A Method and System for Detecting APT Attack Paths Based on Conditional Temporal Diffusion Generative Reconstruction

Abstract

This invention discloses an APT attack path revealing method and system based on conditional temporal diffusion generative reconstruction, belonging to the field of network security detection technology. The method constructs a structured event sequence based on multi-source heterogeneous security log data; uses the structured event sequence as the original attack signal, and gradually adds noise to a pure noise state through a forward diffusion process; constructs a condition vector based on query constraints, and uses the condition vector as the generation constraint to gradually recover the attack signal from the pure noise state through a reverse denoising process. During the reverse denoising process, the intermediate layer features of the noise prediction network latent space are semantically aligned with a predefined set of attack semantic labels to obtain a reconstructed attack behavior sequence containing attack semantic labels; a three-dimensional attack path is constructed based on the reconstructed attack behavior sequence and visualized. This invention, through the fusion of a diffusion model and a cross-attention mechanism, achieves the revealing reconstruction of a complete attack path from chaotic logs, possessing strong noise resistance and interpretability.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method and system for revealing APT attack paths based on conditional temporal diffusion generative reconstruction. Background Technology

[0002] Advanced Persistent Threats (APTs) are a type of complex cyberattack characterized by long-term infiltration, multi-stage penetration, and precise target theft. Attackers typically combine vulnerability exploitation, social engineering, file-to-ground decryption, and encrypted communication to gradually complete the entire process from initial access, privilege maintenance, lateral movement, and data leakage over a period of months or even years. With the increasing trend of "specialized supply" and "industrial collaboration," APT attacks have spread from nation-state warfare to critical infrastructure, financial institutions, and high-tech enterprises, posing a systemic security threat.

[0003] Existing technologies for APT attack detection and path reconstruction mainly fall into three categories: First, rule-based and feature-based alarm correlation methods match and correlate multi-source logs through predefined attack patterns. However, this method heavily relies on prior knowledge and is almost ineffective against variant attacks and zero-day vulnerabilities. Furthermore, the rule base is costly to maintain and cannot cover the fragmented, jump-like attack steps over long periods. Second, attack chain reasoning methods based on graph neural networks model entities and events as graph structures and use graph mining algorithms to identify abnormal edges or nodes to infer attack paths. However, existing graph solutions typically construct static snapshots based on fixed time windows, making it difficult to model the non-linear behavior of attackers that progresses slowly over time. Moreover, graph reasoning is prone to breakage and false paths when faced with high-noise edges introduced by massive alarms. Third, attack sequence prediction methods based on time series models use models such as Long Short-Term Memory Networks and Transformers to model and predict log sequences. However, these methods only perform surface pattern learning on the call sequence and fail to delve into the semantic relationships behind the events. They lack explicit alignment with the attacker's intent, cannot output interpretable attack paths, and the path reconstruction is incomplete and discontinuous in low signal-to-noise ratio environments.

[0004] In summary, the existing detection system still has the following core technical problems: First, the massive alarm logs are noisy and redundant, making it impossible to directly reconstruct the actual attack path; Second, traditional correlation analysis relies on rules or features, which can lead to missed detections and broken links for multi-step, long-term, and covert attacks, and cannot be visualized; Third, existing attack tracing lacks temporal constraints, resulting in inaccurate alignment between attack behavior and attack semantics, and distorted path reconstruction; Fourth, it cannot automatically generate high-fidelity, interpretable three-dimensional attack paths in a unified spatiotemporal dimension. Summary of the Invention

[0005] To address the problems existing in the prior art, this invention provides a method and system for reconstructing APT attack paths based on conditional temporal diffusion generative modeling. It utilizes temporal conditional coding to constrain the temporal consistency of the reconstruction process, and leverages a cross-attention semantic alignment mechanism to achieve accurate mapping between the underlying log patterns and the high-level attack intentions. It reconstructs the complete attack trajectory from chaotic logs and outputs three-dimensional spatiotemporal visualization results.

[0006] This invention is achieved through the following technical solution: A method for revealing APT attack paths based on conditional temporal diffusion generative reconstruction includes the following steps: Constructing structured event sequences based on multi-source heterogeneous security log data; The structured event sequence is used as the original attack signal, and noise is gradually added through a forward diffusion process until the original attack signal is gradually denoised to a pure noise state. Based on the query constraints, a condition vector is constructed. Using the condition vector as the generation constraint, the attack signal is gradually recovered from the pure noise state through the reverse denoising process. In the reverse denoising process, the intermediate layer features of the latent space of the noise prediction network are semantically aligned with the predefined attack semantic label set to obtain the reconstructed attack behavior sequence containing attack semantic labels. Based on the reconstructed attack behavior sequence, a three-dimensional attack path is constructed and visualized.

[0007] Preferably, the step of using the structured event sequence as the original attack signal and gradually adding noise through a forward diffusion process includes: A Markov chain is used to gradually add Gaussian noise to the original attack signal. The intensity of the noise added at each step is controlled by a preset noise variance scheduling table, and the original attack signal is gradually denoised to a pure noise state to obtain a noise signal state sequence.

[0008] Preferably, the noise signal state at each step in the noise signal state sequence is obtained directly from the original attack signal and the cumulative noise scheduling coefficient of the corresponding step by a reparameterization sampling method.

[0009] Preferably, the construction of the condition vector based on query constraints includes: The timestamp information of the structured event sequence is converted into a temporal embedding vector based on the position encoding method; the query constraints input by the user are encoded by the embedding layer and concatenated with the temporal embedding vector to obtain the condition vector.

[0010] Preferably, the stepwise recovery of the attack signal from a pure noise state through the reverse denoising process includes: The noise prediction network is trained to learn the inverse denoising process. The noise signal state and the corresponding real noise added in the noise signal state sequence are used as training data. The conditional vector is used as the generation constraint. The noise prediction network is trained by the mean square error loss function. In the prediction phase, the trained noise prediction network randomly samples pure noise from a standard Gaussian distribution as the initial state. It uses a conditional vector constructed based on real-time data as a constraint and iteratively denoises the noise using the trained noise prediction network. In each denoising step, noise is removed from the current noise state based on the predicted noise. The reconstructed attack behavior sequence is obtained through iterations of a preset total number of steps.

[0011] Preferably, the step of semantically aligning the intermediate layer features of the noisy prediction network's latent space with a predefined set of attack semantic labels includes: The hidden state of the current layer of the noise prediction network is taken as the query input, and the hidden state is mapped to a query matrix; the predefined set of attack semantic labels is mapped to a key matrix and a value matrix. Calculate the cross-attention between the query matrix and the key matrix to obtain semantic enhancement features, and use the semantic enhancement features to update the hidden state of the current layer to continue the denoising process.

[0012] Preferably, the predefined set of attack semantic tags includes reconnaissance, initial access, execution, persistence, lateral movement, and data transfer.

[0013] Preferably, the cross-attention calculation also yields an attention weight matrix, where each element represents the contribution of the corresponding log event feature to the corresponding attack semantic label, used to construct the label and evidence chain for the attack phase.

[0014] Preferably, the step of constructing a three-dimensional attack path and visualizing it based on the reconstructed attack behavior sequence includes: An attack timeline chain is constructed based on the timestamps of each attack event in the reconstructed attack behavior sequence. An asset topology chain is constructed based on the source and target asset information of each attack event. An attack stage chain is constructed based on the attention weight matrix to mark the corresponding attack stage for each attack event. The attack timeline chain, asset topology chain, and attack stage chain are mapped to the asset axis, attack stage axis, and time axis of the three-dimensional coordinate system, respectively, to generate a dynamic and interactive attack path visualization result.

[0015] An APT attack path revealing system based on conditional temporal diffusion generative reconstruction includes: The preprocessing module is used to construct structured event sequences based on multi-source heterogeneous security log data; The forward diffusion module is used to take the structured event sequence as the original attack signal, and gradually add noise through the forward diffusion process to gradually add noise to the original attack signal until it reaches a pure noise state. The reverse denoising and semantic alignment module is used to construct a condition vector based on query constraints. Using the condition vector as the generation constraint, the attack signal is gradually recovered from the pure noise state through the reverse denoising process. In the reverse denoising process, the intermediate layer features of the latent space of the noise prediction network are semantically aligned with the predefined attack semantic label set to obtain the reconstructed attack behavior sequence containing attack semantic labels. The visualization module is used to construct a three-dimensional attack path and visualize it based on the reconstructed attack behavior sequence.

[0016] Compared with the prior art, the present invention has the following beneficial technical effects: This application proposes an APT attack path discovery method based on conditional temporal diffusion generative reconstruction. It transforms the APT attack path discovery problem into a "noise-denoising" reconstruction problem within a diffusion model framework, and achieves precise alignment between the underlying log patterns and high-level attack semantics through a cross-attention key-value mapping mechanism. First, the method converts the timestamp information of the structured event sequence into a temporal embedding vector based on a positional encoding method. This vector is then concatenated with the user query constraint encoding to form a conditional vector, providing temporal consistency and directional constraints for subsequent generation processes. Second, the structured event sequence is used as the original attack signal. Gaussian noise is gradually added to a pure noise state through a forward diffusion process, simulating the process of the attack signal being overwhelmed by massive logs. In the reverse denoising process, the conditional vector is used as the generation constraint, and a noise prediction network is used to gradually recover the attack signal from the pure noise. A cross-attention mechanism is introduced in each denoising step, using the intermediate layer features of the latent space of the noise prediction network as the query. Attention is calculated with a predefined set of attack semantic labels, integrating the attack semantic information into the current feature before continuing denoising. Finally, a reconstructed attack behavior sequence containing attack semantic labels is obtained. This method solves the problems of insufficient detection capability, difficulty in ensuring temporal consistency, and semantic gap between low-level features and high-level intents in traditional methods by integrating a diffusion model and a cross-attention mechanism, and achieves the developmental reconstruction of the complete attack path from chaotic logs.

[0017] This application also proposes a conditional temporal diffusion generative reconstruction APT attack path development system, an electronic device, and a computer storage medium, which possess all the advantages of the aforementioned conditional temporal diffusion generative reconstruction APT attack path development method. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart of the APT attack path reconstruction and visualization method based on conditional temporal diffusion generative model of the present invention; Figure 2 This is a schematic diagram of the cross-attention key-value mapping alignment mechanism of the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0021] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0022] like Figure 1 As shown, an APT attack path revealing method based on conditional temporal diffusion generative reconstruction includes the following steps: Step 1: Collect raw log data from multi-source heterogeneous security probes and infrastructure, and perform field unification, timestamp alignment and structure transformation on the raw log data to obtain a structured event sequence in a unified format.

[0023] The specific implementation method of step 1 will be described in detail below.

[0024] S11: Access raw data streams through a multi-source log collector. The data source types collected include at least one of the following: terminal logs, network logs, application logs, and infrastructure logs.

[0025] Terminal logs include operating system event logs, process creation and termination events reported by EDR probes, file access events, and registry modification events; Network logs include network traffic metadata, firewall session logs, intrusion detection and prevention system alerts, and domain name system resolution records; Application logs include database access logs and authentication logs; Infrastructure logs include virtualization platform logs, container runtime logs, and cloud platform application programming interface call logs.

[0026] The multi-source log collector extracts events from four levels: file operations, process execution, network communication, and system calls. Each record has a timestamp and execution body identifier.

[0027] The data collector employs a breakpoint resume and backpressure mechanism, automatically storing data locally when the network is interrupted or processing capacity is saturated, and resuming uploading once restored. The sampling strategy is dynamically adjusted based on the frequency and time distribution of events. When the system behavior is stable, only key events with significant state changes are recorded, and high-frequency repetitive events are sampled at a lower frequency. When potential attack signs such as lateral movement probing, bulk file access, unusual external connections, or privilege escalation operations are detected, the sampling frequency is automatically increased to capture complete behavioral fragments.

[0028] For events that trigger an exception, the system automatically backtracks and caches events within a preset time window preceding the execution body to preserve the contextual integrity of the attack chain.

[0029] S12: Convert the collected raw log data into a unified structured format.

[0030] Structured fields are standardized as six-tuples: timestamp, source executable identifier, target identifier, behavior type, status, and original description.

[0031] The timestamps are accurate to the millisecond level and are uniformly converted to the UTC+0 time zone. The source execution entity identifier is a unique identifier for the execution entity, which is represented as PID in the process domain. The operating system supplements the record with a globally unique identifier for the process to deal with PID reuse. The target identifier is dynamically determined based on the behavior type: for file operations, it is an absolute path; for network communication, it is an Internet Protocol address and port number pair; for inter-process communication, it is the target PID; and for registry operations, it is the complete registry path. Behavior types are mapped to a predefined three-level classification system. The first level consists of five domains: process, file, network, registry, and service. The second level consists of operation types such as creation, modification, deletion, and access. The third level consists of subcategories such as the number of bytes written and the connection direction. The status indicates whether the operation was successful or failed, and an error code is recorded when it fails; the original description retains the full text of the original log for subsequent verification and auditing.

[0032] In some embodiments, the multi-source log collector can also access extended data sources such as application layer gateway logs, email gateway logs, or cloud workload protection platform logs.

[0033] In some embodiments, the structured fields may also be extended to auxiliary fields such as threat intelligence hit identifiers or asset importance levels, based on security operation needs.

[0034] By collecting heterogeneous data from multiple sources and using unified structured preprocessing, scattered security alerts and logs are transformed into standardized behavioral event sequences, providing a unified data foundation for subsequent time-series modeling. An adaptive sampling strategy centered on anomaly triggering is employed, which reduces redundant data while preserving key behavioral information and contextual integrity related to attack semantics. This solves the problem of traditional methods struggling to distinguish between genuine attack signals and noise in massive alert logs.

[0035] Step 2: Convert the timestamp information of the structured event sequence into a high-dimensional temporal embedding vector based on the positional encoding method; Construct conditional control signals based on query constraints, including time window range, set of assets under interest, and alarm type filtering conditions; The conditional control signal is encoded by the embedding layer and then concatenated with the timing embedding vector to obtain the complete conditional vector. .

[0036] The specific implementation method of step 2 will be described in detail below.

[0037] S21: For the timestamp of each event in the structured event sequence, a high-dimensional temporal embedding vector is generated using sine and cosine positional encoding. The positional encoding is calculated as follows: for positions with even-numbered dimension indices, sine function encoding is used; for positions with odd-numbered dimension indices, cosine function encoding is used. The default embedding dimension is set to 512 dimensions, and the encoding formula uses an exponentially decaying frequency to control the time sensitivity of different dimensions.

[0038] For the timestamp of each event The system uses sine / cosine position coding to generate high-dimensional temporal embedding vectors:

[0039] in This is a dimension index, with a value range of [value range missing]. arrive , For the embedded dimension.

[0040] S22: Construct a condition control signal based on the query constraints, wherein the query constraints include at least one of the following: Time window range, used to specify the time interval for analysis; Focus on the asset set, a list of assets used to limit the analysis, represented in the form of an asset mask; Alarm type filtering is used to filter specific behavior categories; Threat intelligence context is used to introduce external intelligence, such as known malicious Internet Protocol addresses or domain names, as a soft constraint.

[0041] The condition control signal is encoded by the embedding layer and then concatenated with the timestamp code to form a complete condition vector.

[0042] In some embodiments, the positional encoding may also employ learnable positional encoding or relative positional encoding instead of sine and cosine encoding.

[0043] In some embodiments, the conditional control signal may also extend to other dimensions such as user behavior context or network topology distance.

[0044] By concatenating timestamp encoding and conditional control signals into a conditional vector, the temporal sequence information is integrated into the generation process of the diffusion model, ensuring that the reconstructed attack path is continuous and reasonable in the temporal dimension. Simultaneously, the conditional control signals allow users to flexibly specify time windows, asset ranges, and alarm types according to security analysis needs, enabling on-demand generation of attack paths.

[0045] Step 3: Using the structured event sequence as the initial attack signal, the forward diffusion process is defined as a Markov chain with Gaussian noise added step by step. The intensity of the noise added at each step is controlled by a preset noise variance scheduling table. The initial attack signal is gradually annoyed to a pure noise state to obtain a noise signal state sequence, thereby realizing the mathematical modeling of the process of the attack signal being submerged by massive log noise. The specific implementation method of step 3 will be described in detail below.

[0046] S31: Treat the preprocessed structured event sequence as the initial attack signal, and define the forward diffusion process as a Markov chain with Gaussian noise added step by step. Each step takes the state of the previous step as a condition, obtains the noise intensity parameter of the current step from the predefined noise variance scheduling table, adds Gaussian noise of preset intensity on the basis of the state of the previous step, and generates the noisy state of the current step.

[0047] The forward diffusion process is defined as a Markov chain with Gaussian noise added stepwise:

[0048] in For diffusion steps, This represents the total number of diffusion steps (default value is 1000). A predefined noise variance scheduling table is used to control the intensity of noise added at each step.

[0049] S32: Through the reparameterization sampling method, the initial attack signal can be directly obtained. The noise state of any step is obtained by sampling from the preset total number of diffusion steps:

[0050] in, Added realistic noise, , This is the cumulative noise scheduling coefficient.

[0051] The noisy state is obtained by multiplying the initial attack signal by the square root of the accumulated noise scheduling coefficient, and adding the Gaussian noise multiplied by the square root of the complement of the accumulated noise scheduling coefficient.

[0052] As the number of diffusion steps increases, the original attack signal is gradually covered by Gaussian noise, generating a series of intermediate states that gradually transition from the original signal to pure noise, forming a noise signal state sequence. When the total number of diffusion steps is reached... At that time, the noise-generated state approximates a pure noise distribution. It accurately simulates the real-world scenario where attack behavior is completely submerged in messy logs.

[0053] In some embodiments, the noise variance scheduling table may also employ a cosine scheduling strategy or a linear scheduling strategy.

[0054] In some embodiments, the total number of diffusion steps can be adjusted to a value in the range of 500 to 2000 steps, depending on actual needs.

[0055] The problem of APT attack path discovery is transformed into a "noise-denoising" reconstruction problem within a diffusion model framework. The attack signal is gradually submerged into pure noise through a forward diffusion process, providing a mathematical basis for inverse denoising and reconstruction. This enables the model to learn the ability to recover the attack signal from pure noise during the training phase, thus possessing the ability to fully reconstruct the attack path from chaotic logs during the inference phase.

[0056] Step 4: Using each noise signal state in the noise signal state sequence and the corresponding added real noise as training data, and using the conditional vector as the generation constraint, train the noise prediction network; In the prediction phase, starting from a pure noise state, the pre-trained noise prediction network is used to iteratively denoise the data, constrained by a conditional vector constructed based on real-time data. In each denoising step, the intermediate layer features of the latent space of the noise prediction network are cross-attentioned with a predefined set of attack semantic labels. After incorporating the attack semantic information into the current features, the denoising is completed. Through iterations of a preset total number of steps, a reconstructed attack behavior sequence containing attack semantic labels is obtained.

[0057] The specific implementation method of step 4 will be described in detail below.

[0058] S41: The training objective is to learn the inverse denoising process. ,in, This is the condition vector.

[0059] The inverse denoising process is parameterized into a noise prediction network. The noise prediction network Based on the current noise state Current diffusion steps and the condition vector Input: Predicted noise .

[0060] Extract each noise signal state from the noise signal state sequence. and the corresponding added real noise , with the condition vector To generate constraints, the mean square error between the noise predicted by the noise prediction network and the actual noise is calculated as a loss function:

[0061]

[0062] in, Real noise added to the forward process. This is the cumulative noise scheduling coefficient.

[0063] During training, to improve the model's sensitivity to attack signals, the following training strategy is adopted: the condition vector is randomly selected with a preset probability. Setting the value to zero allows the model to learn both conditional and unconditional generation simultaneously; assigning higher loss weights to attack events than normal events alleviates the class imbalance problem; randomly inserting noisy events, randomly pruning, or scaling the time axis into the attack sequences in the training set improves the model's generalization ability.

[0064] The network parameters are iteratively updated with the goal of minimizing the loss function until convergence, resulting in the trained noise prediction network.

[0065] S42: In the prediction phase, from pure noise At the beginning, for k = K , K 1,…,1, execute the following steps sequentially: First, based on the current noise state Current diffusion steps and the condition vector As input, the noise prediction network is trained. Predict the noise added in the current step .

[0066] Secondly, based on the predicted noise, noise is removed from the current noise state, and a random term is added to obtain the noise state from the previous step:

[0067] in, For random items (when (for use at times) To preset the variance, the following can be used: Alternatively, it can be determined based on the noise control table.

[0068] Then, during the hidden state calculation at each step of the noise prediction network, attack semantic information is incorporated into the current feature based on the cross-attention key-value mapping alignment mechanism. For example... Figure 2 As shown, the specific execution process of this mechanism is as follows: Take the hidden state of the current layer of the noise prediction network As input to the query, through the learnable first linear projection matrix Map it to a query matrix :

[0069] The predefined set of attack semantic labels is mapped into a key matrix through an embedding layer. Sum matrix .

[0070] The key matrix is ​​an embedding matrix after mapping a predefined set of attack semantic tags through an embedding layer. Each row represents the embedding vector of a semantic tag. The set of attack semantic tags includes attack stage tags such as reconnaissance, initial access, execution, persistence, lateral movement, and data transmission. The value matrix is ​​a representation vector matrix after mapping the set of attack semantic tags through an embedding layer.

[0071] Finally, the cross-attention between the query matrix and the key matrix is ​​calculated to obtain the semantically enhanced features. The semantic enhancement features are input into the network layer after the cross-attention layer in the noise prediction network, along with the attention weight matrix, to continue denoising.

[0072] like Figure 2As shown, the attention weights between the query matrix and the key matrix are calculated using a scaled dot product attention method. The dot product result is normalized using a normalized exponential function to obtain the attention weight matrix. The value matrix is ​​then weighted and summed based on the attention weight matrix to output semantically enhanced features. These semantically enhanced features retain both the local information of the original log noise pattern and the global guidance of attack semantics.

[0073] The calculation method for cross-attention is as follows:

[0074] Attention weight matrix:

[0075] pass Step-by-step iteration, eventually from The reconstructed attack behavior sequence containing attack semantic tags is obtained. .

[0076] The attention weight matrix has interpretability value: each element in the weight matrix represents the degree of contribution of the corresponding log event feature to the corresponding attack semantic label. When the attack path is finally output, it can be traced back to show which log events mainly supported the determination of which attack stage, forming a chain of evidence.

[0077] In some embodiments, the noise prediction network may also be replaced by an attention-based temporal encoder or a temporal convolutional attention hybrid architecture.

[0078] In some embodiments, the conditional injection method may also use feature concatenation or conditional normalization to replace the cross-attention mechanism.

[0079] In some embodiments, the attack semantic tag set can also be mapped to the tactical phase number of the MITRE ATT&CK framework to achieve alignment with international security standards.

[0080] In some embodiments, the cross-attention layer may also employ a multi-head cross-attention mechanism, which involves concatenating multiple attention heads after parallel computation.

[0081] By employing a conditional temporal constraint-based inverse denoising and reconstruction process, the ability of a diffusion model to recover signals from noise is applied to APT attack path reconstruction. Compared to traditional classification or rule-matching methods, this generative reconstruction method can completely recover the true attack path from massive logs with extremely low signal-to-noise ratios, overcoming the limitations of traditional methods that heavily rely on prior knowledge and fail to reconstruct complete paths when faced with fragmented attack steps. The injection of conditional vectors ensures the temporal consistency of the reconstruction results, avoiding temporal errors and breaks.

[0082] By introducing a cross-attention key-value mapping mechanism into the latent space of the diffusion model, precise alignment between low-level log noise patterns and high-level attack semantics is achieved. Compared with the limitations of existing methods that only perform surface pattern learning on the call sequence, this mechanism overcomes the semantic gap between low-level features and high-level intents. This allows the reconstructed attack path to include not only the event sequence but also the semantic labels of the attack stages corresponding to each event, significantly improving the interpretability of the detection results and the efficiency of security analysts' judgment.

[0083] Step 5: Construct an attack timeline chain based on the timestamps of each attack event in the reconstructed attack behavior sequence, and construct an asset topology chain based on the source asset and target asset information of each attack event; Based on the attention weight matrix, an attack phase chain is constructed by marking the corresponding attack phase for each attack event; The attack timeline chain, asset topology chain, and attack phase chain are mapped to a three-dimensional coordinate system of asset-attack phase-time to generate a dynamic and interactive visualization of the attack path.

[0084] The specific implementation method of step 5 will be described in detail below.

[0085] S51: Constructing a triple attack chain based on the reconstructed attack behavior sequence: The attack sequence chain, which reconstructs attack events in chronological order of timestamps, forms a continuous timeline. The asset topology chain extracts the source and target assets involved in each attack event, connects them in the order of access, and forms a lateral movement path between assets; The attack phase chain, based on the attention weight matrix, marks the corresponding attack phase for each event, forming a phase evolution sequence from reconnaissance, initial access, execution, persistence, lateral movement, and data outgoing.

[0086] S52: Mapping the triple link to a three-dimensional coordinate system: The horizontal axis represents the asset topology, with asset nodes arranged according to network topology or logical groups, and the lines between nodes indicating access relationships. The vertical axis represents the attack stages, arranged sequentially according to the attack chain, with different stages marked by different colors; the vertical axis also represents the time dimension, extending from the earliest time to the latest time, reflecting the duration of the attack.

[0087] Employing a dynamic rendering mechanism, it supports the following interactive operations: rotation and zoom to observe the attack path from any angle; click drill-down to display a detailed event list of the asset; time slider to dynamically display the phases of the attack by dragging the timeline; and evidence highlighting to highlight the log events and attention weights supporting the judgment by clicking the attack phase label.

[0088] In some embodiments, the three-dimensional mapping may also employ a force-guided layout or a layered layout arrangement.

[0089] In some embodiments, the visualization rendering may also employ a WebGL rendering engine or a desktop rendering engine.

[0090] By mapping the reconstructed attack sequence to a three-dimensional coordinate system, the attack path is transformed from abstract data into an intuitive graphic. Compared with existing two-dimensional log lists or time-series diagrams, three-dimensional visualization can simultaneously present information in three dimensions: asset topology, attack phase evolution, and time progression. This allows security analysts to intuitively understand the attacker's intrusion trajectory, dwell time, and behavioral evolution, significantly improving security operation efficiency.

[0091] Step 6: Receive user input query conditions such as time window, asset range, or alarm type, convert the query conditions into a condition vector, call the trained conditional temporal diffusion model to perform the reverse denoising process, and generate an attack path that satisfies the query conditions; the real-time imaging mode does not require retraining the model, and a single query can return results within seconds.

[0092] The specific implementation method of step 6 is described in detail below.

[0093] S61: Receive user-input query conditions via a visual interface, including at least one of time window, asset range, alarm type, and threat level. Convert the user-input query conditions into a condition vector.

[0094] S62: Input the transformed conditional vector into the trained noise prediction network, and perform an inverse denoising process starting from a pure noise state to generate a reconstructed attack behavior sequence that meets the query conditions. Since there is no need to retrain the model, a single query can return results within seconds.

[0095] In some embodiments, the query criteria may also support asset name searches using regular expressions or fuzzy matching.

[0096] In some embodiments, the visualization interface may also provide preset query templates to facilitate security analysts in quickly selecting common query scenarios.

[0097] By employing a query-based real-time imaging mode, pre-trained diffusion models are directly applied to interactive security analysis scenarios. Compared to solutions that require retraining or batch offline analysis, this mode only needs to perform a reverse denoising inference process, eliminating the need to retrain the model. This enables lightweight, real-time interactive detection, meeting the practical needs of security operations.

[0098] The APT attack path revealing method based on conditional temporal diffusion generative reconstruction of the present invention has the following beneficial effects: First, in terms of noise resistance, this invention transforms the APT detection problem into a "noise addition-denoising" reconstruction problem under the diffusion model framework, giving full play to the inherent advantages of generative models. It can completely reconstruct the real attack path from massive alarm logs with extremely low signal-to-noise ratios, solving the problem of insufficient detection capability of traditional rule-based or classification-based detection methods in strong noise environments.

[0099] Second, regarding temporal consistency, by injecting timestamp encoding as a conditional constraint into the reverse denoising process, the reconstructed attack chain is ensured to be continuous and reasonable in the time dimension. This effectively solves the path breakage problem caused by time window segmentation or isolated detection in existing technologies, and can completely restore the attacker's long-term intrusion trajectory.

[0100] Third, regarding semantic alignment and interpretability, a cross-attention key-value mapping mechanism is used to achieve explicit alignment between log noise patterns and attack semantic labels in the latent space of the diffusion model, bridging the semantic gap between low-level features and high-level intents. The attention weight matrix can serve as a chain of evidence for backtracking, making the detection results traceable and interpretable, thus improving the efficiency of security analysts' judgments.

[0101] Fourth, in terms of visualization, the reconstructed attack sequence is mapped to a three-dimensional coordinate system of "asset-attack phase-time" to generate a dynamic and interactive attack path diagram, which intuitively displays the attacker's intrusion trajectory, dwell time and behavioral evolution, thereby improving the efficiency of security operations.

[0102] Fifth, in terms of deployment flexibility, it supports the dynamic generation of attack paths based on the user-input time window or asset range. Only the reverse denoising process needs to be performed, without the need to retrain the model. The model can be flexibly deployed on edge nodes or the central side to meet the real-time requirements of actual security operation scenarios.

[0103] Sixth, in terms of generalized detection capabilities, it does not rely on attack signatures or prior rules. Through generative reconstruction, it learns the distribution differences between normal behavior and attack behavior, and has the ability to detect unknown variants and zero-day APT attacks, effectively adapting to the dynamically evolving threat environment.

[0104] Correspondingly, this application also provides an APT attack path revealing system based on conditional temporal diffusion generative reconstruction, including: The preprocessing module is used to construct structured event sequences based on multi-source heterogeneous security log data; The forward diffusion module is used to take the structured event sequence as the original attack signal, and gradually add noise through the forward diffusion process to gradually add noise to the original attack signal until it reaches a pure noise state. The reverse denoising and semantic alignment module is used to construct a condition vector based on query constraints. Using the condition vector as the generation constraint, the attack signal is gradually recovered from the pure noise state through the reverse denoising process. In the reverse denoising process, the intermediate layer features of the latent space of the noise prediction network are semantically aligned with the predefined attack semantic label set to obtain the reconstructed attack behavior sequence containing attack semantic labels. The visualization module is used to construct a three-dimensional attack path and visualize it based on the reconstructed attack behavior sequence.

[0105] It should be noted that, in the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another device, or some features may be ignored or not executed. The modules described as separate components may or may not be physically separated. The components shown as modules may be one or more physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the modules can be selected to achieve the purpose of the solution in this embodiment according to actual needs.

[0106] Furthermore, in the various embodiments of the present invention, the modules can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The integrated unit described above can be implemented in hardware or as a software functional unit.

[0107] An electronic device provided in this application includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the conditional temporal diffusion generative reconstruction APT attack path visualization method described in any of the above embodiments.

[0108] Another electronic device provided in this application embodiment may further include: an input port connected to a processor for transmitting multimodal data collected by an external acquisition device to the processor; a display unit connected to the processor for displaying the processor's processing results to the outside world; and a communication module connected to the processor for enabling communication between the electronic device and the outside world. The display unit may be a display panel, a laser scanning display, etc.; the communication method adopted by the communication module includes, but is not limited to, Mobile High Definition Link (HML), Universal Serial Bus (USB), High Definition Multimedia Interface (HDMI), and wireless connection (including Wi-Fi, Bluetooth, Bluetooth Low Energy, and IEEE 802.11s-based communication technology).

[0109] This application provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the steps of the conditional temporal diffusion generative reconstruction APT attack path revealing method described in any of the above embodiments.

[0110] For descriptions of relevant parts of the APT attack path development system, electronic device, and computer-readable storage medium based on conditional temporal diffusion generative reconstruction provided in this application, please refer to the detailed descriptions of the corresponding parts in the APT attack path development method based on conditional temporal diffusion generative reconstruction provided in this application, which will not be repeated here. Furthermore, parts of the technical solutions provided in this application that are consistent with the implementation principles of corresponding technical solutions in the prior art have not been described in detail to avoid excessive elaboration.

[0111] The above content is only for illustrating the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. Any modifications made to the technical solution based on the technical concept proposed in this invention shall fall within the scope of protection of the claims of this invention.

Claims

1. A method for revealing APT attack paths based on conditional temporal diffusion generative reconstruction, characterized in that, Includes the following steps: Constructing structured event sequences based on multi-source heterogeneous security log data; The structured event sequence is used as the original attack signal, and noise is gradually added through a forward diffusion process until the original attack signal is gradually denoised to a pure noise state. Based on the query constraints, a condition vector is constructed. Using the condition vector as the generation constraint, the attack signal is gradually recovered from the pure noise state through the reverse denoising process. In the reverse denoising process, the intermediate layer features of the latent space of the noise prediction network are semantically aligned with the predefined attack semantic label set to obtain the reconstructed attack behavior sequence containing attack semantic labels. Based on the reconstructed attack behavior sequence, a three-dimensional attack path is constructed and visualized.

2. The APT attack path revealing method based on conditional temporal diffusion generative reconstruction according to claim 1, characterized in that, The step of using the structured event sequence as the original attack signal and gradually adding noise through a forward diffusion process includes: A Markov chain is used to gradually add Gaussian noise to the original attack signal. The intensity of the noise added at each step is controlled by a preset noise variance scheduling table, and the original attack signal is gradually denoised to a pure noise state to obtain a noise signal state sequence.

3. The APT attack path revealing method based on conditional temporal diffusion generative reconstruction according to claim 2, characterized in that, The noise signal state at each step in the noise signal state sequence is obtained directly from the original attack signal and the cumulative noise scheduling coefficient of the corresponding step by a reparameterization sampling method.

4. The APT attack path revealing method based on conditional temporal diffusion generative reconstruction according to claim 1, characterized in that, The construction of the condition vector based on query constraints includes: The timestamp information of the structured event sequence is converted into a temporal embedding vector based on the position encoding method; the query constraints input by the user are encoded by the embedding layer and concatenated with the temporal embedding vector to obtain the condition vector.

5. The APT attack path revealing method based on conditional temporal diffusion generative reconstruction according to claim 1, characterized in that, The process of gradually recovering the attack signal from a pure noise state through reverse denoising includes: The noise prediction network is trained to learn the inverse denoising process. The noise signal state and the corresponding real noise added in the noise signal state sequence are used as training data. The conditional vector is used as the generation constraint. The noise prediction network is trained by the mean square error loss function. In the prediction phase, the trained noise prediction network randomly samples pure noise from a standard Gaussian distribution as the initial state. It uses a conditional vector constructed based on real-time data as a constraint and iteratively denoises the noise using the trained noise prediction network. In each denoising step, noise is removed from the current noise state based on the predicted noise. The reconstructed attack behavior sequence is obtained through iterations of a preset total number of steps.

6. The APT attack path revealing method based on conditional temporal diffusion generative reconstruction according to claim 1, characterized in that, The step of semantically aligning the intermediate layer features of the noisy prediction network's latent space with a predefined set of attack semantic labels includes: The hidden state of the current layer of the noise prediction network is taken as the query input, and the hidden state is mapped to a query matrix; the predefined set of attack semantic labels is mapped to a key matrix and a value matrix. Calculate the cross-attention between the query matrix and the key matrix to obtain semantic enhancement features, and use the semantic enhancement features to update the hidden state of the current layer to continue the denoising process.

7. The APT attack path revealing method based on conditional temporal diffusion generative reconstruction according to claim 6, characterized in that, The predefined set of attack semantic tags includes reconnaissance, initial access, execution, persistence, lateral movement, and data transfer.

8. The APT attack path revealing method based on conditional temporal diffusion generative reconstruction according to claim 6, characterized in that, The cross-attention calculation also yields an attention weight matrix, where each element represents the contribution of the corresponding log event feature to the corresponding attack semantic label, which is used to construct the label and evidence chain for the attack phase.

9. The APT attack path revealing method based on conditional temporal diffusion generative reconstruction according to claim 1, characterized in that, The process of constructing a three-dimensional attack path and visualizing it based on the reconstructed attack behavior sequence includes: An attack timeline chain is constructed based on the timestamps of each attack event in the reconstructed attack behavior sequence. An asset topology chain is constructed based on the source and target asset information of each attack event. An attack stage chain is constructed based on the attention weight matrix to mark the corresponding attack stage for each attack event. The attack timeline chain, asset topology chain, and attack stage chain are mapped to the asset axis, attack stage axis, and time axis of the three-dimensional coordinate system, respectively, to generate a dynamic and interactive attack path visualization result.

10. An APT attack path revealing system based on conditional temporal diffusion generative reconstruction, characterized in that, include: The preprocessing module is used to construct structured event sequences based on multi-source heterogeneous security log data; The forward diffusion module is used to take the structured event sequence as the original attack signal, and gradually add noise through the forward diffusion process to gradually add noise to the original attack signal until it reaches a pure noise state. The reverse denoising and semantic alignment module is used to construct a condition vector based on query constraints. Using the condition vector as the generation constraint, the attack signal is gradually recovered from the pure noise state through the reverse denoising process. In the reverse denoising process, the intermediate layer features of the latent space of the noise prediction network are semantically aligned with the predefined attack semantic label set to obtain the reconstructed attack behavior sequence containing attack semantic labels. The visualization module is used to construct a three-dimensional attack path and visualize it based on the reconstructed attack behavior sequence.

Images