APT attack detection method and electronic device

Abstract

The application relates to an APT attack detection method and electronic equipment, and belongs to the technical field of computers.The method comprises the following steps: calculating a Laplace matrix of a current time window based on a feature correlation graph and a graph signal vector of the current time window; nodes in the feature correlation graph correspond to different attack features, edges are determined according to logical correlations between the attack features, and edge weights are determined according to the correlations between the attack features; the graph signal vector is used to quantify the state of the attack features corresponding to each node in the feature correlation graph in the current time window; Dirichlet energy and Rayleigh quotient are calculated according to the Laplace matrix; if the Dirichlet energy is greater than a ground state energy threshold value and the Rayleigh quotient is less than or equal to a Rayleigh quotient low-frequency threshold value, it is determined that an APT attack occurs.The APT attack detection method and electronic equipment provided by the application can effectively capture low-frequency hidden behaviors, realize accurate and reliable APT attack detection, and have good mathematical interpretability.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to an APT attack detection method and electronic device. Background Technology

[0002] Advanced Persistent Threat (APT) attacks are characterized by high stealth, long latency, and customized payloads, making them the primary threat to the security of critical information infrastructure. Unlike traditional attacks that aim for "instantaneous destruction," APT attacks follow a cyber kill chain model, exhibiting highly sparse behavior in the time domain and stealthy lateral movement in the spatial domain.

[0003] Currently, the main technologies for detecting APT attacks include the following: (1) IDS / EDR based on static rule matching and fingerprint recognition: relies on predefined attack signature databases (such as virus signatures, malicious IPs) or fixed rules (such as "if PowerShell is detected to be executing and connected to the external network, an alarm will be triggered"). This solution cannot deal with unknown threats (0-day attacks); for the "low-frequency, slow" behaviors common in APT attacks (such as executing a command once per hour), since the single point of action does not meet the hard threshold, it is very easy to be missed.

[0004] (2) Correlation analysis based on linear weighted scoring: Security events are mapped to different dimensions, weights are assigned according to expert experience, and the weighted total score of each dimension is calculated. If the score exceeds the threshold, it is judged as an attack. This scheme only focuses on the activity of "points" and ignores the logical topological relationship between attack steps; it is easily affected by high-frequency and inefficient noise (such as normal business scanning), which may lead to false alarms.

[0005] (3) Hard mapping based on the ATT&CK framework: The collected attack features are forcibly mapped to discrete cells of the ATT&CK matrix, and the attack tactics and techniques are matched to identify them. This scheme is essentially still a static classification, with poor representation ability; it is also weak in identifying atypical attacks that bypass the established tactics.

[0006] Therefore, there is currently a lack of a method that can effectively capture low-frequency covert behaviors and achieve accurate and reliable APT attack detection. Summary of the Invention

[0007] Based on the above analysis, the embodiments of the present invention aim to provide an APT attack detection method and electronic device to solve the problem of the lack of an existing method that can effectively capture low-frequency covert behavior and achieve accurate and reliable APT attack detection.

[0008] On one hand, embodiments of the present invention provide an APT attack detection method, which includes: calculating the Laplacian matrix of the current time window based on a feature association graph and a graph signal vector of the current time window; wherein, nodes in the feature association graph correspond to different attack features, edges between nodes are determined according to the logical correlation between the attack features corresponding to the nodes, and edge weights are determined according to the correlation degree between the attack features; the graph signal vector of the current time window is used to quantify the state of the attack feature corresponding to each node in the feature association graph in the current time window; calculating the Dirichlet energy and Rayleigh quotient of the current time window based on the Laplacian matrix; and determining that an APT attack has occurred if the Dirichlet energy is greater than the ground state energy threshold and the Rayleigh quotient is less than or equal to the Rayleigh quotient low-frequency threshold; wherein, the ground state energy threshold is the Dirichlet energy calculated under normal business conditions.

[0009] Furthermore, after calculating the Dirichlet energy and Rayleigh quotient of the current time window based on the Laplace matrix, the method further includes: in response to the Dirichlet energy being greater than the ground state energy threshold and the Rayleigh quotient being greater than or equal to the Rayleigh quotient high-frequency oscillation threshold, determining that an isolated anomaly event has occurred; wherein the isolated anomaly event includes random noise and transient high-frequency attacks, and the Rayleigh quotient high-frequency oscillation threshold is greater than the Rayleigh quotient low-frequency threshold.

[0010] Furthermore, after calculating the Dirichlet energy and Rayleigh quotient of the current time window based on the Laplace matrix, the method further includes: in response to the Dirichlet energy being greater than the ground state energy threshold and the Rayleigh quotient being between the low-frequency threshold and the high-frequency oscillation threshold of the Rayleigh quotient, generating an event to be investigated and reporting it.

[0011] Furthermore, after calculating the Dirichlet energy and Rayleigh quotient of the current time window based on the Laplace matrix, the method further includes: determining that the operation is normal in response to the Dirichlet energy being less than or equal to the ground state energy threshold.

[0012] Furthermore, each element of the graph signal vector is the signal value of the attack feature corresponding to each node; wherein: the signal value is defined as the offset of the attack feature distribution of the attack feature; wherein, the offset of the attack feature distribution includes the KL divergence or JS divergence between the historical baseline distribution of the attack feature and the observed distribution of the current time window.

[0013] Furthermore, the Laplace matrix is ​​expressed as: ; in, Denotes the Laplace matrix, This represents a weighted adjacency matrix constructed based on the edge weights in the feature association graph. This represents the degree matrix of the weighted adjacency matrix; The Dirichlet energy is represented as: ; The Rayleigh quotient is represented as:

[0014] in, Represents Dirichlet energy. Represents the graph signal vector, Indicates the transpose operation; This refers to Rayleigh.

[0015] Furthermore, after determining that an APT attack has occurred, the method further includes: determining APT attack risk nodes by comparing the signal values ​​of attack features corresponding to each node in the feature association graph with corresponding signal value thresholds; predicting graph signal vectors after a preset number of time windows based on graph diffusion operators; for the remaining nodes in the feature association graph excluding the APT attack risk nodes, obtaining the predicted signal values ​​of each remaining node after a preset number of time windows based on the prediction results of the graph signal vectors after the preset number of time windows; constructing a candidate set of future risk nodes based on the remaining nodes whose predicted signal values ​​are greater than a preset threshold; calculating the risk score of each node in the candidate set of future risk nodes, and determining the future risk nodes of the APT attack based on the risk scores.

[0016] Further, calculating the risk score of each node in the candidate set of future risk nodes includes: for each node in the candidate set of future risk nodes, determining the correlation strength between the node and the APT attack risk node; and determining the risk score by weighted summation of the predicted signal value and the correlation strength.

[0017] Furthermore, the prediction result of the graph signal vector after passing through a preset number of time windows is expressed as follows:

[0018] in, This represents the prediction result of the graph signal vector after a preset number of time windows. Indicates the current time window. This represents the preset number of time windows. This represents the graph diffusion operator. Denotes the Laplace matrix, The graph signal vector representing the current time window; The nodes in the candidate set of future risk nodes The association strength with nodes at risk of APT attacks is expressed as follows: in, This represents the set of nodes at risk of APT attacks. This represents the nodes in the candidate set of future risk nodes. APT attack risk nodes The sum of the weights of the edges between them.

[0019] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement any of the APT attack detection methods described above.

[0020] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the APT attack detection method as described above.

[0021] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements any of the APT attack detection methods described above.

[0022] The APT attack detection method and electronic device provided by this invention calculates the Laplace matrix of the current time window based on the feature correlation graph and the graph signal vector of the current time window, calculates the Dirichlet energy and Rayleigh quotient of the current time window based on the Laplace matrix, and performs APT attack detection based on the Dirichlet energy and Rayleigh quotient. This method can effectively capture low-frequency covert behaviors, achieve accurate and reliable APT attack detection, and has good mathematical interpretability.

[0023] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings. Attached Figure Description

[0024] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts. Figure 1 This is a flowchart illustrating the APT attack detection method provided by the present invention; Figure 2 A schematic diagram of the physical structure of an electronic device is provided. Detailed Implementation

[0025] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0026] Figure 1 This is a flowchart illustrating the APT attack detection method provided by the present invention. Figure 1 As shown, the method includes: Step S1: Calculate the Laplacian matrix of the current time window based on the feature association graph and the graph signal vector of the current time window; wherein, the nodes of the feature association graph correspond to different attack features, the edges between nodes are determined according to the logical correlation between the attack features corresponding to the nodes, and the edge weights are determined according to the correlation degree between the attack features; the graph signal vector of the current time window is used to quantify the state of the attack feature corresponding to each node in the feature association graph in the current time window.

[0027] A feature association graph is pre-constructed to map multi-dimensional attack features into a graph structure, establishing the topological foundation for attack evolution. The feature association graph is a weighted undirected graph, represented as follows: Among them, the attack characteristics form the node set. Each node represents an attack characteristic, such as "SQL injection alert," "abnormal PowerShell execution," or "lateral SMB connection." Edges between nodes are determined based on the logical relationships between the attack characteristics they represent, and all edges form an edge set. The logical correlation between attack features represents the functional and tactical relationship between two attack features. If two attack features are logically related, then an edge exists between them. The edge weights between nodes are determined based on the degree of correlation between attack features, and the edge weights of the feature correlation graph form a weighted adjacency matrix. Edge weights can be assigned based on the official causal relationships of the ATT&CK framework, scores from a security expert knowledge base, or statistical results from historical attack samples.

[0028] APT attack detection is performed on a time-window basis. The Laplacian matrix of the current time window is calculated based on the feature correlation graph and the graph signal vector of the current time window. The Laplacian matrix can be a combined graph Laplacian matrix, a normalized graph Laplacian matrix, or a random walk Laplacian matrix.

[0029] Step S2: Calculate the Dirichlet energy and Rayleigh quotient of the current time window based on the Laplace matrix.

[0030] After obtaining the Laplace matrix, a structured analysis of the eigenvalue graph is performed using the Laplace matrix. First, the Dirichlet energy and Rayleigh quotient of the current time window are calculated based on the Laplace matrix obtained from the current time window.

[0031] Step S3: In response to the Dirichlet energy being greater than the ground state energy threshold and the Rayleigh quotient being less than or equal to the Rayleigh quotient low-frequency threshold, an APT attack is determined to have occurred; wherein, the ground state energy threshold is the Dirichlet energy calculated under normal business conditions.

[0032] The determination of whether an APT attack has occurred is based on the calculated Dirichlet energy and Rayleigh quotient within the current time window. First, the Dirichlet energy can be compared to a ground-state energy threshold, which is a baseline value for the Dirichlet energy calculated under normal operating conditions. If the Dirichlet energy is greater than the ground-state energy threshold, it confirms the presence of highly active anomalous activity in the current system. The Dirichlet energy measures the total variation of a signal across its graph structure. When the Dirichlet energy exceeds the ground-state energy threshold, it indicates the presence of signal clusters that significantly deviate from the normal operating baseline within the system.

[0033] Further comparison of the Rayleigh quotient with the Rayleigh quotient low-frequency threshold reveals that if the Rayleigh quotient is less than or equal to the Rayleigh quotient low-frequency threshold, a structured attack path is confirmed, indicating an APT attack has occurred. The conditions for determining that an APT attack has occurred in the current time window are that the Dirichlet energy of the current time window is greater than the ground state energy threshold, and the Rayleigh quotient of the current time window is less than or equal to the Rayleigh quotient low-frequency threshold.

[0034] APT attacks are low-frequency signals with concentrated and smooth energy. The Rayleigh quotient low-frequency threshold is a predetermined threshold that determines when an APT attack has occurred, provided the Dirichlet energy is greater than the ground state energy threshold and the Rayleigh quotient is less than or equal to this threshold.

[0035] This invention does not rely on any fixed rules. By automatically learning the spectral smoothness of the graph structure through the Laplace matrix, any anomalous signal flow (i.e., a structured attack chain) that exhibits "Dirichlet energy exceeding the ground state energy threshold, with its Rayleigh quotient clustering in the minimum interval" in its topological structure can be captured, regardless of whether its tactical label is known or whether the time interval is regular. This achieves a paradigm shift from "rule-driven" to "structure-aware" and possesses extremely strong generalization capabilities.

[0036] The APT attack detection method provided by this invention is based on a white-box mathematical model. Each calculation step (Dirichlet energy, Rayleigh quotient) has a strict mathematical definition and clear security semantics. It requires no massive amount of labeled training, making it easier to implement, interpret, and trust in security operations centers.

[0037] The APT attack detection method provided by this invention calculates the Laplacian matrix of the current time window based on the feature correlation graph and the graph signal vector of the current time window, calculates the Dirichlet energy and Rayleigh quotient of the current time window based on the Laplacian matrix, and performs APT attack detection based on the Dirichlet energy and Rayleigh quotient. This method can effectively capture low-frequency covert behaviors, achieve accurate and reliable APT attack detection, and has good mathematical interpretability.

[0038] According to an APT attack detection method provided by the present invention, after calculating the Dirichlet energy and Rayleigh quotient of the current time window based on the Laplace matrix, the method further includes: determining that an isolated anomaly event has occurred in response to the Dirichlet energy being greater than the ground state energy threshold and the Rayleigh quotient being greater than or equal to the Rayleigh quotient high-frequency oscillation threshold; wherein the isolated anomaly event includes random noise and transient high-frequency attacks, and the Rayleigh quotient high-frequency oscillation threshold is greater than the Rayleigh quotient low-frequency threshold.

[0039] If the Dirichlet energy of the current time window is greater than the ground state energy threshold, the Rayleigh quotient of the current time window is further compared with the low-frequency threshold of the Rayleigh quotient. If the Rayleigh quotient is greater than the low-frequency threshold, the Rayleigh quotient of the current time window is further compared with the high-frequency oscillation threshold. If the Rayleigh quotient of the current time window is greater than or equal to the high-frequency oscillation threshold, then an isolated anomaly event is determined to have occurred. Isolated anomalies include random noise and transient high-frequency attacks.

[0040] Random noise and transient high-frequency attacks both belong to high-frequency signals, manifesting as drastic, abrupt alarms at local nodes. Although their destructive power is obvious, they lack structural coherence. For example, although transient high-frequency attacks have high signal strength, they appear as local bursts or discontinuous jumps in the graph topology, which is consistent with the characteristics of traditional high-frequency attacks (such as brute-force attacks, DDoS, and large-scale scanning), rather than a covert APT chain.

[0041] The Rayleigh quotient high-frequency oscillation threshold is a predetermined threshold that, when the Dirichlet energy is greater than the ground state energy threshold, determines whether an isolated anomalous event has occurred if the Rayleigh quotient is greater than or equal to this threshold. The Rayleigh quotient high-frequency oscillation threshold is greater than the Rayleigh quotient low-frequency threshold.

[0042] In this invention, "low frequency" and "high frequency" specifically refer to the rate of change of the graph signal in the topological space. Although APT attacks may cause the Dirichlet energy to exceed the ground state energy threshold, the attack behavior follows a kill chain that flows smoothly between features, resulting in minimal difference in signal values ​​between adjacent nodes. This invention utilizes the Rayleigh quotient to capture this "low variation per unit intensity" characteristic, thereby classifying it as a low-frequency attack signal with global coherence; while random traffic fluctuations, due to drastic jumps between non-adjacent nodes, manifest as high-frequency interference with a high Rayleigh quotient.

[0043] The APT attack detection method provided by this invention determines the occurrence of isolated anomalies by determining that the Dirichlet energy is greater than the ground state energy threshold and the Rayleigh quotient is greater than or equal to the Rayleigh quotient high-frequency oscillation threshold.

[0044] According to an APT attack detection method provided by the present invention, after calculating the Dirichlet energy and Rayleigh quotient of the current time window based on the Laplace matrix, the method further includes: in response to the Dirichlet energy being greater than the ground state energy threshold and the Rayleigh quotient being located between the low-frequency threshold of the Rayleigh quotient and the high-frequency oscillation threshold of the Rayleigh quotient, generating an event to be investigated and reporting it.

[0045] If the Dirichlet energy of the current time window is greater than the ground state energy threshold, the Rayleigh quotient of the current time window is further compared with the low-frequency threshold of the Rayleigh quotient. If the Rayleigh quotient is greater than the low-frequency threshold, the Rayleigh quotient of the current time window is further compared with the high-frequency oscillation threshold. If the Rayleigh quotient of the current time window is greater than the low-frequency threshold but less than the high-frequency oscillation threshold, an event to be investigated is generated and reported.

[0046] When the Dirichlet energy is greater than the ground state energy threshold, and the Rayleigh quotient is between the low-frequency threshold and the high-frequency oscillation threshold of the Rayleigh quotient, this situation can be recorded, generated as an event to be investigated, and reported for manual analysis.

[0047] The APT attack detection method provided by this invention generates and reports an event to be investigated when the Dirichlet energy is greater than the ground state energy threshold and the Rayleigh quotient is between the low-frequency threshold and the high-frequency oscillation threshold of the Rayleigh quotient, thereby improving the reliability of APT attack detection.

[0048] According to an APT attack detection method provided by the present invention, after calculating the Dirichlet energy and Rayleigh quotient of the current time window based on the Laplace matrix, the method further includes: determining that the operation is normal in response to the Dirichlet energy being less than or equal to the ground state energy threshold.

[0049] After obtaining the Dirichlet energy and Rayleigh quotient for the current time window, the Dirichlet energy can be compared with the ground state energy threshold. If the Dirichlet energy is less than or equal to the ground state energy threshold, then it is determined that the operation is normal.

[0050] Understandably, the order in which the Dirichlet energy is compared with the ground state energy threshold, the Rayleigh quotient is compared with the low-frequency Rayleigh quotient threshold, and the Rayleigh quotient is compared with the high-frequency oscillation threshold is only a preferred method to obtain results quickly, and the order of comparison can be flexibly adjusted.

[0051] The APT attack detection method provided by this invention determines that the system is working normally if the Dirichlet energy is less than or equal to the ground state energy threshold, thus realizing the determination of the normal working state.

[0052] According to an APT attack detection method provided by the present invention, each element of the graph signal vector is a signal value of the attack feature corresponding to each node; wherein: the signal value is defined as the offset of the attack feature distribution of the attack feature; wherein, the offset of the attack feature distribution includes the KL divergence or JS divergence between the historical baseline distribution of the attack feature and the observed distribution of the current time window.

[0053] The graph signal vector is used to quantify the state of the attack feature corresponding to each node in the feature association graph within the current time window. Each element of the graph signal vector is the signal value of the attack feature corresponding to each node. , This indicates the number of nodes in the feature association graph.

[0054] The signal value can be defined as the offset of the attack feature distribution. This offset can be represented as the KL divergence between the historical baseline distribution of the attack features and the observed distribution within the current time window. The historical baseline distribution of the attack features can be a probability distribution of attack features under normal business conditions, statistically obtained based on long-term historical data (e.g., 30 days), such as execution time distribution and parameter length distribution. The observed distribution within the current time window is the real-time behavioral distribution of the attack features within that window. By establishing a probability distribution profile of the feature behaviors, this method can transform the deliberately suppressed "physical frequency" (e.g., attack frequency) by the attacker into mathematical "abnormal potential energy," and then use the Laplace operator to structurally correlate these abnormal potential energies, thereby identifying hidden attack chains.

[0055] The offset of the attack feature distribution can also be expressed as the JS divergence between the historical baseline distribution of the attack features and the observed distribution in the current time window. The JS divergence is symmetric and bounded, avoiding the singularity problem of the KL divergence and improving computational stability.

[0056] In addition, the signal value of the attack feature can also be defined as the statistical moment deviation (such as Z-score), information entropy, reconstruction error (which can be determined based on the autoencoder), or surprise degree of the attack feature.

[0057] Regardless of the definition method used for graph signals, the essence is to transform "covert behavior" into the "energy value" of nodes. Because this invention introduces the graph Laplacian operator (calculation of the Laplacian matrix), these discrete, multi-dimensional anomalous signals are placed within the same topological context for logical verification. As long as these signals can "align" on the feature correlation graph and form a smooth path (judged by a Dirichlet energy greater than the ground state energy threshold and a Rayleigh quotient less than the Rayleigh quotient low-frequency threshold), the model can confirm it as an APT attack. Therefore, these alternative solutions essentially inherit the detection capability for low-speed attacks from the architecture of this invention.

[0058] The APT attack detection method provided by this invention improves the detection capability for "low-frequency, slow" APT attacks by defining the signal value as the offset of the attack feature distribution of the attack features.

[0059] According to an APT attack detection method provided by the present invention, the Laplacian matrix is ​​represented as follows: ; in, Denotes the Laplace matrix, This represents a weighted adjacency matrix constructed based on the edge weights in the feature association graph. This represents the degree matrix of the weighted adjacency matrix; The Dirichlet energy is represented as: ; The Rayleigh quotient is represented as:

[0060] in, Represents Dirichlet energy. Represents the graph signal vector, Indicates the transpose operation; This refers to Rayleigh.

[0061] The APT attack detection method provided by this invention improves the accuracy and convenience of APT detection by constructing a Laplace matrix to determine whether a series of abnormal activities with a coherent structure are occurring in the current system.

[0062] According to the present invention, after determining that an APT attack has occurred, the method further includes: determining APT attack risk nodes by comparing the signal values ​​of attack features corresponding to each node in the feature association graph with corresponding signal value thresholds; predicting graph signal vectors after a preset number of time windows based on graph diffusion operators; for the remaining nodes in the feature association graph excluding the APT attack risk nodes, obtaining the predicted signal values ​​of each of the remaining nodes after the preset number of time windows based on the prediction results of the graph signal vectors after the preset number of time windows; constructing a candidate set of future risk nodes based on the remaining nodes whose predicted signal values ​​are greater than a preset threshold; calculating the risk score of each node in the candidate set of future risk nodes, and determining the future risk nodes of the APT attack based on the risk scores.

[0063] Attack signatures can reflect the methods or stages of an APT attack to some extent. After confirming an APT attack, further risk assessment is needed to help eliminate potential threats.

[0064] For the attack characteristics corresponding to each node, a pre-set signal value threshold is established. This threshold can be obtained based on historical data statistics under normal operating conditions. After confirming an APT attack, risky nodes are identified by comparing the signal values ​​of the attack characteristics corresponding to each node in the feature association graph with the corresponding signal value threshold. Risky APT nodes include nodes whose attack characteristic signal values ​​are greater than the corresponding signal value threshold. There can be multiple risky APT nodes. Risk assessment can then be performed on the attack characteristics corresponding to the identified risky APT nodes.

[0065] The graph signal vector is predicted based on the graph diffusion operator after a preset number of time windows. In the prediction result of the graph signal vector after the preset number of time windows, each element is the predicted signal value of the attack feature corresponding to each node after the preset number of time windows. Based on the prediction result of the graph signal vector after the preset number of time windows, the predicted signal values ​​of the remaining nodes, excluding nodes at risk of APT attacks, are obtained after the preset number of time windows.

[0066] A preset threshold for signal values ​​is set. Risk screening is only performed when the signal value is greater than the preset threshold. Therefore, after obtaining the predicted signal values ​​of the remaining nodes (excluding those at risk of APT attacks) after a preset number of time windows, each predicted signal value is compared with the preset threshold. A candidate set of future risk nodes is constructed based on the remaining nodes whose predicted signal values ​​are greater than the preset threshold.

[0067] The risk score of each node in the candidate set of future risk nodes is calculated, and the future risk nodes for APT attacks are determined based on the risk scores. The node with the highest risk score can be selected as the future risk node for APT attacks. Attack characteristics of future risk nodes for APT attacks can be used for risk screening to proactively mitigate risks.

[0068] The APT attack detection method provided by this invention improves the risk screening and early warning capabilities of APT risk detection by identifying APT attack risk nodes and further determining future APT attack risk nodes by predicting future semaphores.

[0069] According to an APT attack detection method provided by the present invention, the step of calculating the risk score of each node in the candidate set of future risk nodes includes: for each node in the candidate set of future risk nodes, determining the correlation strength between the node and the APT attack risk node; and determining the risk score by weighted summation of the predicted signal value and the correlation strength.

[0070] The higher the predicted signal value of each node in the risk node candidate set, the stronger the correlation between each node in the risk node candidate set and the identified APT attack risk node, indicating that the risk energy tends to converge on this node, and the higher the probability that this node will become a future risk node of APT attack.

[0071] For each node in the candidate set of future risk nodes, the correlation strength between the node and APT attack risk nodes is determined. This is achieved by weighted summation of the predicted signal value and the correlation strength to determine the risk score of each node in the candidate set. In the weighted summation, the first weight of the predicted signal value can be set to 0.5-0.7, and the second weight of the correlation strength can be set to 0.2-0.4, with the sum of their weights being 1.

[0072] The APT attack detection method provided by this invention determines the correlation strength between each node in the candidate set of future risk nodes and APT attack risk nodes, and determines the risk score by weighted summation of the predicted signal value and the correlation strength, thereby improving the accuracy of the risk score and thus improving the accuracy of the judgment of future risk nodes of APT attacks.

[0073] According to an APT attack detection method provided by the present invention, the prediction result of the graph signal vector after passing through a preset number of time windows is expressed as follows:

[0074] in, This represents the prediction result of the graph signal vector after a preset number of time windows. Indicates the current time window. This represents the preset number of time windows. This represents the graph diffusion operator. Denotes the Laplace matrix, The graph signal vector representing the current time window; The nodes in the candidate set of future risk nodes The association strength with nodes at risk of APT attacks is expressed as follows:

[0075] in, This represents the set of nodes at risk of APT attacks. This represents the nodes in the candidate set of future risk nodes. APT attack risk nodes The sum of the weights of the edges between them.

[0076] Nodes in the candidate set of future risk nodes The image signal after a preset number of time windows is The elements in can be based on Determine the nodes in the candidate set of future risk nodes Image signal after a preset number of time windows In determining At that time, if the nodes in the future risk node candidate set APT attack risk nodes If there are multiple paths, the path is determined by the maximum sum of the edge weights. .

[0077] Then the nodes in the candidate set of future risk nodes The risk score is expressed as:

[0078] in, This represents the nodes in the candidate set of future risk nodes. The risk score, The first weight represents the predicted signal value. The second weight represents the strength of the association.

[0079] The APT attack detection method provided by this invention further improves the accuracy of risk scores by determining the prediction results of signal value vectors based on graph diffusion operators and determining the association strength based on the sum of edge weights between nodes in the candidate set of future risk nodes and APT attack risk nodes, thereby further improving the accuracy of determining future risk nodes of APT attacks.

[0080] The APT attack detection method provided by this invention has the following advantages: (1) Enhance the ability to detect covert attacks: It can identify low-frequency, slow, and distributed perturbation-type APT attacks, and solve the problem of missing detection of low-speed and slow penetration attacks.

[0081] (2) Significantly reduce false alarm rate: The Dirichlet energy is used to distinguish between isolated anomalies and structural anomalies, effectively filtering out random noise caused by business fluctuations.

[0082] (3) Enhanced mathematical interpretability: It has good mathematical interpretability, which is better than the black box model.

[0083] (4) It has predictive capabilities: it uses diffusion operators to predict future risk nodes and make risk predictions in advance.

[0084] (5) Strong mathematical stability: Based on the semi-positive definite theory of the graph Laplace matrix, the numerical stability of the model is guaranteed in complex data environments.

[0085] (6) Unknown threat detection capability: It does not rely on fixed rules and discovers atypical attacks that deviate from the normal path through the principle of structural smoothness.

[0086] This invention creatively integrates the Thulaplace quadratic form (Dirichlet energy) with the APT attack chain topology, forming an evolution from "point detection" to "field detection," realizing the transformation from local identification to global situational awareness, and solving the problems of difficulty in quantifying attack chains and low distinguishability in APT detection.

[0087] Figure 2 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 2 As shown, the electronic device may include a processor 210, a communications interface 220, a memory 230, and a communication bus 240, wherein the processor 210, the communications interface 220, and the memory 230 communicate with each other via the communication bus 240. The processor 210 can call logical instructions in the memory 230 to execute the APT attack detection methods provided in the above embodiments.

[0088] Furthermore, the logical instructions in the aforementioned memory 230 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0089] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the APT attack detection method provided in the above embodiments.

[0090] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the APT attack detection methods provided in the above embodiments.

[0091] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0092] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0093] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0094] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

[0095] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. An APT attack detection method, characterized in that, include: The Laplacian matrix of the current time window is calculated based on the feature association graph and the graph signal vector of the current time window; wherein, the nodes of the feature association graph correspond to different attack features, the edges between nodes are determined according to the logical correlation between the attack features corresponding to the nodes, and the edge weights are determined according to the correlation degree between the attack features; the graph signal vector of the current time window is used to quantify the state of the attack feature corresponding to each node in the feature association graph in the current time window. Calculate the Dirichlet energy and Rayleigh quotient of the current time window based on the Laplace matrix; An APT attack is determined to have occurred if the Dirichlet energy is greater than the ground state energy threshold and the Rayleigh quotient is less than or equal to the Rayleigh quotient low-frequency threshold; wherein the ground state energy threshold is the Dirichlet energy calculated under normal business conditions.

2. The APT attack detection method according to claim 1, characterized in that, After calculating the Dirichlet energy and Rayleigh quotient for the current time window based on the Laplace matrix, the method further includes: In response to the Dirichlet energy being greater than the ground state energy threshold and the Rayleigh quotient being greater than or equal to the Rayleigh quotient high-frequency oscillation threshold, an isolated anomaly event is determined to have occurred; wherein the isolated anomaly event includes random noise and transient high-frequency attacks, and the Rayleigh quotient high-frequency oscillation threshold is greater than the Rayleigh quotient low-frequency threshold.

3. The APT attack detection method according to claim 1, characterized in that, After calculating the Dirichlet energy and Rayleigh quotient for the current time window based on the Laplace matrix, the method further includes: In response to the Dirichlet energy being greater than the ground state energy threshold, and the Rayleigh quotient being between the low-frequency threshold and the high-frequency oscillation threshold of the Rayleigh quotient, an event to be investigated is generated and reported.

4. The APT attack detection method according to claim 1, characterized in that, After calculating the Dirichlet energy and Rayleigh quotient for the current time window based on the Laplace matrix, the method further includes: If the Dirichlet energy is less than or equal to the ground state energy threshold, then it is determined that the operation is normal.

5. The APT attack detection method according to claim 1, characterized in that, Each element of the graph signal vector represents the signal value of the attack feature corresponding to each node; where: The signal value is defined as the offset of the attack feature distribution; wherein the offset of the attack feature distribution includes the KL divergence or JS divergence between the historical baseline distribution of the attack features and the observed distribution of the current time window.

6. The APT attack detection method according to claim 1, characterized in that, The Laplace matrix is ​​represented as follows: ； in, Denotes the Laplace matrix, This represents a weighted adjacency matrix constructed based on the edge weights in the feature association graph. This represents the degree matrix of the weighted adjacency matrix; The Dirichlet energy is represented as follows: ； The Rayleigh quotient is represented as: in, Represents Dirichlet energy. Represents the graph signal vector, Indicates the transpose operation; This refers to Rayleigh.

7. The APT attack detection method according to claim 5, characterized in that, After determining that an APT attack has occurred, the method further includes: APT attack risk nodes are identified by comparing the signal values ​​of attack features corresponding to each node in the feature association graph with the corresponding signal value thresholds. Predicting graph signal vectors after a preset number of time windows based on graph diffusion operators; For the remaining nodes in the feature association graph, excluding the nodes at risk of APT attacks, The predicted signal values ​​of each remaining node after the preset number of time windows are obtained based on the prediction results of the graph signal vector after the preset number of time windows. A candidate set of future risk nodes is constructed based on the remaining nodes whose predicted signal values ​​are greater than a preset threshold; Calculate the risk score of each node in the candidate set of future risk nodes, and determine the future risk nodes for APT attacks based on the risk scores.

8. The APT attack detection method according to claim 7, characterized in that, The calculation of the risk score for each node in the candidate set of future risk nodes includes: For each node in the candidate set of future risk nodes, determine the association strength between the node and the APT attack risk node; The risk score is determined by weighted summation of the predicted signal value and the correlation strength.

9. The APT attack detection method according to claim 8, characterized in that, The prediction result of the graph signal vector after passing through a preset number of time windows is expressed as follows: in, This represents the prediction result of the graph signal vector after a preset number of time windows. Indicates the current time window. This represents the preset number of time windows. This represents the graph diffusion operator. Denotes the Laplace matrix, The graph signal vector representing the current time window; The nodes in the candidate set of future risk nodes The association strength with nodes at risk of APT attacks is expressed as follows: in, This represents the set of nodes at risk of APT attacks. This represents the nodes in the candidate set of future risk nodes. APT attack risk nodes The sum of the edge weights between them.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the APT attack detection method as described in any one of claims 1 to 9.

Images