Digital avatar driven unknown network attack scenario restoration method and device

Abstract

The application discloses a digital avatar-driven unknown network attack scene restoration method and device, and belongs to the technical field of network security. The method takes a pre-constructed and deployed digital avatar resource as an attack trigger anchor point, and realizes high-confidence trigger sensing, threat research and attack scene restoration on terminal attack behavior through layered enhancement collection, risk expansion association, process group modeling, suspicious sample focusing extraction and attack chain reconstruction on the avatar trigger event.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to a method and apparatus for reconstructing unknown network attack scenarios driven by digital avatars. Background Technology

[0002] In today's complex and ever-changing cyberspace environment, unknown cyberattacks targeting critical terminal data resources have become a significant threat to information security. Unknown cyberattacks refer to attacks where attackers use methods, tools, samples, or processes not yet fully understood by the defender to intrude into and damage networks. These attacks are characterized by: continuously changing attack payloads, rapidly evolving attack samples, dynamically adjusting behavioral chains, and flexibly switching attack phases. Furthermore, many of these actions can be disguised as normal system operations or legitimate business activities. For such attacks, defenders often find it difficult to achieve stable and effective detection solely through known threat intelligence, malicious sample signature databases, rule matching, or static strategies, thus exhibiting strong stealth, adversarial nature, and uncertainty.

[0003] Among numerous unknown cyberattacks, Advanced Persistent Threats (APTs) and ransomware attacks are two of the most representative scenarios. APT attacks typically have clear targets and long-term latency characteristics. Attackers often target specific organizations, key personnel, or high-value data resources, gradually establishing a foothold through social engineering, vulnerability exploitation, abuse of legitimate accounts, and backdoor implantation. They then continuously conduct directory traversal, permission probing, target selection, file reading, copying and aggregation, compression and packaging, and covert dissemination around critical files. This type of attack emphasizes long-term latency, low-frequency operations, and phased advancement. Many behaviors during the attack appear superficially similar to normal office access, making it difficult for traditional endpoint protection systems to identify them in a timely manner.

[0004] Ransomware attacks have become one of the most destructive and widespread forms of cyberattacks. The attack process has evolved from early simple methods relying on email delivery and single-point infection to complex attack chains combining vulnerability exploitation, remote service penetration, privilege escalation, lateral movement, mass deployment, and centralized encryption. After successfully gaining control of the target terminal or local area network, attackers typically prioritize probing high-value files and shared directories, traversing, filtering, copying, deleting shadow copies of volumes, disabling protection, mass encryption, or performing double ransomware attacks on critical data resources. This not only causes direct economic losses but can also lead to critical business interruptions, irrecoverable data, and the leakage of sensitive information, posing a serious threat to the information system security of key industries, critical infrastructure, and enterprises.

[0005] Existing endpoint data security measures mainly focus on static file encryption, access control, endpoint antivirus scanning, and malicious sample identification based on rules or signature databases. These methods are effective in dealing with known threats or general unauthorized access, but overall they still rely primarily on "known feature identification" and "peripheral blocking," generally lacking the ability to dynamically perceive, trace, and provide evidence-based responses around critical data resources. In particular, when attackers bypass traditional detection mechanisms using unknown vulnerabilities, evasion samples, legitimate tools, disguised processes, stolen credentials, or phased low-frequency operations, the system often struggles to promptly identify their reconnaissance, probing, access, copying, compression, dissemination, or encryption activities targeting critical files. This results in the compromise of critical data resources, while also making it difficult to effectively preserve high-value evidence from the attack process.

[0006] On the other hand, while existing endpoint security systems can collect a certain amount of file operation logs, process behavior logs, registry logs, and network connection logs, these logs are typically scattered in origin, inconsistent in granularity, have weak temporal correlations, and are subject to significant background noise. This makes them difficult to directly support rapid assessment of unknown network attacks and reconstruction of attack scenarios. Particularly in APT (Aggressive Persistent Threat) and ransomware attacks, attackers often employ low-frequency, weak-feature, long-latency, and multi-stage approaches to gradually approach critical data resources. Individual actions are relatively small in scale, but the overall chain spans a long period. Traditional methods relying on threshold alerts, isolated event detection, or single-point feature matching are insufficient to establish stable, high-confidence triggering evidence. Even when conducting post-attack forensic investigations, analysts often need to manually sift through massive amounts of logs to identify suspicious behaviors. It is difficult to quickly locate key processes, files, network sessions, and suspicious samples directly related to the attack, let alone fully reconstruct the attacker's behavioral path and scenario evolution around critical data resources.

[0007] Furthermore, existing technologies generally suffer from the following shortcomings in unknown cyberattack scenarios: First, they lack a source of key events that can trigger subsequent analysis with high confidence, making it difficult to focus on the attack in a timely manner; second, they lack a mechanism for layered enhanced collection around key triggering events, leading to the easy loss of key evidence; third, they lack a unified correlation analysis framework for the attack chain, making it difficult to effectively link the relationships between processes, files, network sessions, and suspicious samples; and fourth, they lack scenario-based analysis methods that can quickly reconstruct the attack process around key data resources, resulting in low efficiency in attack threat assessment, incomplete scenario reconstruction, and insufficient evidence support capabilities.

[0008] Therefore, relying solely on static protection, signature detection, or post-incident log backtesting is insufficient to meet the practical needs of "early detection, rapid location, reconstructibility, and forensic evidence" for typical unknown cyberattacks such as APT attacks and ransomware attacks. There is an urgent need for a new technical solution for assessing and reconstructing unknown cyberattack threats. This solution should be able to construct a high-confidence triggering mechanism around key data resources, transforming previously concealed, dispersed, and weakly characterized attack behaviors into perceptible, correlated, and traceable starting points for analysis. Furthermore, it should enable layered enhanced data collection, attack chain extraction, focused analysis of suspicious samples, and attack scenario reconstruction, thereby achieving accurate assessment of unknown cyberattack behaviors on endpoints and complete reconstruction of attack scenarios. Summary of the Invention

[0009] To address the problems of delayed detection, fragmented evidence chains, difficulty in reconstructing attack processes, and difficulty in focusing and extracting suspicious samples in existing technologies for terminal eavesdropping and ransomware attacks, this invention provides a method and apparatus for reconstructing unknown network attack scenarios driven by digital avatars. This method uses pre-constructed and deployed digital avatar resources as attack trigger anchors. Through layered enhanced collection of avatar-triggered events, risk expansion and correlation, process group modeling, focused extraction of suspicious samples, and attack chain reconstruction, it achieves high-confidence trigger perception of terminal attack behavior, threat assessment, and attack scenario reconstruction.

[0010] To achieve the above objectives, the technical solution of the present invention includes the following:

[0011] A method for reconstructing unknown network attack scenarios driven by digital avatars, the method comprising: Based on the target terminal's business scenario, file type distribution, directory structure, user habits, and resource characteristics, construct multiple types of digital substitute resources and adaptively deploy these digital substitute resources to the target terminal. Lightweight data collection is continuously performed on the target terminal's file system behavior, process behavior, network behavior, and identity access behavior. When an external process is detected to trigger a surrogate event related to digital surrogate resources, enhanced data collection is performed centered on this event to obtain an enhanced evidence set. The lightweight data collection involves collecting the minimum necessary behavioral features related to security analysis, while the enhanced data collection involves comprehensive contextual collection of relevant behavior logs, process chains, file objects, network connections, and identity credentials. Starting from the avatar triggering event, cross-source association is performed between the triggering process and related processes. Based on the suspicious process group and attack behavior subgraph constructed by the cross-source association, the malice judgment result of the localized sample is obtained. Attack scenarios are reconstructed based on enhanced evidence sets, suspicious process groups, attack behavior subgraphs, and the results of malice assessment of localized samples, resulting in an attack source map.

[0012] Furthermore, based on the target terminal's business scenario, file type distribution, directory structure, user habits, and resource characteristics, multiple types of digital surrogate resources are constructed, including: For the target terminal's industry, job role, and business scenario, a digital avatar resource template library is pre-established. The digital avatar resource template library includes document, table, image, audio / video, compressed package, configuration, log, and data fragment resource templates. The attribute information recorded for each digital avatar resource template includes resource type, applicable business scenario, file naming rules, recommended delivery directory, meta-attribute features, associated resource relationships, and incentive priority. Select target resources from digital surrogate resource templates, public information, desensitized samples, and rule-based materials. Construct original digital surrogate resources that are consistent with the target business environment by replacing fields, cropping content, rewriting rules, preserving layout, converting formats, disguising timestamps, reconstructing metadata, and / or splicing associated attachments. The original digital surrogate resource is configured with external attributes and contextual relationships consistent with the real business environment to obtain the digital surrogate resource; wherein, the external attributes include file name, extension, naming style, creation time, modification time, access time, owner and permissions; the contextual relationships include directory hierarchy, attachment reference relationship, shortcut relationship, internal structure of compressed package and version and theme consistency between resource clusters in the same directory.

[0013] Furthermore, adaptively delivering the digital avatar resources to the target terminal includes: Based on the popularity of the target terminal's directory, file access habits, distribution of shared paths, job role characteristics, and high-value naming rules, delivery points are selected from the target directory. The high-value naming rules refer to a set of rules constructed based on historical file access behavior statistics and high-frequency sensitive semantic features in file naming. These high-frequency sensitive semantic features are defined as the number or proportion of a certain sensitive semantic feature in historical file access behavior statistics and file naming exceeding a set value. The target directories include desktop, download directory, document directory, email attachment directory, shared directory, project data directory, work log directory, and / or compressed archive directory. Based on the association mapping relationship between the business role of the file access subject and the target directory, the priority directory location and delivery method of the digital surrogate resource are determined from the delivery points; wherein, the delivery method includes resource cluster delivery method or single file delivery method.

[0014] Furthermore, enhanced evidence collection was conducted centered on the stand-in triggering event, resulting in an enhanced evidence set, including: When an external process is detected to trigger a substitute event related to digital substitute resources, a substitute trigger event log is generated. The substitute trigger event log includes the substitute trigger time, the triggering process name and process ID, the original target file path, the substitute file path, the calling thread or handle information, the currently logged-in user and the trigger session identifier. An event analysis window is constructed centered around the event triggered by the stand-in; Enhanced data collection is performed based on this event analysis window. This enhanced collection includes time-domain enhanced collection, process-domain enhanced collection, object-domain enhanced collection, network-domain enhanced collection, and identity-domain enhanced collection. Time-domain enhancement involves expanding a preset time window forward and backward around the trigger moment and supplementing it with relevant behavior logs. Process-domain enhanced collection expands the collection of the triggering process, its parent process, child processes, sibling processes, and their command-line parameters. Object-domain enhanced collection expands the collection of files in the same directory, associated attachments, batch-read files, and compressed archive objects around the digital avatar resource. Identity-domain enhanced collection expands the collection of account switching, remote login, credential retrieval, and shared mapping behaviors around the triggering session. Logs continuously generated during the enhanced collection period are parsed for key fields, and the results of the key field parsing are used for hierarchical filtering to obtain an enhanced evidence set. The hierarchical filtering includes: marking logs directly related to the triggering event as core evidence; marking logs related to the same session, same directory, or same network connection of the triggering process as strongly correlated evidence; and marking logs that only have background supporting significance as weakly correlated evidence.

[0015] Furthermore, starting from the avatar-triggered event, cross-source association is performed between the triggering process and related processes. Based on the suspicious process group and attack behavior subgraph constructed from the cross-source association, the localized sample malice assessment results are obtained, including: Based on the triggering relevance between the triggering process and related processes, a suspicious process group is constructed. The related processes include the parent and child processes of the triggering process, the sibling processes of the triggering process, processes with adjacent execution relationships within the same session, related processes triggered by the same user account, processes with file handle inheritance relationships with the triggering process, and processes with network connection inheritance relationships. Factors determining the triggering relevance include: the time distance from the triggering time of the substitute, whether the substitute's resources are directly accessed, whether there is a process tree relationship with the triggering process, whether command-line parameters, working directory, or loaded modules are shared, and whether the process participates in subsequent copying, compression, encryption, or uploading activities. Based on a suspicious process group, an attack behavior subgraph is constructed, consisting of process nodes, file nodes, network nodes, and session nodes. The edges in the attack behavior subgraph include process creation edges, file access edges, file copying / renaming / compression edges, network connection edges, session inheritance edges, module loading edges, and sample landing edges. The attributes of the attack behavior subgraph also include the stage in which it is located, which includes resource reconnaissance stage, target selection stage, batch reading stage, file aggregation stage, compression and packaging stage, and network transmission or encrypted execution stage. Based on the suspicious process groups and attack behavior subgraphs, suspicious sample files related to the attack activities are extracted from the target terminal file system. Based on preset rules and a localized sample analysis engine, malicious detection is performed on suspicious sample files to obtain localized sample maliciousness assessment results.

[0016] Furthermore, based on the surrogate trigger event logs, enhanced evidence sets, suspicious process groups, attack behavior subgraphs, and the results of localized sample malice assessment, the attack scenario is reconstructed to obtain an attack source map, including: Using the substitute-triggered event as the initial event source, and combining the enhanced evidence set with the results of the localized sample malice assessment, the attack event is expanded bidirectionally to obtain network session information; By integrating the surrogate triggering event, suspicious process group, attack behavior subgraph, localized sample malice assessment results and network session information, the attack chain reconstruction result is obtained. An endpoint attack attribution map is generated based on the attack chain reconstruction results.

[0017] Furthermore, using the surrogate-triggered event as the initial event source, and combining the enhanced evidence set with the results of the localized sample malice assessment, a bidirectional expansion of the attack event is performed to obtain network session information, including: The system expands bidirectionally using the substitute trigger event as the initial event source; wherein, the bidirectional expansion includes reverse backtracking and forward pursuit; the reverse backtracking is the source of the trigger process; the forward pursuit is the copying, compression, transmission, encryption, deletion and clearing behavior after the trigger event; Based on the results of the enhanced evidence set and the maliciousness assessment of the localized samples, it is determined whether the events in the bidirectional expansion are attack events. Among them, the conditions for an attack event include: the events in the bidirectional expansion are suspicious events in the results of the maliciousness assessment of the localized samples; the events in the bidirectional expansion are connected to the core evidence or strongly related evidence in the enhanced evidence set through the same process, the same session, or the same network; and the events in the bidirectional expansion simultaneously satisfy the continuous abnormal expansion characteristics of the file operation behavior chain and the process network behavior chain within the time window of the substitute triggering event. Network session information is constructed based on attack events in bidirectional extension.

[0018] A device for recreating unknown network attack scenarios driven by a digital avatar, the device comprising: The digital surrogate resource construction and deployment module is used to construct multiple types of digital surrogate resources based on the target terminal's business scenario, file type distribution, directory structure, user habits, and resource characteristics, and adaptively deploy the digital surrogate resources to the target terminal. The layered enhanced collection and log management module is used to continuously and lightweightly collect file system behavior, process behavior, network behavior, and identity access behavior of the target terminal. When an external process is detected to trigger a surrogate event related to digital surrogate resources, enhanced collection is performed centered on the surrogate trigger event to obtain an enhanced evidence set. The lightweight collection is the collection of the minimum necessary behavioral features related to security analysis, while the enhanced collection is a comprehensive contextual collection of relevant behavioral logs, process chains, file objects, network connections, and identity credentials. The attack chain association extraction and suspicious sample focusing and analysis module is used to perform cross-source association of the triggering process and related processes starting from the surrogate triggering event, and obtain the localized sample malice analysis results based on the suspicious process group and attack behavior subgraph constructed based on the cross-source association; The threat assessment result generation and attack scenario reconstruction module is used to reconstruct attack scenarios based on enhanced evidence sets, suspicious process groups, attack behavior subgraphs and the malice assessment results of localized samples, and obtain attack source tracing diagrams.

[0019] A computer device includes: a processor and a memory storing computer program instructions; the processor, when executing the computer program instructions, implements the method for reconstructing unknown network attack scenarios driven by digital avatars as described above.

[0020] A computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement the method for reconstructing unknown network attack scenarios driven by digital avatars as described above.

[0021] Compared with the prior art, the present invention has at least the following beneficial effects.

[0022] 1. This invention uses digital surrogate resource triggering events as high-confidence anchor points, which can significantly narrow the scope of terminal attack analysis and reduce the interference of background noise from massive logs on the judgment. 2. The present invention designs a layered enhanced collection mechanism driven by a substitute trigger, which can dynamically improve the log granularity and evidence retention strength according to the trigger event, and more efficiently solidify key attack evidence; 3. The present invention designs a method for constructing suspicious process groups and extracting attack behavior subgraphs based on trigger anchors, which can expand and reconstruct the complete attack chain from a single proxy access event; 4. This invention designs a suspicious sample focusing extraction method based on process call chains and file dependency chains, which can efficiently locate suspicious samples strongly related to attack events from a large number of system files; 5. This invention is applicable to terminal data theft attacks, ransomware attacks, and other terminal attack scenarios targeting critical data resources, and has strong practical applicability. Attached Figure Description

[0023] Figure 1 This is a flowchart illustrating the overall workflow of the digital avatar-driven method for reconstructing unknown network attack scenarios according to the present invention.

[0024] Figure 2 This describes the principle of the method for reconstructing unknown network attack scenarios driven by digital avatars in this embodiment of the invention.

[0025] Figure 3 This is an overall structural diagram of the unknown network attack scenario reconstruction device driven by digital avatars in an embodiment of the present invention. Detailed Implementation

[0026] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, and to make the objectives, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0027] like Figure 1 and Figure 2 As shown in the figure, the method for reconstructing unknown network attack scenarios driven by digital avatars provided in this embodiment of the invention includes the following steps.

[0028] Step S1: Construction and adaptive deployment of multi-type digital avatar resources.

[0029] Based on the target terminal's business scenario, file type distribution, directory structure, user habits, and high-value resource characteristics, multiple types of digital surrogate resources are constructed, and these digital surrogate resources are adaptively deployed to high-hit locations on the target terminal to form a set of surrogate resources that can trigger attack behavior monitoring.

[0030] Step S11: Digital Alien Resource Template Construction. A digital avatar resource template library is pre-established based on the industry, job role, and business scenario of potential victim terminals. This template library includes, but is not limited to, document, table, image, audio / video, compressed file, configuration, log, and data fragment resource templates. Each template records the following attribute information: resource type, applicable business scenario, file naming rules, recommended delivery directory, meta-attribute characteristics, associated resource relationships, and inducement priority.

[0031] Step S12: Digital Substitute Resource Construction. Select target resources from pre-set templates, publicly available materials, anonymized samples, and rule-based materials. Construct a digital substitute resource consistent with the target business environment through methods such as field replacement, content trimming, rule rewriting, layout preservation, format conversion, timestamp spoofing, metadata reconstruction, and attachment splicing. The digital substitute resource may include, but is not limited to: Documents, reports, notices, contracts, and record sheets; Images, diagrams, flowcharts, screenshots; Audio, video, voice messages, training materials; Configuration files, log snippets, database export snippets, compressed files, and their attachments.

[0032] For example, in one implementation, for internal project document ontology files, a substitute resource can be generated based on a publicly available project report template. Sensitive fields in the original file (such as the real project name, real participants, and real time points) are replaced with preset generic fields, while retaining the original document structure and format. By adjusting the modification time, creation time, and author information, consistency in behavior at the metadata level is simulated, thereby generating a substitute document with a realistic business appearance but without containing sensitive information. Furthermore, for table-type data resources, a substitute resource can be constructed based on de-identified sample data. While retaining the field structure and data distribution characteristics, key values ​​are perturbed within ranges or replaced with symbols, while maintaining the consistency of relationships between fields. This ensures that the substitute data is statistically similar to the real data but does not reflect the actual business data content.

[0033] Step S13: Digital avatar resource consistency masquerading. Set external attributes and contextual relationships for the digital avatar resource that are consistent with the real business environment, including: Filename, extension, and naming style; Creation time, modification time, access time; Ownership, permissions, directory hierarchy; Attachment reference relationships, shortcut relationships, and the internal structure of the compressed file; Version and theme consistency across resource clusters within the same directory.

[0034] The above methods can be used to increase the credibility of stand-in resources and the probability of being reached by attackers.

[0035] Step S14: Adaptive Deployment of Digital Alien Resources. Based on terminal directory popularity, file access habits, shared path distribution, job role characteristics, and high-value naming rules, deployment points are selected from locations such as desktop, download directory, document directory, email attachment directory, shared directory, project data directory, work log directory, and compressed archive directory. High-value naming rules refer to a set of rules constructed based on historical file access behavior statistics and high-frequency sensitive semantic features in file naming. These rules are used to identify file naming patterns that are more likely to be prioritized or clicked by the accessing entity in the actual usage environment, such as naming structures containing business-sensitive keywords, task instruction words, or project semantic identifiers. Specifically, this includes: (1) Sensitive semantic keyword rules are used to reflect keywords in the file name that are related to sensitive business or high-value information, such as "contract", "budget", "finance", "salary", "customer", "account", "password", "list", "plan", "report", "data", "confidential", "internal", etc. The specific keywords are configured according to the business scenario of the target unit or obtained from the statistics of historical file access records; (2) Business object identification rules, which are used to reflect the semantic identifiers with business orientation, such as project name, project number, department name, customer name, business system name, equipment name, and task number appearing in the file name; (3) Semantic rules for task instructions, which are used to reflect words such as “pending processing”, “please confirm”, “final version”, “summary”, “approval”, “submit”, “important”, “urgent”, “backup” that can involve task status, processing requirements or priorities; (4) Document purpose semantic rules, which are used to reflect naming components that can characterize the business purpose of a document, such as "contract", "list", "ledger", "plan", "scheme", "report", "record", "address book", "voucher", "configuration", "backup"; (5) Combination naming structure rules, which are used to reflect the naming structure formed by combining multiple semantic elements mentioned above according to the file naming habits in the target business environment, such as the combination of project identifier, document type and version information, the combination of department name, business theme and time identifier, and the combination of task number, data type and status identifier.

[0036] Furthermore, a mapping relationship is established between business roles and target directories. This serves two purposes: first, it determines the priority directory locations for digital surrogate resources; second, it determines the deployment method—using resource cluster deployment in directories with high business semantic matching, and single-file deployment in directories with low matching or scattered scenarios, thereby improving the natural distribution and access hit probability of surrogate resources in the real business environment. Here, business roles refer to the semantic identity tags of file-accessing entities within the business system, used to characterize the typical file access habits and directory usage preferences of different types of users, such as finance, R&D, operations, or project management roles. This information assists in determining the deployment location and distribution strategy of digital surrogate resources, rather than directly referring to the digital surrogate resources themselves.

[0037] Step S2: Layered enhanced log collection and event storage driven by surrogate triggers.

[0038] The system continuously collects file system behavior, process behavior, network behavior, and identity access behavior of the target terminal. When a process triggers a digital avatar resource access event, it initiates layered enhanced collection centered on the triggering event, retains evidence of highly correlated behaviors within the preceding and following time windows, and parses, filters, and structures the logs for storage.

[0039] Step S21: Continuous Lightweight Data Collection. The system performs lightweight, continuous data collection on the target terminal's file system behavior, process behavior, network behavior, and identity and session behavior, and generates temporary log files. Lightweight data collection refers to a method of continuously recording only the minimum necessary behavioral characteristics related to security analysis, without performing file content-level collection, full system image collection, or high-frequency system call tracing, in order to reduce the impact on terminal performance and normal user operation.

[0040] The collected basic logs include: file access behavior logs, process creation and exit logs, process network connection logs, authentication and session access logs, and digital avatar resource trigger logs. Compared to complete behavior auditing or deep system monitoring methods, the lightweight collection method in this invention does not record file content or process execution detail-level instruction information, but only retains behavior-level metadata for security analysis. This ensures the observability of attack behavior while achieving low-overhead, continuous behavior monitoring capabilities. The minimum necessary behavioral features related to security analysis refer to behavior-level metadata that can be used to identify the subject, object, type, time of occurrence, and relationships between subjects, including: (1) Process behavior characteristics, including process name, process identifier, parent process identifier, process start and exit time, executable file path, and process start command; (2) File behavior characteristics, including access file path, file name, file type, file operation type, operation time, process identifier of the file operation, and file creation, opening, reading, writing, renaming, and deletion behavior identifiers; (3) Network behavior characteristics, including the process identifier, source address, destination address, source port, destination port and network protocol that initiated the network connection; (4) Digital substitute resource association characteristics, including substitute file path, trigger process identifier, trigger time and trigger operation type.

[0041] Step S22: Substitute Trigger Event Identification. When an application process performs operations such as opening, previewing, copying, renaming, compressing, deleting, sharing, uploading, or encrypting a digital substitute resource, the system identifies this event as a substitute trigger event and records the substitute trigger time, triggering process name and process ID, original target file path, substitute file path, calling thread or handle information, and the currently logged-in user and session identifier, thereby generating a substitute trigger event log. The substitute trigger event refers to external application process access behavior to the digital substitute resource, excluding internal system maintenance operations, resource synchronization operations, and background update operations triggered by the substitute system itself, thus avoiding misjudging non-aggressive or system behaviors as offensive behaviors.

[0042] Step S23: Layered Enhanced Acquisition Startup. After identifying the surrogate trigger event, the system constructs an event analysis window centered on the event and automatically enters the enhanced acquisition mode.

[0043] The enhanced acquisition mode includes: Time domain enhancement: Expand the preset time window forward and backward around the trigger moment to supplement relevant behavior logs; Process domain enhancement: Extend the collection of data around the triggering process to its parent process, child process, sibling processes, and command-line parameters; Object domain enhancement: Expand the collection of files in the same directory, associated attachments, batch-read files, and compressed archive objects around the accessed surrogate file; Network domain enhancement: Extend the collection of data on the network connectivity, domain name resolution, remote shared access, and external connection behavior of the triggering process; Identity domain enhancement: Focusing on triggering sessions, this feature collects data on account switching, remote login, credential retrieval, and shared mapping behaviors.

[0044] Step S24: Log Structured Parsing and Hierarchical Storage. The system parses key fields of logs continuously generated during the enhanced data collection period and stores them in the database through hierarchical filtering: Mark logs directly related to the triggering event as core evidence; Mark logs related to the same session, directory, or network connection as the triggering process as strong evidence of correlation. Logs that only provide background information are marked as weak evidence.

[0045] Temporary log files, after being parsed and stored, can be deleted according to a deletion strategy to reduce storage pressure. Specifically, the deletion strategy includes: prioritizing the deletion of temporary log files that have been stored and are weakly correlated evidence or have exceeded the set retention period; and retaining or delaying the deletion of original logs corresponding to core evidence and strongly correlated evidence after persistent storage, thereby achieving dynamic optimization of log storage resources and hierarchical management of evidence data.

[0046] Step S25: Front-end Display and Event Retrieval. The system displays the surrogate trigger event log, file operation behavior log, process network behavior log, and process detailed information log in the GUI interface, and allows viewing the enhanced evidence set within the associated time window using the trigger event as an index. Specifically, the system establishes a time window centered on the occurrence time of the trigger event, and uses process identifier, session identifier, file path identifier, and network connection identifier as association keys to perform cross-log source matching and aggregation of core evidence, strongly correlated evidence, and weakly correlated evidence; at the same time, it assigns differentiated weights to different logs according to the evidence classification results, with core evidence having the highest weight, followed by strongly correlated evidence, and weakly correlated evidence having the lowest weight. Finally, through time alignment, multi-key association, and weight fusion, the various types of logs are integrated into a structured enhanced evidence set for subsequent attack behavior analysis and suspicious process group construction.

[0047] Step S3: Extraction of attack chain associations based on trigger anchors and focused analysis of suspicious samples.

[0048] Starting with the surrogate trigger event, cross-source association is performed on the triggering process, its parent, child and sibling processes, related file objects, network sessions and subsequent operation events to construct a suspicious process group and attack behavior subgraph; further, suspicious files that are triggered, loaded, called, released or associated are extracted from the suspicious process group, and maliciousness is judged using a localized sample analysis engine.

[0049] Step S31: Constructing a Suspicious Process Group. Starting with the triggering process in the surrogate triggering event, construct a suspicious process group by combining the following relationships: parent-child process relationship, sibling process relationship, adjacent execution relationship under the same session, related process relationship triggered by the same user account, file handle inheritance relationship, and network connection inheritance relationship.

[0050] The system calculates the trigger relevance for each process, which is determined by at least the following factors: the time distance from the trigger time of the substitute, whether it directly accesses the substitute's resources, whether there is a process tree relationship with the triggering process, whether it shares command line parameters, working directory or loaded modules, and whether it participates in subsequent copying, compression, encryption or uploading behaviors.

[0051] When a process triggers a relevance higher than a threshold, it is included in the suspicious process group.

[0052] Step S32: Attack Behavior Subgraph Extraction. Based on the suspicious process group, construct an attack behavior subgraph consisting of process nodes, file nodes, network nodes, and session nodes. The edge relationships include, but are not limited to: process creation edges, file access edges, file copy / rename / compression edges, network connection edges, session inheritance edges, module loading edges, and sample landing edges.

[0053] Based on the behavioral trajectory before and after the surrogate trigger event, the system sorts the attack behavior subgraph in chronological order and identifies the following key stages: resource reconnaissance stage, target selection stage, batch reading stage, file collection stage, compression and packaging stage, and network transmission or encrypted execution stage.

[0054] Step S33: Suspicious Sample Focused Extraction. Based on the suspicious process groups and attack behavior subgraphs, extract sample files highly relevant to the attack activity from the terminal file system. Extraction targets include, but are not limited to: File formats include EXE, DLL, LNK, BAT, PS1, VBS, JS, DAT, INI, TMP, ZIP, etc. The module file loaded by the triggered process; The files that are written to, released, or invoked; Newly created or renamed files in the same event window; Uploaded, cached, or packaged files corresponding to external linking activities.

[0055] To avoid an excessively broad sample extraction scope, this invention employs a focused extraction strategy, calculating the sample correlation degree for each candidate file. The sample correlation degree includes at least: Distance from the triggering process; Frequency of references to suspicious process groups; Is it located in the trigger directory or an adjacent directory? Does it appear in a new event window? Does it involve signature anomalies, hash anomalies, or path spoofing?

[0056] When the correlation between samples exceeds the threshold, candidate files are copied to a preset suspicious file path for unified management.

[0057] Step S34: Localized Sample Maliciousness Assessment. Based on preset rules and a localized sample analysis engine, perform maliciousness detection on the extracted suspicious sample files.

[0058] The localized sample analysis engine comes pre-loaded with a trusted white-signature certificate library, a popular malware hash library, a suspicious path and disguised filename rule library, loading chain anomaly rules, and a lightweight static behavior feature library. Through rapid analysis of black and white samples, signature verification, hash comparison, path rule analysis, and lightweight static feature analysis, it outputs three levels of results for suspicious samples: malicious, suspicious, and unknown.

[0059] Step S4: Threat assessment results generation and terminal attack scenario reconstruction.

[0060] A global fusion analysis is performed on the malicious samples, suspicious process groups, file operation trajectories, network connection trajectories, and surrogate trigger sequences after assessment. This reconstructs the attacker's reconnaissance, probing, access, copying, packaging, external connection, or encryption process around key data resources, forming a terminal attack scenario tracing diagram and related evidence output results.

[0061] Step S41: Bidirectional Expansion of the Substitute Trigger Anchor Point. Using the substitute trigger event as the core anchor point, the attack event is expanded bidirectionally. The input data for Step S4 includes: the substitute trigger event log, the enhanced evidence set generated in Step S24, and the localized sample malice assessment results (malicious / suspicious / unknown labels and their corresponding sample identifiers) output in Step S34.

[0062] During the attack event determination process, the system uses the "avatar trigger event" as the initial event source. When one or a combination of the following conditions are met, the event is identified as an attack event: (1) The corresponding suspicious sample is determined to be "malicious" in step S34; (2) The surrogate triggering event and the core evidence or strongly related evidence in the enhanced evidence set are connected and associated with each other through the same process, the same session or the same network; (3) The continuous abnormal expansion characteristics of the file operation behavior chain and the process network behavior chain are satisfied simultaneously within the time window.

[0063] The bidirectional extension behavior covers the following specific methods: Reverse backtracking: Tracing back the preceding sources of the triggering process, including the startup entry point, delivery path, parent process source, source of the written file, and initial network session; Forward tracing: Tracks copying, compression, distribution, encryption, deletion, and cleanup behaviors after an event is triggered.

[0064] Step S42: Attack Scenario Reconstruction. The surrogate triggering event, suspicious process group, attack behavior subgraph, suspicious sample analysis results, and network session information are uniformly integrated to reconstruct the complete attack chain. The network session information originates from the bidirectional expansion results of Step S41, including initial network session information obtained during the reverse backtracking process and network connection and outbound behavior records continuously generated during the forward tracing process, used to characterize the continuity of network interactions across stages during the attack.

[0065] The attack chain includes at least: an initial execution node, a key jump node, a substitute trigger node, a file aggregation node, an external transmission or encrypted execution node, and a key sample mounting node.

[0066] Step S43: Source Map Generation and Result Display. An endpoint attack source map is automatically generated based on the attack chain reconstruction results. The map shows: Key timeline; Key processes and their process tree relationships; Key file objects and their operation paths; Critical network connections and external paths; Key samples and their malicious conclusions; Mapping relationship between the substitute trigger node and the original target file.

[0067] Ultimately, this will generate a traceability result that shows the entire process of attacks that steal or extort critical data resources, allowing users and security analysts to gain a comprehensive understanding, conduct manual review, and take subsequent actions.

[0068] like Figure 3 As shown, this embodiment of the invention also provides a digital avatar-driven unknown network attack scenario reconstruction device, comprising the following modules: (1) Digital avatar resource construction and deployment module: used to construct different types of digital avatar resources and adaptively deploy them according to the target terminal directory popularity, job role, scene tag and file type preference.

[0069] Currently supported resource types include, but are not limited to: Document types: txt, docx, doc, pdf, xlsx, xls, csv, pptx, ppt, json, md; Image types: jpg, png; Video files: mp4, mov; Audio files: mp3, wav; And other types of resources such as compressed files, configuration files, and log fragments.

[0070] (2) Layered Enhanced Acquisition and Log Management Module: It is used to identify the triggering events of substitute resources and automatically start layered enhanced acquisition of time domain, process domain, object domain, network domain and identity domain around the triggering time; at the same time, it performs log parsing, hierarchical filtering, database management and front-end display. (3) Attack chain association extraction and suspicious sample focusing analysis module: used to construct suspicious process groups, extract attack behavior subgraphs, focus on extracting suspicious sample files, and output malice analysis results through localized sample analysis engine; (4) Threat assessment result generation and attack scenario reconstruction module: used to perform global fusion analysis on surrogate trigger events, enhanced collection logs, suspicious process groups, network behavior, file behavior and sample assessment results, automatically reconstruct attack scenarios and generate terminal attack tracing diagrams.

[0071] The effectiveness of this invention will be experimentally verified by simulating two types of attack scenarios, including advanced network espionage attack simulation and ransomware encryption ransomware attack simulation.

[0072] (1) Advanced network espionage attack simulation.

[0073] This embodiment takes the advanced cyberattack group "Silver Fox" as an example to reproduce its typical attack methods such as Trojan sample implantation, remote control, directory browsing, and sensitive file theft, and to verify the effectiveness of the present invention in attack threat assessment and scenario reconstruction in advanced network espionage scenarios.

[0074] The specific steps are as follows: (A) Deploy the “Silver Fox” organization’s real remote control framework on the simulated attack terminal to generate a Trojan program executable file for controlling potential victim terminals; (B) Delivering and running the Trojan program on the simulated victim terminal and viewing the attack remote control terminal, it can be seen that the newly infected victim device has been successfully online, forming a covert communication channel, and key information such as IP and username can be observed. (C) By browsing the victim's device file directory through the remote control terminal, the attacker observes decoy files of different formats in commonly used user directories such as desktop, documents, and downloads. These files have content similar to critical and sensitive files, thereby triggering the theft of secrets and downloading the files to the attack terminal through the remote control channel. (D) After the digital avatar-driven unknown network attack scenario reconstruction device detects the digital avatar resource triggering event, it uses the event as a high-confidence anchor point to automatically start layered enhanced collection around the triggering time, triggering process, associated file objects and network sessions, and continuously records file system behavior, process behavior, network behavior and identity session information. (E) This device further constructs a suspicious process group around the surrogate triggering event, extracts the parent-child and sibling processes, landed files and external behaviors related to the triggering process, and performs focused extraction and localized maliciousness analysis on the relevant suspicious samples; (F) After completing sample identification and behavior association, this device automatically reconstructs the complete attack scenario from Trojan execution, remote control online, directory traversal, target selection, surrogate triggering, file theft to external connection channel use, and generates terminal attack tracing map; (G) Based on the localized maliciousness assessment results, this device promptly blocks the data theft process and related control links, causing the remote control channel to be interrupted. The attacking end displays that the victim terminal has gone offline and cannot continue to carry out real-time remote control and file theft.

[0075] This experimental case demonstrates that, under conditions where advanced network espionage attacks have entered the actual file access stage, this invention can use digital surrogate resource triggering events as a high-confidence entry point to quickly locate suspicious processes, network sessions, and operation objects strongly related to espionage activities from massive amounts of terminal behavior; and through a surrogate-triggered, layered enhanced collection mechanism, it can promptly solidify key evidence during attack execution; further, by combining suspicious process group construction, suspicious sample focused extraction, and attack behavior subgraph correlation analysis, it can achieve automatic extraction and global reconstruction of the complete process of advanced network espionage attacks. This proves that this invention can not only effectively support the protection of critical data resources, but also significantly improve the attack scenario reconstruction capability, sample discovery and extraction capability, and evidence tracing capability in terminal espionage attack scenarios.

[0076] (2) Simulation of ransomware encryption ransomware attack.

[0077] This embodiment uses the widely distributed Locky ransomware to verify the effectiveness of the digital avatar-driven unknown network attack scenario reconstruction device in encrypted ransomware attack scenarios.

[0078] When the Locky ransomware sample is directly implanted and run on a simulated victim terminal, the ransomware filters important files on the victim terminal and performs batch encryption, while simultaneously displaying a ransom note. To verify the effectiveness of the method of this invention in ransomware attack scenarios, the following experiments were conducted after deploying the device of this invention on a simulated victim terminal: (A) After the ransomware sample runs on the terminal, it begins to perform batch scanning and filtering of files in directories such as the desktop, documents, and downloads; (B) When the ransomware process touches the pre-deployed digital surrogate resources and performs operations such as reading, rewriting, and encryption, this device recognizes the surrogate triggering event and automatically starts layered enhanced collection of the triggering process and its associated behaviors; (C) This device continuously records evidence related to the ransomware process, such as bulk file access behavior, suspicious child process behavior, network behavior, command line parameters, directory traversal traces, and newly generated or renamed files; (D) Based on the surrogate trigger anchor, this device constructs a suspicious process group and attack behavior subgraph related to ransomware attacks, and identifies the key nodes in the ransomware sample's target selection, batch reading, encrypted execution and file rewriting processes; (E) This device further extracts suspicious sample files that are strongly related to the ransomware process and quickly assesses their malice through a localized sample analysis engine; (F) After completing event identification and sample confirmation, this device promptly blocks the ransomware process to prevent critical files from being further encrypted and damaged; (G) At the same time, this device automatically generates ransomware attack tracing results around the surrogate triggering event, which is used to demonstrate the entire process of attack sample execution, batch file traversal, surrogate triggering, encryption expansion and blocking measures.

[0079] This experimental case demonstrates that, under the condition that a ransomware attack has been initiated and has begun to access high-value data resources, this invention can quickly discover the true attack intent of the ransomware process through digital surrogate resource triggering events, and thereby drive the enhanced collection and evidence preservation of subsequent highly correlated logs; by constructing a suspicious process group around the surrogate triggering behavior, extracting suspicious samples and reconstructing the attack scenario, this device can not only promptly identify and block encrypted ransomware attacks and protect critical data resources from continuous damage, but also output structured attack process results for security analysis and forensic assessment.

[0080] Although the present invention has been described through the above preferred embodiments, those skilled in the art will understand that various modifications in form and detail can be made therein without departing from the spirit and scope of the invention. Therefore, the scope of protection of the present invention should be defined by the appended claims.

Claims

1. A method for reconstructing unknown network attack scenarios driven by digital avatars, characterized in that, The method includes: Based on the target terminal's business scenario, file type distribution, directory structure, user habits, and resource characteristics, construct multiple types of digital substitute resources and adaptively deploy these digital substitute resources to the target terminal. Lightweight data collection is continuously performed on the target terminal's file system behavior, process behavior, network behavior, and identity access behavior. When an external process is detected to trigger a surrogate event related to digital surrogate resources, enhanced data collection is performed centered on this event to obtain an enhanced evidence set. The lightweight data collection involves collecting the minimum necessary behavioral features related to security analysis, while the enhanced data collection involves comprehensive contextual collection of relevant behavior logs, process chains, file objects, network connections, and identity credentials. Starting from the avatar triggering event, cross-source association is performed between the triggering process and related processes. Based on the suspicious process group and attack behavior subgraph constructed by the cross-source association, the malice judgment result of the localized sample is obtained. Attack scenarios are reconstructed based on enhanced evidence sets, suspicious process groups, attack behavior subgraphs, and the results of malice assessment of localized samples, resulting in an attack source map.

2. The method according to claim 1, characterized in that, Based on the target terminal's business scenario, file type distribution, directory structure, user habits, and resource characteristics, we construct multiple types of digital surrogate resources, including: For the target terminal's industry, job role, and business scenario, a digital avatar resource template library is pre-established. The digital avatar resource template library includes document, table, image, audio / video, compressed package, configuration, log, and data fragment resource templates. The attribute information recorded for each digital avatar resource template includes resource type, applicable business scenario, file naming rules, recommended delivery directory, meta-attribute features, associated resource relationships, and incentive priority. Select target resources from digital surrogate resource templates, public information, desensitized samples, and rule-based materials. Construct original digital surrogate resources that are consistent with the target business environment by replacing fields, cropping content, rewriting rules, preserving layout, converting formats, disguising timestamps, reconstructing metadata, and / or splicing associated attachments. The original digital surrogate resource is configured with external attributes and contextual relationships consistent with the real business environment to obtain the digital surrogate resource; wherein, the external attributes include file name, extension, naming style, creation time, modification time, access time, owner and permissions; the contextual relationships include directory hierarchy, attachment reference relationship, shortcut relationship, internal structure of compressed package and version and theme consistency between resource clusters in the same directory.

3. The method according to claim 1, characterized in that, Adaptively delivering the digital avatar resources to the target terminal includes: Based on the popularity of the target terminal's directory, file access habits, distribution of shared paths, job role characteristics, and high-value naming rules, delivery points are selected from the target directory. The high-value naming rules refer to a set of rules constructed based on historical file access behavior statistics and high-frequency sensitive semantic features in file naming. These high-frequency sensitive semantic features are defined as the number or proportion of a certain sensitive semantic feature in historical file access behavior statistics and file naming exceeding a set value. The target directories include desktop, download directory, document directory, email attachment directory, shared directory, project data directory, work log directory, and / or compressed archive directory. Based on the association mapping relationship between the business role of the file access subject and the target directory, the priority directory location and delivery method of the digital surrogate resource are determined from the delivery points; wherein, the delivery method includes resource cluster delivery method or single file delivery method.

4. The method according to claim 1, characterized in that, Enhanced evidence was collected centered on the event triggered by the stand-in, resulting in an enhanced evidence set, including: When an external process is detected to trigger a substitute event related to digital substitute resources, a substitute trigger event log is generated. The substitute trigger event log includes the substitute trigger time, the triggering process name and process ID, the original target file path, the substitute file path, the calling thread or handle information, the currently logged-in user and the trigger session identifier. An event analysis window is constructed centered around the event triggered by the stand-in; Enhanced data collection is performed based on this event analysis window. This enhanced collection includes time-domain enhanced collection, process-domain enhanced collection, object-domain enhanced collection, network-domain enhanced collection, and identity-domain enhanced collection. Time-domain enhancement involves expanding a preset time window forward and backward around the trigger moment and supplementing it with relevant behavior logs. Process-domain enhanced collection expands the collection of the triggering process, its parent process, child processes, sibling processes, and their command-line parameters. Object-domain enhanced collection expands the collection of files in the same directory, associated attachments, batch-read files, and compressed archive objects around the digital avatar resource. Identity-domain enhanced collection expands the collection of account switching, remote login, credential retrieval, and shared mapping behaviors around the triggering session. Logs continuously generated during the enhanced collection period are parsed for key fields, and the results of the key field parsing are used for hierarchical filtering to obtain an enhanced evidence set. The hierarchical filtering includes: marking logs directly related to the triggering event as core evidence; marking logs related to the same session, same directory, or same network connection of the triggering process as strongly correlated evidence; and marking logs that only have background supporting significance as weakly correlated evidence.

5. The method according to claim 1, characterized in that, Starting with the avatar-triggered event, cross-source association is performed between the triggering process and related processes. Based on the suspicious process group and attack behavior subgraph constructed from the cross-source association, the localized sample malice assessment results are obtained, including: Based on the triggering relevance between the triggering process and related processes, a suspicious process group is constructed. The related processes include the parent and child processes of the triggering process, the sibling processes of the triggering process, processes with adjacent execution relationships within the same session, related processes triggered by the same user account, processes with file handle inheritance relationships with the triggering process, and processes with network connection inheritance relationships. Factors determining the triggering relevance include: the time distance from the triggering time of the substitute, whether the substitute's resources are directly accessed, whether there is a process tree relationship with the triggering process, whether command-line parameters, working directory, or loaded modules are shared, and whether the process participates in subsequent copying, compression, encryption, or uploading activities. Based on a suspicious process group, an attack behavior subgraph is constructed, consisting of process nodes, file nodes, network nodes, and session nodes. The edges in the attack behavior subgraph include process creation edges, file access edges, file copying / renaming / compression edges, network connection edges, session inheritance edges, module loading edges, and sample landing edges. The attributes of the attack behavior subgraph also include the stage in which it is located, which includes resource reconnaissance stage, target selection stage, batch reading stage, file aggregation stage, compression and packaging stage, and network transmission or encrypted execution stage. Based on the suspicious process groups and attack behavior subgraphs, suspicious sample files related to the attack activities are extracted from the target terminal file system. Based on preset rules and a localized sample analysis engine, malicious detection is performed on suspicious sample files to obtain localized sample maliciousness assessment results.

6. The method according to claim 1, characterized in that, Based on the surrogate trigger event log, enhanced evidence set, suspicious process group, attack behavior subgraph, and the maliciousness assessment results of localized samples, the attack scenario is reconstructed to obtain the attack source map, including: Using the substitute-triggered event as the initial event source, and combining the enhanced evidence set with the results of the localized sample malice assessment, the attack event is expanded bidirectionally to obtain network session information; By integrating the surrogate triggering event, suspicious process group, attack behavior subgraph, localized sample malice assessment results and network session information, the attack chain reconstruction result is obtained. An endpoint attack attribution map is generated based on the attack chain reconstruction results.

7. The method according to claim 6, characterized in that, Using the avatar-triggered event as the initial event source, and combining the enhanced evidence set with the results of localized sample malice assessment, a bidirectional expansion of the attack event is performed to obtain network session information, including: The system expands bidirectionally using the substitute trigger event as the initial event source; wherein, the bidirectional expansion includes reverse backtracking and forward pursuit; the reverse backtracking is the source of the trigger process; the forward pursuit is the copying, compression, transmission, encryption, deletion and clearing behavior after the trigger event; Based on the results of the enhanced evidence set and the maliciousness assessment of the localized samples, it is determined whether the events in the bidirectional expansion are attack events. Among them, the conditions for an attack event include: the events in the bidirectional expansion are suspicious events in the results of the maliciousness assessment of the localized samples; the events in the bidirectional expansion are connected to the core evidence or strongly related evidence in the enhanced evidence set through the same process, the same session, or the same network; and the events in the bidirectional expansion simultaneously satisfy the continuous abnormal expansion characteristics of the file operation behavior chain and the process network behavior chain within the time window of the substitute triggering event. Network session information is constructed based on attack events in bidirectional extension.

8. A device for recreating unknown network attack scenarios driven by a digital avatar, characterized in that, The device includes: The digital surrogate resource construction and deployment module is used to construct multiple types of digital surrogate resources based on the target terminal's business scenario, file type distribution, directory structure, user habits, and resource characteristics, and adaptively deploy the digital surrogate resources to the target terminal. The layered enhanced collection and log management module is used to continuously and lightweightly collect file system behavior, process behavior, network behavior, and identity access behavior of the target terminal. When an external process is detected to trigger a surrogate event related to digital surrogate resources, enhanced collection is performed centered on the surrogate trigger event to obtain an enhanced evidence set. The lightweight collection is the collection of the minimum necessary behavioral features related to security analysis, while the enhanced collection is a comprehensive contextual collection of relevant behavioral logs, process chains, file objects, network connections, and identity credentials. The attack chain association extraction and suspicious sample focusing and analysis module is used to perform cross-source association of the triggering process and related processes starting from the surrogate triggering event, and obtain the localized sample malice analysis results based on the suspicious process group and attack behavior subgraph constructed based on the cross-source association; The threat assessment result generation and attack scenario reconstruction module is used to reconstruct attack scenarios based on enhanced evidence sets, suspicious process groups, attack behavior subgraphs and the malice assessment results of localized samples, and obtain attack source tracing diagrams.

9. A computer device, characterized in that, The computer device includes: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the method for reconstructing unknown network attack scenarios driven by digital avatars as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the method for reconstructing unknown network attack scenarios driven by digital avatars as described in any one of claims 1-7.

Images