Network-side traffic tracing method and device based on LLM enhanced attack chain reconstruction

Abstract

The application discloses a network side traffic tracing method and device based on LLM enhanced attack chain reconstruction, first, the network side traffic is uniformly represented, the subject semantic consistency and fragment association ability are improved; then, the abnormal event construction strategy based on the residual autoencoder and the rule recognition is introduced, the identification ability of low-frequency abnormal traffic is improved; then, the LLM is used for attack stage inference, and the preset knowledge is used for semantic enhancement, the accuracy of attack stage determination and the reliability of cross-stage link association are improved. Finally, under the link checking mechanism enhanced by the LLM, the network side attack chain with stage order and time context is recovered through graph reasoning. The method faces multi-stage concealed attack scenes including APT, can improve the identification ability of low-frequency weak abnormal attack traffic, reduce the link fragmentation caused by address mapping and stage ambiguity, and improve the integrity, explainability and engineering controllability of attack chain recovery.

Description

Technical Field

[0001] This invention relates to the field of network traffic analysis and attack attribution technology, and more specifically, to a network-side traffic attribution method and apparatus based on LLM-enhanced attack chain reconstruction. Background Technology

[0002] In network-side traffic tracing scenarios, APT attacks are a typical form of multi-stage covert attacks, usually manifesting as a continuous weak signal process spanning time windows, hosts, and stages. Attackers often employ low-frequency, dispersed, and covert communication methods during reconnaissance, endpoint establishment, lateral movement, and data transmission phases, mixing attack traffic with a large amount of normal business traffic. A single flow record typically only reflects one connection or a local statistical segment, making it difficult to directly reveal the complete attack intent.

[0003] Furthermore, in real-world network environments, issues such as SNAT (Source Network Address Translation) / DNAT (Destination Network Address Translation), reverse proxies, mapping between public network entry points and internal network entities, and inconsistent source fields in multiple logs are common. The same host may be represented by different addresses or different port roles in different logs. If the attack chain is directly reconstructed based on the original 5-tuple, the attack behavior can easily be broken into multiple unrelated segments, making it impossible to stably close the staged events and attack chains.

[0004] Existing network traffic attribution solutions for handling multi-stage covert attacks such as APTs mainly include rule-based and alarm aggregation schemes, link association schemes based on statistical or graph models, and semantic analysis schemes incorporating large language models. Rule-based and alarm aggregation schemes are simple to implement, but are susceptible to alarm redundancy, threshold sensitivity, and stage fragmentation. Statistical models, Bayesian networks, Hidden Markov Models, and graph models can improve link representation capabilities, but they are still insufficient for characterizing low-frequency, weakly anomalous traffic and cross-host propagation relationships. While directly using large language models to generate attack chains has strong text understanding capabilities, its output controllability is insufficient, easily generating unverifiable new nodes or links that do not meet temporal, entity, and stage constraints, thus weakening the interpretability of the attribution results.

[0005] Therefore, there is a need for a network traffic attribution method that can both preserve statistical evidence of network traffic and controllably enhance the stage semantics and cross-stage causal relationships of multi-stage covert attacks such as APTs. Summary of the Invention

[0006] This invention proposes a network traffic attribution method and apparatus based on LLM-enhanced attack event inference and attack chain reconstruction. Taking persistent, phased, and covert attacks such as APTs as typical applicable scenarios, it aims to solve the problems of low-frequency weak anomalies being difficult to identify, entity fragmentation due to address mapping, unstable semantics of candidate event phases, and insufficient interpretability of attack chain recovery in existing network traffic attribution technologies. This method significantly improves the accuracy and robustness of attack event discovery, phase semantic confirmation, and attack chain recovery in complex network traffic environments by unifying network traffic views, constructing anomalies, conducting constrained large language model event review, and reconstructing graph inference links.

[0007] To achieve the above objectives, the present invention provides the following technical solution: The first aspect provides a network traffic attribution method based on LLM-enhanced attack chain reconstruction, including: Extract flow records from the raw network traffic and unify the view; Multi-time window aggregation is performed on the traffic after the view is unified to generate window-level attack behavior fragments. The trained residual denoising autoencoder is used to learn the baseline of normal behavior, and the abnormal prior is obtained based on the reconstruction error and rank percentile. Atomic evidence is generated for the window-level attack behavior fragments based on a pre-built set of rules. Based on rule strength and anomalous priors, atomic evidence of the same internal subject, the same attack stage, the same event type and adjacent time are merged into structured anomalous events. Based on the structured abnormal events, an ambiguous event group and a host context are constructed. The ambiguous event group, the host context, and the semantic prompts are input into the large language model reviewer to obtain the output results. Based on the output results, a staged event set is obtained. For each candidate event pair in the staged event set, the candidate causal edge score is calculated, and a candidate causal graph is constructed. A beam search is performed on the candidate causal graph to generate candidate attack chains. A constrained large language model structure consistency evaluation and rearrangement are performed on the candidate attack chains to output the network-side attack chains.

[0008] In one implementation, extracting flow records from the raw network traffic and performing view unification includes: Entity mapping is performed based on asset mapping configuration, address translation rules, and directional semantic rules, mapping the behavior of the same network entity under different logs or different address representations to a unified subject representation.

[0009] In one implementation, multi-time-window aggregation is performed on the traffic after view unification to generate window-level attack behavior fragments, including: Multi-time-window aggregation is performed on the traffic after the view is unified, transforming a single connection into a window-level attack behavior fragment reflecting phase behavior, represented as:

[0010] in, This indicates a specific rule or rule number within a pre-built set of rules. This represents the collection of stream records after the view is unified. Representation rules The corresponding time window, Representation rules The corresponding grouping key; This represents a fragment of window-level attack behavior.

[0011] In one implementation, atomic evidence belonging to the same internal entity, the same attack phase, the same event type, and that are temporally adjacent are merged into a structured anomalous event based on rule strength and anomalous priors, including: The underlying confidence level of atomic evidence is calculated based on rule strength and anomalous priors; Based on the basic confidence of atomic evidence, the event-based merging confidence of a group of atomic evidence that are from the same internal subject, the same attack phase, the same event type, and are temporally adjacent is calculated. Based on the event-based merging confidence level, atomic evidence from the same internal subject, the same attack phase, the same event type, and adjacent times are merged into structured anomalous events.

[0012] In one implementation, an ambiguous event group and a host context are constructed based on the structured abnormal events. The ambiguous event group, the host context, and semantic prompts are input into a large language model reviewer to obtain the output results, including: Construct ambiguous event groups based on internal subjects, event types, stage labels, peer consistency, and time proximity; Extract the host context within the same subject's time frame before and after; The ambiguous event group, host context, and semantic hints are input into the large language model reviewer, and the output is limited to a reserved subset of candidate event IDs.

[0013] In one implementation, the method further includes a semantic enhancement process, comprising: concatenating event type, stage label, key port, internal subject, external counterpart and preset attack technology description into event text; obtaining event semantic representation through TF-IDF (term frequency-inverse document frequency) and truncated singular value decomposition; and calculating the semantic similarity between two events based on the event semantic representation.

[0014] In one implementation, the process of calculating candidate causal edge scores for candidate event pairs in the staged event set and constructing a candidate causal graph includes: For candidate event pairs in the staged event set, candidate causal edge scores are calculated based on temporal consistency, entity association, state continuity, event confidence, stage syntax constraints, compatibility, and semantic similarity. When a candidate event pair is simultaneously valid on multiple types of evidence, does not meet the exclusion condition, and the candidate causal edge score is not lower than the preset edge threshold, the candidate event pair is added to the candidate causal graph. The candidate causal graph includes event nodes, candidate directed edges, edge scores, time intervals, entity association types, stage transition types, and evidence items that support the edge.

[0015] In one implementation, a beam search is performed on the candidate causal graph to generate candidate attack chains, and a constrained large language model structural consistency evaluation and rearrangement are performed on the candidate attack chains to output a network-side attack chain, including: A bundle search is performed on the candidate causal graph starting from nodes with high-value end events or stage completeness that meet preset conditions to generate a set of candidate attack chains. For candidate attack chains in the candidate attack chain set, calculate the average weight of adjacent event edges, stage coverage, and order rationality, and call the constrained large language model to perform structural consistency scoring. Calculate the final chain score of the candidate attack chain based on the average weight of adjacent event edges, stage coverage, order rationality, and structural consistency score. Based on the final chain score, a constrained large language model structural consistency evaluation and rearrangement are performed on the candidate attack chains to output the network-side attack chains.

[0016] Based on the same inventive concept, a second aspect of this invention provides a network-side traffic tracing device based on LLM-enhanced attack chain reconstruction, comprising: The traffic view unification module is used to extract flow records from the raw traffic on the network side and unify the view. The abnormal event construction module is used to perform multi-time window aggregation on the traffic after the view is unified, generate window-level attack behavior fragments, learn the normal behavior baseline using the trained residual denoising autoencoder, and obtain abnormal priors based on reconstruction error and rank percentile. And generate atomic evidence for the window-level attack behavior fragments according to the pre-built rule set, and merge atomic evidence of the same internal subject, the same attack stage, the same event type and adjacent time into structured anomalous events based on rule strength and anomalous prior. The attack phase inference module is used to construct ambiguous event groups and host contexts based on the structured abnormal events, input the ambiguous event groups, host contexts and semantic prompts into the large language model reviewer, obtain the output results, and obtain the phased event set based on the output results; The attack link recovery module is used to calculate the candidate causal edge score for candidate event pairs in the staged event set and construct a candidate causal graph. Then, perform a bundle search on the candidate causal graph to generate candidate attack chains, perform a constrained large language model structure consistency evaluation and rearrangement on the candidate attack chains, and output the network-side attack chain.

[0017] Based on the same inventive concept, a third aspect of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, it implements the network traffic tracing method based on LLM enhanced attack chain reconstruction described in the first aspect.

[0018] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows: This invention discloses a network traffic tracing method based on LLM-enhanced attack event inference and attack chain reconstruction. It is typically applicable to persistent, multi-stage attacks such as APTs. First, it reduces entity fragmentation caused by the mixing of public network entry points, internal network real addresses, and proxy paths through view unification and subject semantic normalization. Then, it constructs anomaly priors through multi-time window aggregation and residual denoising autoencoders, improving the stability of identifying low-frequency, weakly anomalous traffic and reducing false positives and false negatives caused by relying solely on fixed rule thresholds. Next, it restricts the large language model to a candidate event reviewer and a candidate chain structure consistency evaluator, avoiding the large language model from generating events or attack chains out of thin air, thus improving the controllability, verifiability, and interpretability of the LLM enhancement process. Finally, it utilizes ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) to... (Adversarial tactics, techniques and common sense) Semantic enhancement and multi-factor candidate causal edge scoring integrate time, entity, state, stage syntax and behavioral semantics into the attack chain recovery process, and outputs an attack chain with stage order, time context, key entities and link confidence, providing support for attack entry point location, lateral propagation analysis, outgoing peer identification and subsequent blocking measures. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a schematic diagram of the overall framework of the network traffic tracing method based on LLM-enhanced attack chain reconstruction in this embodiment of the invention; Figure 2 This is a pseudocode diagram illustrating the LLM-enhanced event inference process in an embodiment of the present invention; Figure 3 This is a pseudocode diagram illustrating the process of constructing an event cause-effect graph and reconstructing an attack chain in an embodiment of the present invention. Figure 4 This is a schematic diagram of the recovery results of a typical attack chain in the DAPT2020 dataset according to an embodiment of the present invention; Figure 5 This is a schematic diagram of the recovery results of a typical attack chain in the Unraveled dataset according to an embodiment of the present invention. Detailed Implementation

[0021] This invention proposes a network traffic tracing method based on LLM-enhanced attack event inference and attack chain reconstruction, targeting multi-stage covert attacks including APTs. It aims to address the shortcomings of existing network traffic tracing technologies in low-frequency weak anomaly identification, cross-address mapping subject unification, stage semantic confirmation, and interpretable recovery of attack chains.

[0022] The technical concept employed is as follows: First, a unified view representation of network-side traffic is implemented to improve the semantic consistency of the main body and the ability to correlate segments. Next, an anomaly construction strategy based on residual autoencoders and rule recognition is introduced to improve the ability to identify low-frequency anomaly traffic, thereby enhancing the stability of anomaly detection in high-noise traffic environments. Subsequently, LLM is used for attack phase inference, and semantic enhancement is performed by combining ATT&CK knowledge to improve the accuracy of attack phase determination and the reliability of cross-phase link correlation. Finally, under the LLM-enhanced link verification mechanism, network-side attack chains with phase order and temporal context are recovered through graph reasoning.

[0023] The method provided by this invention is aimed at multi-stage covert attack scenarios, including APT, and can improve the ability to identify low-frequency weak anomaly attack traffic, reduce link fragmentation caused by address mapping and stage ambiguity, and improve the integrity, interpretability and engineering controllability of attack chain recovery.

[0024] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are all within the scope of protection of the present invention.

[0025] Example 1 This invention discloses a network traffic source tracing method based on LLM-enhanced attack chain reconstruction. This method uses network traffic as evidence and targets multi-stage, covert attack scenarios, including Advanced Persistent Threats (APTs). It aims to identify low-frequency, scattered, and weakly anomaly-prone suspicious behaviors from complex network traffic, and recover event chains with stage semantics, temporal context, and entity associations. This provides interpretable technical support for security alert analysis, event tracking, threat localization, and response decisions.

[0026] like Figure 1 As shown, the method takes raw network traffic as input and addresses event discovery and link recovery for multi-stage covert attacks such as APTs. Through traffic view unification, abnormal event construction, attack stage inference, and attack link recovery, it outputs a staged event set, a candidate causal graph, and a network-side attack chain. The method includes: S1: Extract flow records from the raw network traffic and unify the view.

[0027] Specifically, S1 is a unified traffic view.

[0028] The overall goal of this method is to obtain the raw traffic set from the network side. Recovering a set of events with phase semantics And further restore the set of attack chains that satisfy the time, entity, and phase constraints. Its formal representation is:

[0029] in, For the first Traffic records, The total number of traffic records. Configure asset mapping and address recovery. For a pre-built set of rules, This represents the baseline for normal behavior.

[0030] S1 includes: Entity mapping is performed based on asset mapping configuration, address translation rules, and directional semantic rules, mapping the behavior of the same network entity under different logs or different address representations to a unified subject representation.

[0031] In practice, S1 can be implemented in the following ways: The input raw network traffic is cleaned and parsed using a 5-tuple to extract fields such as timestamp, source address, destination address, source port, destination port, protocol, number of bytes, duration, and direction. Based on the internal network address range, critical asset roles, known service ports, NAT folding rules, and the mapping relationship from the public network entry point to the internal network entity in the asset mapping configuration, the internal entity is restored. Among them, the NAT folding rule refers to the network address translation merging rule, which folds multiple public network addresses, internal network addresses, and port representations caused by SNAT, DNAT, port mapping, or reverse proxy into the same stable internal entity according to the asset mapping relationship. The semantics of the external peer and direction are determined based on the internal and external network address ranges, connection direction, and port role. Through this process, different representations of the same host in the public network entry address, internal network real address, or proxy path can be merged into a unified entity, reducing link fragmentation caused by SNAT / DNAT or reverse proxy.

[0032] In one implementation, the k-th normalized flow record in S1 can be represented as:

[0033] in, ∈{1,2,…,M'} represents the stream record index, and M' represents the total number of original stream records. Indicates the first One original stream record, This represents the corresponding normalized stream record; This represents a normalized mapping function used in the parameter set. Under the constraints, entity mapping, address translation and recovery, direction semantic determination and key field extraction are performed on the original stream records; Indicates the internal subject, Indicates the external counterpart entity. Indicates the critical service port. Indicates direction semantics. Represents a timestamp. This normalization result retains statistical fields such as byte count, duration, protocol, and packet count. It represents a unified entity at the flow record level, serving as a continuation of the unified traffic view results and preserving the entity, peer, time, and statistical characteristics required for subsequent event construction. Through this processing, directional semantics are unified into categories such as Inbound, Outbound, Lateral, and External, reducing event merging errors caused by address reuse and semantic inconsistencies. Directional semantics support subsequent identification of cross-host propagation relationships. Specifically, Inbound represents inbound traffic / data flowing from the external area to the internal core area; Outbound represents outbound traffic / data flowing from the internal core area to the external area; Lateral represents lateral movement within the same security domain / network layer; and External represents external networks / entities completely outside the current analysis entity's boundary, where traffic initiation and reception are not within the currently managed internal network, used to identify external access entities completely outside the internal domain.

[0034] S2: Perform multi-time window aggregation on the traffic after view unification to generate window-level attack behavior fragments, use the trained residual denoising autoencoder to learn the normal behavior baseline, and obtain the abnormal prior based on the reconstruction error and rank percentile.

[0035] Specifically, S2 is for obtaining prior information about an anomaly, and is part of the construction of an anomaly event.

[0036] S2 performs multi-time window aggregation on the traffic after view unification to generate window-level attack behavior fragments, including: Multi-time-window aggregation is performed on the traffic after the view is unified, transforming a single connection into a window-level attack behavior fragment reflecting phase behavior, represented as:

[0037] in, This indicates a specific rule or rule number within a pre-built set of rules. This represents the collection of stream records after the view is unified. Representation rules The corresponding time window, Representation rules The corresponding grouping key; Indicates within the time window and group keys The following is a record of the stream. The aggregated window-level attack behavior fragments record one or more of the following: traffic scale, port diversity, peer discreteness, bidirectional byte volume, arrival interval stability, upload / download ratio, new neighbor growth rate, and local topology change rate. These are used as inputs to the anomaly prior model and subsequent rule evidence calculation.

[0038] In practice, S2 can be implemented in the following ways: Traffic after view unification is aggregated according to multiple time windows, including 5 minutes, 30 minutes and 2 hours; the grouping key consists of internal subject, external peer, direction semantics, port or rule focus field; For a given rule r, time window T, and grouping key K, normalized flow records falling into the same window and the same grouping key are aggregated to form a window-level aggregated sample. The aggregated sample is composed of the grouping key, time window, and aggregated vector. The aggregated vector is the numerical feature part of the aggregated sample, which may include statistics such as traffic scale, port diversity, peer discreteness, bidirectional byte volume, arrival interval stability, upload and download ratio, new neighbor growth rate, and local topology change rate.

[0039] In one implementation, S2 further includes residual denoising autoencoder training.

[0040] Specifically, the residual denoising autoencoder is first trained using normal baseline traffic, enabling the model to learn the reconstruction patterns under normal communication modes. Then, during the inference phase, the reconstruction error of the current window sample is calculated, and an anomaly prior is generated by combining the normal baseline empirical distribution and the rank percentile of similar windows. This anomaly prior is used to measure the degree of deviation of the current window behavior from normal behavior, allowing anomaly scores on different hosts, different rule granularities, and different time windows to be compared on a similar scale.

[0041] During training, the residual denoising autoencoder is trained using normal samples to learn normal reconstruction patterns. Its training loss is:

[0042] in, and These represent the encoder and decoder, respectively. and For the corresponding model parameters, This represents the SmoothL1 reconstruction loss function; N represents the number of training aggregate samples. Indicates the aggregated sample index. Indicates the first A standardized aggregate vector, For input disturbance, The training target vector is undisturbed; during the inference phase, the anomaly prior is constructed using the reconstruction error and the rank percentile.

[0043] Reconstruction error measures the degree to which the current window behavior deviates from the normal baseline. The larger the error, the more significant the difference between the window-level statistical segment and the normal behavior pattern.

[0044]

[0045] in, This is an anomalous prior. The mean absolute reconstruction error of the current window samples. This is an empirical distribution mapping of reconstruction error under normal baseline conditions. This indicates the rank percentile of the current sample within the same window. For adjustment coefficients, specifically, Shape adjustment coefficient for mapping outlier distributions ( >0), used to adjust the sensitivity of the tail of the empirical distribution; The fusion weighting coefficients between the empirical distribution mapping and the rank percentile of the same window (0≤ ≤1), The larger the value, the greater the influence of the rank percentile term. The smaller the value, the greater the influence of the empirical distribution mapping term.

[0046] S3: Generate atomic evidence for the window-level attack behavior fragments according to the pre-built rule set, and merge atomic evidence of the same internal subject, the same attack stage, the same event type and adjacent time into structured abnormal events based on rule strength and abnormal prior.

[0047] Specifically, S3 is an anomaly event construction. The pre-built rule set is formed by ATT&CK attack technology knowledge, network-side attack phase experience, historical sample statistical characteristics, and manually configured security detection rules, and can be added, deleted, or updated according to the actual network environment.

[0048] S3 includes: S3.1: Calculate the basic confidence level of atomic evidence based on rule strength and anomalous priors; S3.2: Calculate the event-based merging confidence of a group of atomic evidences that are from the same internal subject, the same attack phase, the same event type, and are temporally adjacent, based on the basic confidence of atomic evidence; S3.3: Based on the event-based merging confidence level, atomic evidence from the same internal subject, the same attack phase, the same event type, and adjacent times are merged into structured anomalous events.

[0049] In practice, atomic evidence is generated for each rule hit. In this process, atomic evidence simultaneously retains internal subjects, external peers, stage hints, event types, rule strength, and anomalous priors. Each rule hit means that a certain window-level attack behavior fragment satisfies any judgment condition in the rule set, such as port diversity exceeding the threshold, abnormal increase in peer dispersion, abnormal upload / download ratio, or the appearance of new internal neighbor access. One rule hit corresponds to one interpretable low-level evidence.

[0050] The basic confidence level of atomic evidence is calculated based on rule strength and anomalous priors, specifically as follows:

[0051] in, Indicates atomic evidence index, Indicates the first The rule strength corresponding to each atomic piece of evidence Indicates an anomalous prior. Indicates the basic confidence level of atomic evidence. This function represents the function that clips the calculation results to the interval [0,1].

[0052] A set of atomic evidence that is from the same internal entity, the same attack phase, the same event type, and is temporally adjacent. The event-based merging confidence level is:

[0053] in, This represents the product of each atomic piece of evidence in the evidence set E. This indicates that the l-th atomic evidence does not support the complement of the event; Multiple pieces of evidence are fused by multiplying complementary quantities and then inverting them. Any high-confidence evidence or multiple persistent evidences can increase the event-based merging confidence C(E), and the result remains in the [0,1] range. After event-based merging, the underlying rule hits are compressed into structured event nodes with subject, counterpart, time range, anomaly, confidence, and stage labels.

[0054] Through S3 processing, low-level rule hits are compressed into event nodes that are more suitable for chain inference, which can reduce the impact of alarm redundancy on subsequent attack chain recovery.

[0055] S4: Construct ambiguous event groups and host contexts based on structured abnormal events, input the ambiguous event groups, host contexts and semantic prompts into the large language model reviewer, obtain the output results, and obtain the staged event set based on the output results.

[0056] Specifically, S4 is the acquisition of the set of phased events in attack phase inference.

[0057] In S4, ambiguous event groups and host contexts are constructed based on structured anomalous events. These ambiguous event groups, host contexts, and semantic hints are then input into the large language model reviewer to obtain the output, which includes: S4.1: Construct ambiguous event groups based on internal subjects, event types, stage labels, peer consistency, and time proximity; S4.2: Extract the host context within the same subject's time frame before and after; S4.3: Input the ambiguous event group, host context, and semantic hints into the large language model reviewer, and limit the output to a reserved subset of candidate event IDs as the output result.

[0058] For specific implementation details, please refer to [link / reference]. Figure 2 First, ambiguous event groups are constructed based on internal subjects, event types, stage labels, peer consistency, and time proximity. And extract the host context within the same subject's time frame. Then, attack technique descriptions matching the event type, stage label, port protocol, and behavioral keywords are retrieved from the ATT&CK knowledge base to form ATT&CK semantic hints, which are used to supplement the stage description and behavioral semantics. After that, constrained hints are generated to explicitly limit the large language model to output only a subset of candidate event IDs. Finally, out-of-bounds ID deletion, duplicate ID deletion, illegal format filtering, subject consistency check, time sequence check, and stage semantic check are performed on the output of the large language model.

[0059] The output is limited to a reserved subset of candidate event IDs, which is represented as:

[0060] in, This represents a large language model reviewer. A reserved subset of candidate event IDs.

[0061] A set of phased events following review Represented as:

[0062] in, Let j represent the set of events, where j represents the j-th ambiguous event group or candidate event group. This represents the total number of ambiguous event groups; after each group is reviewed by a constrained large language model, only a subset of existing candidate event IDs is retained, and all retained subsets together form a staged event set.

[0063] The large language model in S4 does not directly generate new events or attack chains from scratch; instead, it is used as a candidate event reviewer. When the large language model output is empty, the system retains the event with the highest confidence and most consistent context from the ambiguous event group; when there are events in the output that clearly conflict with the host context or ATT&CK semantics, the system removes them. Through this constrained mechanism, the semantic understanding capabilities of the large language model can be utilized while preventing unverifiable events from entering the subsequent link recovery process.

[0064] In one implementation, S4 further includes a semantic enhancement process, comprising: concatenating event type, stage label, key port, internal subject, external peer and preset attack technology description into event text, obtaining event semantic representation through TF-IDF and truncated singular value decomposition, and calculating the semantic similarity between two events based on the event semantic representation.

[0065] Specifically, the default attack technique is the ATT&CK attack. The event type, stage label, key port, internal subject, external peer, and ATT&CK attack technique description are concatenated into event text, and a low-dimensional semantic representation is obtained through TF-IDF and truncated singular value decomposition. ATT&CK semantics are used to represent the concatenated text derived from the event's own fields and the ATT&CK attack technique description; it does not independently determine the event's authenticity but serves as evidence of behavioral continuity in subsequent causal edge judgments.

[0066] In practice, ATT&CK semantics consists of event fields and ATT&CK attack technique descriptions, mainly including tactical phases, technique names, technique descriptions, common port protocols, and behavioral keywords, which are used to provide external knowledge constraints for large language model review and semantic similarity calculation.

[0067] The semantic similarity between two events is calculated based on the semantic representation of the events, specifically as follows:

[0068] in, , Let i and j represent the i-th and j-th events, respectively. and For the corresponding semantic representation of the event, semantic similarity does not directly determine the truth or falsehood of the event, but serves as auxiliary evidence for judging candidate causal edges.

[0069] S5 and S6 can be accessed Figure 3The process is as follows. The system uses reviewed, phased events as nodes, enumerates candidate event pairs that satisfy the time sequence constraint, and calculates scores for time consistency, entity association, state continuity, event confidence, phase syntax constraints, ATT&CK compatibility, and semantic similarity. For event pairs with scores not lower than a preset edge threshold and whose key evidence does not conflict, they are added to a candidate causal graph. The candidate causal graph includes event nodes, candidate directed edges, edge scores, time intervals, entity association types, phase transition types, and evidence items supporting the edge.

[0070] S5: Calculate the candidate causal edge scores for candidate event pairs in the staged event set, and construct a candidate causal graph.

[0071] Specifically, S5 is the candidate causal graph construction in attack link recovery.

[0072] S5 includes: S5.1: For candidate event pairs in the staged event set, calculate candidate causal edge scores based on temporal consistency, entity association, state continuity, event confidence, stage syntax constraints, ATT&CK compatibility, and semantic similarity. S5.2: When a candidate event pair is simultaneously valid on multiple types of evidence, does not meet the exclusion condition, and the candidate causal edge score is not lower than the preset edge threshold, the candidate event pair is added to the candidate causal graph. The candidate causal graph includes event nodes, candidate directed edges, edge scores, time intervals, entity association types, stage transition types, and evidence items that support the edge.

[0073] Regarding the difference between ATT&CK compatibility and ATT&CK semantics, ATT&CK semantics is used to describe the technical, tactical, and behavioral implications of a single event, while ATT&CK compatibility is used to determine whether two candidate events have a reasonable sequential relationship in terms of attack phase migration and technical combinations.

[0074] Specifically, in S5, temporal consistency is used to constrain the chronological order of events; entity association is used to connect events that are from the same entity, the same peer, or propagated from an external entry point to an internal host; state continuity is used to characterize phase evolution; event confidence is used to suppress low-quality nodes; phase syntax constraints are used to exclude obviously unreasonable phase sequences; ATT&CK compatibility is based on the ATT&CK tactical phase and technical combination relationship to determine whether the event pair conforms to the attack process evolution logic; semantic similarity is based on the event text vector to measure whether the behavioral descriptions of two events are similar. Only when candidate event pairs simultaneously satisfy the preset constraints in multiple types of evidence such as time, entity, phase, or semantics, and there is no obviously conflicting evidence, are high-value candidate edges formed.

[0075] In the specific implementation process, the score of the candidate causal edge is calculated as follows:

[0076] in, , , , , , and These represent temporal consistency, entity association, state continuity, event confidence, stage syntax constraints, ATT&CK compatibility, and semantic similarity, respectively. , , , , , and For the corresponding weighting coefficients, The Sigmoid function is used for event pairs to be true simultaneously across multiple types of evidence. This indicates that the candidate event pairs satisfy the preset constraints at least in key dimensions such as time sequence, entity association, stage transition, or behavioral semantics. If the exclusion conditions are not met, it means that there are no exclusion conditions such as time reversal, subject irrelevance, or stage conflict.

[0077] S6: Perform a bundle search on the candidate causal graph to generate candidate attack chains, perform a constrained large language model structure consistency evaluation and rearrangement on the candidate attack chains, and output the network-side attack chain.

[0078] Specifically, S6 is attack link recovery.

[0079] Specifically, S6 includes: S6.1: Perform a bundle search on the candidate causal graph starting from nodes with high-value end events or stage completeness that meet the preset conditions, and generate a set of candidate attack chains; S6.2: For candidate attack chains in the candidate attack chain set, calculate the average weight of adjacent event edges, stage coverage, and order rationality, and call the constrained large language model to perform structural consistency scoring. Calculate the final chain score of the candidate attack chain based on the average weight of adjacent event edges, stage coverage, order rationality, and structural consistency score. S6.3: Based on the final chain score, perform a constrained large language model structure consistency evaluation and rearrangement on the candidate attack chains, and output the network-side attack chains.

[0080] Specifically, the large language model is only used at this stage to evaluate whether the candidate chain conforms to the context and stage logic, without adding new nodes or edges.

[0081] The final chain score of the candidate attack chain is calculated based on the average edge weight of adjacent events, stage coverage, order rationality, and structural consistency score. Specifically:

[0082] in, Indicates the number of the candidate attack chain. Indicates the index of the event position in the candidate chain. This represents a candidate attack chain containing m event nodes. This represents the index of the k-th event in the candidate attack chain. The score represents the candidate causal edge score between adjacent event pairs. Indicates the stage score weight. Indicates the candidate edge weight. Assess the rationality of phase coverage and phase sequence. The structural consistency score of candidate attack chains is used to evaluate the constrained large language model.

[0083] This represents a candidate attack chain containing m event nodes. This represents the index of the k-th event in the candidate attack chain. The score represents the candidate causal edge score between adjacent event pairs. The output network-side attack chain has the attack phase sequence, time context and key entity relationships, which is used to characterize multi-stage attack processes including APTs.

[0084] In specific implementation, this invention can adopt the following operating configuration: the flow feature extraction tools use CICFlowMeter (CIC flow meter) and NFStream (network flow analysis framework); the anomaly prior model uses a residual denoising autoencoder; semantic representation uses TF-IDF and 128-dimensional truncated singular value decomposition; the bundle search width is set to 5; the minimum edge threshold is set to 0.35; the large language model temperature is set to 0.0; the stage set includes Recon, Foothold, Lateral, and Exfil. The above parameters are only one embodiment, and those skilled in the art can adjust them according to network size, log granularity, computing resources, and response time requirements.

[0085] To verify the effectiveness of the method of the present invention, two network traffic datasets, DAPT2020 and Unraveled, were selected for testing in the embodiments. DAPT2020 covers stages such as normal day, reconnaissance, landing point establishment, lateral movement, and data transmission; Unraveled covers a longer period of enterprise network environment and more complex attack backgrounds.

[0086] As shown in Table 1, this invention achieves 95.62% precision, 91.61% recall, and 93.57% F1 score on the DAPT2020 dataset, while maintaining an FPR of 0.12%; and 93.28% precision, 87.75% recall, and 90.43% F1 score on the Unraveled dataset, while maintaining an FPR of 0.08%. Here, Precision represents accuracy, Recall represents recall, F1 score represents the F1 score, and FPR represents the false positive rate. These results demonstrate that this invention can maintain a high level of event detection capability in complex network traffic environments and effectively suppress false positives.

[0087] Table 1

[0088] like Figure 4As shown, in a typical case of DAPT2020, the recovery chain covers four stages: Recon, Foothold, Lateral, and Exfil. Specifically, the Recon stage first targets the continuous enumeration and port probing of publicly exposed web services. The internal entity 192.168.3.29 successively accesses the external peer 206.207.50.50's 9003 / BadStore and 9002 / Mutillidae / OWASP services, and extends to the web service reconnaissance of 184.98.36.245, thereby locating the attack entry point and early target. BadStore is a vulnerable web target program running on port 9003, Mutlidae is an open-source vulnerable web target range running on port 9002, and OWASP stands for Open Web Application Security Project. During the Foothold phase, the link converges to the core victim host 192.168.3.29, and continuous communication via port 9000 from 192.168.3.29 to 206.207.50.50 identifies the landing point establishment and confirms C2 access. During the Lateral phase, 192.168.3.29 further accesses the 3306 / MySQL service of the internal host 192.168.3.30, resulting in consecutive database enumeration and MySQL bypass events, indicating that the attack extends from the landing point host to critical internal database nodes. During the Exfil phase, port 4444 from 192.168.3.30 to 206.207.50.50 forms a C2 outbound channel, while a callback outbound event occurs from 192.168.3.29 to port 58938 of this external peer, thus linking the reconnaissance entry point, core victim node, lateral hub, and outbound peer into a complete network-side attack chain. The reconnaissance phase revolves around web enumeration and port probing of publicly exposed services; the target phase converges on the core victim host; the lateral movement phase shifts to internal database and service access; and the outward propagation phase establishes a backhaul channel facing external peers. This recovery result provides a basis for locating attack entry points, identifying core victim nodes, and analyzing the outward propagation channel.

[0089] like Figure 5As shown, in a typical Unraveled case, the recovery chain unfolds along four phases: Recon, Foothold, Lateral, and Exfil. The Recon phase begins with a gateway probe (135 / DCE_RPC) from 192.168.0.11 to 10.8.10.70, reflecting a prolonged and low-rate early network enumeration. In the Foothold phase, the victim host 10.1.3.8 repeatedly connects to the external peer 10.8.10.84's 443 / TLS_C2 service, establishing a persistent TLS covert communication channel to confirm control relationships after the attack has reached its target. In the Lateral phase, 10.1.3.8 further accesses the internal node 10.1.5.21's 80 / Internal_HTTP service; continuous HTTP lateral probing indicates the attack is expanding to other hosts and services within the internal network. During the Exfil phase, the 3306 / MySQL connection from 10.1.3.17 to 10.1.5.21 was identified as an internal data collection event, representing the data aggregation and outward transmission preparation process. Therefore, this invention can connect early gateway reconnaissance, victim host covert channels, internal lateral discovery, and data collection processes into a cross-stage network-side attack backbone within complex enterprise traffic contexts.

[0090] The main key points of this invention include: 1. Constrained Large Language Model Event Review: Unlike directly generating attack chains using a large language model, this invention limits the review of the large language model to existing candidate events, and ensures the verifiability of the output through candidate ID constraints, format verification, subject consistency verification, and stage semantic verification. This mechanism improves the stage semantic verification capability while avoiding uncontrollable problems caused by generating events out of thin air.

[0091] 2. Combining Anomaly Priors with Rule Evidence: Relying solely on rules is susceptible to threshold sensitivity and alarm redundancy, while relying solely on unsupervised anomaly scores may deviate from attack semantics. This invention combines anomaly priors generated by a residual denoising autoencoder with rule strength to first form atomic evidence, then compress it into structured anomaly events, enabling low-frequency weak anomalies to enter the link recovery process as interpretable event nodes.

[0092] 3. Graph Reasoning-Driven Attack Chain Reconstruction: This invention constructs candidate causal edges using time consistency, entity association, state continuity, event confidence, stage syntax constraints, ATT&CK compatibility, and semantic similarity, and recovers candidate attack chains through bundle search. Compared to simple time sorting, this method can better handle attack processes across hosts, stages, and time windows.

[0093] 4. Enhanced Chain-Level Structural Consistency: This invention calls a constrained large language model for structural consistency evaluation after candidate chains are generated, ensuring that the model only optimizes the candidate chain ranking without altering candidate nodes or edges. This design preserves the interpretability of the graph search process while improving the stability of the main chain's priority output in complex contexts.

[0094] Example 2 Based on the same inventive concept, this embodiment provides a network-side traffic tracing device based on LLM-enhanced attack chain reconstruction, comprising: The traffic view unification module is used to extract flow records from the raw traffic on the network side and unify the view. The abnormal event construction module is used to perform multi-time window aggregation on the traffic after the view is unified, generate window-level attack behavior fragments, learn the normal behavior baseline using the trained residual denoising autoencoder, and obtain abnormal priors based on reconstruction error and rank percentile. And generate atomic evidence for the window-level attack behavior fragments according to the pre-built rule set, and merge atomic evidence of the same internal subject, the same attack stage, the same event type and adjacent time into structured anomalous events based on rule strength and anomalous prior. The attack phase inference module is used to construct ambiguous event groups and host contexts based on the structured abnormal events, input the ambiguous event groups, host contexts and semantic prompts into the large language model reviewer, obtain the output results, and obtain the phased event set based on the output results; The attack link recovery module is used to calculate the candidate causal edge score for candidate event pairs in the staged event set and construct a candidate causal graph. Then, perform a bundle search on the candidate causal graph to generate candidate attack chains, perform a constrained large language model structure consistency evaluation and rearrangement on the candidate attack chains, and output the network-side attack chain.

[0095] Optionally, the device also includes: The output module is used to output a set of staged events, a candidate cause-effect graph, a network-side attack chain, and information on the stage, time range, key subjects, external counterparts, and confidence level corresponding to the network-side attack chain.

[0096] Since the apparatus described in Embodiment 2 of this invention is the same apparatus used in implementing the network traffic tracing method based on LLM enhanced attack chain reconstruction in Embodiment 1 of this invention, those skilled in the art can understand the specific structure and variations of this apparatus based on the method described in Embodiment 1 of this invention, and therefore will not be repeated here. All apparatuses used in the method of Embodiment 1 of this invention fall within the scope of protection of this invention.

[0097] Example 3 The present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the network-side traffic tracing method based on LLM-enhanced attack chain reconstruction described above.

[0098] In specific implementation, the computer device may include a processor, a communications interface, memory, and a communication bus. The processor, communications interface, and memory communicate with each other via the communication bus. The processor can invoke logical instructions from the memory to execute the network traffic tracing method based on LLM-enhanced attack chain reconstruction, which mainly includes the software processing portion described above.

[0099] Furthermore, the logical instructions in the aforementioned memory can be implemented as software functional units and sold or used as independent products, and can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0100] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0101] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention. Clearly, those skilled in the art can make various modifications and variations to the embodiments of the invention without departing from the spirit and scope of the invention. Thus, if these modifications and variations of the embodiments of the invention fall within the scope of the claims of the invention and their equivalents, the invention also intends to include these modifications and variations.

Claims

1. A network-side traffic tracing method based on LLM-enhanced attack chain reconstruction, characterized in that, include: Extract flow records from the raw network traffic and unify the view; Multi-time window aggregation is performed on the traffic after the view is unified to generate window-level attack behavior fragments. The trained residual denoising autoencoder is used to learn the baseline of normal behavior, and the abnormal prior is obtained based on the reconstruction error and rank percentile. Atomic evidence is generated for the window-level attack behavior fragments based on a pre-built set of rules. Based on rule strength and anomalous priors, atomic evidence of the same internal subject, the same attack stage, the same event type and adjacent time are merged into structured anomalous events. Based on the structured abnormal events, an ambiguous event group and a host context are constructed. The ambiguous event group, the host context, and the semantic prompts are input into the large language model reviewer to obtain the output results. Based on the output results, a staged event set is obtained. For each candidate event pair in the staged event set, the candidate causal edge score is calculated, and a candidate causal graph is constructed. A beam search is performed on the candidate causal graph to generate candidate attack chains. A constrained large language model structure consistency evaluation and rearrangement are performed on the candidate attack chains to output the network-side attack chains.

2. The network traffic tracing method based on LLM-enhanced attack chain reconstruction as described in claim 1, characterized in that, Extracting flow records from raw network traffic and unifying the view includes: Entity mapping is performed based on asset mapping configuration, address translation rules, and directional semantic rules, mapping the behavior of the same network entity under different logs or different address representations to a unified subject representation.

3. The network traffic tracing method based on LLM-enhanced attack chain reconstruction as described in claim 1, characterized in that, Perform multi-time-window aggregation on the traffic after view unification to generate window-level attack behavior fragments, including: Multi-time-window aggregation is performed on the traffic after the view is unified, transforming a single connection into a window-level attack behavior fragment reflecting phase behavior, represented as: in, This indicates a specific rule or rule number within a pre-built set of rules. This represents the collection of stream records after the view is unified. Representation rules The corresponding time window, Representation rules The corresponding grouping key; This represents a fragment of window-level attack behavior.

4. The network-side traffic tracing method based on LLM-enhanced attack chain reconstruction as described in claim 1, characterized in that, Based on rule strength and anomalous priors, atomic evidence belonging to the same internal entity, the same attack phase, the same event type, and those occurring at adjacent times are merged into structured anomalous events, including: The underlying confidence level of atomic evidence is calculated based on rule strength and anomalous priors; Based on the basic confidence of atomic evidence, the event-based merging confidence of a group of atomic evidence that are from the same internal subject, the same attack phase, the same event type, and are temporally adjacent is calculated. Based on the event-based merging confidence level, atomic evidence from the same internal subject, the same attack phase, the same event type, and adjacent times are merged into structured anomalous events.

5. The network-side traffic tracing method based on LLM-enhanced attack chain reconstruction as described in claim 1, characterized in that, Based on the structured abnormal events, an ambiguous event group and a host context are constructed. The ambiguous event group, host context, and semantic prompts are input into the large language model reviewer to obtain the output results, including: Construct ambiguous event groups based on internal subjects, event types, stage labels, peer consistency, and time proximity; Extract the host context within the same subject's time frame before and after; The ambiguous event group, host context, and semantic hints are input into the large language model reviewer, and the output is limited to a reserved subset of candidate event IDs.

6. The network-side traffic tracing method based on LLM-enhanced attack chain reconstruction as described in claim 1, characterized in that, The method also includes a semantic enhancement process, which includes: concatenating the event type, stage label, key port, internal subject, external counterpart and preset attack technology description into event text, obtaining the event semantic representation through TF-IDF and truncated singular value decomposition, and calculating the semantic similarity between two events based on the event semantic representation.

7. The network-side traffic tracing method based on LLM-enhanced attack chain reconstruction as described in claim 1, characterized in that, For candidate event pairs in the staged event set, calculate candidate causal edge scores and construct a candidate causal graph, including: For candidate event pairs in the staged event set, candidate causal edge scores are calculated based on temporal consistency, entity association, state continuity, event confidence, stage syntax constraints, compatibility, and semantic similarity. When a candidate event pair is simultaneously valid on multiple types of evidence, does not meet the exclusion condition, and the candidate causal edge score is not lower than the preset edge threshold, the candidate event pair is added to the candidate causal graph. The candidate causal graph includes event nodes, candidate directed edges, edge scores, time intervals, entity association types, stage transition types, and evidence items that support the edge.

8. The network-side traffic tracing method based on LLM-enhanced attack chain reconstruction as described in claim 1, characterized in that, A beam search is performed on the candidate causal graph to generate candidate attack chains. Constrained large language model structural consistency evaluation and rearrangement are then performed on the candidate attack chains to output the network-side attack chains, including: A bundle search is performed on the candidate causal graph starting from nodes with high-value end events or stage completeness that meet preset conditions to generate a set of candidate attack chains. For candidate attack chains in the candidate attack chain set, calculate the average weight of adjacent event edges, stage coverage, and order rationality, and call the constrained large language model to perform structural consistency scoring. Calculate the final chain score of the candidate attack chain based on the average weight of adjacent event edges, stage coverage, order rationality, and structural consistency score. Based on the final chain score, a constrained large language model structural consistency evaluation and rearrangement are performed on the candidate attack chains to output the network-side attack chains.

9. A network-side traffic tracing device based on LLM-enhanced attack chain reconstruction, characterized in that, include: The traffic view unification module is used to extract flow records from the raw traffic on the network side and unify the view. The abnormal event construction module is used to perform multi-time window aggregation on the traffic after the view is unified, generate window-level attack behavior fragments, learn the normal behavior baseline using the trained residual denoising autoencoder, and obtain abnormal priors based on reconstruction error and rank percentile. And generate atomic evidence for the window-level attack behavior fragments according to the pre-built rule set, and merge atomic evidence of the same internal subject, the same attack stage, the same event type and adjacent time into structured anomalous events based on rule strength and anomalous prior. The attack phase inference module is used to construct ambiguous event groups and host contexts based on the structured abnormal events, input the ambiguous event groups, host contexts and semantic prompts into the large language model reviewer, obtain the output results, and obtain the phased event set based on the output results; The attack link recovery module is used to calculate the candidate causal edge score for candidate event pairs in the staged event set and construct a candidate causal graph. Then, perform a bundle search on the candidate causal graph to generate candidate attack chains, perform a constrained large language model structure consistency evaluation and rearrangement on the candidate attack chains, and output the network-side attack chain.

10. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the network-side traffic tracing method based on LLM-enhanced attack chain reconstruction as described in any one of claims 1 to 8.

Images