 20 minutes. Four of these attacks occur entirely within the peak attack period, and one attack occurs half of its duration within the peak attack period. The total duration within the peak attack period is 4 × 4 + 2 = 18 minutes, so the period coverage is 18 / 20 = 90%.

[0085] Step S313: If the time period coverage is less than k3, then expand all concentrated attack time periods to both sides, with an expansion step size of k4, and recalculate the time period coverage after each expansion until the time period coverage is not less than k3; and record the concentrated attack time period at this time as the attack activity time period of the corresponding date, where k3 is the set threshold and k4 is the set duration; in this embodiment, k3 is 85% and k4 = 2 minutes, which can be flexibly set.

[0086] Step S314: Repeatedly obtain the attacker's daily attack activity time periods to obtain the attacker's activity time period information;

[0087] In practice, the time period coverage is used to verify whether the previously identified concentrated attack periods truly cover most of the attack duration. If the coverage is insufficient, it indicates that the current concentrated attack periods may be too narrow, missing the preparation, cleanup, or low-intensity execution phases before and after the attack begins, and therefore need to be expanded.

[0088] Step S4 involves constructing an attacker's identity and attribution profile based on the attacker's tool action matching information and activity time period information, and conducting investigation and evidence collection during the corresponding time period; Step S4 includes the following sub-steps:

[0089] Step S401: Based on the attacker's activity time period information, use large model analysis to determine which time zone the work schedule matches and infer the attacker's location; then combine tool action matching information to infer the attacker's organizational background and identity; and generate corresponding natural language descriptions based on the inferred attacker's location, organizational background, and identity, which are recorded as the attacker's identity and attribution profile.

[0090] The attacker's identity and affiliation profile is essentially a combination of the activity time period characteristics and tool action characteristics analyzed earlier to generate a comprehensive judgment of the attacker. It mainly tells us the region or time zone where the attacker is located, the attacker's organizational background, the attacker's active time period, etc., thereby helping to narrow down the scope of subsequent log, traffic, and terminal investigation to more targeted time periods and targets.

[0091] Step S402: Based on the attacker's identity and attribution profile, as well as the corresponding activity time period information, conduct key investigations and evidence collection on relevant logs, traffic, and terminals.

[0092] In practice, the region, identity, organizational background, and active time window provided by the profile can be used to guide evidence retrieval and verification. This can clarify the key points of the investigation and reduce blind searches in massive amounts of data. Concentrated searches in corresponding time periods make it easier to find traces of attacks, related events, and key evidence. This improves the efficiency of evidence collection, as well as the hit rate and the integrity of the evidence chain.

[0093] Example 2, please refer to Figure 4 As shown, Figure 4 A schematic diagram of an electronic device is provided, which may include a processor, a communication interface, a memory, and a communication bus. The processor, communication interface, and memory communicate with each other via the communication bus. The memory stores computer-readable instructions, and the processor can call these instructions. When the processor executes a computer-readable instruction, it performs steps similar to those in a large-scale model-assisted forensic tracing method for network security analysis. This achieves the following functions: collecting fragmented evidence from logs, traffic, endpoints, and threat intelligence, and performing data cleaning and preprocessing to obtain attack forensics data; based on the attack forensics data, using a large-scale model to extract attack tool information and attack action information, and performing matching analysis to obtain attacker tool action matching information; based on the attack forensics data, using a large-scale model to extract attack operation time information, and performing activity period analysis to obtain attacker activity period information; constructing an attacker identity and attribution profile based on the attacker's tool action matching information and activity period information, and conducting investigation and evidence collection within the corresponding time periods.

[0094] Furthermore, when the logical instructions in the aforementioned memory can be implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0095] Example 3: This application also provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program performs steps as described in the large-scale model-assisted forensic tracing method for network security analysis, to achieve the following functions: collecting fragmented evidence from logs, traffic, terminals, and threat intelligence, and performing data cleaning and preprocessing to obtain attack forensics data; based on the attack forensics data, using a large-scale model to extract attack tool information and attack action information, and performing matching analysis to obtain attacker tool action matching information; based on the attack forensics data, using a large-scale model to extract attack operation time information, and performing activity period analysis to obtain attacker activity period information; constructing an attacker's identity and attribution profile based on the attacker's tool action matching information and activity period information, and conducting investigation and forensics in the corresponding time period.

[0096] Based on the above description of the embodiments, the embodiments of the present invention can be provided as methods, systems, or computer program products. Based on this understanding, the above technical solutions, in essence or in terms of their contribution to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or certain parts of the embodiments.

[0097] In the embodiments provided in this application, it should be understood that the disclosed system or method can be implemented in other ways. The embodiments described above are merely illustrative. For example, the division of modules or units is only a logical functional division, and there may be other division methods in actual implementation. Furthermore, multiple modules or units may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the coupling or direct coupling or communication connection shown or discussed may be through some communication interfaces. The indirect coupling or communication connection between systems, modules, and units may be electrical, mechanical, or other forms.

[0098] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A large-scale model-assisted source tracing and forensics method for network security analysis, characterized in that, Includes the following steps: Collect fragmented evidence from logs, traffic, endpoints, and threat intelligence, and perform data cleaning and preprocessing to obtain attack forensics data; Based on attack forensics data, large models are used to extract attack tool information and attack action information, and matching analysis is performed to obtain attacker tool action matching information. Based on attack forensics data, the timing information of attack operations is extracted using a large model, and the activity period analysis is performed to obtain the attacker's activity period information. Based on the attacker's tool action matching information and activity time period information, an attacker's identity and attribution profile are constructed, and investigation and evidence collection are carried out in the corresponding time period.

2. The large-scale model-assisted source tracing and forensics method for network security analysis according to claim 1, characterized in that, Collect fragmented evidence from logs, traffic, endpoints, and threat intelligence, and perform data cleaning and preprocessing to obtain attack forensics data, including the following sub-steps: For attack activities, data from endpoint logs, network traffic, and threat intelligence are collected, and data about attack activities are recorded as raw fragmented evidence data; By removing invalid evidence such as those with format errors, abnormal timestamps, missing fields, and duplicates from the original fragmented evidence data, denoised fragmented evidence data is obtained.

3. The large-scale model-assisted source tracing and forensics method for network security analysis according to claim 2, characterized in that, Collecting fragmented evidence from logs, traffic, endpoints, and threat intelligence, and performing data cleaning and preprocessing to obtain attack forensics data also includes the following sub-steps: The unstructured data in the denoised fragmented evidence data is structured, and the data of the same type but different sources and different formats in the denoised fragmented evidence data are converted into a unified format to obtain standard fragmented evidence data. Standard fragmented evidence data is uniformly feature-encoded, mapping all evidence into a form that can be directly used by a large model, and is denoted as attack forensics data.

4. The large-scale model-assisted source tracing and forensics method for network security analysis according to claim 3, characterized in that, Based on attack forensics data, large-scale models are used to extract attack tool information and attack action information, and matching analysis is performed to obtain attacker tool action matching information, including the following sub-steps: Based on attack forensics data, the core identifying features of the attacker's attack tools are extracted using a large model and then fuzzy matched with a malware sample library to obtain the matched malware families, which are recorded as attack tool matching information. For attack tools that cannot be matched with malicious families through core identifier features and malware sample libraries, the corresponding code is extracted, and similarity calculation is performed with the code feature libraries of known threat organizations to match the corresponding threat organizations. After completion, the attacker's attack tool matching information is obtained.

5. The large-scale model-assisted source tracing and forensics method for network security analysis according to claim 4, characterized in that, Based on attack forensics data, large-scale models are used to extract attack tool and attack action information, and matching analysis is performed to obtain attacker tool and action matching information. This process also includes the following sub-steps: It also uses a large model to extract all the attacker's attack actions, arranges the extracted attack actions in chronological order, and obtains continuous attack actions with causal relationships based on the executor, time and target of the attack actions. The system maps consecutive attack actions with causal relationships to the corresponding tactical phases of the MITRE ATT&CK framework and constructs a complete attack chain. It then performs similarity calculations with a known threat organization's TTPs vector library, outputs the attacker's identity matching ranking and confidence level, and infers the attacker's identity to obtain attack action matching information. The attacker's tool matching information and attack action matching information are recorded as attacker's tool action matching information.

6. The large-scale model-assisted source tracing and forensics method for network security analysis according to claim 5, characterized in that, Based on attack forensics data, the time information of attack operations is extracted using a large model, and the activity period analysis is performed to obtain the attacker's activity period information. This also includes the following sub-steps: Based on attack forensics data, a large model is used to extract the time when all attack operations by the attacker occurred, which is recorded as the attack operation time; and the duration of all attack operations is counted and recorded as the attack duration, ensuring that the attack operation time and attack duration are accurate to the second. After completion, the attack time data is obtained. Divide a 24-hour day into 86,400 time periods, each of which is 1 second, and denote them as second-level time periods; denote any second-level time period as the first time period; Based on the attack time data, the number of attack operations in progress within the first time period is counted and recorded as the energy density of the first time period. Repeatedly acquire energy density for each second of the day.

7. The large-scale model-assisted source tracing and forensics method for network security analysis according to claim 6, characterized in that, Based on attack forensics data, the timing information of attack operations is extracted using a large model, and activity period analysis is performed to obtain the attacker's activity period information, including the following sub-steps: The 24 hours of a day are divided into 1440 time periods, each lasting 1 minute, denoted as a minute time period. For any minute time period, the energy density of the 60 second-level time periods contained within it is summed to obtain the minute energy corresponding to the minute time period. The minute energy of each minute time period is repeatedly obtained every day and arranged in chronological order to obtain the minute energy sequence for each day. Record the minute energy sequence of any day as the first energy sequence, set the sliding window size to 30 minutes and the sliding step size to 1 minute; start from the beginning of the first energy sequence and slide it sequentially to obtain multiple windows; For each window, calculate the minute energy for all minute periods within the window and record it as the window's integrated energy; count the integrated energies of all windows and arrange them in order of the windows to record the integrated energy sequence; calculate the median of the integrated energy sequence and record it as the background energy baseline BH.

8. The large-scale model-assisted source tracing and forensics method for network security analysis according to claim 7, characterized in that, Based on attack forensics data, the time information of attack operations is extracted using a large model, and the activity period analysis is performed to obtain the attacker's activity period information. This also includes the following sub-steps: Let HF be any integral energy in the integral energy sequence; based on the change of HF compared to the previous integral energy, determine the trend of HF, which includes an upward trend, a downward trend, and a stable trend. If HF shows an upward trend and HF is greater than k1×BH, then HF is marked as an upward inflection point. If HF shows a downward trend and HF is less than k1×BH, then HF is marked as a downward abrupt change point; Otherwise, no mark is made, where k1 is the first proportional coefficient set; Repeatedly mark all integral energies in the integral energy sequence; mark the first of a series of consecutive rising abrupt change points as the start point and the first of a series of consecutive falling abrupt change points as the end point; mark a single consecutive rising abrupt change point as the start point and a single consecutive falling abrupt change point as the end point; Record the start time of the window corresponding to the start point as the attack start time, and the end time of the window corresponding to the end point as the attack end time; obtain all attack start times and attack end times, and mark them in the first energy sequence; record the time period formed with the attack start time as the start time and the attack end time as the attack concentration period.

9. The large-scale model-assisted source tracing and forensics method for network security analysis according to claim 8, characterized in that, Based on attack forensics data, the time information of attack operations is extracted using a large model, and the activity period analysis is performed to obtain the attacker's activity period information. This also includes the following sub-steps: For any two adjacent attack concentration periods, obtain the corresponding interval period. If the duration of the interval period is less than 30 minutes; or if the duration of the interval period is not less than 30 minutes but less than 60 minutes, and there is a window with an integral energy greater than k2×BH completely within the window of the interval period; then merge the two adjacent attack concentration periods and the interval period into one attack concentration period. Where k2 is the set second proportional coefficient; The attack duration of all attack operations corresponding to the date of the first energy sequence is counted, and the proportion of all attack durations falling within the attack concentration period is calculated and recorded as the period coverage. If the time period coverage is less than k3, then all attack-concentrated time periods are expanded to both sides with an expansion step size of k4. The time period coverage is recalculated after each expansion until the time period coverage is not less than k3. The attack-concentrated time period at this time is recorded as the attack activity period of the corresponding date, where k3 is the set threshold and k4 is the set duration. Repeatedly obtain the attacker's daily attack activity time periods to obtain the attacker's activity time period information.

10. The large-scale model-assisted source tracing and forensics method for network security analysis according to claim 9, characterized in that, Based on the attacker's tool and action matching information and activity time period information, construct an attacker's identity and attribution profile, and conduct investigation and evidence collection during the corresponding time period, including the following sub-steps: Based on the attacker's activity time period information, a large model is used to analyze and determine which time zone the work schedule matches, and to infer the attacker's location; then, combined with tool action matching information, the attacker's organizational background and identity are inferred; and based on the inferred attacker's location, organizational background and identity, a corresponding natural language description is generated, which is recorded as the attacker's identity and attribution profile. Based on the attacker's identity and attribution profile, as well as the corresponding activity time period information, we will focus on investigating and collecting evidence from relevant logs, traffic, and terminals.

Images