Method, device, equipment, medium and product for detecting lateral spreading behavior of network threats

Abstract

This invention discloses a method, apparatus, device, medium, and product for detecting the lateral spread behavior of network threats. The method includes constructing a temporal connection graph based on network security event logs; determining suspicious attack paths from the temporal connection graph based on constraints such as attacker potential target orientation, rare connections, and time sequence; constructing an attack intent graph based on the suspicious attack paths; determining the vector representation of edges in the attack intent graph based on the node feature vector representation and the vector representation of different interaction time intervals; and determining the lateral spread behavior using a feature hypersphere model based on the vector representation of edges in the attack intent graph. This method simultaneously performs fine-grained modeling of covert attacks in the lateral spread stage from both temporal and structural dimensions, effectively identifying camouflage behaviors implemented by attackers by mimicking normal access sequences and adjusting interaction time patterns, thereby effectively identifying covert attack behaviors in the lateral spread stage.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, apparatus, device, medium and product for detecting the lateral spread of network threats. Background Technology

[0002] As cyberspace continues to expand and become increasingly complex, cyber threats are exhibiting greater stealth and diversity. Advanced persistent threats (APS) typically do not immediately launch a final attack after infiltrating a target network. Instead, they gradually gain control of more devices through long-term infiltration, privilege escalation, and lateral movement to achieve objectives such as stealing sensitive data, disrupting critical business systems, or attacking industrial control systems. Therefore, detecting threats during the lateral spread phase has become an important research direction in cybersecurity protection.

[0003] However, existing technologies still lack more effective means to identify attacks that are highly camouflaged, stealthy, and capable of concealing their behavior by leveraging network dynamics during the lateral spread phase. Therefore, how to effectively identify covert attack behaviors during the lateral spread phase is a pressing technical problem that needs to be solved. Summary of the Invention

[0004] This invention provides a method, apparatus, device, medium, and product for detecting the lateral spread of network threats, in order to solve the technical problem that existing technologies cannot effectively identify covert attack behaviors during the lateral spread stage.

[0005] According to one aspect of the present invention, a method for detecting the lateral spread behavior of network threats is provided, comprising:

[0006] A temporal connection graph is constructed based on network security event logs. The temporal connection graph represents graph structure data that describes the relationship between network spatial structure and temporal evolution.

[0007] Based on the constraints of attacker's potential target orientation, rare connections, and time sequence, suspicious attack paths are determined from the temporal connection graph, and an attack intent graph is constructed based on the suspicious attack paths;

[0008] The time intervals of different interactive behaviors in the attack intent graph are converted into vector representations, and the vector representations of the edges in the attack intent graph are determined based on the node feature vector representations in the attack intent graph and the vector representations of the different interactive behavior time intervals.

[0009] Based on the vector representation of the edges in the attack intent graph, the lateral diffusion behavior is determined by the feature hypersphere model, which is constructed based on the overall distribution of the vector representation of normal edges.

[0010] According to another aspect of the present invention, a detection device for the lateral spread behavior of network threats is provided, comprising:

[0011] A construction module is used to construct a temporal connection graph based on network security event logs. The temporal connection graph represents graph structure data that represents the relationship between network spatial structure and temporal evolution.

[0012] The determination module is used to identify suspicious attack paths from the temporal connection graph based on constraints such as the attacker's potential target orientation, rare connections, and time sequence, and to construct an attack intent graph based on the suspicious attack paths;

[0013] The conversion module is used to convert the time intervals of different interaction behaviors in the attack intent graph into vector representations, and to determine the vector representations of the edges in the attack intent graph based on the node feature vector representations in the attack intent graph and the vector representations of the different interaction behavior time intervals.

[0014] The detection module is used to determine the lateral diffusion behavior based on the vector representation of the edges in the attack intent graph through a feature hypersphere model, which is constructed based on the overall distribution of the vector representation of normal edges.

[0015] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising: at least one processor;

[0016] and a memory communicatively connected to the at least one processor;

[0017] The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to perform the method for detecting the lateral spread of network threats as described in any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions, the computer instructions being configured to cause a processor to execute and implement the method for detecting the lateral spread behavior of network threats as described in any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer program product is provided, the computer program product comprising a computer program that, when executed by a processor, implements the method for detecting the lateral spread behavior of network threats as described in any embodiment of the present invention.

[0020] The technical solution of this invention constructs an attack intent graph, determines the vector representation of edges in the attack intent graph based on the node feature vector representation and the vector representation of different interaction time intervals in the attack intent graph, and then determines the lateral diffusion behavior through a feature hypersphere model. This solves the problem that existing technologies cannot effectively identify covert attack behaviors in the lateral diffusion stage, and achieves the beneficial effect of effectively identifying the disguised behavior implemented by attackers by imitating normal access order and adjusting interaction time patterns, thereby effectively identifying covert attack behaviors in the lateral diffusion stage.

[0021] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a flowchart illustrating a method for detecting the lateral spread behavior of network threats according to Embodiment 1 of the present invention.

[0024] Figure 2 This is a schematic diagram of the attack intent graph construction process provided in Embodiment 2 of the present invention;

[0025] Figure 3 This is a flowchart illustrating a method for detecting the lateral spread behavior of network threats according to Embodiment 2 of the present invention.

[0026] Figure 4 This is a flowchart illustrating a method for detecting the lateral spread behavior of network threats according to Embodiment 3 of the present invention.

[0027] Figure 5 This is a flowchart illustrating a method for detecting the lateral spread behavior of network threats according to Embodiment 4 of the present invention.

[0028] Figure 6 A flowchart illustrating a method for detecting the lateral spread behavior of network threats, provided as a specific embodiment of the present invention;

[0029] Figure 7 This is a schematic diagram of the structure of a network threat lateral propagation detection device provided in Embodiment 5 of the present invention;

[0030] Figure 8This is a schematic diagram of the structure of an electronic device for a method of detecting the lateral spread behavior of network threats according to an embodiment of the present invention. Detailed Implementation

[0031] To enable those skilled in the art to better understand the present invention, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention. It should be understood that the various steps described in the method embodiments of the present invention can be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0032] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0033] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0034] It should be noted that the terms "a" and "a plurality of" used in this invention are illustrative rather than restrictive. Those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0035] The names of the messages or information exchanged between the multiple devices in the embodiments of the present invention are for illustrative purposes only and are not intended to limit the scope of these messages or information.

[0036] Example 1

[0037] Figure 1 This is a flowchart illustrating a method for detecting lateral spread behavior of network threats according to Embodiment 1 of the present invention. This method is applicable to detecting attack behavior during the lateral spread stage. This method can be executed by a device for detecting lateral spread behavior of network threats, wherein the device can be implemented by software and / or hardware and is generally integrated on an electronic device. In this embodiment, the electronic device includes, but is not limited to, a security analysis server.

[0038] like Figure 1 As shown in Embodiment 1 of the present invention, a method for detecting the lateral spread behavior of network threats includes the following steps:

[0039] S110. Construct a time-series connection graph based on network security event logs, wherein the time-series connection graph represents the graph structure data representing the relationship between network spatial structure and temporal evolution.

[0040] The network security event log can include authentication logs, traffic records, and host access events in the network.

[0041] The temporal connection graph is a directed graph model used to represent the connection activities of network nodes over time, where nodes represent hosts or network entities, and edges represent connection events with timestamps. There is no specific limit to the number of temporal connection graphs.

[0042] In this embodiment, the collected network security event logs are organized into a time-series connection graph to describe the connection activities of network nodes over time. The time-series connection graph can be defined as a directed graph:

[0043]

[0044] in, A node set is used to represent a collection of hosts, servers, workstations, terminals, or other network entities in a network. Indicates the first One node; Let edge be the set of edges, used to represent connection events that occur between network entities (i.e., nodes). For each edge... Indicates the source node exist Time and target node A connection occurs between them; This is the node feature matrix, used to record the attribute characteristics of each node. Represents the feature dimension of a node.

[0045] In this embodiment, by constructing a temporal connection graph, the network's security event logs are uniformly transformed into graph structure data that can simultaneously represent the network's spatial structure and temporal evolution relationship, serving as the basis for subsequent suspicious path discovery and abnormal connection detection.

[0046] S120. Based on the constraints of the attacker's potential target orientation, rare connections, and time sequence, determine the suspicious attack paths from the time sequence connection graph, and construct an attack intent graph based on the suspicious attack paths.

[0047] It should be noted that when dealing with large-scale network data, if anomaly detection is performed directly on the full time-series connection graph, the analysis scope is large, there are many redundant normal events, and the detection efficiency is low. Therefore, this step first constructs an attack intent graph to retain paths that are more likely to pose a threat to the network and narrow the analysis scope of subsequent lateral spread detection.

[0048] In this embodiment, by combining the attacker's potential target orientation, rare connections, and time sequence constraints, suspicious paths related to the attack propagation intent are screened from the large-scale temporal connection graph, and a smaller but more threat-related attack intent graph is formed.

[0049] Among them, the attack intent graph refers to the graph formed by suspicious attack paths related to the attack propagation intent extracted from the temporal connection graph, which is used to narrow the analysis scope of subsequent anomaly detection.

[0050] Figure 2 This is a schematic diagram of the attack intent graph construction process provided in Embodiment 1 of the present invention, as shown below. Figure 2 As shown, edges are selected from the temporal connection graph based on potential target-oriented constraints to construct a reachable graph. Rare paths are determined from the reachable graph based on rare connection constraints to construct a directed graph. Edges that satisfy the temporal order constraints are selected from the directed graph to determine suspicious attack paths. An attack intent graph is constructed based on the suspicious attack paths.

[0051] Among them, the potential goal-oriented constraint can be understood as finding a reachable path from the starting node to the target node from the temporal connection graph and filtering out normal paths that cannot reach the target node; the rare connection constraint can be understood as using the historical connection frequency of the edge to find suspicious paths with low connection frequency; the temporal order can be understood as only keeping the outgoing edge of the node whose outgoing edge time is greater than the earliest incoming edge time of the node.

[0052] S130. Convert the time intervals of different interaction behaviors in the attack intent graph into vector representations, and determine the vector representations of the edges in the attack intent graph based on the node feature vector representations in the attack intent graph and the vector representations of the different interaction behavior time intervals.

[0053] In this embodiment, the vector representation of the time interval of different interaction behaviors is embedded into the node feature vector representation in the attack intent graph to enhance the temporal feature expression of the nodes, and the graph structure information of the attack intent graph is fused, and the spatiotemporal joint representation of the edges (i.e. the vector representation of the edges in the attack intent graph) is learned using the graph attention mechanism.

[0054] The interaction time interval is used to represent the duration between two consecutive connection actions. Although attackers may mimic the access sequence of legitimate users, the time intervals between their consecutive interaction actions often differ from those of normal users. Therefore, embedding the vector representation of different interaction time intervals into node features is beneficial for revealing the abnormal rhythmic patterns of attackers hidden in legitimate traffic.

[0055] In this embodiment, based on the node feature vector representation in the attack intent graph and the vector representation of different interaction time intervals in the attack intent graph, a vector representation of the edge that can better distinguish between normal connections and covert attack connections is obtained. Unlike the existing technology that only learns independent feature vectors for each node, this embodiment injects vector representations of different interaction time intervals into the node features and performs multi-head attention aggregation on the neighbor node information through a graph attention mechanism, thereby obtaining a vector representation of the edge applicable to abnormal connection detection.

[0056] S140. Based on the vector representation of the edges in the attack intent graph, the lateral diffusion behavior is determined by the feature hypersphere model, which is constructed based on the overall distribution of the vector representation of normal edges.

[0057] Based on the assumption that the vast majority of edges are normal edges, an unsupervised single-classification learning method is used to fit the vector representation of normal edges, resulting in a feature hypersphere model. The feature hypersphere model is used to represent the feature space boundary formed by fitting the features of normal edges; edges falling outside this feature space boundary can be considered as abnormal edges.

[0058] In this embodiment, anomaly distance scores are calculated based on the vector representations of edges in the attack intent graph and the center of the feature hypersphere model. These scores are then compared with the radius of the feature hypersphere model. The comparison results determine whether an edge is an anomalous edge, corresponding to lateral diffusion behavior. Embodiment 1 of this invention provides a method for detecting lateral diffusion behavior of network threats. First, a temporal connection graph is constructed based on network security event logs. This temporal connection graph represents the graph structure data representing the spatial structure and temporal evolution of the network. Second, based on attacker potential target orientation, rare connections, and temporal sequence behavioral constraints, suspicious attack paths are determined from the temporal connection graph. An attack intent graph is then constructed based on these suspicious attack paths. Next, the time intervals of different interaction behaviors in the attack intent graph are converted into vector representations. The vector representations of edges in the attack intent graph are determined based on the node feature vector representations and the vector representations of the different interaction time intervals. Finally, based on the vector representations of the edges in the attack intent graph, lateral diffusion behavior is determined using a feature hypersphere model, which is constructed based on the overall distribution of the vector representations of normal edges. The above methods can more effectively reveal the disguised behaviors of attackers by mimicking normal access sequences and adjusting the interaction rhythm. In complex and dynamic network environments, they can more accurately distinguish between normal deviations and real attacks, and have stronger covert attack identification capabilities and better detection targeting.

[0059] Example 2

[0060] Figure 3 This is a flowchart illustrating a method for detecting the lateral spread of network threats according to Embodiment 2 of the present invention. Embodiment 2 is an optimization based on the above embodiments. For details not covered in this embodiment, please refer to Embodiment 1.

[0061] like Figure 3 As shown in Embodiment 2 of the present invention, a method for detecting the lateral spread behavior of network threats includes the following steps:

[0062] S210. Construct a time-series connection diagram based on network-based security event logs.

[0063] The temporal connection graph represents the graph structure data that describes the relationship between spatial structure and temporal evolution.

[0064] S220. Select edges from the temporal connection graph that satisfy the attacker's potential goal-oriented constraints to construct a reachable graph.

[0065] It's important to note that attackers typically target high-value assets or high-privilege hosts during lateral movement. Therefore, paths reaching the target node are usually more threat-relevant. This step first identifies reachable paths from the starting node to the target node in the temporal connectivity graph, filtering out normal paths that cannot reach the target node to construct a reachability graph. Satisfying the attacker's potential goal-oriented constraints can be understood as retaining only edges that are logically likely to lead to the target node during the attack.

[0066] in, This represents the target node set, where the target nodes are nodes storing high-value assets, nodes with high management authority, or other key nodes in the time-series connection graph. This represents the set of starting nodes, where each starting node is a node in the temporal connection graph with an in-degree of 0.

[0067] Specifically, from the temporal connectivity graph, edges that satisfy the attacker's potential goal-oriented constraints are selected to construct a reachable graph, including:

[0068] Step 1: Determine the starting node and the target node from the timing connection diagram. The starting node is a node with an in-degree of zero, and the target node is a key node in the network structure.

[0069] Among them, key nodes include at least nodes that store high-value assets in the time-series connection graph and nodes with high management privileges.

[0070] Step 2: Starting from the starting node, explore forward to determine the exploration path from the starting node to the target node. The exploration path is obtained by iteratively traversing the set of accessible neighbor nodes of the current exploration node. Each exploration traversal records the predecessor access relationship nodes of the current exploration node. The set of accessible neighbor nodes is obtained by removing the set of prohibited nodes from the set of neighbor nodes of the current exploration node. The set of prohibited nodes consists of non-target nodes that have been explored and traversed.

[0071] Specifically, for a starting node, the starting node is taken as the current exploration node. A forward exploration traversal is performed based on the set of accessible neighbor nodes of the current exploration node (the set of accessible neighbor nodes is obtained by removing the set of forbidden nodes from the set of neighbor nodes of the current exploration node. The set of forbidden nodes consists of non-target nodes that have been explored and traversed. Non-target nodes can be nodes other than the target node in the temporal connection graph). The set of accessible neighbor nodes is taken as the current exploration node, and a forward exploration traversal is performed based on the set of accessible neighbor nodes of the current exploration node until the target node is reached, thus obtaining the exploration path from the starting node to the target node.

[0072] In each probe traversal, the predecessor visit relationship node of the currently explored node is recorded. The predecessor visit relationship node can be interpreted as follows: if node A's neighbor node is node B, then node A is the predecessor visit relationship node of node B.

[0073] It should be noted that not all starting nodes can reach the target node by continuously visiting neighboring nodes. Starting nodes can be randomly divided into multiple groups to simulate diverse attack paths for attackers to reach the target node from different groups of starting nodes.

[0074] It should be noted that the exploration path includes all paths from the starting node to the ending node. The ending node can be a node with no outgoing degree, and can include both target and non-target nodes. The exploration path satisfies the conditions of being continuous and acyclic. Acyclicity can be understood as the attacker not repeatedly visiting nodes that have already been explored. The forbidden node set is initially empty, and is updated to include non-target nodes after each exploration traversal.

[0075] Step 3: Starting from the target node, backtrack the exploration path according to the set of predecessor access relationship nodes until the backtracking path corresponding to the target node is completed. Construct a reachability graph of potential target-oriented constraints from the set of reachable edges formed by the edges in the backtracking path.

[0076] The predecessor visit relationship node set consists of the predecessor visit relationship nodes of the current exploration node recorded in each exploration traversal.

[0077] In step 3, the edges in the backtracking path are extracted from the edge set of the temporal connection graph to form a reachable edge set.

[0078] The above steps 1-3 are illustrated by example. Assume the temporal connection graph contains edges A→B, A→C, B→C, C→E, and E→D. According to step 1, node A is determined as the starting node, and node D as the target node; according to step 2, the initial set of prohibited nodes is... (The initial set of forbidden nodes is empty). Start exploring and traversing from the initial node A, recording the predecessor visit relationships. }, The set of neighboring nodes of the currently explored node is The set of accessible neighbor nodes is Update the set of prohibited nodes that have been visited. The first exploration traversal yields the paths: A→B, A→C; the current explored node is updated to {B,C}, and the set of neighboring nodes of the current explored node is... , Therefore, the set of accessible neighbor nodes is Update the set of visited forbidden nodes. Record the predecessor access relationship node The second exploration yields the path: C→E; the current exploration node is {E}, and the set of neighboring nodes of the current exploration node is... Therefore, the set of accessible neighbor nodes is Update the set of visited forbidden nodes. Record the predecessor access relationship node The third exploration yields the path E→D; thus, the exploration paths A→B and A→C→E→D are obtained. According to step 3, from the target node {D}, the set of predecessor-visited relation nodes is used. }, , Perform backtracking to obtain the set of reachable edges. A graph consisting of a set of reachable edges is a reachable graph with potential goal-oriented constraints.

[0079] S230. Select rare paths that satisfy rare connection constraints from the reachable graph to construct a directed graph.

[0080] It should be noted that although some of the attacker's lateral movement paths are structurally reachable, they often occur with low frequency in historical events. Therefore, this step can use the historical connection frequency of edges to find suspicious paths.

[0081] Specifically, constructing a directed graph by selecting rare paths that satisfy rare connection constraints from the reachable graph includes: searching for a rare path between the starting node and the target node in the reachable graph using a shortest path algorithm based on the historical connection frequency of the edges in the reachable graph, where the rare path is the path with the lowest edge frequency cost; removing the first rare path from the reachable graph and then searching again using the shortest path algorithm to obtain a second rare path, until the number of rare paths obtained is greater than a preset value; and constructing a directed graph based on the edge set and node set of the rare paths.

[0082] Among them, rare paths that satisfy rare connection constraints can be understood as preferentially selecting paths that have a low historical occurrence frequency.

[0083] In this step, we assume the node To the node The historical connection frequency of the edge is , The calculation formula is as follows:

[0084]

[0085] In the above formula, Representing nodes in historical events To the node The historical average number of daily connections, Representing nodes in historical events To the node The historical average number of daily connections, Represents a node The set of neighboring nodes. Among them, , Indicates in Key events in celestial history To the node Total number of connections.

[0086] in, The smaller the value, the more likely it is to be a node To the node The rarer the connection.

[0087] In this embodiment, the rarest z paths are searched based on the historical connection frequency of the edges. For each target node... and starting node , This represents a subset of nodes in the reachable graph. These subsets are the nodes remaining after filtering out the starting nodes that are unreachable from the target node. Dijkstra's algorithm can be used to select these nodes. and nodes Search for the rarest path among the z paths. After finding each rarest path, remove it from the reachable graph and re-execute the search. This process is repeated to obtain the first z rarest paths. Then, define the set of edges belonging to the first z rarest paths. and node set Together they form a directed graph .

[0088] The above processing method preserves diverse sparse connection paths (i.e. rare paths with low historical connection frequency of edges) on the one hand, and avoids interference from a large number of high-frequency normal paths on attack analysis on the other hand. At the same time, the search complexity can be reduced by controlling z to a small value.

[0089] S240. Based on the edges in the directed graph that satisfy the time order constraint, determine the suspicious attack paths, and construct an attack intent graph based on the suspicious attack paths.

[0090] It should be noted that attackers typically follow a step-by-step approach when expanding laterally; that is, a node can only initiate subsequent visits after a certain node has been visited. Therefore, in obtaining a directed graph composed of rare paths... Next, this step further introduces time sequence constraints to filter the paths.

[0091] Specifically, determining suspicious attack paths based on edges satisfying time order constraints in the directed graph includes: for each node in the directed graph, obtaining a first timestamp set consisting of all outgoing edge times and a second timestamp set consisting of all incoming edge times; determining the earliest incoming edge time of each node based on the second timestamp set of each node; filtering outgoing edges from the first timestamp set of each node whose outgoing edge time is greater than the earliest incoming edge time of the node; and identifying the paths corresponding to the outgoing edges as suspicious attack paths.

[0092] For directed graphs any node in First, obtain the node. Set of timestamps of all incoming edges (i.e., the second set of timestamps) and the set of timestamps of all outgoing edges. (i.e., the first set of timestamps), then calculate the nodes. Earliest time of entry into the border The calculation formula is as follows:

[0093]

[0094] Then, only retain nodes whose outgoing edge time is greater than the node's time. Earliest time of entry into the border Outgoing edges. This can be understood as follows: only connections originating from a node are considered candidate edges that satisfy the attack progression sequence after the node has been visited in time.

[0095] Finally, edges that satisfy the above time sequence constraints are used as suspected attack paths to construct the attack intent graph. .

[0096] S250. Convert the time intervals of different interactive behaviors in the attack intent graph into vector representations, and determine the vector representations of the edges in the attack intent graph based on the node features of the attack intent graph and the vector representations of the different interactive behavior time intervals.

[0097] S260. Based on the vector representation of the edges in the attack intent graph, the lateral diffusion behavior is determined using the feature hypersphere model.

[0098] The feature hypersphere model is modeled as the common features of normal edges.

[0099] Embodiment 2 of this invention provides a method for detecting the lateral spread of network threats, which elaborates on the process of constructing an attack intent graph. This method, through triple constraints of attacker potential target orientation, rare connections, and temporal order, can extract more suspicious paths with attack spread intent from a large-scale temporal connection graph, providing input for subsequent connection representation learning.

[0100] Example 3

[0101] Figure 4 This is a flowchart illustrating a method for detecting the lateral spread of network threats according to Embodiment 3 of the present invention. Embodiment 3 is an optimization based on the above embodiments. For details not covered in this embodiment, please refer to the above embodiments.

[0102] like Figure 4 As shown in Embodiment 3 of the present invention, a method for detecting the lateral spread behavior of network threats includes the following steps:

[0103] S310. Construct a timing connection diagram based on network-based security event logs.

[0104] The temporal connection graph represents the graph structure data that describes the relationship between spatial structure and temporal evolution.

[0105] S320. Based on the constraints of the attacker's potential target orientation, rare connections, and time sequence, determine the suspicious attack paths from the time sequence connection graph, and construct an attack intent graph based on the suspicious attack paths.

[0106] S330. Convert the time intervals of different interactive behaviors in the attack intent graph into vector representations.

[0107] The domain of the interaction time interval is: In this step, the time interval for interactive behavior will be... Mapped to 3D vectors, i.e., finding mappings of continuous functions. This allows for any time interval between interactive actions. All can be converted into vector representations To characterize the similarity of interactive behaviors across different time intervals, a bounded function is defined:

[0108]

[0109] And make it satisfy the following inner product relationship:

[0110]

[0111] in, This represents the inner product operation. Interaction time interval The vector representation of , Interaction time interval The vector representation of . Considering that the similarity between different time intervals depends on the relative difference between the time intervals, this embodiment uses a translation-invariant kernel function, that is:

[0112]

[0113] In the above formula, express The content on the left is from The content on the right is defined.

[0114] Therefore, it can be guaranteed that:

[0115]

[0116] In the above formula, Indicates simultaneous action on the time interval and time interval The amount of translation.

[0117] According to Bochner's theorem, the translation-invariant kernel function can be expressed in its Fourier transform form:

[0118]

[0119] in, , , For random variables, Represents an unknown probability distribution. Let i represent the real number and i represent the imaginary part of the complex number unit. Indicates conjugate. Represents the relationship between random variables Take the expected value. Indicates from Multiple samples Calculate separately And perform a weighted average of the calculation results.

[0120] According to Euler's formula, for any real number It has the following formula:

[0121]

[0122] Substituting into the Fourier transform formula above, we get:

[0123]

[0124] This can be further simplified to:

[0125]

[0126] To estimate the kernel function, this embodiment uses Monte Carlo integration to approximate the above equation, namely:

[0127]

[0128] Therefore, the time interval of the interaction behavior can be obtained. Vector representation of:

[0129]

[0130] in, The embedding dimension represents the random Fourier feature. Indicates according to distribution Random variables obtained from sampling A translation-invariant kernel function and randomized Fourier features can be used to convert scalar time intervals into vector representations, enabling the model to learn the differences between normal and abnormal interaction rhythms. This mapping transforms scalar interaction time intervals into vector representations. This is to facilitate fusion with node features.

[0131] It should be noted that this step uses a non-parametric method to estimate the unknown distribution. Instead of pre-setting a fixed prior distribution, it is based on actual data. Initialization and optimization. Preferably, it can be based on the time interval of the interaction behavior. Select at equal intervals within the time interval Time interval parameters The reciprocal of each time interval parameter is used as the corresponding initial frequency. After that, Optimization is performed to make... Approaching This makes the resulting time interval vector representation more consistent with the time patterns in actual network interaction data.

[0132] S340. Inject the vector representation of the time interval of different interactive behaviors into the corresponding node features in the attack intent map to obtain the query vector.

[0133] In this step, after obtaining the vector representation of the interaction time interval, it is injected into the node feature representation.

[0134] Assuming nodes Learning networks and time in layer 0 graphs The node feature vectors are represented as follows:

[0135]

[0136] In the above formula, Represents a node The original node characteristics.

[0137] To model the joint representation of nodes in the structural and temporal dimensions, this embodiment introduces a Graph Neural Network (GNN) to perform hierarchical learning of node feature representations, where the first... Layered graph learning networks are used to aggregate and update node feature representations layer by layer.

[0138] For the current node In its first Layered graph learning networks, time The query vector is defined as:

[0139]

[0140] In the above formula, since the query vector represents the current node... At the current time The state, due to the time corresponding to the current node. With current time There is no time difference, so the time interval is 0, therefore the current node... The vector representation of the interaction time interval is as follows , In the above formula, This represents vector concatenation, i.e., concatenation of the current node. In the Layered graph learning networks, time The node feature vector representation and Perform concatenation to obtain the current node. In the Layered graph learning networks, time The query vector.

[0141] S350. Through the graph attention mechanism, the neighbor node information and node information of each node in the attack intent graph are aggregated to obtain multi-head attention.

[0142] The neighbor node information includes a key vector set and a value vector set. The node information includes a query vector set. The key vector set is composed of node feature vectors representing multiple neighbor nodes of different nodes at different layers and times in the graph learning network. The initial values ​​of the value vector set are the same as the initial values ​​of the key vector set.

[0143] It should be noted that although the initial inputs of the key vector set and the value vector set are the same, they are projected through different parameter matrices during the multi-head attention computation. The key vectors are used to calculate the attention weights, and the value vectors are used to aggregate information according to the attention weights.

[0144] Specifically, a graph attention mechanism is used to aggregate neighbor node information to obtain node feature vector representations that can simultaneously reflect structural relationships and temporal rhythms.

[0145] For the current node The set of neighboring nodes Its key vector set is defined as:

[0146]

[0147] In the above formula, Indicates the current node The neighboring nodes In the Layered graph learning networks, time The node feature vector representation below, Indicates the time when the corresponding neighbor node was connected; Indicates the current node The time interval for interactive behavior is The vector representation of .

[0148] value vector set for:

[0149]

[0150] The above formula indicates that the initial values ​​of the value vector set are the same as the initial values ​​of the key vector set.

[0151] Therefore, the query vector set, key vector set, and value vector set can be stacked into a matrix. , and .

[0152] This step utilizes a graph attention mechanism to aggregate neighbor node information, assuming the number of attention heads is [number missing]. Then, the multi-head attention is represented as:

[0153]

[0154] Among them, the Each attention head is represented as:

[0155]

[0156] in, , , Represents the parameter matrix, This represents the sum of the original node features and the interaction time interval features. .

[0157] S360. Update the node feature vector representation of the attack intent graph based on the multi-head attention.

[0158] Multi-head attention is a neighbor information aggregation operator in graph learning networks. Multi-head attention aggregation is completed after each graph learning iteration.

[0159] Among them, after completing multi-head attention aggregation, the node is at the 1st Layered graph learning networks, time The node feature vector representation is updated as follows:

[0160]

[0161] In the above formula, , Represents the parameter matrix, , Indicates the bias term. This represents the activation function.

[0162] S370. Construct vector representations at different times based on the updated node feature vector representations.

[0163] In this step, after obtaining the updated node feature vector representation, it is necessary to further construct the edge vector representation.

[0164] Suppose the source node feature vector of a certain edge is represented as The feature vector of the target node is represented as Then the edge at time vector representation for:

[0165]

[0166] in, This indicates the number of layers in the last layer of the learning network.

[0167] In the above manner, each edge is encoded as a joint vector representation that simultaneously contains source node structural information (i.e., source node feature vector representation), target node structural information (i.e., target node feature vector representation), and the interaction time interval.

[0168] S380. Based on the vector representation of the edges in the attack intent graph, the lateral diffusion behavior is determined by the feature hypersphere model, which is constructed based on the overall distribution of the vector representation of normal edges.

[0169] The present invention provides a method for detecting the lateral spread of network threats in embodiment three. This method embeds the vector representation of different interaction time intervals into the node feature vector representation (i.e., the initial node representation obtained by fusing the time-encoded vectors of different interaction time intervals with the original node features), and fuses graph structure information (i.e., based on the neighbor relationships of the temporal connection graph, multi-layer graph neural network propagation and attention-weighted aggregation of nodes). It then utilizes a graph attention mechanism to learn the spatiotemporal joint representation of edges (i.e., simultaneously fusing node structural neighborhood information and the joint vector representation of time interval encoding) to obtain the vector representation of the edges. It is used to characterize the overall distribution pattern of intervals in normal interactive behaviors.

[0170] Example 4

[0171] Figure 5 This is a flowchart illustrating a method for detecting the lateral spread of network threats according to Embodiment 4 of the present invention. Embodiment 4 is an optimization based on the above embodiments. For details not covered in this embodiment, please refer to the above embodiments.

[0172] like Figure 5 As shown in Embodiment 4 of the present invention, a method for detecting the lateral spread behavior of network threats includes the following steps:

[0173] S410, Construct a timing connection diagram based on network-based security event logs.

[0174] The temporal connection graph represents the graph structure data that describes the relationship between spatial structure and temporal evolution.

[0175] S420. Based on the constraints of the attacker's potential target orientation, rare connections, and time sequence, determine the suspicious attack paths from the time sequence connection graph, and construct an attack intent graph based on the suspicious attack paths.

[0176] S430. Convert the time intervals of different interaction behaviors in the attack intent graph into vector representations, and determine the vector representations of the edges in the attack intent graph based on the node feature vector representations in the attack intent graph and the vector representations of the different interaction behavior time intervals.

[0177] S440. Based on the vector representation of the edges in the attack intent graph, learn the distribution boundary of a normal edge and construct a feature hypersphere model.

[0178] In this model, the center refers to the center point of the feature hypersphere in the feature space, used to measure the distance between each side representation and the center of the normal distribution. The center representation of the central feature hypersphere model is as follows:

[0179]

[0180] In the above formula, This represents the total number of edges in the network. Indicates the first in the network Vector representation of an edge.

[0181] In this embodiment, during the learning process of the feature hypersphere model, the objective function of the feature hypersphere model is minimized to make the vector representations of most normal edges as close as possible to the center of the feature hypersphere model, thereby fitting the spatial features of the normal edges. The objective function of the feature hypersphere model... for:

[0182]

[0183] In the above formula, This represents the number of edges involved in the model learning process. Indicates the first Each side at time The vector representation of , The center of the characteristic hypersphere model is represented at time [time]. Corresponding representation; Indicates the first The center of the hypersphere model with individual sides and features at time... The squared distance; The Frobenius norm represents all learnable parameters of the feature hypersphere model, used to constrain the complexity of the feature hypersphere model; This represents the regularization coefficient.

[0184] S450. For each edge in the attack intent graph, calculate the squared distance between the vector representation of the edge at different times and the center of the feature hypersphere model, and obtain the anomaly distance score corresponding to each edge at different times.

[0185] For any edge At any moment bottom edge Anomaly distance score for:

[0186]

[0187] In the above formula, Indicates the first Edge at time The vector representation of , The center of the characteristic hypersphere model is represented at time [time]. Corresponding representation; Indicates the first The edge and the center of the feature hypersphere model at time... The squared distance.

[0188] In the above formula, The larger the value, the more likely it is to be an edge. The more pronounced the deviation from the normal edge distribution.

[0189] S460. Compare the abnormal distance score corresponding to each edge at different times with the radius of the feature hypersphere model.

[0190] The radius of the characteristic hypersphere model is... .

[0191] S470. If the abnormal distance score corresponding to the next edge at the first moment is greater than the radius of the feature hypersphere model, then the behavior corresponding to the next edge at the first moment is determined to be a lateral diffusion behavior.

[0192] The first moment can be any moment.

[0193] Among them, when At that time, it indicates the first moment. below Too far from the center of the normal connection, falling outside the feature hypersphere model, therefore the next edge at the first moment... The corresponding behavior was identified as lateral diffusion behavior.

[0194] The fourth embodiment of the present invention provides a method for detecting the lateral spread behavior of network threats. It fits the feature space of normal edges based on the vector representation of the edges, so that the vector representation of normal edges is distributed as much as possible inside the hypersphere model, and the edges that deviate from the feature space (i.e. the edges that fall outside the hypersphere model) are identified as abnormal connections.

[0195] Based on the technical solutions of the above embodiments, this invention provides a specific implementation method.

[0196] As one specific implementation method of this embodiment. Figure 6 A flowchart illustrating a method for detecting the lateral spread behavior of network threats, provided as a specific embodiment of the present invention, is shown below. Figure 6 As shown, the process includes the following:

[0197] Construct a timing connection graph, which represents different nodes (i.e. Figure 6 In The temporal relationship of ) Figure 6 In These represent the times when the connection events between the two nodes occurred, respectively. In The timing connection diagram can be represented as:

[0198]

[0199] in, Represents a set of nodes. Denotes the set of edges. This represents the node feature matrix. Figure 6 Nodes in That is, a set of nodes The nodes in.

[0200] For example, Figure 6 There are nodes To the node The connection event occurs at time . Then the connection event can be represented as:

[0201]

[0202] This edge (i.e., the connection event) belongs to the edge set of the temporal connection graph. In this way, network security incident logs are transformed into graph-structured data that simultaneously contains the network spatial structure and temporal evolution relationships.

[0203] Based on the constraints of attackers' potential target orientation, rare connections, and time sequence, suspicious attack paths are identified from the temporal connection graph, and an attack intent graph is constructed from the suspicious attack paths. Figure 6 middle The side Represents a node At any moment With nodes A connection event occurred; The side Represents a node At any moment With nodes A connection event has occurred. Figure 6 The middle can be the node If a path can reach a target node, then that path is more relevant to an attack.

[0204] Figure 6 In (b), the learned connection representation corresponds to converting the time intervals of different interactive behaviors in the attack intent graph into vector representations. For example, if the current analysis time is... ,node At any moment With nodes If a connection is established, the time interval for this interaction is: The interaction time interval vector is represented as: Similarly, Figure 6 In Indicates the current time With time The interaction time interval is represented by a vector. Indicates the current time With time The interaction time interval is represented by a vector. This represents the zero time interval vector corresponding to the current node at the current moment.

[0205] The neighbor node information for each node in the attack intent map is determined by using the node feature vector representations of multiple neighbor nodes at different layers and times in the network. This neighbor node information can be obtained by concatenating or fusing the neighbor node feature vector representations with the corresponding interaction time interval vector representations. For example: Represents a node At any moment The node feature vector under the current time is represented by its feature vector relative to the current time. The concatenation result is represented by the time interval vector.

[0206] Combination Figure 6 If the current node is Its neighboring nodes include and Then, neighbor node information can be constructed:

[0207]

[0208]

[0209] The above information is the node. The elements in the set of key vectors.

[0210] Figure 6 The term "aggregation" in this context refers to the aggregation of neighbor node information for each node in the attack intent graph through the graph attention mechanism in the self-attention layer to obtain multi-head attention; and the updating of node feature vector representations in the attack intent graph based on multi-head attention.

[0211] Figure 6 The "self-attention layer" in the above embodiment refers to the graph attention mechanism, which is used to perform weighted aggregation of the neighbor node information of a node. The result after passing through the self-attention layer... and Representing nodes respectively and nodes At the present moment The node feature vector is represented by the aggregator of neighbor information. Figure 6 In Representing an edge At any moment The vector representation corresponds to the edge vector representation in Embodiments 3 and 4. .

[0212] Combination Figure 6 After processing by the self-attention layer, the source node The node representation is updated to Target node The node representation is updated to .in, Includes nodes Its own attributes, its neighboring nodes The structural information and corresponding interaction time interval characteristics, Includes nodes Features include its own attributes, neighbor structure information, and corresponding interaction time intervals.

[0213] Construct vector representations at different times based on the updated node feature vector representations. Figure 6 In section (b), "splicing" corresponds to step S370 in Example 3. Figure 6 The edge in For example, node As the source node, node The target node is represented by [target node]. After graph attention aggregation, the source node representation is obtained. and target node representation After splicing the two together, we get the edge. The vector representation is This formula corresponds to the unified expression in Example 3: It should be noted that the time interval feature in the edge vector representation is not added separately when concatenating the source and target nodes, but is already injected and integrated into the node representation during the aforementioned time interval vector construction, query / key / value vector construction, and graph attention aggregation processes. Therefore, the edge vector representation... It also includes source node structure information, target node structure information, and time features obtained by injecting the interaction behavior time interval vector and aggregating it through graph attention.

[0214] Calculate the squared distance between the vector representation of an edge and the center of the feature hypersphere model at different times. If the distance is greater than the radius of the feature hypersphere model, the corresponding edge is determined to be an abnormal connection.

[0215] Figure 6 In This represents the center of the characteristic hypersphere model. The radius represents the feature hypersphere model. The interior of the feature hypersphere represents the region where normal edges cluster in the feature space; the area falling within the radius... The vector representation of edges outside of this boundary is considered an anomalous connection, corresponding to potential lateral diffusion behavior.

[0216] by Figure 6Edge connection in For example, its anomaly distance score can be expressed as:

[0217]

[0218] when When the edge is outside the characteristic hypersphere, deviating from the normal edge distribution, it is therefore judged as an anomalous connection, corresponding to potential lateral diffusion behavior; when When the condition is met, it indicates that the edge is located inside the feature hypersphere and falls within the normal edge distribution range, therefore it is determined to be a normal connection. Figure 6 In the middle, located inside the circle The vector represents a normal edge connection; edge vectors located outside the circle represent deviations from the normal edge distribution and can be identified as abnormal connections.

[0219] Example 5

[0220] Figure 7 This is a schematic diagram of a network threat lateral spread detection device provided in Embodiment 5 of the present invention. The device is applicable to detecting attack behavior during the lateral spread stage. The device can be implemented by software and / or hardware and is generally integrated into an electronic device.

[0221] like Figure 7 As shown, the device includes: a construction module 110, a determination module 120, a conversion module 130, and a detection module 140.

[0222] Module 110 is used to construct a temporal connection graph based on network security event logs, wherein the temporal connection graph represents graph structure data representing the relationship between network spatial structure and temporal evolution;

[0223] The determination module 120 is used to determine suspicious attack paths from the temporal connection graph based on the constraints of the attacker's potential target orientation, rare connections and time sequence, and to construct an attack intent graph based on the suspicious attack paths;

[0224] The conversion module 130 is used to convert the time intervals of different interactive behaviors in the attack intent graph into vector representations, and to determine the vector representations of the edges in the attack intent graph based on the node feature vector representations in the attack intent graph and the vector representations of the different interactive behavior time intervals.

[0225] The detection module 140 is used to determine the lateral diffusion behavior based on the vector representation of the edges in the attack intent map through a feature hypersphere model, wherein the feature hypersphere is constructed based on the overall distribution of the vector representation of normal edges.

[0226] In this embodiment, the device first constructs a temporal connection graph based on network security event logs using a construction module 110. This temporal connection graph represents graph structure data representing the relationship between network spatial structure and temporal evolution. Secondly, a determination module 120 determines suspicious attack paths from the temporal connection graph based on constraints such as attacker potential target orientation, rare connections, and temporal order, and constructs an attack intent graph based on these suspicious attack paths. Then, a conversion module 130 converts the time intervals of different interaction behaviors in the attack intent graph into vector representations, and determines the vector representations of edges in the attack intent graph based on the node feature vector representations and the vector representations of the different interaction behavior time intervals. Finally, a detection module 140 determines lateral diffusion behavior based on the vector representations of edges in the attack intent graph using a feature hypersphere model, which is constructed based on the overall distribution of normal edge vector representations.

[0227] This embodiment provides a detection device for the lateral spread of network threats, which can effectively identify the camouflage behavior implemented by attackers by imitating normal access sequences and adjusting interaction time patterns, thereby effectively identifying covert attack behaviors in the lateral spread stage.

[0228] Furthermore, the determining module 120 includes:

[0229] The first filtering submodule is used to filter edges from the temporal connection graph that satisfy the attacker's potential target-oriented constraints to construct a reachable graph;

[0230] The second filtering submodule is used to filter out rare paths that satisfy rare connection constraints from the reachable graph to construct a directed graph;

[0231] The determination submodule is used to identify suspicious attack paths based on the edges in the directed graph that satisfy the time sequence constraint.

[0232] Based on the above optimizations, the first filtering submodule is specifically used for execution:

[0233] Step 1: Determine the starting node and the target node from the timing connection diagram. The starting node is a node with an in-degree of zero, and the target node is a key node in the network structure.

[0234] Step 2: Starting from the starting node, explore forward to determine the exploration path from the starting node to the target node. The exploration path is obtained by iteratively traversing the set of accessible neighbor nodes of the current exploration node. Each exploration traversal records the predecessor access relationship nodes of the current exploration node. The set of accessible neighbor nodes is obtained by removing the set of prohibited nodes from the set of neighbor nodes of the current exploration node. The set of prohibited nodes consists of non-target nodes that have been explored and traversed.

[0235] Step 3: Starting from the target node, backtrack the exploration path according to the set of predecessor access relationship nodes until the backtracking path corresponding to the target node is completed. Construct a reachability graph of potential target-oriented constraints from the set of reachable edges formed by the edges in the backtracking path.

[0236] The second filtering submodule includes:

[0237] The first search submodule is used to search for a rare path between the starting node and the target node in the reachable graph based on the historical connection frequency of the edges in the reachable graph and to use the shortest path algorithm as the first rare path. The rare path is the path with the minimum edge frequency cost.

[0238] The second search submodule is used to remove the first rare path from the reachability graph and then re-apply the shortest path algorithm to search for the second rare path until the number of rare paths obtained is greater than a preset value.

[0239] A construction submodule is used to construct a directed graph based on the set of edges and nodes of the rare path.

[0240] The determined submodules include:

[0241] The acquisition submodule is used to acquire, for each node in the directed graph, a first timestamp set consisting of all outgoing edge times of each node and a second timestamp set consisting of all incoming edge times of each node.

[0242] The determination submodule is used to determine the earliest incoming edge time of each node based on the second timestamp set of each node;

[0243] The filtering submodule is used to filter out outgoing edges from the first timestamp set of each node that have an outgoing edge time greater than the earliest incoming edge time of the node.

[0244] The determination submodule is used to identify the path corresponding to the outgoing edge as a suspicious attack path.

[0245] Furthermore, the conversion module 130 includes:

[0246] The conversion submodule is used to convert the time intervals of different interactive behaviors in the attack intent graph into vector representations.

[0247] The injection submodule is used to inject the vector representation of different interaction time intervals into the corresponding node features of the attack intent map to obtain the query vector;

[0248] The aggregation submodule is used to aggregate the neighbor node information and node information of each node in the attack intent graph through the graph attention mechanism to obtain multi-head attention. The neighbor node information includes a key vector set and a value vector set, and the node information includes a query vector set. The key vector set is composed of node feature vector representations of multiple neighbor nodes of different nodes at different layers and times in the graph learning network. The initial value of the value vector set is the same as the initial value of the key vector set.

[0249] The update submodule is used to update the node feature vector representation of the attack intent graph based on the multi-head attention.

[0250] The construction submodule is used to construct the vector representation of the nodes at different time points based on the updated node feature vector representation.

[0251] Furthermore, the detection module 140 is specifically used to: calculate the squared distance between the vector representation of an edge and the center of the feature hypersphere model at different times for each edge in the attack intent map, and obtain the abnormal distance score corresponding to each edge at different times; compare the abnormal distance score corresponding to each edge at different times with the radius of the feature hypersphere model; if the abnormal distance score corresponding to the next edge at the first time is greater than the radius of the feature hypersphere model, then the behavior corresponding to the next edge at the first time is determined to be a lateral diffusion behavior.

[0252] Based on the above scheme, the feature hypersphere model learns the distribution boundary of a normal edge based on the vector representation of the edge in the attack intent graph; wherein, the center of the feature hypersphere model is represented by the average of the vector representations of all edges, and the radius of the feature hypersphere model is a hyperparameter.

[0253] The aforementioned detection device for lateral spread of network threats can execute the detection method for lateral spread of network threats provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the method.

[0254] Example 6

[0255] Figure 8 A schematic diagram of an electronic device 10 that can be used to implement embodiments of the present invention is shown. The electronic device may be a security analysis server or other computer device. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the invention described and / or claimed herein.

[0256] like Figure 8As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0257] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0258] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, central processing unit (CPU), graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as methods for detecting the lateral spread behavior of network threats.

[0259] In some embodiments, the method for detecting the lateral spread of network threats can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the method for detecting the lateral spread of network threats described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to perform the method for detecting the lateral spread of network threats by any other suitable means (e.g., by means of firmware).

[0260] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include: implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0261] In some embodiments, the method for detecting the lateral spread of network threats can be implemented as a computer program, which is inadvertently included in a computer program product. When executed by a processor, the computer program implements the method for detecting the lateral spread of network threats according to the present invention. The computer program product can be understood as a software product that primarily implements its solution through a computer program. The computer program used to implement the method of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer program causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer program can be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a standalone software package, or entirely on a remote machine or server.

[0262] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0263] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0264] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0265] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0266] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0267] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for detecting the lateral spread behavior of network threats, characterized in that, The method includes: A temporal connection graph is constructed based on network security event logs. The temporal connection graph represents graph structure data that describes the relationship between network spatial structure and temporal evolution. Based on the constraints of attacker's potential target orientation, rare connections, and time sequence, suspicious attack paths are determined from the temporal connection graph, and an attack intent graph is constructed based on the suspicious attack paths; The time intervals of different interactive behaviors in the attack intent graph are converted into vector representations, and the vector representations of the edges in the attack intent graph are determined based on the node feature vector representations in the attack intent graph and the vector representations of the different interactive behavior time intervals. Based on the vector representation of normal edges in the attack intent map, the lateral diffusion behavior is determined by the feature hypersphere model, which is constructed based on the overall distribution of the vector representation of normal edges.

2. The method according to claim 1, characterized in that, The process of identifying suspicious attack paths from the temporal connection graph based on constraints such as the attacker's potential target orientation, rare connections, and temporal order includes: From the temporal connectivity graph, edges that satisfy the attacker's potential target-oriented constraints are selected to construct a reachable graph; From the reachable graph, rare paths that satisfy rare connection constraints are selected to construct a directed graph; Suspicious attack paths are determined based on the edges in the directed graph that satisfy the time sequence constraint.

3. The method according to claim 2, characterized in that, The step of constructing a reachable graph by filtering edges from the temporal connectivity graph that satisfy the attacker's potential goal-oriented constraints includes: Step 1: Determine the starting node and the target node from the timing connection diagram. The starting node is a node with an in-degree of zero, and the target node is a key node in the network structure. Step 2: Starting from the starting node, explore forward to determine the exploration path from the starting node to the target node. The exploration path is obtained by iteratively traversing the set of accessible neighbor nodes of the current exploration node. Each exploration traversal records the predecessor access relationship nodes of the current exploration node. The set of accessible neighbor nodes is obtained by removing the set of prohibited nodes from the set of neighbor nodes of the current exploration node. The set of prohibited nodes consists of non-target nodes that have been explored and traversed. Step 3: Starting from the target node, backtrack the exploration path according to the set of predecessor access relationship nodes until the backtracking path corresponding to the target node is completed. Construct a reachability graph of potential target-oriented constraints from the set of reachable edges formed by the edges in the backtracking path.

4. The method according to claim 2, characterized in that, The step of selecting rare paths that satisfy rare connection constraints from the reachable graph to construct a directed graph includes: Based on the historical connection frequency of the edges in the reachable graph, the shortest path algorithm is used to search for a rare path between the starting node and the target node in the reachable graph as the first rare path. The rare path is the path with the minimum edge frequency cost. After removing the first rare path from the reachability graph, the shortest path algorithm is used again to search for the second rare path, until the number of rare paths obtained is greater than a preset value. Construct a directed graph based on the set of edges and nodes of the rare path.

5. The method according to claim 2, characterized in that, The step of determining suspicious attack paths based on edges in the directed graph that satisfy time sequence constraints includes: For each node in the directed graph, obtain a first timestamp set consisting of all outgoing edge times for each node and a second timestamp set consisting of all incoming edge times for each node; The earliest incoming edge time for each node is determined based on the second timestamp set of each node; Filter out edges whose outgoing edge time is greater than the earliest incoming edge time of the node from the first timestamp set of each node; The path corresponding to the outgoing edge is considered a suspicious attack path.

6. The method according to claim 1, characterized in that, The step of determining the vector representation of the edge in the attack intent graph based on the node feature vector representation in the attack intent graph and the vector representation of the time interval of different interaction behaviors includes: The vector representation of the time interval of different interaction behaviors is injected into the corresponding node features in the attack intent map to obtain the query vector; Through the graph attention mechanism, the neighbor node information and node information of each node in the attack intent graph are aggregated to obtain multi-head attention. The neighbor node information includes a key vector set and a value vector set, and the node information includes a query vector set. The key vector set is composed of the node feature vector representations of multiple neighbor nodes of different nodes at different layers and times in the graph learning network. The initial value of the value vector set is the same as the initial value of the key vector set. The node feature vector representation of the attack intent graph is updated based on the multi-head attention; Construct vector representations at different times based on the updated node feature vector representations.

7. The method according to claim 1, characterized in that, The determination of lateral diffusion behavior based on the vector representation of edges in the attack intent graph using a feature hypersphere model includes: For each edge in the attack intent map, calculate the squared distance between the vector representation of an edge and the center of the feature hypersphere model at different times to obtain the anomaly distance score for each edge at different times. The abnormal distance score corresponding to each edge at different times is compared with the radius of the feature hypersphere model; If the abnormal distance score corresponding to the next edge at the first moment is greater than the radius of the feature hypersphere model, then the behavior corresponding to the next edge at the first moment is determined to be a lateral diffusion behavior.

8. The method according to claim 7, characterized in that, The feature hypersphere model learns the distribution boundary of a normal edge based on the vector representation of the edge in the attack intent graph; The center of the feature hypersphere model is represented by the average of the vector representations of all edges, and the radius of the feature hypersphere model is a hyperparameter.

9. A device for detecting the lateral spread of network threats, characterized in that, The device includes: A construction module is used to construct a temporal connection graph based on network security event logs. The temporal connection graph represents graph structure data that represents the relationship between network spatial structure and temporal evolution. The determination module is used to identify suspicious attack paths from the temporal connection graph based on constraints such as the attacker's potential target orientation, rare connections, and time sequence, and to construct an attack intent graph based on the suspicious attack paths; The conversion module is used to convert the time intervals of different interaction behaviors in the attack intent graph into vector representations, and to determine the vector representations of the edges in the attack intent graph based on the node feature vector representations in the attack intent graph and the vector representations of the different interaction behavior time intervals. The detection module is used to determine the lateral diffusion behavior based on the vector representation of normal edges in the attack intent map using a feature hypersphere model, which is constructed based on the overall distribution of the vector representation of normal edges.

10. An electronic device, characterized in that, The electronic device includes: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores a computer program that can be executed by the at least one processor, which is then executed by the at least one processor to enable the at least one processor to perform the method for detecting the lateral spread of network threats as described in any one of claims 1-9.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the method for detecting the lateral spread behavior of network threats as described in any one of claims 1-9.

12. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements a method for detecting the lateral spread behavior of network threats according to any one of claims 1-9.

Images