A Threat-Driven and Weighted Knowledge Graph-Based APT Attack Tracing Method and System

Abstract

This disclosure provides an APT attack attribution method and system based on threat-driven and weighted knowledge graphs, relating to the field of network security defense technology. The method includes: constructing an APT domain-level ontology; acquiring multi-source unstructured threat intelligence reports, structuring these reports, and generating standardized triples; constructing an attribution knowledge graph based on the standardized triples and the domain-level ontology using a triadic entity alignment algorithm; aggregating APT threat genes based on the attribution knowledge graph, optimizing feature weights based on an inverse scoring weighting mechanism, and introducing a weight-aware rotation embedding-weighted interval loss function to construct an attribution-oriented weighted RotatE model; transforming the attribution task into a knowledge graph link prediction process, using the attribution-oriented weighted RotatE model for energy-driven inference, and outputting the APT organization attribution results. This disclosure achieves highly accurate and robust APT organization attribution, enhancing network security defense capabilities.

Description

Technical Field

[0001] This disclosure relates to the field of network security defense technology, specifically to an APT attack tracing method and system based on threat-driven and weighted knowledge graphs. Background Technology

[0002] The statements in this section are merely background information relating to this disclosure and do not necessarily constitute prior art.

[0003] APT groups are characterized by their high degree of stealth, long persistence, and targeted nature, and their attacks seriously threaten the security of critical sectors such as energy, finance, and government. Accurately tracing the origins of APT groups can support security operations such as threat hunting, incident response, and risk assessment, and is a core component of network defense.

[0004] Existing APT attribution techniques mainly include rule-based methods, traditional machine learning methods, and knowledge graph methods. These methods rely on manual sorting of expert knowledge to match attack evidence with preset patterns, or on methods such as support vector machines and random forests to extract report features and train models using NLP techniques such as TF-IDF and N-grams, or on methods such as constructing threat knowledge graphs to model entities and relationships and using knowledge graph embedding (KGE) models such as RotatE for reasoning.

[0005] However, the existing methods described above still have the following limitations: (1) It is difficult to adapt to the iteration of APT technology, and the large-scale maintenance cost is high and the scalability is poor; (2) Relying on manual feature engineering, attack evidence is treated as an independent feature vector, ignoring the semantic relationship between entities, which limits the accuracy of source tracing; (3) Insufficient governance of heterogeneous threat intelligence (CTI), with inconsistent reporting formats, terminology, and aliases from multiple sources, resulting in fragmented and semantically chaotic graph input; lack of feature discrimination modeling, with existing models treating all attack features equally, unable to distinguish between high-discrimination features such as exclusive backdoors and rare vulnerabilities and low-value features such as general tools and shared tactics, and easily interfered with by background noise; graph reasoning is not adapted to the source tracing task, with most KGE models geared towards general graph completion rather than source tracing scenarios that distinguish APT organizations with similar technologies, making it difficult to output accurate source tracing results under incomplete and noisy intelligence. Summary of the Invention

[0006] To address the aforementioned issues, this disclosure proposes an APT attack attribution method and system based on threat-driven and weighted knowledge graphs. It constructs a two-level framework of upstream CTI governance and downstream attribution reasoning. Through heterogeneous CTI standardization, feature structuring, weighted graph reasoning, and APT organization attribution, it solves the problems of insufficient heterogeneous threat intelligence governance, lack of feature distinguishability modeling, and graph reasoning not being adapted to attribution tasks. This achieves highly accurate and robust APT organization attribution, thereby improving network security defense capabilities.

[0007] According to some embodiments, the present disclosure adopts the following technical solutions: APT attack attribution methods based on threat-driven and weighted knowledge graphs include: Construct an APT domain-level ontology; Acquire multi-source unstructured threat intelligence reports, structure these reports, and generate standardized triples; Based on standardized triples and domain-level ontology, a three-in-one entity alignment algorithm is used to construct a source knowledge graph; Based on the source tracing knowledge graph, we aggregate the threat genes of APT organizations, optimize feature weights based on the inverse scoring weight mechanism, and introduce a weight-aware rotation embedding-weighted interval loss function to construct a source tracing-oriented weighted RotatE model. The source tracing task is transformed into a knowledge graph link prediction process. The source-oriented weighted RotatE model is used for energy-driven inference to output the source tracing results of APT organizations.

[0008] According to some embodiments, the present disclosure adopts the following technical solutions: An APT attack attribution system based on threat-driven and weighted knowledge graphs includes: The initialization module is used to construct the APT domain-level ontology; The structured module is used to acquire multi-source unstructured threat intelligence reports, structure these reports, and generate standardized triples. The knowledge graph construction module is used to construct a source knowledge graph based on standardized triples and domain-level ontology, using a three-in-one entity alignment algorithm. The graph enhancement module is used to aggregate APT organization threat genes based on the source tracing knowledge graph, optimize feature weights based on the inverse scoring weight mechanism, and introduce a weight-aware rotation embedding-weighted interval loss function to construct a source tracing-oriented weighted RotatE model. The source tracing reasoning module is used to transform the source tracing task into a knowledge graph link prediction process. It uses the source tracing-oriented weighted RotatE model to perform energy-driven reasoning and outputs the source tracing results of the APT organization.

[0009] According to some embodiments, the present disclosure adopts the following technical solutions: A computer program product includes a computer program that, when executed by a processor, implements the aforementioned APT attack attribution method based on threat-driven and weighted knowledge graphs.

[0010] According to some embodiments, the present disclosure adopts the following technical solutions: A non-transitory computer-readable storage medium is provided for storing computer instructions, which, when executed by a processor, implement the aforementioned APT attack tracing method based on threat-driven and weighted knowledge graphs.

[0011] According to some embodiments, the present disclosure adopts the following technical solutions: An electronic device includes a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to enable the electronic device to implement the APT attack tracing method based on threat-driven and weighted knowledge graphs.

[0012] Compared with the prior art, the beneficial effects of this disclosure are as follows: This disclosed APT attack attribution method, based on threat-driven and weighted knowledge graphs, unifies the semantics of multi-source reports and eliminates alias redundancy by aligning LLM structure and three-in-one entities, transforming fragmented intelligence into standardized attribution evidence and solving the problem of heterogeneous data integration.

[0013] This disclosure presents an APT attack attribution method based on threat-driven and weighted knowledge graphs. It proposes an ISW ​​mechanism to strengthen the weights of high-discrimination features such as exclusive backdoors and rare vulnerabilities, while suppressing background noise such as common tools and shared tactics, thus significantly improving the ability to distinguish similar APT groups.

[0014] This disclosure presents an APT attack attribution method based on threat-driven and weighted knowledge graphs. It constructs an attribution-oriented weighted RotatE model, which uses threat genes as the core reasoning basis. This method is adapted to the needs of APT attribution tasks and can still output accurate results under incomplete and noisy intelligence.

[0015] The threat-driven and weighted knowledge graph-based APT attack attribution method disclosed herein achieves an accuracy of 94.88% and a weighted F1 score of 94.76% on the AADM+ benchmark dataset, which are 7.36% and 8.04% higher than the existing best APT-ATT model, respectively. It also achieves a macro recall rate of 93.65% for niche APT groups and is more robust.

[0016] This disclosed APT attack attribution method based on threat-driven and weighted knowledge graphs is based on knowledge graph construction, making the attribution process traceable and the evidence chain clear; it is adaptable to APT technology iterations, and only requires updating the dictionary and retraining the model when adding new organizations or features, making it highly scalable. Attached Figure Description

[0017] The accompanying drawings, which form part of this disclosure, are used to provide a further understanding of this disclosure. The illustrative embodiments of this disclosure and their descriptions are used to explain this disclosure and do not constitute an undue limitation of this disclosure.

[0018] Figure 1 This is an overall architecture diagram of the APT attack tracing method based on threat-driven and weighted knowledge graphs according to an embodiment of this disclosure; Figure 2 This is an example diagram of information processing in an embodiment of this disclosure. Detailed Implementation

[0019] The present disclosure will be further described below with reference to the accompanying drawings and embodiments.

[0020] It should be noted that the following detailed descriptions are illustrative and intended to provide further explanation of this disclosure. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure pertains.

[0021] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments according to this disclosure. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms “comprising” and / or “including” are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0022] Example 1 One embodiment of this disclosure provides an APT attack attribution method based on threat-driven and weighted knowledge graphs, the method steps of which include: Step 1: Construct the APT domain-level ontology; Step 2: Obtain multi-source unstructured threat intelligence reports, structure these reports, and generate standardized triples; Step 3: Based on standardized triples and domain-level ontology, construct a source knowledge graph using a three-in-one entity alignment algorithm; Step 4: Based on the source tracing knowledge graph, aggregate the threat genes of APT organizations, optimize the feature weights based on the inverse scoring weight mechanism, and introduce the weight-aware rotation embedding-weighted interval loss function to construct the source tracing-oriented weighted RotatE model; Step 5: Transform the source tracing task into a knowledge graph link prediction process, use the source tracing-oriented weighted RotatE model for energy-driven inference, and output the source tracing results of the APT organization.

[0023] As one embodiment, this disclosure presents an APT attack attribution method based on threat-driven and weighted knowledge graphs. It constructs a two-level framework of "upstream CTI governance and downstream attribution reasoning," and builds an attribution-oriented weighted RotatE model to adapt to the attribution task. The specific implementation process of this method is as follows: Step 1: Construct the APT domain-level ontology; This disclosure, based on industry standards such as STIX 2.1, MITRE ATT&CK, and CVE, designs a hierarchical ontology with "two layers of entities + one layer of relations" to achieve unified semantic modeling for heterogeneous CTI. The hierarchical ontology in the APT domain includes three layers: a low-level observable entity layer, a mid-level attack feature entity layer, and a top-level preference relation layer. Specific content includes: (1) The bottom layer consists of low-level observable entities: including atomic attack traces such as IP addresses, domain names, malware hashes, vulnerability numbers (CVEs), files / processes, and registry entries, providing basic evidence for tracing the source; (2) The middle layer consists of mid-level attack characteristic entities: including threat organizations, attack patterns, infrastructure, malicious software tools, attack targets (industries / organizations), etc., which are the core characteristics that distinguish APT organizations; (3) The top layer is the top-level preference relationship layer (threat gene carrier): three types of core preference relationships are defined—has_toolpref (tool preference), has_vulnpref (vulnerability preference), and has_tacticpref (tactical preference), which are used to characterize the stable and exclusive behavior patterns of APT organizations, i.e. threat genes.

[0024] Threat genes must meet three main characteristics: stability (multiple attacks and reuses by the same organization), exclusivity (distinguishing them from other organizations), and structure (derived from structured CTI rather than isolated indicators).

[0025] Step 2: Obtain multi-source unstructured threat intelligence reports, structure the multi-source unstructured threat intelligence reports, and generate standardized triples; Specifically, acquire multi-source unstructured threat intelligence reports and perform LLM-assisted structuring of these reports: Using a generalized large language model, through four steps—entity extraction, report rewriting, triple parsing, and TTP annotation—multi-source (Chinese and English) unstructured APT reports are transformed into standardized graph triples. 1. Entity extraction: Slide the report through a sliding window, filter out irrelevant narrative, and extract low-level entities defined in the ontology. 2. Report rewriting: Rewrite fragmented statements into standardized technical summaries according to the MITRE ATT&CK tactical phases (initial access, persistence, etc.) to eliminate ambiguity in reference; 3. Triple parsing: Extract the "entity-relationship-entity" triples and map them to the middle and lower level entities and preset relations of the ontology, that is, classify entities according to the defined ontology categories.

[0026] 4. TTP Labeling: Match attack behaviors with MITRE ATT&CK tactics / techniques to generate standardized behavior labels.

[0027] As one example, it can be used for the Qianwen 3 series of large language models.

[0028] Step 3: Based on standardized triples and domain-level ontology, construct a source knowledge graph using a three-in-one entity alignment algorithm; This disclosure unifies entity aliases and version variants and eliminates graph redundancy through three processes: dynamic technical dictionary, hybrid progressive matching, and APT enhancement. Specific steps include: (1) Construct an APT-specific dictionary to store entity standard names, aliases, technical attributes (tactical, vulnerability associations) and known associations (tool-vulnerability-organization); (2) Perform hybrid progressive matching, which integrates precise matching (entity name / category consistency check), fuzzy matching (edit distance to identify naming variants), and semantic matching (Sentence-BERT to capture deep semantic associations). The matching score formula is as follows: in, As the weight, exact matching is prioritized; when no exact match is found, fuzzy matching and semantic matching are combined. To accurately match similarity, For fuzzy matching similarity, Let be the semantic matching similarity, where is the exact matching similarity. For exact matching, its value is 0 / 1; for fuzzy matching... It is based on the division between the edit distance and the overall name length, and the numerical edit distance is weighted during the process; semantic matching uses a fine-tuned model to perform vector cosine similarity matching.

[0029] (3) APT Enhancement: Improve the alignment accuracy of low-resource entities by using technology-related propagation alignment (indirect alignment of sparse entities through tool-vulnerability-tactical paths) and evolutionary adaptive alignment (adapting to entity version iterations and changes in technology usage). Specifically, by utilizing the connection relationship and time dimension of tool-vulnerability-tactical technology, the similarity of candidate entities with low matching similarity is increased proportionally according to the connection relationship and time.

[0030] The final output is a standardized, low-redundancy, and highly consistent source knowledge graph, providing high-quality input for downstream reasoning.

[0031] Step 4: Based on the source tracing knowledge graph, aggregate the threat genes of APT organizations, optimize the feature weights based on the inverse scoring weight mechanism, and introduce the weight-aware rotation embedding-weighted interval loss function to construct the source tracing-oriented weighted RotatE model; This disclosure constructs a source-oriented weighted knowledge graph embedding model through four steps: threat gene aggregation, inverse scoring weight optimization, weighted RotatE training, and energy-driven source tracing reasoning. The specific process is as follows: (1) Threat genes aggregate to generate APT organizational behavioral fingerprints: Traverse the knowledge graph of the training set, count the frequency of mid-level attack features (tools, tactics, vulnerabilities) associated with each APT organization, map them to the top three types of preference relationships, and generate a weighted organization-feature preference relationship set, i.e., the threat genes of APT organizations, with the initial weights being the frequency of feature occurrence. .

[0032] (2) Introducing the Inverse Scoring Weight (ISW) mechanism, a differentiated feature mechanism: Drawing inspiration from TF-IDF, this approach treats APT organizations as "documents" and attack characteristics as "terms." Through feature association statistics, discriminative weight calculation, and final weight fusion, it strengthens highly exclusive features and suppresses common features. 1. Feature Association Statistics: Statistically analyze the association of mid-level features in the training set. t The number of APT tissues N(t) is given; the smaller N(t) is, the higher the feature discrimination. 2. Calculate the discrimination weights :

[0033] in, For a set of mid-level features of the same type, (Avoid division by zero).

[0034] 3. Final weight fusion:

[0035] By integrating the initial frequency weight and the discrimination weight, the goal is to achieve "the highest weight for high-frequency specific features and the lowest weight for low-frequency general features".

[0036] (3) Define a quadruple data structure to adapt to the source tracing task: Define the source-specific training unit quadruple ,in, The head entity represents the APT organization; For each relation, the top-level preference relation is represented by (has_toolpref / has_vulnpref / has_tacticpref). Tail entities represent mid-level attack characteristics; The final weight of the feature represents its source-tracing value. Specific definitions are shown in Tables 1-2.

[0037] Table 1 Entity Definition Table

[0038] Table 2 Advanced Preference Relationship Table

[0039] (4) Constructing a source-oriented weighted RotatE model: Based on the standard RotatE model (source tracing knowledge graph), a weight-aware rotation embedding-weighted interval loss function is added to adapt it to source tracing tasks. Specifically, this includes: 1. Weight-aware rotation embedding: In standard RotatE This model introduces weights to scale the rotation amplitude:

[0040] High-weight features (specific features) have a large rotation range and high correlation strength, while low-weight features (general features) have the opposite.

[0041] 2. Weighted interval loss function:

[0042] in, It is a set of positive quadruplets. It is a set of negative quadruplets. (Interval) imposes a greater penalty on mispredictions of high-value features, strengthening the distinguishing boundary between similar APT organizations.

[0043] Step 5: Transform the source tracing task into a knowledge graph link prediction process, use the source tracing-oriented weighted RotatE model for energy-driven inference, and output the source tracing results of the APT organization.

[0044] This step transforms the source tracing task into knowledge graph link prediction, outputting the source tracing results in three steps, including: (1) Query preprocessing: The source report to be traced is extracted and aligned with the training data to generate standardized query pairs. The input is h,r,t,w Then, after training, a high-dimensional vector is generated for each APT organization; all known APT organizations are used as candidate organizations. (2) Energy aggregation calculation: Calculate candidate APT tissues The energy fraction is obtained by calculating the Euclidean distance between the query pair and the query pair. :

[0045] in, For candidate organization embedding vectors, the lower the energy score, the higher the matching degree.

[0046] (3) Source tracing decision: Select the candidate organization with the smallest energy score as the final source tracing result:

[0047] Simulation Experiment (1) Implementation environment Software: Python 3.9, PyTorch 2.1, Sentence-BERT, Neo4j (graph storage); Datasets: 1030 multi-source APT reports in Chinese and English (initialized dictionary), CTINexus dataset (information extraction verification), AADM+ dataset (source tracing performance verification, training set: test set = 8:2).

[0048] (2) Implementation process 1. Ontology Construction and Initialization: Based on standards such as STIX 2.1 and MITRE ATT&CK, define a three-layer ontology specific to APTs, build an initial dynamic technology dictionary, and input known APT organizations, tools, vulnerabilities, and aliases; 2. Multi-source report structuring: Input report, generate standardized triples through LLM slicing rewriting, entity extraction, triple parsing, and TTP annotation; 3. Entity alignment and graph construction: Perform triadic entity alignment to eliminate alias redundancy, store the aligned triples in Neo4j, and construct a source knowledge graph; 4. Threat gene aggregation: Traverse the map, count the APT tissue-feature frequencies, and generate initial weights for threat genes; 5. ISW Weight Optimization: Calculate the feature discrimination weights, fuse the initial weights to obtain the final weights, and generate a quadruplet training set; 6. Weighted RotatE Model Training: Initialize entity and relation embedding vectors, train the model using a weighted interval loss function, and iterate until the loss converges; 7. Source tracing and verification: Input the test report, generate query pairs after preprocessing, calculate the energy score, and output the source tracing results; 8. Performance Evaluation: Using accuracy, weighted F1, and macro recall as indicators, the advantages of this disclosure are verified by comparing it with models such as SVM, RotatE, and APT-ATT. The comparison results are shown in Table 3.

[0049] Table 3 Statistical table of comparative experimental results

[0050] (III) Implementation Results In this embodiment, the present disclosure achieves the following results on the AADM+ dataset: accuracy of 94.88%, weighted precision of 96.57%, weighted recall of 94.88%, weighted F1 score of 94.76%, macro precision of 93.69%, macro recall of 93.65%, and macro F1 score of 92.52%, which are significantly better than the prior art. In the information extraction task, the entity extraction F1 score is 0.950 and the technology recognition F1 score is 0.975, which are significantly improved compared with the ATTACK+ model.

[0051] Example 2 One embodiment of this disclosure provides an APT attack attribution system based on threat-driven and weighted knowledge graphs, including: The initialization module is used to construct the APT domain-level ontology; The structured module is used to acquire multi-source unstructured threat intelligence reports, structure these reports, and generate standardized triples. The knowledge graph construction module is used to construct a source knowledge graph based on standardized triples and domain-level ontology, using a three-in-one entity alignment algorithm. The graph enhancement module is used to aggregate APT organization threat genes based on the source tracing knowledge graph, optimize feature weights based on the inverse scoring weight mechanism, and introduce a weight-aware rotation embedding-weighted interval loss function to construct a source tracing-oriented weighted RotatE model. The source tracing reasoning module is used to transform the source tracing task into a knowledge graph link prediction process. It uses the source tracing-oriented weighted RotatE model to perform energy-driven reasoning and outputs the source tracing results of the APT organization.

[0052] Example 3 One embodiment of this disclosure provides a computer program product, including a computer program that, when executed by a processor, implements the aforementioned APT attack tracing method based on threat-driven and weighted knowledge graphs.

[0053] Example 4 One embodiment of this disclosure provides a non-transitory computer-readable storage medium for storing computer instructions. When these computer instructions are executed by a processor, they implement the aforementioned APT attack tracing method based on threat-driven and weighted knowledge graphs.

[0054] Example 5 One embodiment of this disclosure provides an electronic device, including a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to enable the electronic device to implement the APT attack tracing method based on threat-driven and weighted knowledge graphs.

[0055] This disclosure is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0056] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0057] While the specific embodiments of this disclosure have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of this disclosure. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of this disclosure are still within the scope of protection of this disclosure.

Claims

1. An APT attack attribution method based on threat-driven and weighted knowledge graphs, characterized in that, include: Construct an APT domain-level ontology; Acquire multi-source unstructured threat intelligence reports, structure these reports, and generate standardized triples; Based on standardized triples and domain-level ontology, a three-in-one entity alignment algorithm is used to construct a source knowledge graph; Based on the source tracing knowledge graph, we aggregate the threat genes of APT organizations, optimize feature weights based on the inverse scoring weight mechanism, and introduce a weight-aware rotation embedding-weighted interval loss function to construct a source tracing-oriented weighted RotatE model. The source tracing task is transformed into a knowledge graph link prediction process. The source-oriented weighted RotatE model is used for energy-driven inference to output the source tracing results of APT organizations.

2. The APT attack attribution method based on threat-driven and weighted knowledge graphs as described in claim 1, characterized in that, The construction of the APT domain hierarchical ontology includes three layers: low-level observable entities, mid-level attack feature entities, and top-level preference relation layer. The low-level observable entities include multiple atomic attack traces such as IP addresses, domain names, malware hashes, vulnerability numbers, files / processes, and registry entries, providing basic evidence for tracing the source; The mid-level attack signature entities include threat organizations, attack patterns, infrastructure, malware tools, and attack targets; The top-level preference relationship layer defines three types of core preference relationships, including tool preference, vulnerability preference, and tactical preference, which represent threat genes.

3. The APT attack attribution method based on threat-driven and weighted knowledge graphs as described in claim 1, characterized in that, The process of acquiring multi-source unstructured threat intelligence reports, structuring these reports, and generating standardized triples includes: Based on multi-source unstructured threat intelligence reports, the report is sliced ​​using a sliding window to filter irrelevant narratives and extract low-level entities defined by the ontology. According to the MITRE ATT&CK tactical phase, fragmented statements are rewritten into standardized technical summaries; Extract the entity-relation-entity triple and map it to the middle and lower level entities and preset relations of the ontology; The attack behavior is matched with the MITRE ATT&CK technique to generate standardized behavior labels.

4. The APT attack attribution method based on threat-driven and weighted knowledge graphs as described in claim 1, characterized in that, The aforementioned method, based on standardized triples and domain-level ontology, employs a three-in-one entity alignment algorithm to construct a source knowledge graph, including: Build an APT-specific dictionary to store entity standard names, aliases, technical attributes, and known relationships; Perform precise matching, fuzzy matching, and semantic matching, and align through technical association propagation and evolutionary adaptive alignment to output a standardized, low-redundancy, and highly consistent source knowledge graph.

5. The APT attack attribution method based on threat-driven and weighted knowledge graphs as described in claim 1, characterized in that, The aforementioned source-tracing knowledge graph aggregates APT threat genes, optimizes feature weights based on an inverse scoring weighting mechanism, and introduces a weight-aware rotational embedding-weighted interval loss function to construct a source-tracing-oriented weighted RotatE model, including: Traverse the knowledge graph of source tracing, count the frequency of occurrence of mid-level attack features associated with each APT organization, map them to the top three types of preference relationships, and generate a weighted organization-feature preference relationship set, that is, the threat genes of APT organizations; Treating APT organizations as documents and attack characteristics as terms, we strengthen highly exclusive features and suppress general features through feature association statistics, discriminative weight calculation, and final weight fusion process. We define a traceability-specific unit quadruple and, based on the traceability knowledge graph model, introduce a weight-aware rotation embedding-weighted interval loss function to obtain the traceability-oriented weighted RotatE model.

6. The APT attack attribution method based on threat-driven and weighted knowledge graphs as described in claim 1, characterized in that, The process of transforming the source tracing task into a knowledge graph link prediction process utilizes the source-guided weighted RotatE model for energy-driven inference, outputting APT organization source tracing results, including: Generate standardized query pairs using the source-guided weighted RotatE model; Calculate the Euclidean distance between the candidate APT organization and the query pair to obtain the energy score; The candidate tissue with the lowest energy fraction was selected as the final source tracing result.

7. An APT attack attribution system based on threat-driven and weighted knowledge graphs, characterized in that, include: The initialization module is used to construct the APT domain-level ontology; The structured module is used to acquire multi-source unstructured threat intelligence reports, structure these reports, and generate standardized triples. The knowledge graph construction module is used to construct a source knowledge graph based on standardized triples and domain-level ontology, using a three-in-one entity alignment algorithm. The graph enhancement module is used to aggregate APT organization threat genes based on the source tracing knowledge graph, optimize feature weights based on the inverse scoring weight mechanism, and introduce a weight-aware rotation embedding-weighted interval loss function to construct a source tracing-oriented weighted RotatE model. The source tracing reasoning module is used to transform the source tracing task into a knowledge graph link prediction process. It uses the source tracing-oriented weighted RotatE model to perform energy-driven reasoning and outputs the source tracing results of the APT organization.

8. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the APT attack tracing method based on threat-driven and weighted knowledge graphs as described in any one of claims 1-6.

9. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium is used to store computer instructions, which, when executed by a processor, implement the APT attack tracing method based on threat-driven and weighted knowledge graphs as described in any one of claims 1-6.

10. An electronic device, characterized in that, include: The device includes a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to enable the electronic device to perform the APT attack attribution method based on threat-driven and weighted knowledge graphs as described in any one of claims 1-6.

Images