An attack detection method and system
Patent Information
- Application Number
- CN202611146948.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-07-30
- Publication Date
- 2026-10-13
Smart Images
Figure CN122908981A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of industrial internet security technology, and in particular to an attack detection method and system. Background Technology
[0002] Advanced Persistent Threat (APT) attacks are characterized by multi-stage, long-term, and highly covert attacks. Attackers typically achieve their goals through multiple stages, including initial intrusion, persistence, lateral movement, and data theft. Traditional rule-based or signature-based detection methods struggle to capture the contextual relationships within APT attacks. In recent years, provenance graph-based methods have become a research hotspot, as they construct causal relationship graphs of system events to trace the complete chain of attack behavior.
[0003] Currently, related technologies typically achieve APT attack detection based on rule-based or anomaly propagation methods or graph similarity. These methods often rely solely on a single detection result when making decisions, making them susceptible to accidental noise or single-point anomalies, which can lead to false alarms. Consequently, the accuracy and robustness of APT attack detection are unsatisfactory.
[0004] Therefore, the problems with the relevant technologies still need to be solved and optimized. Summary of the Invention
[0005] The purpose of this invention is to at least partially solve one of the technical problems existing in the related art.
[0006] Therefore, one objective of this invention is to provide an attack detection method and system, wherein the method can effectively improve the accuracy and robustness of APT attack detection.
[0007] To achieve the above-mentioned technical objectives, the technical solutions adopted in the embodiments of this application include: In a first aspect, embodiments of this application provide an attack detection method, including: Obtain several snapshots of the causal graph of the target system within the current time window; All the causal graph snapshots are input into a trained subgraph matching network for matching and recognition, to obtain a subgraph matching group for each causal graph snapshot; A joint decision is made on all the subgraph matching groups to obtain the attack detection result of the target system. The trained subgraph matching network is obtained through the following steps: Obtain multi-source log data from the target system, and construct a causal origination graph based on the multi-source log data; A restart-based random walk is performed on the causal origination graph to obtain several random walk subgraphs. The random walk subgraphs are used to represent the graph set of process nodes visited by the origination node in a random walk. The origination node is any one of the process nodes in the causal origination graph. Based on all the random walk subgraphs, the initialized subgraph matching network is trained to obtain the trained subgraph matching network.
[0008] In addition, the method according to the above embodiments of this application may also have the following additional technical features: Furthermore, in one embodiment of this application, the step of jointly determining all the subgraph matching groups to obtain the attack detection result of the target system includes: Obtain the average threshold of the window and the attack matching conditions; The probability values of all the subgraph matching groups are filtered to obtain several target probability values. Each target probability value is used to characterize the maximum subgraph matching probability among all the subgraph matching probabilities of the corresponding subgraph matching group. Based on the average threshold of the window and the attack matching conditions, attack detection is performed on all the target probability values to obtain the attack detection result.
[0009] Further, in one embodiment of this application, the step of performing attack detection on all the target probability values based on the window average threshold and the attack matching condition to obtain the attack detection result includes: Based on the window average threshold, perform average threshold analysis on all the target probability values to obtain threshold analysis information; Based on the attack matching conditions, condition matching is performed on all the target probability values to obtain condition matching information; The attack detection result is determined based on the threshold analysis information and the condition matching information.
[0010] Furthermore, in one embodiment of this application, the step of performing a restart-based random walk on the causal origin graph to obtain several random walk subgraphs includes: Obtain the restart interval, neighbor access interval, maximum step size, and first intermediate node; the first intermediate node is the source node or the second intermediate node of the previous step. Based on the random number, interval matching is performed on the restart interval and the neighbor access interval to obtain the interval matching result; If the interval matching result is that the random number is within the restart interval, then the first intermediate node is updated according to the source node to obtain the second intermediate node of the current traversal step; or, if the interval matching result is that the random number is within the neighbor access interval, then the causal source graph is processed by neighbor process node access according to the first intermediate node to obtain the second intermediate node of the current traversal step. If the current walk step is less than the maximum walk step, then return to the steps of obtaining the restart interval, neighbor access interval, maximum walk step and first intermediate node; or, if the current walk step is equal to the maximum walk step, then obtain the random walk subgraph based on the source node and all the second intermediate nodes.
[0011] Further, in one embodiment of this application, the subgraph matching network includes a cascaded encoding subnetwork and a calibration subnetwork, and the step of training the initialized subgraph matching network based on all the random walk subgraphs to obtain the trained subgraph matching network includes: Obtain attack pattern diagram; All the random walk subgraphs are input into the initialized encoding subnetwork for parameter update, resulting in a trained encoding subnetwork; Freeze the parameters of the trained encoding subnetwork, input the attack pattern graph and / or all the random walk subgraphs into the initialized subgraph matching network for parameter update, and obtain the trained calibration subnetwork; The trained subgraph matching network is obtained based on the trained encoding subnetwork and the trained calibration subnetwork.
[0012] Furthermore, in one embodiment of this application, the step of inputting all the random walk subgraphs into the initialized encoding subnetwork for parameter update to obtain the trained encoding subnetwork includes: Node features are extracted from the random walk subgraph to obtain several original node features; Based on the random walk subgraph, attention fusion based on dual bias is performed on the original features of all nodes to obtain several node fusion features; Global embedding analysis is performed on the fusion features of all the nodes to obtain the global embedding vector of the random walk subgraph; Based on the global embedding vector, the initialized encoding subnetwork is updated to obtain the trained encoding subnetwork.
[0013] Furthermore, in this embodiment of the application, the step of performing attention fusion based on dual bias on all the original features of the nodes to obtain several node fusion features includes: An edge type bias analysis is performed on the random walk subgraph to obtain several edge type bias terms; Shortest path distance bias analysis is performed on the random walk subgraph to obtain several shortest path distance bias terms; Based on all the edge type bias terms and the shortest path distance bias terms, attention fusion is performed on all the original features of the nodes to obtain several node fused features.
[0014] Secondly, embodiments of this application provide an attack detection system, including: The first processing unit is used to acquire several causal graph snapshots of the target system within the current time window; The second processing unit is used to input all the causal graph snapshots into the trained subgraph matching network for matching and recognition, so as to obtain the subgraph matching group for each causal graph snapshot; The third processing unit is used to perform a joint decision on all the subgraph matching groups to obtain the attack detection result of the target system. The trained subgraph matching network is obtained through the following steps: Obtain multi-source log data from the target system, and construct a causal origination graph based on the multi-source log data; A restart-based random walk is performed on the causal origination graph to obtain several random walk subgraphs. The random walk subgraphs are used to represent the graph set of process nodes visited by the origination node in a random walk. The origination node is any one of the process nodes in the causal origination graph. Based on all the random walk subgraphs, the initialized subgraph matching network is trained to obtain the trained subgraph matching network.
[0015] Thirdly, embodiments of this application also provide an electronic device, including: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor performs the method described above.
[0016] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a processor-executable program, which, when executed by the processor, is used to implement the above-described method.
[0017] Fifthly, embodiments of this application also provide a computer program product, which includes a computer program stored in a computer-readable storage medium. A processor of an electronic device reads the computer program from the computer-readable storage medium and executes the computer program, causing the electronic device to perform the method described above.
[0018] The advantages and beneficial effects of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application: This application discloses an attack detection method and system, wherein the method acquires several causal graph snapshots of a target system within a current time window; inputs all the causal graph snapshots into a trained subgraph matching network for matching and identification, obtaining a subgraph matching group for each causal graph snapshot; performs joint decision on all the subgraph matching groups to obtain the attack detection result of the target system; wherein the trained subgraph matching network is trained through the following steps: acquiring multi-source log data of the target system, constructing a causal origination graph based on the multi-source log data; performing a restart-based random walk on the causal origination graph to obtain several random walk subgraphs, wherein the random walk subgraphs are used to represent the graph set of process nodes visited by the origination node in a random walk; the origination node is any one of the process nodes in the causal origination graph; and training the initialized subgraph matching network based on all the random walk subgraphs to obtain the trained subgraph matching network. This method, by jointly judging the subgraph matching groups of each causal graph snapshot within the current time window, can suppress false alarms caused by random noise or single-point anomalies, effectively improving the accuracy and robustness of APT attack detection. Attached Figure Description
[0019] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the following description is provided with accompanying drawings of the relevant technical solutions in the embodiments of this application or the prior art. It should be understood that the accompanying drawings described below are only for the purpose of clearly illustrating some embodiments of the technical solutions in this application. For those skilled in the art, other drawings can be obtained based on these drawings without any creative effort.
[0020] Figure 1 A flowchart illustrating an attack detection method provided in an embodiment of this application; Figure 2 This is a schematic diagram of the framework of an attack detection system provided in an embodiment of this application; Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation
[0021] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting this application. The step numbers in the following embodiments are set only for ease of explanation, and there is no limitation on the order between the steps. The execution order of each step in the embodiments can be adaptively adjusted according to the understanding of those skilled in the art.
[0022] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.
[0023] Currently, related technologies typically achieve APT attack detection based on rule-based or anomaly propagation methods or graph similarity. These methods often rely solely on a single detection result when making decisions, making them susceptible to accidental noise or single-point anomalies, which can lead to false alarms. Consequently, the accuracy and robustness of APT attack detection are unsatisfactory.
[0024] Specifically, rule-based or anomaly propagation-based methods, such as MORSE and Tactical Provenance Analysis, rely on predefined attack patterns or anomaly labels, resulting in poor generalization ability and high rule maintenance costs, which makes the accuracy and robustness of APT attack detection unsatisfactory.
[0025] Graph similarity-based approaches, such as UNICORN and ProvG, transform the detection problem into graph structure comparison. However, in the process of graph structure comparison, static neighborhood-extended k-ego subgraphs or graph convolutional networks (such as RGCN and GCN) are usually used for processing. Since static neighborhood-extended k-ego subgraphs ignore the temporal order of attack events, they are difficult to capture the temporal dependencies in the attack chain, especially lacking sensitivity to slow attacks and long-term latent attacks. Graph convolutional networks have limited ability to model long-distance dependencies in heterogeneous graphs, and the number of parameters increases linearly with the increase of edge types.
[0026] It should be noted that the aforementioned related technologies are only used to assist in understanding the technical solutions of this application and do not mean that they belong to the publicly disclosed prior art.
[0027] In view of this, embodiments of this application provide an attack detection method and system. The method performs joint judgment on the subgraph matching groups of each causal graph snapshot within the current time window. Specifically, it performs attack detection on the target probability value of each subgraph matching group by using the window average threshold and attack matching conditions. By considering the detection data within the current time window, it suppresses false alarms caused by random noise or single-point anomalies, effectively improving the accuracy and robustness of APT attack detection.
[0028] Furthermore, the subgraph matching network in this method uses a restart-based random walk mechanism, specifically a restart and random access to neighbor process nodes, to make the walk more inclined to select the most recently occurring interactions in the target system and the process nodes that play a pivotal role, so as to obtain several random walk subgraphs for each process node. Each random walk subgraph can fully represent the temporal context of a structure, so that the temporal order of attack events is fully considered, that is, the temporal dependencies in the attack chain can be captured better, which is conducive to improving the accuracy and robustness of APT detection.
[0029] Furthermore, this method utilizes dual-bias-based attention fusion in the encoded sub-network, specifically by introducing an edge type bias term and a shortest path distance bias term. This allows it to model long-range dependencies between any pair of nodes in the random walk subgraph, while decoupling the parameter size from the number of edge types. Combined with subsequent attention fusion, this approach can improve the accuracy and robustness of APT detection in the subgraph matching network.
[0030] Reference Figure 1 In this application embodiment, an attack detection method includes: Step 110: Obtain several causal graph snapshots of the target system within the current time window; In this embodiment, the target system can be a control system that controls and schedules the power grid. A causal graph snapshot can be obtained by acquiring audit log data of the target system at each time point within the current time window, and constructing a corresponding source graph based on the audit log data at each time point, denoted as a causal graph snapshot. Each causal graph snapshot is used to characterize the system activities of the target system at the corresponding time within the current time window. Specifically, these system activities can be all active processes of the target system and their interaction relationships.
[0031] Step 120: Input all the causal graph snapshots into the trained subgraph matching network for matching and recognition, and obtain the subgraph matching group for each causal graph snapshot; In this embodiment, for any causal graph snapshot, the matching identification can first be performed by extracting the causal graph snapshot into several temporal context subgraphs centered on each process node of the causal graph snapshot, and inputting each temporal context subgraph into a trained subgraph matching network. The subgraph matching network calculates the subgraph matching probability of each temporal context subgraph based on the embedding vector of the pre-learned / stored APT attack pattern graph. This subgraph matching probability is used to characterize the matching probability between the temporal context subgraph and the APT attack pattern graph. Then, the subgraph matching probabilities of all temporal context subgraphs are determined as the subgraph matching group of the causal graph snapshot.
[0032] Step 130: Perform a joint decision on all the subgraph matching groups to obtain the attack detection result of the target system; In this embodiment of the application, multiple matching probabilities within the current time window can be jointly judged to reduce false alarms caused by factors such as occasional noise, thereby obtaining the attack detection result of the target system.
[0033] In some embodiments, the step of jointly determining all the subgraph matching groups to obtain the attack detection result of the target system includes: Obtain the average threshold of the window and the attack matching conditions; The probability values of all the subgraph matching groups are filtered to obtain several target probability values. Each target probability value is used to characterize the maximum subgraph matching probability among all the subgraph matching probabilities of the corresponding subgraph matching group. In this embodiment, the average window threshold can be any one of 0.5, 0.6, 0.8, etc. The attack matching condition is used to determine whether there are at least M target probability values greater than a preset threshold within the current time window, where M is a positive integer less than the total number of target probability values. The preset threshold can be any one of 0.5, 0.6, 0.65, etc. For any subgraph matching group, probability value filtering can be performed by comparing the magnitude of the matching probabilities of all subgraphs in the subgraph matching group and determining the largest subgraph matching probability as the target probability value of the subgraph matching group.
[0034] Based on the average threshold of the window and the attack matching conditions, attack detection is performed on all the target probability values to obtain the attack detection result.
[0035] Further, the step of performing attack detection on all the target probability values based on the window average threshold and the attack matching condition to obtain the attack detection result includes: Based on the window average threshold, perform average threshold analysis on all the target probability values to obtain threshold analysis information; Based on the attack matching conditions, condition matching is performed on all the target probability values to obtain condition matching information; The attack detection result is determined based on the threshold analysis information and the condition matching information.
[0036] In this embodiment, the average threshold analysis can first calculate the average of all target probability values and compare the average value with the average threshold of the window to obtain threshold analysis information. Conditional matching can then determine whether all target probability values meet the attack matching conditions, generating conditional matching information indicating a match when at least M target probability values are greater than a preset threshold, or generating conditional matching information indicating a mismatch when no M target probability values are greater than the preset threshold.
[0037] Specifically, if the threshold analysis information is that the average value is greater than the average threshold of the window, and the condition matching information is a match, an attack detection result can be obtained that indicates that the target system has APT attack activities within the current time window; or, if the threshold analysis information is that the average value is less than or equal to the average threshold of the window, or the condition matching information is a mismatch, an attack detection result can be obtained that indicates that the target system does not have APT attack activities within the current time window.
[0038] The trained subgraph matching network is obtained through the following steps: Obtain multi-source log data from the target system, and construct a causal origination graph based on the multi-source log data; In this embodiment, the multi-source log data can be audit logs, system call records, process monitoring data, etc., of the target system over historical periods. The causal origination graph can first be generated by parsing the system entities and interaction events between them from the multi-source log data. System entities include processes, files, network sockets, and registry entries; interaction events between system entities can include process creation, file read / write, network connection, memory mapping, etc. Then, based on graph generation technology, each system entity is identified as a process node in the graph, and each interaction event is identified as a directed edge. A directed heterogeneous graph is constructed based on all process nodes and directed edges, denoted as the causal origination graph.
[0039] It should be noted that the method of obtaining the causal graph snapshot in step 110 is similar to the method of obtaining the causal origin graph, and can be easily deduced by analogy.
[0040] A restart-based random walk is performed on the causal origination graph to obtain several random walk subgraphs. The random walk subgraphs are used to represent the graph set of process nodes visited by the origination node in a random walk. The origination node is any one of the process nodes in the causal origination graph. In the embodiments of this application, for any process node in the causal origin graph, the process node can be used as the starting point to perform several restart-based random walks within the causal origin graph to obtain a graph set of process nodes visited by the process node in each random walk, which is denoted as the random walk subgraph.
[0041] In some embodiments, performing a restart-based random walk on the causal origin graph to obtain several random walk subgraphs includes: Obtain the restart interval, neighbor access interval, maximum step size, and first intermediate node; the first intermediate node is the source node or the second intermediate node of the previous step. Based on the random number, interval matching is performed on the restart interval and the neighbor access interval to obtain the interval matching result; If the interval matching result is that the random number is within the restart interval, then the first intermediate node is updated according to the source node to obtain the second intermediate node of the current traversal step; or, if the interval matching result is that the random number is within the neighbor access interval, then the causal source graph is processed by neighbor process node access according to the first intermediate node to obtain the second intermediate node of the current traversal step. If the current walk step is less than the maximum walk step, then return to the steps of obtaining the restart interval, neighbor access interval, maximum walk step and first intermediate node; or, if the current walk step is equal to the maximum walk step, then obtain the random walk subgraph based on the source node and all the second intermediate nodes.
[0042] In this embodiment of the application, the maximum number of steps for any random walk of the source node can be preset, for example, the maximum number of steps. For the first step in a random walk, its first intermediate node can be the source node, while for the second and subsequent steps in a random walk, the first intermediate node can be the second intermediate node of the previous step.
[0043] Understandably, for the current step, the restart interval can be represented as: The neighbor access range can be ,in, The specific value can be set according to the actual situation, such as any one of 0.2, 0.5, 0.4, etc.; while the random number can be a value randomly generated within the range of 0 to 1. Interval matching can determine whether the random number falls within the restart interval or the neighbor access interval to obtain the interval matching result.
[0044] Specifically, if the interval matching result is that the random number is within the restart interval, then based on the source node, the first intermediate node is updated in the form of replacement to obtain the second intermediate node of the current walk. The specific node indicated by the second intermediate node of the current walk is the source node, so that the source node will start walking again from the starting point in the next walk of this random walk process; or, if the interval matching result is that the random number is within the neighbor access interval, then the process node that is the neighbor of the first intermediate node of the current walk is randomly selected as the next step to obtain the second intermediate node of the current walk.
[0045] For example, when the random matching result is a random number within the neighbor access interval, the probability of any neighbor's process node being selected can be:
[0046] in, process nodes of neighbors The probability of being selected can make the walk more likely to choose the most recently interacted and height-numbered hub nodes; It is an exponential function with the natural constant as its base; This is the time decay coefficient, and its value range can be [0.1, 1]. This is the time difference; The first intermediate node In a causal origin graph, the larger the total degree value, the denser the interactions between nodes in the causal origin graph. This is the degree index weighting factor, and its value can be [0.5, 2]. The current time is randomly selected; The first intermediate node process nodes with neighbors The event timestamp of the directed edge.
[0047] After obtaining the second intermediate node of the current walk step, we can compare the size relationship between the current walk step and the maximum walk step. If the current walk step is less than the maximum walk step, we can return to the steps of obtaining the restart interval, the neighbor visit interval, the maximum walk step, and the first intermediate node to proceed to the next walk step. Alternatively, if the current walk step is equal to the maximum walk step, it means that the current random walk process of the source node has ended. At this time, we can construct the random walk subgraph of the source node in this random walk process based on the source node and the second intermediate node under each walk step, combined with the directed edges between the nodes in the causal relationship.
[0048] Based on all the random walk subgraphs, the initialized subgraph matching network is trained to obtain the trained subgraph matching network.
[0049] In this embodiment of the application, all random walk subgraphs of each process node of the causal origin graph can be input into an initialized subgraph matching network for training to obtain a trained subgraph matching network.
[0050] In some embodiments, the subgraph matching network includes a cascaded encoding subnetwork and a calibration subnetwork. The step of training the initialized subgraph matching network based on all the random walk subgraphs to obtain the trained subgraph matching network includes: Obtain attack pattern diagram; All the random walk subgraphs are input into the initialized encoding subnetwork for parameter update, resulting in a trained encoding subnetwork; In this embodiment, the attack pattern graph can be a source graph of known APT attack patterns, and there are various ways to obtain it, which will not be described in detail here. The initialized encoding subnetwork can be a Transformer encoder, and the Transformer encoder is optimized by introducing double bias in the attention mechanism of each layer of the Transformer encoder, so that the encoding subnetwork can perceive the semantic differences of the interaction relationship and the topological position of the node in the graph.
[0051] Parameter updates can be achieved by inputting each random walk subgraph of each process node into an initialized encoding subnetwork for training, thereby updating the network parameters of the encoding subnetwork and obtaining a trained encoding subnetwork. Various specific model training methods exist, which will not be elaborated upon here.
[0052] Further, the step of inputting all the random walk subgraphs into the initialized encoding subnetwork for parameter update to obtain the trained encoding subnetwork includes: Node features are extracted from the random walk subgraph to obtain several original node features; In this embodiment, for any random walk subgraph, node feature extraction can involve extracting components such as the node type embedding vector, the normalized degree value, and the difference between the node's first appearance time and the current time for each subgraph node. All components are then concatenated and mapped through a linear projection layer to obtain the original node features of each subgraph node. Specifically, the node type embedding vector can be the embedding vector for processes, files, network sockets, or registry entries. The normalized degree value can be the logarithmic normalized form of the total degree of the subgraph node in the random walk subgraph. The difference between the node's first appearance time and the current time can be obtained by recording the time the subgraph node was first visited in the random walk subgraph, calculating the difference with the current analysis time, and then taking a logarithmic transformation, so that the model can perceive the newness or oldness of the nodes.
[0053] Based on the random walk subgraph, attention fusion based on dual bias is performed on the original features of all nodes to obtain several node fusion features; Furthermore, the dual-bias attention fusion of all the original features of the nodes yields several node fusion features, including: An edge type bias analysis is performed on the random walk subgraph to obtain several edge type bias terms; Shortest path distance bias analysis is performed on the random walk subgraph to obtain several shortest path distance bias terms; Based on all the edge type bias terms and the shortest path distance bias terms, attention fusion is performed on all the original features of the nodes to obtain several node fused features.
[0054] In this embodiment of the application, for each directed edge in the random walk subgraph, each directed edge corresponds to a category such as process creation, file reading, file writing, network connection or memory mapping. The learnable scalar bias parameter of each directed edge can be obtained and recorded as the edge type bias term of the directed edge. Its initial value can be set to 0 and updated accordingly during the update process in the encoded subnetwork.
[0055] Understandably, for any pair of nodes in a random walk subgraph, the shortest path distance bias analysis can be performed by calculating the length of the undirected shortest path between the two subgraph nodes in the pair and mapping this undirected shortest path length into a vector form using sine or cosine position encoding to obtain the shortest path distance bias term for the pair. The length of the undirected shortest path can be determined by the minimum number of edges required to connect the two subgraph nodes in the pair.
[0056] Attention fusion can be achieved by inputting the original node features of each subgraph node into the encoder, and then determining the attention score between each subgraph node and the other subgraph nodes based on the edge type bias term and the shortest path distance bias term. The attention fusion can be determined by weighting and aggregating the original node features through the attention scores. There are already various attention mechanisms in the encoder, such as multi-head self-attention mechanism, which will not be elaborated here.
[0057] For example, the attention score can be represented as:
[0058] in, The attention score between the i-th subgraph node and the j-th subgraph node is calculated by considering the attention weight, as well as the semantic feature similarity between nodes, the type importance of the interaction relationship, and the proximity of the nodes in the graph structure. Let be the query vector of the i-th subgraph node under the attention mechanism; Let be the key vector of the j-th subgraph node under the attention mechanism; This is the scaling factor in the attention mechanism; This is the edge type bias term corresponding to the directed edge between the i-th subgraph node and the j-th subgraph node; This is the shortest path distance offset term between the i-th subgraph node and the j-th subgraph node.
[0059] Global embedding analysis is performed on the fusion features of all the nodes to obtain the global embedding vector of the random walk subgraph; Based on the global embedding vector, the initialized encoding subnetwork is updated to obtain the trained encoding subnetwork.
[0060] In this embodiment, for any random walk subgraph, global embedding analysis can be performed by averaging the fusion features of all nodes in the random walk subgraph element-wise along each dimension using mean pooling to obtain the global embedding vector of the random walk subgraph. Network update can be performed by constructing several training triples from the subgraph pool of each process node in the causal origination graph, and inputting each training triple into the encoder to obtain several global embedding vectors corresponding to the training triples. Then, based on all the global embedding vectors of the training triples, the corresponding target loss value is calculated, and the network parameters in the encoding subnetwork are updated using the backpropagation algorithm until the model converges to obtain the trained encoding subnetwork.
[0061] It is understandable that a training triple can include anchor samples, positive samples, and negative samples. Anchor samples can be any random walk subgraph in the subgraph pool of a certain process node; positive samples can be random walk subgraphs in the corresponding subgraph pool where both nodes and edges are contained in the anchor sample. The inclusion of nodes and edges in the corresponding subgraph pool in the anchor sample is called the subgraph inclusion relationship; negative samples can be any random walk subgraph that does not satisfy the subgraph inclusion relationship with the anchor sample.
[0062] It should be noted that since the subgraphs generated by multiple random walks of the same process node are all centered on that node, and the walk ranges and directions differ, there are significant overlaps and inclusion relationships among these subgraphs. Therefore, positive sample pairs can be naturally constructed based on this homology relationship. Positive samples and anchor points form positive sample pairs, which should maintain a relatively close distance in the embedding space.
[0063] The target loss value can be determined by minimizing the triplet loss function. The objective of this triplet loss function is to ensure that the distance between the positive sample embedding and the anchor embedding, even with a marginal parameter, is still less than the distance between the negative sample embedding and the anchor embedding. This triplet loss function can be expressed as:
[0064] in, This is a functional representation of the triplet loss function; Anchor point sample; Positive samples; Negative samples; It is a function for maximizing the value; The embedding vector of the anchor sample; The embedding vector of the positive sample; The embedding vector of the negative sample; This is a marginal parameter, and its value can be any one of 0.1, 0.15, etc.
[0065] Freeze the parameters of the trained encoding subnetwork, input the attack pattern graph and / or all the random walk subgraphs into the initialized subgraph matching network for parameter update, and obtain the trained calibration subnetwork; The trained subgraph matching network is obtained based on the trained encoding subnetwork and the trained calibration subnetwork.
[0066] In this embodiment, the trained encoding subnetwork parameters can be frozen, and the attack pattern graph and / or random walk subgraph can be input into a subgraph matching network composed of the encoding subnetwork and the calibration subnetwork for parameter update. This updates the learnable parameters of the calibration subnetwork, and the parameter update content of the calibration subnetwork is similar to that of the aforementioned encoding subnetwork, which can be easily deduced to obtain the trained calibration subnetwork. Specifically, the calibration subnetwork can be an activation function layer, which maps the Euclidean distance between the two embedding vectors output by the encoding subnetwork to the calibrated matching probability. The calibrated matching probability can be expressed as:
[0067] in, The calibrated matching probability; is the sigmoid activation function; d is the Euclidean distance between the two embedding vectors output by the encoder subnetwork; and Here are the learnable parameters, where, Initialize to the mean of the embedding distances of all positive sample pairs and the mean of the embedding distances of all negative sample pairs. Initialize to 1.
[0068] Understandably, the cascaded and trained encoding and calibration subnetworks can be defined as the trained subgraph matching network. In practical applications, the temporal context subgraph of a causal graph snapshot can be input into the trained subgraph matching network. The encoding subnetwork in the subgraph matching network outputs the global embedding vector of the temporal context subgraph, and the Euclidean distance between this global embedding vector and the embedding vector of the APT attack pattern graph is calculated. Then, the calibration subnetwork maps the Euclidean distance to the matching probability to obtain the subgraph matching probability of the temporal context subgraph.
[0069] Reference Figure 2 An attack detection system proposed in this application includes: The first processing unit 101 is used to acquire several causal graph snapshots of the target system within the current time window; The second processing unit 102 is used to input all the causal graph snapshots into the trained subgraph matching network for matching and recognition, so as to obtain the subgraph matching group for each causal graph snapshot; The third processing unit 103 is used to perform a joint decision on all the subgraph matching groups to obtain the attack detection result of the target system. The trained subgraph matching network is obtained through the following steps: Obtain multi-source log data from the target system, and construct a causal origination graph based on the multi-source log data; A restart-based random walk is performed on the causal origination graph to obtain several random walk subgraphs. The random walk subgraphs are used to represent the graph set of process nodes visited by the origination node in a random walk. The origination node is any one of the process nodes in the causal origination graph. Based on all the random walk subgraphs, the initialized subgraph matching network is trained to obtain the trained subgraph matching network.
[0070] It is understood that the content of the above method embodiments is applicable to this system embodiment. The specific functions implemented in this system embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.
[0071] Reference Figure 3 This application also provides an electronic device, including: At least one processor 201; At least one memory 202 is used to store at least one program; When the at least one program is executed by the at least one processor 201, the at least one processor 201 implements the method embodiment described above.
[0072] Similarly, it can be understood that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented by this device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.
[0073] This application also provides a computer-readable storage medium storing a program executable by a processor 201, which, when executed by the processor 201, is used to implement the above-described method embodiments.
[0074] Similarly, the content of the above method embodiments is applicable to the present computer-readable storage medium embodiments. The specific functions implemented by the present computer-readable storage medium embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.
[0075] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps in the above-described method embodiments.
[0076] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above methods.
[0077] In some alternative embodiments, the functions / operations mentioned in the block diagrams may not occur in the order shown in the operation diagrams. For example, depending on the functions / operations involved, two consecutively shown blocks may actually be executed substantially simultaneously, or the blocks may sometimes be executed in reverse order. Furthermore, the embodiments presented and described in the flowcharts of this application are provided by way of example to provide a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is changed and sub-operations described as part of a larger operation are executed independently.
[0078] Furthermore, although this application is described in the context of functional modules, it should be understood that, unless otherwise stated to the contrary, one or more of the functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding this application. Rather, given the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed herein, the actual implementation of the module will be understood within the scope of conventional technology for an engineer. Therefore, those skilled in the art can implement the application set forth in the claims using ordinary techniques without excessive experimentation. It is also understood that the specific concepts disclosed are merely illustrative and not intended to limit the scope of this application, which is determined by the full scope of the appended claims and their equivalents.
[0079] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods in the embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0080] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-including system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.
[0081] More specific examples (a non-exhaustive list) of computer-readable media include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which programs can be printed, because programs can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.
[0082] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.
[0083] In the foregoing description of this specification, the references to terms such as "one embodiment," "another embodiment," or "some embodiments," etc., indicate that a specific feature, structure, material, or characteristic described in connection with an embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.
[0084] Although embodiments of this application have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of this application, the scope of which is defined by the claims and their equivalents.
[0085] The above is a detailed description of the preferred embodiments of this application, but this application is not limited to the embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of this application, and these equivalent modifications or substitutions are all included within the scope defined by the claims of this application.
Claims
1. An attack detection method, characterized in that, include: Obtain several snapshots of the causal graph of the target system within the current time window; All the causal graph snapshots are input into a trained subgraph matching network for matching and recognition, to obtain a subgraph matching group for each causal graph snapshot; A joint decision is made on all the subgraph matching groups to obtain the attack detection result of the target system. The trained subgraph matching network is obtained through the following steps: Obtain multi-source log data from the target system, and construct a causal origination graph based on the multi-source log data; A restart-based random walk is performed on the causal origination graph to obtain several random walk subgraphs. The random walk subgraphs are used to represent the graph set of process nodes visited by the origination node in a random walk. The origination node is any one of the process nodes in the causal origination graph. Based on all the random walk subgraphs, the initialized subgraph matching network is trained to obtain the trained subgraph matching network.
2. The method according to claim 1, characterized in that, The step of jointly deciding on all the subgraph matching groups to obtain the attack detection result of the target system includes: Obtain the average threshold of the window and the attack matching conditions; The probability values of all the subgraph matching groups are filtered to obtain several target probability values. Each target probability value is used to characterize the maximum subgraph matching probability among all the subgraph matching probabilities of the corresponding subgraph matching group. Based on the average threshold of the window and the attack matching conditions, attack detection is performed on all the target probability values to obtain the attack detection result.
3. The method according to claim 2, characterized in that, The step of performing attack detection on all the target probability values based on the window average threshold and the attack matching conditions to obtain the attack detection result includes: Based on the average threshold of the window, perform average threshold analysis on all the target probability values to obtain threshold analysis information; Based on the attack matching conditions, condition matching is performed on all the target probability values to obtain condition matching information; The attack detection result is determined based on the threshold analysis information and the condition matching information.
4. The method according to claim 1, characterized in that, The process of performing a restart-based random walk on the causal origin graph yields several random walk subgraphs, including: Obtain the restart interval, neighbor access interval, maximum step size, and first intermediate node; the first intermediate node is the source node or the second intermediate node of the previous step. Based on the random number, interval matching is performed on the restart interval and the neighbor access interval to obtain the interval matching result; If the interval matching result is that the random number is within the restart interval, then the first intermediate node is updated according to the source node to obtain the second intermediate node of the current traversal step; or, if the interval matching result is that the random number is within the neighbor access interval, then the causal source graph is processed by neighbor process node access according to the first intermediate node to obtain the second intermediate node of the current traversal step. If the current walk step is less than the maximum walk step, then return to the steps of obtaining the restart interval, neighbor access interval, maximum walk step and first intermediate node; or, if the current walk step is equal to the maximum walk step, then obtain the random walk subgraph based on the source node and all the second intermediate nodes.
5. The method according to any one of claims 1-4, characterized in that, The subgraph matching network includes a cascaded encoding subnetwork and a calibration subnetwork. The step of training the initialized subgraph matching network based on all the random walk subgraphs to obtain the trained subgraph matching network includes: Obtain attack pattern diagram; All the random walk subgraphs are input into the initialized encoding subnetwork for parameter update, resulting in a trained encoding subnetwork; Freeze the parameters of the trained encoding subnetwork, input the attack pattern graph and / or all the random walk subgraphs into the initialized subgraph matching network for parameter update, and obtain the trained calibration subnetwork; The trained subgraph matching network is obtained based on the trained encoding subnetwork and the trained calibration subnetwork.
6. The method according to claim 5, characterized in that, The step of inputting all the random walk subgraphs into the initialized encoding subnetwork for parameter update to obtain the trained encoding subnetwork includes: Node features are extracted from the random walk subgraph to obtain several original node features; Based on the random walk subgraph, attention fusion based on dual bias is performed on the original features of all nodes to obtain several node fusion features; Global embedding analysis is performed on the fusion features of all the nodes to obtain the global embedding vector of the random walk subgraph; Based on the global embedding vector, the initialized encoding subnetwork is updated to obtain the trained encoding subnetwork.
7. The method according to claim 6, characterized in that, The process involves performing dual-bias attention fusion on the original features of all the nodes to obtain several fused node features, including: An edge type bias analysis is performed on the random walk subgraph to obtain several edge type bias terms; Shortest path distance bias analysis is performed on the random walk subgraph to obtain several shortest path distance bias terms; Based on all the edge type bias terms and the shortest path distance bias terms, attention fusion is performed on all the original features of the nodes to obtain several node fused features.
8. An attack detection system, characterized in that, include: The first processing unit is used to acquire several causal graph snapshots of the target system within the current time window; The second processing unit is used to input all the causal graph snapshots into the trained subgraph matching network for matching and recognition, so as to obtain the subgraph matching group for each causal graph snapshot; The third processing unit is used to perform a joint decision on all the subgraph matching groups to obtain the attack detection result of the target system. The trained subgraph matching network is obtained through the following steps: Obtain multi-source log data from the target system, and construct a causal origination graph based on the multi-source log data; A restart-based random walk is performed on the causal origination graph to obtain several random walk subgraphs. The random walk subgraphs are used to represent the graph set of process nodes visited by the origination node in a random walk. The origination node is any one of the process nodes in the causal origination graph. Based on all the random walk subgraphs, the initialized subgraph matching network is trained to obtain the trained subgraph matching network.
9. An electronic device, characterized in that, include: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor performs the method as described in any one of claims 1-7.
10. A computer-readable storage medium storing a processor-executable program, characterized in that, The processor-executable program, when executed by the processor, is used to implement the method as described in any one of claims 1-7.