An apt organization attribution method based on relationship perception graph attention network

Abstract

The application provides an APT organization attribution method based on a relationship-aware graph attention network, and belongs to the field of cyberspace security.The method comprises the following steps: step 1, preprocessing of multi-source unstructured APT threat reports, identification of key threat entities such as IP addresses, domain names, malware and attack techniques in the reports, and construction of a heterogeneous threat intelligence graph; step 2, construction of a relationship-aware graph attention network model, capture of semantic interaction features of entities through a graph attention network branch, and capture of topological evolution features of a graph structure through a relationship graph convolution network branch; step 3, introduction of an adaptive gating fusion mechanism, dynamic balancing of the contribution of semantic flow and structure flow by using learnable weight parameters, and realization of deep fusion of multi-modal features; and step 4, construction of a graph pooling reading mechanism based on global attention, calculation of node importance scores to extract global representations of key threat indicators in the graph, and input of the global representations into a Softmax classification layer to realize accurate attribution of APT attack organizations.

Description

Technical Field

[0001] This invention belongs to the field of cyberspace security, specifically relating to an APT organization attribution method based on a relation-aware graph attention network. Background Technology

[0002] In today's highly integrated digital and information age, cyberspace has become a new arena for competition and confrontation between nations, and the cybersecurity situation is becoming increasingly severe. Advanced Persistent Threats (APTs), as the most destructive form of attack, not only threaten the security of government agencies and financial systems but also pose a serious challenge to critical national information infrastructure. APT attacks are typically characterized by high levels of organization, long incubation periods, and complex attack methods, enabling them to bypass traditional defense boundaries and achieve precise strikes. Therefore, constructing efficient APT organization attribution models and developing targeted defense strategies through the tracing and analysis of attack behavior has significant practical and strategic value.

[0003] Current APT attribution methods are mainly divided into expert-based manual analysis and automated attribution methods. Expert analysis methods, in addition to digital footprint comparison and infrastructure preference analysis, also include manual modeling based on attack chain models and tactical techniques. Expert analysis methods rely on the deep domain knowledge of security analysts and can accurately capture the unique habits of attackers, but they suffer from problems such as long analysis cycles, high labor costs, and difficulty in handling massive amounts of intelligence. Automated attribution methods extract features for classification using machine learning and simple deep learning models, but they face two major bottlenecks when dealing with complex adversarial environments:

[0004] First, the structured modeling capabilities of threat intelligence are insufficient. In real-world scenarios, threat reports are mostly unstructured PDF or TXT documents. Existing methods typically treat them as plain text or simple statistical vectors, ignoring the complex semantic relationships between entities (such as the causal logic between malware and C2 domains). This results in a significant loss of high-level semantic information, making it difficult to depict the global topology of attack behavior.

[0005] Secondly, the scarcity of labeled data and class imbalance are significant problems. High-quality labeled APT reports are difficult to obtain, and most samples are concentrated in a few well-known organizations, exhibiting a typical long-tail distribution. This causes the attribution model to easily shift towards the majority class during training, resulting in low accuracy in identifying minority organizations and insufficient generalization ability.

[0006] Furthermore, existing technologies suffer from limitations such as poor flexibility in processing heterogeneous intelligence and limited accuracy in capturing key evidence. Traditional heterogeneous graph models rely on predefined graph schemas, making it difficult to adapt to the rapidly evolving threat ecosystem and the emergence of new entity types; while key attribution signals in lengthy threat reports are easily diluted by noise, and traditional pooling strategies struggle to automatically locate core evidence entities.

[0007] To address the issues of insufficient structured modeling, scarce labels, class imbalance, and limited heterogeneous intelligence processing in APT organization attribution, this invention proposes an APT organization attribution method based on a relation-aware graph attention network. This method first preprocesses the original threat report using multimodal entity extraction and feature representation methods, extracting heterogeneous entities and constructing a 780-dimensional multimodal feature vector. Then, a five-layer enhanced edge construction strategy is used to build a heterogeneous threat intelligence graph that preserves semantic relationships and global strategic intent. Finally, an attribution model based on a dual-flow graph neural network is constructed, employing GATv2 semantic flow and RGCN structured flow for parallel feature extraction. Adaptive gating fusion and global attention pooling mechanisms are used to achieve accurate attribution of APT attack organizations. Summary of the Invention

[0008] To address the shortcomings of existing APT organization attribution methods, such as insufficient structured modeling capabilities, poor flexibility in processing heterogeneous intelligence, limited accuracy in capturing key evidence, and scarcity and class imbalance of labeled data, this invention provides an APT organization attribution method based on a relation-aware graph attention network, comprising:

[0009] Step 1: Preprocess multi-source unstructured APT threat reports, identify key threat entities such as IP addresses, domain names, malware, and attack techniques in the reports, and construct a heterogeneous threat intelligence map;

[0010] Step 2: Construct a relation-aware graph attention network model. Capture the semantic interaction features of entities through graph attention network branches and capture the topological evolution features of graph structure through relation graph convolutional network branches.

[0011] Step 3: Introduce an adaptive gating fusion mechanism, which uses learnable weight parameters to dynamically balance the contributions of semantic flow and structural flow, thereby achieving deep fusion of multimodal features.

[0012] Step 4: Construct a graph pooling readout mechanism based on global attention. By calculating the importance score of nodes, the global representation of key threat indicators in the graph is extracted and input into the Softmax classification layer to achieve accurate attribution of APT attack organizations.

[0013] Firstly, the specific steps of step 1 above are as follows:

[0014] Step 1.1: The original threat intelligence report is processed using a cascading rollback parsing strategy. For PDF threat intelligence documents, pdfplumber is used to preserve the original logical paragraph structure. If parsing fails, it automatically rolls back to PyMuPDF for block-level text extraction. For TXT threat intelligence files, chardet is used to identify the encoding and langdetect is used to identify the language. At the same time, predefined regular expressions are used to filter noisy text such as headers, footers and page numbers.

[0015] Step 1.2: Implement semantically aware paragraph segmentation, dividing the document content D into a set of paragraphs P. First, the text is initially segmented using consecutive line breaks, and fragmented segments with fewer than 20 characters are filtered out. Sentence-transformers are used to encode adjacent paragraphs and calculate cosine similarity. When the cosine similarity is greater than 0.8, adjacent paragraphs are merged to preserve logically coherent units. Finally, paragraphs with more than 1000 characters are segmented a second time according to sentence boundaries to reduce the impact of noise co-occurrence.

[0016] Step 1.3: Threat entities are extracted using a three-level cascaded entity recognition framework. The first level uses regular expressions to accurately match structured indicators such as IP addresses and hash values ​​and exclude private address ranges. The second level uses dictionary matching combined with context scoring (ConScore) to identify unstructured entities such as malware, tool names, and organization aliases. Ambiguity is filtered by calculating the TF-IDF discriminative power and category relevance of context words. The third level performs entity normalization, deduplication, and merges aliases and variants based on edit distance and semantic similarity (BERT cosine similarity).

[0017] Step 1.4: Construct a 780-dimensional node multimodal feature vector. Specifically, it includes: 29-dimensional one-hot encoding type features; 64-dimensional hash projection features, which use MurmurHash3 to map lexical units to 64 buckets to support open-world representations of new entities; 3-dimensional morphological statistical features, including normalized length, digit proportion, and letter proportion; 384-dimensional three-granularity semantic embedding features, which integrate paragraph-level, window-level, and entity-level BERT encodings; and 300-dimensional TF-IDF dimensionality reduction features, which retain significant features by truncating SVD.

[0018] Secondly, the specific steps of step 2 above are as follows:

[0019] Step 2.1: Construct an initial heterogeneous graph based on the co-occurrence relationships of entities within the same paragraph, and calculate the edge weights w using the Jaccard similarity coefficient. ij This eliminates the artificially inflated influence of high-frequency entities on correlation strength;

[0020] Step 2.2: Execute a five-layer enhanced edge construction strategy. Layer 1 consists of co-occurrence edges within paragraphs; Layer 2 consists of cross-paragraph bridging edges, connecting cross-stage attack behaviors through common entities appearing in different paragraphs; Layer 3 consists of domain semantic type edges, mapping the MITRE ATT&CK attack chain logic to explicit relationships such as uses, exploits, and communicates; Layer 4 consists of global virtual root node edges, establishing bidirectional connections between the virtual root node and all entities to converge global strategic intent; and Layer 5 consists of small graph completion edges, adding fully connected edges to the sparse graph to ensure structural integrity.

[0021] Step 2.3 introduces a regularized relation mapping and basis decomposition parameterization mechanism to infer the relation index of edges in online reasoning. To cover all possible combinations of entity types, while transforming the relational transformation matrix W r Represented as B = 30 shared basis matrices V b Linear combination:

[0022]

[0023] in, For relation-specific combination coefficients, the parameter sharing mechanism is used to improve the model's generalization ability under sparse relations.

[0024] Thirdly, the specific steps of step 3 above are as follows:

[0025] Step 3.1: Construct a dual-stream parallel architecture, in which the semantic stream uses GATv2 to capture node-level semantic similarity through a multi-head dynamic attention mechanism, and the structure stream uses a relation-aware graph attention network to capture edge-type structural constraints through relation-specific transformations.

[0026] Step 3.2: Implement adaptive gating fusion. Utilize a two-layer MLP gating network to input the concatenated vector of dual-stream features and calculate the node-by-node fusion coefficients. To achieve semantic stream output With structured flow output Dynamic adaptive fusion:

[0027] Step 3.3: Generate graph-level representations using global attention pooling. Node importance scores are calculated using gated linear units. Then, a normalized weighted summation was performed to extract key threat indicators (IOCs) from the graph as attribution evidence:

[0028]

[0029] Step 3.4: Construct a joint optimization objective, use weighted Focal Loss to address the long-tail distribution and class imbalance of APT organizations, and perform confidence calibration through temperature scaling to output the final attribution probability distribution and Top-K candidate organizations.

[0030] Compared with the prior art, the present invention has the following beneficial effects:

[0031] 1. To address the issues of diverse formats, complex content, and ambiguous entity boundaries in multi-source threat intelligence reports, this invention proposes a cascaded backtracking parsing and multimodal entity extraction method. This method effectively solves the problems of format differences, encoding heterogeneity, and semantic coherence disruption in the AADM and APT-Notes extended datasets by combining robust parsing strategies from pdfplumber and PyMuPDF with semantically aware three-layer paragraph segmentation. Simultaneously, the construction of a three-level cascaded entity recognition framework and 780-dimensional multimodal feature vectors enables complete representation of heterogeneous threat entities such as IP addresses, hashes, and malware, from morphology, type, and semantics. This significantly improves the model's entity recognition accuracy and adaptability to novel attack entities when processing complex, unstructured threat intelligence.

[0032] 2. To address the overfitting problem of traditional graph models caused by the multi-stage attack chain, sparse entity relationships, and long-tail distribution in APT organization attribution, this invention proposes a five-layer enhanced edge construction strategy. This strategy introduces MITRE ATT&CK domain knowledge and a global virtual root node mechanism into heterogeneous graphs. Through intra-segment co-occurrence, cross-segment bridging, domain semantic type edges, global root node edges, and sparse small graph completion edges, it achieves a structured reconstruction of the APT attack lifecycle and the convergence of global strategic intent. This effectively solves the problem of insufficient graph structure representation caused by sparse samples and complex relationships in the AADM and APT-Notes extended datasets. Combined with basis decomposition parameterization technology, it significantly reduces the number of parameters and the risk of overfitting when heterogeneous graph models handle large-scale relationship types, and enhances the model's generalization ability on real long-tailed distributed datasets.

[0033] 3. To address the issues of uneven utilization of multi-source intelligence, lack of interpretability in the decision-making process, and class imbalance challenges faced by attribution models, this invention designs an APT attribution model based on a dual-flow graph neural network. This model achieves decoupled modeling of semantic and structural information in threat intelligence through a parallel architecture of GATv2 semantic flow and RGCN structural flow. It dynamically adjusts the contribution of different intelligence sources using an adaptive gating mechanism and combines global attention pooling to locate key evidence entities (such as specific IOCs or TTPs). This not only improves the attribution accuracy of the model in complex adversarial environments such as AADM and APT-Notes extensions, as well as on long-tailed distributed datasets, but also provides transparent decision-making basis through attention weights, enhancing the model's reliability and interpretability. Attached Figure Description

[0034] Figure 1 This is the overall flowchart of the attribution method RGAT proposed in this invention.

[0035] Figure 2 This is a diagram of the RGAT model architecture proposed in this invention. Detailed Implementation

[0036] The present invention will be further described below with reference to the accompanying drawings and embodiments. It should be noted that the described embodiments are only intended to facilitate the understanding of the present invention and do not constitute any limitation thereof.

[0037] This invention addresses the common pain points in APT organization attribution, such as intelligence sparsity and structural complexity, scarce labeled data, and class imbalance. It proposes an APT organization attribution method based on a relation-aware graph attention network. In real-world network environments, APT attack intelligence is often characterized by multi-source heterogeneity, diverse formats, and sparse entity relationships, leading to a scarcity of high-quality labeled samples. Furthermore, the amount of publicly available intelligence varies significantly among different APT organizations, exhibiting a typical long-tail distribution, which severely restricts the performance of traditional deep supervised learning models. To address these issues, this invention first constructs high-fidelity threat intelligence features using multimodal entity extraction and feature representation methods. Second, through multi-level heterogeneous graph construction and knowledge encoding, it explicitly encodes the domain knowledge of the APT attack lifecycle into a graph topology. Finally, it constructs an attribution model based on a dual-flow graph neural network, achieving accurate attribution of APT attack organizations through adaptive gating fusion and global attention pooling mechanisms. This invention provides a comprehensive attribution framework, and experiments have demonstrated the feasibility and effectiveness of the method.

[0038] like Figure 1 and Figure 2 As shown, the APT organization attribution method proposed in this invention based on a relation-aware graph attention network includes:

[0039] Step 201: Preprocess the multi-source unstructured APT threat reports, use entity extraction operators based on regular expressions and predefined dictionaries to identify key threat entities such as IP addresses, domain names, malware, and attack techniques in the reports, and construct a heterogeneous threat intelligence map based on the co-occurrence relationship and semantic proximity between entities.

[0040] Step 2011: The original threat intelligence report is processed using a cascading back parsing strategy. For PDF documents, pdfplumber is used first to extract content based on the page structure. If the parsing fails or returns empty text, it automatically backtracks to PyMuPDF for block-level text extraction to ensure content integrity. For TXT files, chardet is used to infer character encoding and langdetect is used to identify the main language of the document. At the same time, predefined regular expressions are used to filter noisy text such as headers, footers, page numbers, and watermarks.

[0041] Step 2012: The plain text content D obtained after parsing in Stage 1 is segmented into a set of paragraphs P, using a three-level segmentation strategy, satisfying:

[0042]

[0043] Specifically, the paragraph segmentation rule first uses consecutive newline characters as the primary delimiter to initially segment the text, forming an initial set of paragraphs; then, these initial paragraphs are filtered by length to remove those with a character count θ. len Fragmented paragraphs of less than 20; to avoid semantic unit truncation due to mechanical segmentation, the all-MiniLM-L6-v2 model of sentence-transformers is used to segment adjacent paragraphs p. i and p i+1 Encode the semantic vector; if the cosine similarity θ sim =cos(Enc(p i ),Enc(p i+1 If the length of the two paragraphs is greater than 0.8, they are considered to have a high semantic correlation and are merged into a new paragraph to preserve logically coherent narrative units and ensure that key information is not fragmented. To prevent excessively long paragraphs from leading to overly generalized entity co-occurrence relationships or introducing too much irrelevant information, a maximum paragraph length threshold θ is set. max =1000 characters; For paragraphs with more than this threshold, they will be segmented again according to sentence boundaries to ensure that the length of each paragraph is appropriate, thereby optimizing the efficiency and accuracy of subsequent entity recognition and graph construction, and avoiding the introduction of a large number of noisy co-occurrence relationships due to a single paragraph containing too many entities.

[0044] Step 2013 involves extracting threat entities using a three-level cascaded entity recognition framework. The first level is structured indicator recognition based on regular expressions. This level focuses on identifying structured threat indicators with clear patterns, such as IP addresses and hash values ​​(MD5, SHA1, SHA256). The recognition rule formula is as follows:

[0045]

[0046] For hash values, negative forward and backward assertions are used to limit the context to avoid misidentifying ordinary hexadecimal strings in the document as hash values. The formulas for recognizing hexadecimal strings of length 32, 40, and 64 are as follows:

[0047]

[0048] Secondly, the second level uses dictionary matching combined with context scoring to identify unstructured entities such as malware, tool names, and organization aliases. The candidate entity set satisfies the formula:

[0049]

[0050] The context score ConScore(e) is calculated as follows:

[0051]

[0052] Specifically, Regex(·) is a regular expression, ResRanges is a set of private address ranges, c is a set of context words surrounding the candidate entity e, D is the entire document set, TF-IDF(w,D) represents the importance of word w in document set D, and Rel(w,cat(e)) is the semantic relevance weight between word w and entity category cat(e). By setting a ConScore threshold (e.g., 0.65), ambiguous words that do not represent threatening entities in a specific context can be effectively filtered out.

[0053] Finally, the third level performs entity normalization and deduplication based on edit distance and semantic similarity, and merges aliases and variants. The merging rules satisfy:

[0054]

[0055] Among them, when two entities e i and e j If the edit distance is less than or equal to 3 or the cosine similarity based on BERT embedding is greater than 0.85, they are considered to point to the same entity and are merged.

[0056] Step 2014, for each identified threat entity e i Construct a 780-dimensional multimodal feature vector The feature concatenation method is used to preserve the complete information of each modality. The calculation formula is as follows: ;

[0057] Where t i For 29-dimensional one-hot encoded type features, h i The hash projection features are 64-dimensional, and MurmurHash3 is used to map the tokens to 64 buckets to support open-world representations of new entities. The hash projection satisfies:

[0058]

[0059] Where count(·) is the counting function, ϵ is the smoothing term, and h j Let be the value of the j-th dimension in the hash projection vector.

[0060] s i The 3D morphological statistical features include normalized length, the proportion of numbers, and the proportion of letters, e sim,j The 384-dimensional three-granularity semantic embedding is combined with paragraph-level, window-level, and entity-level BERT encodings, and the fusion satisfies:

[0061]

[0062] f i We reduced the dimensionality of 300-dimensional TF-IDF features and preserved salient features by truncating SVD.

[0063] Step 2015: Construct an initial heterogeneous graph based on co-occurrence relationships within paragraphs. Entities within the same paragraph are connected pairwise, and the edge weight w is calculated using the Jaccard similarity coefficient. ij The edge weights satisfy:

[0064]

[0065] Among them, P i For the entity e i The collection of paragraphs, P j For the entity e j A collection of paragraphs.

[0066] Step 2016: Implement a five-layer enhanced edge construction strategy to enrich the semantic representation of the graph. First, construct co-occurrence edges ξ1 within paragraphs to characterize local semantic relationships. Second, construct cross-paragraph bridging edges ξ2 and connect cross-stage behaviors through common entities appearing in different paragraphs. If entity e k Also appears in paragraph P a and P b Then, connecting other entities in the two paragraphs follows the construction rules shown in the formula:

[0067]

[0068] Subsequently, domain semantic type edges are introduced, and the attack chain logic originating from MITRE ATT&CK is mapped to explicit relationships such as uses, exploits, and communicates. Furthermore, global virtual root node edges are introduced, and bidirectional connections are established between the virtual root node v0 and all entity nodes, with the connection set satisfying:

[0069]

[0070] Finally, for sparse report graphs with |V| < 5 nodes, add fully connected edges and add necessary fully connected edges to ensure the graph structure is complete.

[0071] Step 202: Construct a relation-aware graph attention network model. Adopt a dual-stream parallel feature extraction architecture. Capture the semantic interaction features of entities through graph attention network branches and capture the topological evolution features of graph structures through relation graph convolutional network branches.

[0072] Step 2021 introduces a rule-based relation mapping mechanism. Based on the entity type combination of the source node and the target node, the relation type index of the online inference edge is used to automatically determine the relation type by the entity type pair and cover all possible combinations. In this embodiment, the total number of entity types is T=40, and the corresponding relation type size is (T+1). 2 =1681, and its relation index satisfies; specifically, the relation index r of the edge is determined by the source node e. src and target node e dst The entity type is jointly determined, and its calculation formula is shown in the formula.

[0073]

[0074] Among them, ϕ type (·) indicates retrieving the type index of the entity, where T is the total number of entity types. This mechanism allows edge types to be automatically generated during the inference phase without the need for a predefined schema.

[0075] Step 2022: Implement the basis decomposition parameterization scheme, representing the transformation matrix corresponding to each relation type as a linear combination of shared basis matrices to reduce the parameter size and alleviate overfitting under sparse relations. In this embodiment, the number of shared basis matrices is set to B=30, and the relation transformation satisfies:

[0076]

[0077] Among them, V b Let α be the basis matrix shared by all relations. rbThe combination coefficients are specific to relation r; in this way, the model does not need to learn a complete transformation matrix for each relation type, but instead learns a set of shared basis matrices and the combination coefficients corresponding to each relation.

[0078] Step 203 introduces an adaptive gating fusion mechanism, which uses learnable weight parameters to dynamically balance the contributions of semantic flow and structural flow, thereby achieving deep fusion of multimodal features.

[0079] Step 2031: A dual-stream parallel feature extraction architecture is used to generate semantic features and structural features respectively. The semantic stream uses GATv2 to perform multi-head attention weighted aggregation on neighboring nodes, and its attention coefficient α ij satisfy:

[0080]

[0081] in, It is a learnable attention vector, W is the weight matrix, and h is the weight matrix. i and h j These are the feature vectors of the source node and the target node, respectively, and LeakyReLU(·) is the modified linear unit activation function with leakage.

[0082] Structured Flow utilizes the Relational Graph Convolutional Network (RGCN) to capture structural constraints of edge types. RGCN handles multiple relation types in heterogeneous graphs by aggregating messages using independent transformation matrices for each relation type. The l-th layer node h... i The update formula satisfies:

[0083]

[0084] Where σ(·) is the Sigmoid activation function, R is the set of relation types, and N i r c is the set of neighbors of node i under relation r. i , r It is the normalization constant, W r (l) and W0 (l) It is a relation-specific weight matrix. Combined with basis decomposition parameterization techniques, RGCN can efficiently handle large-scale relation types and capture structural constraint information in graph topology.

[0085] Step 2032 involves concatenating semantic and structural features into vectors, and then adaptively calculating the node-by-node fusion coefficient g from the dual-stream node-level output using a learnable two-layer MLP (Multilayer Perceptron) gated network. i ∈[0,1]. The input to this gated network is the semantic stream output. With structured flow output The concatenated vectors have fusion coefficients that satisfy:

[0086]

[0087] Where σ(·) is the Sigmoid activation function, ensuring g i The value is between 0 and 1. Then, node-by-node adaptive fusion is performed, and the final fused node representation... satisfy:

[0088]

[0089] Step 204: Construct a graph pooling readout mechanism based on global attention. By calculating the importance score of nodes, extract the global representation of key threat indicators in the graph and input it into the Softmax classification layer to achieve accurate attribution of APT attack organizations.

[0090] Step 2041: Extract graph-level representations from the fused node representations using a global attention pooling mechanism. Specifically, in the fused node representation After the second layer of GATv2 refinement, the attribution contribution score of each node is calculated through a gating linear unit (GLU). Then, a normalized weighted summation is performed, and the calculation formula is shown in the formula:

[0091]

[0092] in, It is a refined node representation, β i The node importance score is calculated using gated linear units. Attention weights are calculated using softmax(β). i This reflects the contribution of each node to the final graph-level representation, highlighting key entities that contribute significantly to attribution decisions.

[0093] Step 2042: Input the graph-level representation into the classifier to obtain the predicted distribution of tissue labels, where the predicted probabilities satisfy:

[0094]

[0095] Step 2043: During the training phase, weighted Focal Loss is used to alleviate long-tail class imbalance and satisfy the following conditions:

[0096]

[0097] Where N is the total number of samples, y i For real category labels, The model predicts that sample i belongs to the true class y. i The probability, For category y i The weight, is the modulation factor.

[0098] Step 2044, inference phase, confidence level calibration is performed using temperature calibration. A learnable temperature parameter T is introduced to adjust the log probability z output by the classifier. i Scaling is performed, and then the calibrated probability P is obtained through the softmax function. i The calculation formula is shown in the formula below:

[0099]

[0100] Here, T is a hyperparameter determined on the validation set by minimizing the negative log-likelihood. Temperature calibration can effectively adjust the distribution of the model's output probability, making it closer to the true confidence level, thereby outputting the final attribution probability distribution and Top-K candidate organizations.

[0101] In terms of specific dataset configuration, this embodiment uses the AADM and APT-Notes extended datasets as the basis for model training and validation. The AADM dataset, a benchmark dataset in the field, was released by Perry et al. in 2019. It contains intelligence on APT attack groups in 12 categories, mainly composed of unstructured threat intelligence reports, providing reliable basic data for the normalization preprocessing workflow. The APT-Notes extended dataset was independently constructed by project members, focusing on incorporating the latest public reports and technical blogs continuously released by vendors such as ESET, Microsoft, and Palo Alto Networks since 2019. This dataset primarily consists of original PDF / TXT texts and contains a large number of IOCs and fine-grained attack traces (such as URLs, file paths, registry entries, process services, etc.), exhibiting more pronounced practical characteristics and providing rich "interpretable evidence material" for constructing multi-layered heterogeneous graphs.

[0102] In the model performance evaluation phase, to demonstrate the advancement of the proposed RGAT model, this embodiment compares it with three graph representation learning methods: the traditional GCN model, the standard GAT model, and the RGCN model. The experiment evaluates the attribution ability of each model in handling APT organization under conditions of class imbalance and long-tailed distribution using multiple metrics such as accuracy, false positive rate (FPR), and F1 score.

[0103] Table 1 shows the classification performance of each model on the AADM dataset. The RGAT model proposed in this invention achieves excellent performance, with an accuracy of 0.872, a macro-average F1 score of 0.845, a weighted F1 score of 0.928, and a recall of 0.84. In comparison, the APT-ATT model has an accuracy of 0.875, slightly higher than RGAT, but its macro-average F1 score is only 0.8157, mainly due to its limitations in handling class imbalance, resulting in insufficient recognition accuracy for minority class samples. The MLDSJ model has an accuracy of 0.85 and a recall of 0.828. Its performance is limited by its relatively simple feature extraction method, which makes it difficult to fully capture the complex correlation features of APT attack organizations. The APT-MMF model has relatively low performance across the board, with an accuracy of 0.821 and a macro-average F1 score of only 0.788, verifying that the introduction of a relation-aware graph attention network into RGAT can effectively enhance the model's ability to model complex threat intelligence graph structures.

[0104] Table 1 shows the performance comparison of the present invention and three comparative models on the AADM dataset:

[0105] ;

[0106] Table 2 shows the classification performance of the four models on the APT-Notes extended dataset. As can be seen from Table 2, the RGAT model maintains the highest detection accuracy, achieving an accuracy of 0.917, a macro-average F1 score of 0.895, a weighted F1 score of 0.968, and a recall of 0.886, demonstrating good robustness against complex and diverse APT attack groups. Compared to the second-best performing MLDSJ model, the RGAT model improves accuracy by approximately 0.018. The APT-ATT model achieves an accuracy of 0.8823 and a macro-average F1 score of 0.8476 on this dataset, confirming that relying solely on traditional attention mechanisms lacks sufficient fine-grained feature capture capabilities when facing complex threat intelligence. The APT-MMF model achieves an accuracy of 0.875 on this dataset, further demonstrating that RGAT can better capture global structural features in heterogeneous threat intelligence maps, improving attribution performance.

[0107] Table 2 shows the performance comparison of the present invention and three comparative models on the APT-Notes extended dataset:

[0108] .

Claims

1. An APT organizational attribution method based on a relation-aware graph attention network, characterized in that, The steps include the following: Step 1: Preprocess multi-source unstructured APT threat reports, identify key threat entities such as IP addresses, domain names, malware, and attack techniques in the reports, and construct a heterogeneous threat intelligence map; Step 2: Construct a relation-aware graph attention network model. Capture the semantic interaction features of entities through graph attention network branches and capture the topological evolution features of graph structure through relation graph convolutional network branches. Step 3: Introduce an adaptive gating fusion mechanism, which uses learnable weight parameters to dynamically balance the contributions of semantic flow and structural flow, thereby achieving deep fusion of multimodal features. Step 4: Construct a graph pooling readout mechanism based on global attention. By calculating the importance score of nodes, the global representation of key threat indicators in the graph is extracted and input into the Softmax classification layer to achieve accurate attribution of APT attack organizations.

2. The method as described in claim 1, characterized in that, The specific implementation of step 1 includes the following steps: Step 1.1: A cascading rollback parsing strategy is adopted. For threat intelligence PDF documents, pdfplumber is called first for layout parsing. If it fails, it rolls back to PyMuPDF for text extraction. For threat intelligence TXT files, chardet is used to identify the encoding and langdetect is used to identify the language. Step 1.2: Implement semantically aware three-layer paragraph segmentation. The first layer is based on line breaks for segmentation and filtering of short fragments. The second layer is based on BERT cosine similarity to calculate the similarity of adjacent paragraphs and perform semantic merging. The third layer is for segmenting very long paragraphs according to sentence boundaries with length restrictions. Step 1.3 utilizes a three-level cascaded entity recognition framework. The first level identifies structured indicators such as IP addresses and hash values ​​based on regular expressions. The second level identifies unstructured entities such as malware and attack tools based on dictionary matching combined with contextual TF-IDF scoring. The third level performs entity normalization and deduplication based on edit distance and semantic similarity. Step 1.4: Construct a 780-dimensional node multimodal feature vector, including 29-dimensional one-hot encoded type features, 64-dimensional hash projection features, 3-dimensional morphological statistical features, 384-dimensional three-granularity semantic embedding features, and 300-dimensional TF-IDF dimensionality reduction features; Step 1.5: Construct a five-layer enhanced edge for a multi-layered heterogeneous threat intelligence graph, using the following strategy: Layer 1 consists of co-occurrence edges within paragraphs, calculating the association weights between entities within the same paragraph based on the Jaccard coefficient; Layer 2 consists of cross-paragraph bridging edges, establishing logical connections across attack phases through common entities appearing in different paragraphs; Layer 3 consists of domain semantic type edges, mapping the attack chain logic originating from MITRE ATT&CK to explicit relation edges; Layer 4 consists of global virtual root node edges, aggregating global strategic intent by establishing bidirectional connections between virtual root nodes and all entities; Layer 5 consists of small graph completion edges, adding fully connected edges to extremely sparse report graphs to ensure the integrity of the graph structure.

3. The method as described in claim 1, characterized in that, The specific implementation of step 2 includes the following steps: Step 2.1, without pre-setting a schema-free graph pattern, infer the relationship type index of edges online based on the type combination of source and target nodes. The calculation formula is as follows: ; Where, r ij t is the index of the relationship from node i to node j. src and t dst These are the type indices for the source node and the target node, respectively, N. type The total number of predefined entity types; Step 2.2: Calculate the attention scores between nodes using the multi-head attention mechanism, and generate a semantic feature vector containing local semantic context by weighted aggregation of neighborhood node features. ; Step 2.3 utilizes Basis Decomposition (BDE) to process large-scale relation types in the relation-aware graph attention network model. It learns the structured topological features of the graph through linear transformations of specific relations, generating structural feature vectors. .

4. The method as described in claim 1, characterized in that, The specific implementation of step 3 includes the following steps: Step 3.1: Construct a gated neural network, taking the concatenated vector of semantic and structural features as input, and outputting the fusion coefficient. The calculation formula is as follows: ; in, The sigmoid activation function is used, and MLP(·) represents a multilayer perceptron operation, which consists of multiple fully connected layers and non-linear activation functions, and is used to learn fusion weights based on input features. This represents the node feature vector output by the semantic stream. This represents the node feature vectors output by the structured flow. This represents a vector concatenation operation; Step 3.2, perform feature fusion operation. This enables adaptive adjustments to the value of intelligence from different sources; in, Let α represent the final fused node feature vector, and α represent the fusion coefficient of each node.

5. The method as described in claim 1, characterized in that, The specific implementation of step 4 includes the following steps: Step 4.1: Construct the attention readout module and use gated linear units to calculate the attribution contribution score s of each node. i The calculation formula is as follows: ; in, Let n be the total number of nodes in the graph, representing the entire graph. s represents the feature vector of node i after the second layer of GATv2 refinement. i This represents the node importance score calculated by the gated linear unit (GLU). softmax(·) is a normalized exponential function that maps the node score to a probability distribution. Step 4.2: Obtain the graph-level representation vector by global weighted summation, and input it into a classifier containing Dropout layer and linear transformation layer to predict the target tissue label.

Images