Advanced threat oriented full traffic causal replay detection method and system

Abstract

The application relates to the technical field of network security flow detection, and discloses a full-flow causal playback detection method and system for advanced threats. The method acquires bypass mirror flow, segments and retains messages, and establishes a hierarchical evidence index; protocol analysis, file restoration, rule alarm, sandbox analysis, threat intelligence and host session data are normalized into uniform evidence objects; host, session, file, domain name resolution, uniform resource locator and alarm node are mapped to form a causal attack chain graph; reasoning anchor points are taken as centers, a dynamic correlation window and a causal score are used to restore cross-protocol and phased attack paths; selective evidence playback is performed on path-located message and object evidence, and retroactive evidence chains and standardized alarm logs are output. The application is used for reconstruction and review of low-frequency threat attack processes.

Description

Technical Field

[0001] This invention relates to the field of network security and communication traffic analysis technology, specifically to a detection method and system for constructing causal attack chains based on bypass mirrored traffic and replaying evidence of advanced threat processes. Background Technology

[0002] With the continuous increase in communication protocols and business applications in enterprise networks, data centers, and cloud networks, network security detection systems typically collect communication traffic through bypass mirroring and identify abnormal behavior using methods such as protocol parsing, session reassembly, file restoration, intrusion detection rules, sandbox analysis, and threat intelligence matching. The data formats, object granularities, temporal semantics, and identification methods generated by these processing methods differ, and the detection results are usually saved as independent logs or alerts.

[0003] Advanced threat attacks can span multiple stages, including domain name resolution, resource access, file delivery, control communication, and lateral movement, and are characterized by low communication frequency, long duration, and frequent protocol switching. Current technologies often aggregate alerts based on addresses, ports, and fixed time windows, making it difficult to distinguish between ordinary accesses occurring close together and attacks with data dependencies. Furthermore, it is difficult to recover historical events that did not previously generate alerts using delayed sandbox results or subsequently updated threat intelligence.

[0004] Furthermore, there is often a lack of stable evidence indexes between raw traffic, reconstructed sessions, restored files, and detection alarms. Conventional traffic replay focuses on retransmitting packets according to the recorded time sequence, and cannot select and reconstruct relevant evidence based on the attack path. The single-point alarms output are also difficult to explain the correlation between different stages. Therefore, a technical solution is needed that can uniformly represent multi-source detection results, identify cross-protocol temporal causal relationships, and provide evidence-based replay of the attack process. Summary of the Invention

[0005] The technical problem this invention aims to solve is that the protocol parsing results, file restoration results, rule alerts, sandbox analysis results, threat intelligence hit results, and host session data generated during bypass traffic analysis are separated from each other in terms of identifier, time, and object granularity. Fixed time windows and single-point rules make it difficult to recover low-frequency, cross-day, and cross-protocol attack processes, and the detection conclusions cannot stably refer back to the original packets and derived objects, making it difficult to verify the causal basis between events, the backfilling relationship of historical asynchronous results, and path-level evidence.

[0006] To address the aforementioned technical problems, one aspect of the present invention provides a full-traffic causal replay detection method for advanced threats. This method establishes evidentiary relationships between through-pass messages, reconstructed sessions, protocol objects, detection results, and causal attack paths based on bypass mirrored traffic. It eliminates representational differences between multi-source data by unifying evidentiary objects, expresses data dependencies and stage associations using deterministic edges and candidate causal edges, adapts to low-frequency and cross-stage behaviors using dynamic association windows, and uses inference results to drive selective evidence replay.

[0007] The method includes the following steps.

[0008] S1, acquire the bypass mirror traffic, segment and retain the packets in the bypass mirror traffic, perform session reassembly and protocol parsing on the packets, and establish a hierarchical evidence index between the packets, reassembly sessions and parsing objects.

[0009] Specifically, consecutive messages are written to immutable storage segments according to acquisition time and storage capacity. The message location index records the storage segment identifier, segment offset, acquisition time, acquisition length, and message digest; the session index records the bidirectional 5-tuple, transport protocol status, start and end times, and the sequence number range or offset set of the included messages; the object index records the protocol type, message boundary, object byte range, associated session, and source message; and the event index records the mapping between unified evidence objects and parsing objects, reconstructed sessions, and message locations. These indexes at each level form a bidirectional addressable relationship from event to object, from object to session, and from session to message.

[0010] S2 acquires protocol parsing results, file restoration results, rule alerts, sandbox analysis results, threat intelligence hit results, and host session data. It normalizes the identifiers, times, attributes, and evidence references of data from various sources to form a unified evidence object.

[0011] The unified evidence object E_i is represented as:

[0012] E_i=(eid_i, src_i, type_i, t_s,i, t_e,i, t_c,i, subject_i, object_i, attrs_i, raw_ref_i, hash_i, q_i, version_i).

[0013] Wherein, eid_i is the evidence object identifier, src_i is the source type, type_i is the object type, t_s,i and t_e,i are the event start time and event end time respectively, t_c,i is the arrival time, subject_i and object_i are the subject identifier and object identifier respectively, attrs_i is the attribute set, raw_ref_i is the original evidence reference, hash_i is the integrity summary, q_i is the evidence quality value, and version_i is the version identifier. A unified time base is used for the time values, and the original time values, correction values, and time sources are stored.

[0014] The correction time t′_e for the event corresponding to acquisition node k is determined according to the following formula:

[0015] t′_e=t_e+Δ_k.

[0016] Where t_e is the original event time recorded by the acquisition node, Δ_k is the clock correction amount of acquisition node k relative to a unified time base, and t′_e, t_e, and Δ_k use the same time unit. The event time uncertainty interval T_i is represented as:

[0017] T_i=[t_s,i-ε_i,t_e,i+ε_i].

[0018] Where ε_i is the non-negative time uncertainty, and t_s,i ≤ t_e,i; when the time source provides only a single time point, t_s,i = t_e,i. The quality of evidence value q_i is determined according to the following formula:

[0019] q_i=γ_1×q_com,i+γ_2×q_int,i+γ_3×q_src,i+γ_4×q_time,i.

[0020] Where q_com,i, q_int,i, q_src,i, and q_time,i are the components of completeness, integrity, source credibility, and time credibility, respectively, each ranging from 0 to 1; γ_1, γ_2, γ_3, and γ_4 are non-negative dimensionless weights, and γ_1 + γ_2 + γ_3 + γ_4 = 1, therefore q_i is also ranging from 0 to 1. When necessary evidence citations are missing or integrity verification fails, the corresponding component is set to 0, and the missing or failed status is stored in the unified evidence object.

[0021] S3 maps the unified evidence object to host nodes, session nodes, file nodes, domain name resolution nodes, unified resource locator nodes, and alarm nodes, forming a set of nodes in the causal attack chain graph.

[0022] Specifically, host nodes represent the observed assets and their set of addresses; session nodes represent the communication process defined by a bidirectional 5-tuple; file nodes represent files restored from the session payload or referenced by external detection results; domain name resolution nodes represent domain name queries and resolution responses; Uniform Resource Locator (URL) nodes represent resource request and response objects; and alert nodes represent rule-based alerts, sandbox determinations, threat intelligence hits, and detection events generated by host session anomalies. Rule-based alerts include alerts generated by Snort or detection engines employing equivalent rule processing methods; this source description does not alter the structure of the uniform evidence object and alert nodes.

[0023] S4. Deterministic edges are established based on the temporal sequence, entity continuity, data derivation, and attack phase constraints between nodes. Candidate causal edges are established for node pairs that do not satisfy the deterministic relationship but meet the candidate association conditions.

[0024] Deterministic edges are generated from directly verifiable technical relationships, including the inclusion relationship of the same reconstructed session to protocol objects, the consistency relationship between domain name resolution results and subsequent connection target addresses, the derivation relationship between the Uniform Resource Locator (URL) response bytes and the byte range of the restored file, the equivalence relationship between file content digests and sandbox analysis results or threat intelligence hit results, and the attribution relationship between the location of rule-based alarm messages and the reconstructed session. Candidate causal edges are used to express associations that still need to be scored and confirmed. Their attributes include at least the source node, destination node, candidate edge type, time difference, entity continuity characteristics, protocol semantic characteristics, attack phase characteristics, evidence quality, conflict facts, evidence citations, and scoring version.

[0025] S5 uses nodes corresponding to rule alerts, sandbox analysis results, or threat intelligence hit results as inference anchors, and determines dynamic association windows based on the attack stage of the node and the rarity of related indicators.

[0026] The normalized frequency f_i and rarity R_i of the correlation index are determined according to the following formulas:

[0027] f_i=μ_1×f_host,i+μ_2×f_session,i+μ_3×f_event,i;

[0028] R_i=1-clip(f_i, 0, 1).

[0029] Where f_host,i, f_session,i, and f_event,i are the host coverage frequency, session occurrence frequency, and event occurrence frequency of the indicator within the historical statistical period, respectively. Each frequency is normalized and located between 0 and 1. μ_1, μ_2, and μ_3 are non-negative dimensionless weights, and μ_1 + μ_2 + μ_3 = 1. R_i is located between 0 and 1, with a larger value indicating that the indicator is less common. When the historical sample is empty, f_i is marked as unpredictable, and a preset neutral rarity and a low rarity confidence level are used to prevent the absence of historical data from being directly judged as high rarity.

[0030] The dynamically associated window W_ab from attack phase a to attack phase b is determined by the following formula:

[0031] W_ab=clip(W0_ab×(1+α×R+β×G), W_min, W_max).

[0032] Where clip(x, l, u) = min(max(x, l), u), and l ≤ u; W0_ab is the basic association window from attack phase a to attack phase b, R is the rarity of the current association indicator, G is the quality of existing evidence, α and β are non-negative dimensionless adjustment coefficients, W_min and W_max are the lower and upper limits of the window, respectively, 0 < W_min ≤ W0_ab ≤ W_max; W_ab, W0_ab, W_min, and W_max use the same time unit, and R and G are between 0 and 1. G is the arithmetic mean of the evidence quality values ​​of the unified evidence object corresponding to the inference anchor point and the existing evidence objects directly connected by the deterministic edge; when there is no usable evidence quality value, G is set to 0, and the evidence quality missing state is recorded. When multiple association indicators exist at the same time, R is formed based on indicators with verifiable sources, and indicators lacking sources do not participate in the calculation of the expanded window.

[0033] S6 performs causal scoring on candidate causal edges within the dynamic association window, and combines deterministic edges to search for causal attack paths consisting of multiple attack stages.

[0034] For nodes i and j in attack phases a and b, when the corrected time difference Δt_ij satisfies 0 ≤ Δt_ij ≤ W_ab, the time proximity T_ij is determined according to the following formula:

[0035] T_ij=exp(-Δt_ij / W_ab).

[0036] When Δt_ij < 0 or Δt_ij > W_ab, no candidate causal edge is established in that direction, or T_ij is set to 0. This ensures that the denominator W_ab in the exponential operation is greater than 0 and that the time direction is consistent with the attack phase direction.

[0037] The candidate causal edge score S_ij from node i to node j is determined by the following formula:

[0038] S_ij=clip(w_t×T_ij+w_k×K_ij+w_d×D_ij+w_s×P_ij+w_q×Q_ij-w_c×C_ij, 0, 1).

[0039] Wherein, K_ij represents entity continuity, D_ij represents data derivation strength, P_ij represents attack phase compatibility, Q_ij represents evidence quality, and C_ij represents conflict degree, with each component ranging from 0 to 1; w_t, w_k, w_d, w_s, w_q, and w_c are non-negative dimensionless weights, and w_t + w_k + w_d + w_s + w_q = 1. Evidence quality Q_ij can be determined according to Q_ij = √(q_i × q_j) × q_edge,ij, where q_i and q_j are the evidence quality values ​​of the unified evidence objects corresponding to the two nodes, and q_edge,ij is the edge evidence quality, all three ranging from 0 to 1.

[0040] When there are r mutually independent conflicting facts, the degree of conflict C_ij is determined according to the following formula:

[0041] C_ij=1-(1-c_1)×(1-c_2)×…×(1-c_r).

[0042] Where c_m is the normalization strength of the m-th conflicting fact, ranging from 0 to 1; r is a non-negative integer; when r ≥ 1, the aforementioned multiplication expansion applies, and when r = 0, C_ij = 0 is defined. Conflicting facts include inconsistent subject identities, non-overlapping address lease times, inconsistent document content digests, inconsistent domain name resolution results and connection targets, and conflicts between the event's time direction and stage direction.

[0043] Candidate causal edges are included in the search subgraph after their scores reach the edge acceptance threshold. For path π, its path score (Score(π)) is determined according to the following formula:

[0044] Score(π)=clip(Avg(S_ij)×H_π+η×M_π-λ×C_π, 0, 1).

[0045] Where Avg(S_ij) is the arithmetic mean of the scores of candidate causal edges in the path, with deterministic edges not included in this mean but serving as a path continuity constraint; H_π is the attack phase coverage, M_π is the inference anchor matching degree, and C_π is the path conflict degree, all three ranging from 0 to 1; η and λ are non-negative dimensionless coefficients ranging from 0 to 1. When no candidate causal edges exist in the path, Avg(S_ij) is set to 1. Path search simultaneously limits the maximum number of nodes, the maximum number of branches, the allowed attack phase migrations, and the number of repetitions of the same type of node to control the expansion of irrelevant paths.

[0046] S7 locates relevant packets, reassembles sessions, parses objects and external detection results through hierarchical evidence indexing based on causal attack paths, performs selective evidence playback according to the corrected event time and causal topology order, and outputs a traceable evidence chain and standardized alarm logs.

[0047] Selective evidence replay first generates an evidence list based on node identifiers and edge evidence references, then retrieves the original evidence sequentially through the event index, object index, session index, and message location index. The integrity digest hash_i is formed according to the following formula:

[0048] hash_i=H(C_i∥hash_raw,i∥version_i).

[0049] Where H represents the preset one-way digest operation, C_i represents the normalized content of the unified evidence object, hash_raw,i represents the original evidence content digest, version_i represents the normalization rule version, and ∥ indicates field concatenation. During playback, the digest is recalculated for the read content; evidence with inconsistent digests is retained in the evidence list and marked as verification failed, and is not considered valid evidence supporting causal conclusions.

[0050] The selective evidence replay includes extracting packets according to the path range, reconstructing the corresponding reassembled session, re-parsing the protocol object, verifying the restored file byte range, re-verifying rule alarm location, sandbox analysis results, and threat intelligence hit results, and organizing the evidence according to causal topology order. This replay does not resend packets to the monitored service network. For evidence within the same topology layer, it is sorted according to the corrected event time; when time uncertainty intervals overlap, parallel relationships are preserved or the order is determined based on the data derivation direction, and arrival time is not used to replace event time.

[0051] When the sandbox analysis results or threat intelligence hit results arrive later than the corresponding traffic event, historical unified evidence objects are queried based on file content summaries, domain names, addresses, or Uniform Resource Locators (URLs). New alert nodes and deterministic edges are established, and the late result is used as a new inference anchor point to re-execute the path search of the affected subgraph. The original evidence chain is not overwritten, and the new result is saved as an incremental chain version, recording the trigger source, update scope, scoring version, and differences between the old and new paths.

[0052] Standardized alarm logs include chain identifier, chain version, attack stage, affected hosts, associated sessions, domain name resolution records, Uniform Resource Locators (URLs), file content digests, alarm determination, causal edge score, path score, association reason, original evidence location, integrity verification results, and generation time. Each node and each edge in the log carries a corresponding evidence reference, enabling the receiving system to repeatedly retrieve evidence and verify the path using the same index.

[0053] Another aspect of the present invention provides a full-traffic causal replay detection system for advanced threats. This system includes a traffic acquisition and evidence retention module, a parsing and detection adaptation module, a unified evidence object module, a causal attack chain graph construction module, a temporal causal reasoning module, a selective evidence replay module, and an alarm output module.

[0054] The traffic acquisition and evidence retention module is used to acquire bypass mirror traffic, retain packets in segments, and establish a hierarchical evidence index between packets, reassembled sessions, and parsed objects.

[0055] The parsing and detection adaptation module is used to obtain protocol parsing results, file restoration results, rule alerts, sandbox analysis results, threat intelligence hit results, and host session data;

[0056] The unified evidence object module is used to normalize data from various sources;

[0057] The causal attack chain graph construction module is used to form six types of nodes and establish deterministic edges and candidate causal edges;

[0058] The temporal causal reasoning module is used to determine the dynamic association window, calculate the candidate causal edge score, and search for causal attack paths;

[0059] The selective evidence playback module is used to read and reconstruct relevant evidence based on the causal attack path;

[0060] The alarm output module is used to output a traceable evidence chain and standardized alarm logs. Each module transmits data of the same attack process through unified evidence object identifier, node identifier, chain identifier and evidence reference.

[0061] The system can be deployed on traffic analysis devices or server clusters that include processors, memory, and network interfaces. The memory includes raw packet storage areas, reconstructed session storage areas, parsed object storage areas, unified evidence object storage areas, causal attack chain graph storage areas, and standardized alarm log storage areas. The network interface receives mirrored traffic, sandbox analysis results, threat intelligence hit results, and host session data, and sends standardized alarm logs to the security management platform. The processor executes instructions in the memory to complete the data processing corresponding to the steps described above.

[0062] In summary, this invention establishes packets, reconstructed sessions, and parsed objects in bypass mirrored traffic as a bidirectionally addressable evidentiary foundation. It transforms protocol parsing results, file restoration results, rule-based alerts, sandbox analysis results, threat intelligence hit results, and host session data into unified evidentiary objects and maps them to six types of nodes. A causal attack chain graph is constructed using deterministic relationships and scoring candidate relationships. Cross-protocol, phased attack processes are reconstructed using inference anchors, dynamic association windows, and constrained path searches. The obtained paths are then used to reverse-locate and reconstruct relevant evidence, forming a closed-loop processing relationship from raw traffic to standardized alert logs.

[0063] Compared to the processing method of aggregating single-point alarms based on a fixed window, this invention restricts node associations by combining temporal sequence, entity continuity, data derivation, and attack phase constraints. It can suppress false associations caused solely by identical addresses or similar times by utilizing verifiable relationships between domain name resolution, resource access, file bytes, content digests, and detection judgments. Furthermore, the dynamic association window is bounded and adjusted according to the base window of the attack phase, the rarity of indicators, and the quality of existing evidence, so that low-frequency cross-day activities can enter the same constrained search process, while avoiding unlimited window expansion.

[0064] This invention preserves a hierarchical evidence index between events, objects, sessions, and message locations, and writes integrity summaries, time uncertainties, edge association reasons, and scoring versions into the evidence chain. This enables selective acquisition and verification of original messages, protocol objects, restoration files, and external detection results according to the attack path. When sandbox analysis results or threat intelligence hit results are delayed, only the affected subgraph is updated and a new chain version is formed. The historical context is restored without overwriting existing conclusions, and standardized alarm logs with consistent structure, locatable sources, and repeatable verification are output. Attached Figure Description

[0065] Figure 1 This is the overall flowchart of the full-traffic causal replay detection method for advanced threats according to the present invention.

[0066] Figure 2 This is a schematic diagram of the hierarchical evidence index and unified evidence object modeling of the present invention.

[0067] Figure 3 This is a schematic diagram of the causal attack chain graph nodes and causal edge relationships of the present invention.

[0068] Figure 4 This is a schematic diagram of the dynamic association window and constrained path search of the present invention.

[0069] Figure 5 This is a flowchart of the selective evidence playback and asynchronous result backfilling of the present invention.

[0070] Figure 6This is a schematic diagram of the structure and deployment of the full-traffic causal replay detection system for advanced threats according to the present invention.

[0071] Figure 7 This is a schematic diagram illustrating the processing procedure of the present invention in cross-day document delivery and low-frequency control scenarios, and its comparison with the fixed window processing method. Detailed Implementation

[0072] The present invention will be further described below with reference to the accompanying drawings and specific embodiments. The following content is intended to enable those skilled in the art to understand and implement the present invention, and is not intended to limit the present invention to a specific network size, communication protocol, rule engine, sandbox product, threat intelligence source, storage medium, or parameter values. While maintaining the processing relationships between hierarchical evidence indexing, unified evidence objects, causal attack chain graphs, temporal causal reasoning, and selective evidence replay, the corresponding data collection, protocol parsing, object storage, and external detection components can be replaced according to the protocol type and deployment conditions of the monitored network.

[0073] The event time referred to in this invention refers to the actual time when the observed communication behavior or detected object occurs; the arrival time refers to the time when the corresponding data enters the unified modeling processing flow. These two are stored separately to support asynchronous backfilling of sandbox analysis results and threat intelligence hit results. The deterministic edge referred to in this invention refers to a directed relation that can be directly verified by message attribution, session inclusion, byte derivation, parsing result usage, or content digest equivalence relations; the candidate causal edge refers to a directed relation that satisfies some time, entity, protocol semantics, or attack phase constraints and needs to be scored to determine whether it is accepted. The selective evidence replay referred to in this invention is the extraction and reconstruction of relevant evidence according to the causal attack path, excluding retransmission of messages to the monitored service network.

[0074] Example 1

[0075] This embodiment illustrates the complete processing flow of a full-traffic causal replay detection method for advanced threats. For example... Figure 1 As shown, in step S1, the bypass mirror traffic is obtained, the packets in the bypass mirror traffic are segmented and retained, the packets are reassembled and the protocol is parsed, and a hierarchical evidence index is established between the packets, the reassembled sessions and the parsed objects.

[0076] In this embodiment, the acquisition interface of the traffic analysis device is connected to the output of the network splitter or the mirror port of the switch. The acquisition interface operates in a receive-only state and does not send acknowledgment, reset, or probe packets to the monitored link. The acquisition thread records the acquisition node identifier, interface identifier, capture time, capture length, original length, and link layer type for each packet, and appends the packet to the immutable storage segment according to the start time and current capacity of the storage segment. After the storage segment is closed, the segment-level content digest is calculated, and the packets within the segment are no longer rewritten. When the retention policy requires deleting expired storage segments, it first checks whether the storage segment is referenced by an unclosed chain of evidence. Referenced storage segments can be transferred to the evidence preservation area or have their retention period extended.

[0077] The message location reference R_p is represented as:

[0078] R_p=(sensor_id, segment_id, packet_no, offset, cap_len, ts_capture, hash_p).

[0079] In this dataset, `sensor_id` is the identifier of the acquisition node, `segment_id` is the identifier of the immutable storage segment, `packet_no` is the sequence number of the packet within the segment, `offset` is the byte offset of the packet within the storage segment, `cap_len` is the capture length, `ts_capture` is the capture time, and `hash_p` is the packet content digest. `offset` and `cap_len` are in bytes, with 0 ≤ `offset` and 0 < `cap_len`, and their ranges must not exceed the length of the corresponding storage segment. During packet reading, `segment_id`, `offset`, `cap_len`, and `hash_p` are checked simultaneously to prevent incorrect evidence citations caused by storage segment rotation or index misalignment.

[0080] The session reassembly thread performs direction-independent normalization of the source address, destination address, source port, destination port, and transport layer protocol, using the normalized bidirectional 5-tuple as the candidate session key. It then divides the reassembly session based on the transport protocol state, sequence number continuity, idle time, and connection reset state. For Transmission Control Protocol (TCP) sessions, it stores the mapping from sequence number ranges, retransmitted fragments, out-of-order fragments, and payload bytes to the original message in both directions. For connectionless protocol sessions, it divides the transaction based on the application protocol transaction identifier and idle time. Therefore, even if the same 5-tuple is reused at different times, it can be distinguished by the session instance identifier and start and end times.

[0081] The protocol parser reads the reassembled ordered byte stream or transaction message and generates parsing objects such as domain name lookup, domain name response, hypertext transfer request, hypertext transfer response, encrypted session handshake, email message, file transfer message, and remote service message. Each parsing object stores its associated session identifier, message direction, protocol type, message sequence number, start byte offset, end byte offset, and references to the positions of the associated messages. When a file consists of multiple response fragments or multiple session segments, the object index stores an ordered list of byte ranges, rather than using a single filename to represent the byte source.

[0082] like Figure 2 As shown, the hierarchical evidence index, from top to bottom, includes the event index I_E, object index I_O, session index I_S, and message location index I_P. For the unified evidence object identifier gid, its evidence location function L(gid) can be expressed as:

[0083] L(gid)=I_P(I_S(I_O(I_E(gid)))).

[0084] Each indexing function can return an object or a collection of objects. The outer index continues searching for each member in the inner returned collection. When a corresponding content is not found at a certain level, an empty collection is returned and the missing level is recorded, without using other objects from nearby times to fill in the gaps. The index also stores a reverse mapping, allowing the lookup of the corresponding historical unified evidence object when a new file content digest, domain name, or session identifier is received.

[0085] Step S2: Obtain protocol parsing results, file restoration results, rule alerts, sandbox analysis results, threat intelligence hit results, and host session data. Normalize the identifiers, times, attributes, and evidence references of the data from each source to form a unified evidence object.

[0086] Protocol parsing results are output by the protocol parser, with their original evidence references pointing to the object index; file restoration results are output by the file restorer, with their original evidence references including the object identifier, session identifier, message location set, and content summary of the file; rule alerts are output by the rule detection engine, with their original evidence references preferentially using the message sequence number, session identifier, or byte position provided by the rule engine. If none of these positions are provided, the system searches the session index of the same collection node based on the bidirectional quintuple and event time, saving the time tolerance and number of candidates for this search. Sandbox analysis results save the sample content summary, submission identifier, analysis start time, analysis end time, judgment category, and report summary; threat intelligence hit results save the indicator type, indicator value, intelligence version, effective time, expiration time, and source credibility; host session data saves the host identifier, process or user information availability status, network connection direction, remote object, and original log references.

[0087] Each source adapter first converts the address, domain name, Uniform Resource Locator (URL), file content digest, and protocol name into canonical form. The domain name is converted to lowercase and the trailing root tag is removed, preserving the original and canonical values ​​of the internationalized domain name. The URL separates the protocol, host, port, path, and query parts, providing a unified representation for the default port, but without removing query fields that might affect server response. The address is stored in a unified binary format, preserving the address family. The file content digest records the digest algorithm and digest value; equivalence relationships cannot be established between different digest algorithms based solely on the digest string.

[0088] During time normalization, the data collection nodes periodically obtain the offset Δ_k from the unified time source. For traffic events, the captured time correction value is used as the event time; for rule-based alarms, the capture time of the location message takes precedence over the log writing time; for sandbox analysis results, the first appearance time of the sample is used as the event association time of the analyzed object, and the report return time is used as the arrival time; for threat intelligence hit results, the time when the indicator appears in historical traffic is used as the associated event time, and the time when the intelligence version enters the system is used as the arrival time. When precise event time cannot be obtained, ε_i is set according to the accuracy of the time source to form an uncertain interval for event time.

[0089] The normalized content C_i of the evidence object is formed using a fixed field order and explicit null value markers. Then, hash_i is calculated using the original evidence content summary hash_raw,i and the normalization rule version version_i. When the normalization rule is upgraded, the old version object is retained, a new object with the new version_i is generated, and the derivation relationship between the previous and current versions is recorded. Therefore, the same original evidence can still be verified under different normalization versions, and there will be no unexplainable changes in the summary due to changes in field order.

[0090] The quality value of evidence is jointly determined by completeness, integrity, source credibility, and temporal credibility. Completeness reflects the availability of necessary fields and evidence citations; integrity reflects the content summary verification results; source credibility is determined by the status of the acquisition node, the identity of the detection component, and the result signature status; temporal credibility is determined by the clock synchronization status, time resolution, and event location method. All four components are first mapped to the range of 0 to 1, and then weighted by weights γ_1 to γ_4. Weights are managed by configuration versions, and the same weight version is used within the same evidence chain; adjusting weights does not directly rewrite the existing evidence chain, but rather generates a new scoring version.

[0091] Step S3: Map the unified evidence object to host nodes, session nodes, file nodes, domain name resolution nodes, unified resource locator nodes, and alarm nodes to form a set of nodes in the causal attack chain graph.

[0092] like Figure 3As shown, host node H uses the asset identifier as the primary key and stores the address set, address lease range, virtual LAN identifier, and collection area for the observation period. When a stable asset identifier is not obtained, temporary host nodes are formed based on address, collection area, and valid time range. These temporary host nodes are then associated through versioned merging relationships after asset information is subsequently obtained, avoiding direct merging of different hosts during address reuse periods. Session node S uses the session instance identifier as the primary key and stores the bidirectional 5-tuple, protocol, communication direction, start and end times, message count, and payload digest. File node F uses the digest algorithm and content digest as the main content identifier, and also stores file length, media type, restoration status, source byte range, and filename attributes.

[0093] Domain name resolution node D corresponds to a single domain name query and response transaction, storing the query name, query type, set of response addresses, validity period, and associated session. Uniform Resource Locator (URL) node U corresponds to a single resource request and its response, storing the normalized URL, request method, response status, response content type, associated session, and response object. Alarm node A uniformly carries rule-based alarms, sandbox assessments, threat intelligence hits, and host session anomalies. Each alarm node stores the alarm source, assessment category, confidence level, event time, arrival time, involved objects, and original evidence references. All six types of nodes are associated with one or more uniform evidence objects, rather than using the graph node itself as a substitute for original evidence.

[0094] Figure 3 The resource location node U is the graphical abbreviation for Uniform Resource Locator (URL) node U. The inferred causal edges in the diagram represent the status of candidate causal edges after being accepted through scoring and participating in path search. The rejected candidate edges represent candidate relations that were excluded because they did not meet the minimum entity continuity condition, time direction condition, or exclusive conflict check. The above graphical abbreviations and processing statuses do not change the meaning of the URL and candidate causal edges in this specification.

[0095] Step S4: Establish deterministic edges based on the temporal sequence, entity continuity, data derivation, and attack phase constraints between nodes, and establish candidate causal edges for node pairs that meet the candidate association conditions.

[0096] This embodiment first establishes deterministic edges. Between a host node and the session node it initiates or receives, a participation edge is established based on the fact that the asset address is valid within the session period and the collection area is consistent. Between a session node and a domain name resolution node or a Uniform Resource Locator (URL) node, an inclusion edge is established based on the session identifier and object byte range. Between a domain name resolution node and a subsequent session node, a resolution use edge is established when the destination address of the subsequent session is included in the resolution response and occurs within the response's valid time. Between a URL node and a file node, a file derivation edge is established based on the coverage relationship between the response byte range and the file restoration byte range. Between a file node and a sandbox alarm node or a threat reporting alarm node, a decision edge is established based on the digest algorithm and the equality of the content digest. Between a rule alarm node and a session node, a hit edge is established based on the packet position or session identifier.

[0097] When a deterministic edge cannot directly connect adjacent attack phases, candidate causal edges are generated. For example, a low-frequency outbound session that occurs after file delivery may not share protocol objects with the delivery session, but both share the same host, conform to the post-execution control phase sequence, and use uncommon target indicators. Therefore, a candidate causal edge can be established from the file node to the subsequent session node. During candidate generation, direction checks, dynamic association window checks, and minimum entity continuity checks are performed first. Node pairs that share an egress address but cannot be proven to be the same internal host do not meet the minimum entity continuity condition and are not included in the scoring; node pairs that are the same internal host but whose time direction is opposite to the attack phase direction are also not included in the scoring.

[0098] Step S5: Using the nodes corresponding to rule alerts, sandbox analysis results, or threat intelligence hit results as inference anchors, determine the dynamic association window based on the attack stage of the node and the rarity of related indicators.

[0099] Inference anchors include high-confidence rule alert nodes with valid evidence citations, sandbox malware detection nodes associated with the deterministic nature of file content summaries, and threat intelligence alert nodes that hit within the valid version. Inference anchors store anchor type, anchor object, event time, arrival time, and anchor confidence. When multiple anchors point to the same file, domain, or session, they can form a joint anchor, but each original anchor is still stored separately so that it can be recalculated if one of the external results is revoked.

[0100] Taking the transition from document delivery stage a to control communication stage b as an example, the basic association window W0_ab is set to 30 minutes, the lower limit of the window W_min is set to 10 minutes, and the upper limit of the window W_max is set to 180 minutes. Historical statistics show that the rarity of the association index R is 0.80, the quality of existing evidence G is 1.00, and the moderating coefficients α and β are 0.50 and 0.30, respectively.

[0101] W_ab = clip(30 × (1 + 0.50 × 0.80 + 0.30 × 1.00), 10, 180) = 51 minutes.

[0102] The values ​​mentioned above are used to illustrate the calculation relationship of the dynamic association window and do not constitute a limitation on the actual deployment parameters. If R cannot be estimated, the configured neutral sparseness is used and the credibility state of the sparseness source is recorded as low, without changing the meaning of G in representing the quality of existing evidence; if the calculation result is less than W_min or greater than W_max, then W_min or W_max is taken respectively, so that the window will not expand indefinitely due to a single high-risk indicator.

[0103] Step S6: Calculate the candidate causal edge scores within the dynamic association window, and combine them with deterministic edges to search for causal attack paths.

[0104] Entity continuity K_ij is formed by weighting host identity consistency, address validity range overlap, session direction continuity, and user or process information consistency. For networks without deployed host agents, user or process information components are marked as unavailable and renormalized by the remaining available components; missing values ​​are not directly treated as consistent. Data derivation strength D_ij takes a high value when there is direct byte range overlap or content digest equality, and a low value when only object names are the same; attack phase compatibility P_ij is determined by a preset phase transition table; evidence quality Q_ij is jointly determined by the evidence quality of the two endpoints and the evidence quality of the edges.

[0105] For example, if the values ​​of T_ij from a file node to a low-frequency control session node are 0.88, K_ij are 0.95, D_ij are 0.80, P_ij are 0.90, Q_ij are 0.92, and C_ij are 0.05, and we take w_t = 0.20, w_k = 0.20, w_d = 0.25, w_s = 0.20, w_q = 0.15, and w_c = 0.30, then:

[0106] S_ij=clip(0.20×0.88+0.20×0.95+0.25×0.80+0.20×0.90+0.15×0.92-0.30×0.05, 0, 1)=0.869.

[0107] If the edge acceptance threshold is set to 0.75, the candidate causal edge will enter the search subgraph. Both the threshold and weight are provided with configuration versions; the values ​​above only illustrate one feasible calculation method. For edges with deterministic relationships such as content summary equivalence or session inclusion, the same score is not applied to replace deterministic evidence, but evidence quality and conflict status are still preserved. Deterministic edges are marked as invalid and do not continue to participate in path search if their summary verification fails or their attribution index becomes invalid.

[0108] like Figure 4As shown, path search traces back from the inference anchor point to the source of domain name resolution, resource access, and file delivery, while extending backward to subsequent control sessions and lateral activities. The stage migration table allows normal migration between adjacent stages and also allows crossing a stage when evidence is missing in an intermediate stage, but crossing raises the path acceptance threshold and records the missing stage. Path search sets a duplication limit for similar sessions on the same host, performs node merging for identical file content summaries, and terminates branches that form time loops or data derivation loops.

[0109] Assuming the average score Avg(S_ij) of candidate causal edges in a candidate path is 0.88, the attack phase coverage H_π is 0.96, the inference anchor matching degree M_π is 0.75, and the path conflict degree C_π is 0.05, and taking η = 0.20 and λ = 0.30, then:

[0110] Score(π)=clip(0.88×0.96+0.20×0.75-0.30×0.05, 0, 1)=0.9798.

[0111] When the path acceptance threshold is set to 0.80, the path is identified as a causal attack path. A path score higher than the threshold indicates that the path meets the current evidence and configuration conditions, but does not mean that a certain attack fact is absolutely proven without the original evidence; the standardized alarm log still outputs the association reason, score component and evidence location of each edge for subsequent review.

[0112] Step S7: Locate relevant packets, reassemble sessions, parse objects, and external detection results based on the causal attack path. Perform selective evidence playback according to the corrected event time and causal topology order, and output a traceable evidence chain and standardized alarm logs.

[0113] like Figure 5 As shown, the selective evidence replay module first traverses the confirmation path, obtaining the unified evidence object identifier of each node and the reference of each edge evidence, forming a deduplicated evidence list. For event evidence, the corresponding protocol message is read using the event index and object index; for session evidence, the bidirectional payload and related message positions are read using the session index; for file evidence, the restored file and the ordered byte range that makes up the file are read; for external detection results, the original report reference, result summary, and signature status are read. Then, the unified evidence object summary, file content summary, and message content summary are recalculated. Entries that fail verification are retained with the reason for failure noted and are not used to improve edge scores.

[0114] Protocol object re-parsing is performed in an isolated analysis process, using the same parser version as the original evidence object record; if the original version is unavailable, a compatible version is used, and the version differences are recorded in the results. When re-verifying rule alerts, the saved rule version and corresponding message or session payload are used as input; the review of sandbox analysis results and threat intelligence hit results is based on the external result signature, content digest, and version validity period, and samples are not resubmitted to external systems without authorization.

[0115] The replay output forms an evidence sequence according to causal topological order. For domain name resolution results used by subsequent connections, the response node precedes the connection node; for Uniform Resource Locator (URL) responses to derived files, the response object precedes the file node; sandbox results, although arriving later, still have their analyzed object's event association position after the corresponding file node, and their arrival time is recorded separately. If the time uncertainties of two events overlap and there is no data derivation relationship, they remain on the same topological layer, and their order is not forcibly determined.

[0116] The standardized alarm log uses the chain identifier and chain version as the primary key, storing chain-level path scores, stage coverage, inference anchors, affected host sets, and generation time. Node records store node type, object identifier, event time, arrival time, attribute summary, evidence quality, and evidence citation. Edge records store source node, destination node, edge type, deterministic state or candidate score, association reason, conflict facts, and score version. This structure allows the security management platform to both display the attack process and locate underlying evidence along any node or edge.

[0117] Through the above steps, this embodiment forms a complete processing procedure from bypass mirror traffic acquisition, unified evidence modeling, causal attack chain graph construction, temporal causal reasoning to selective evidence playback. Data is transmitted between steps S1 to S7 through hierarchical evidence indexing and unified identifiers, thus ensuring a verifiable correspondence between the reasoning results and the original messages, reconstructed sessions, parsed objects, and external detection results.

[0118] Example 2

[0119] This embodiment combines Figure 2 This section explains the specific implementation methods of hierarchical evidence indexing and unified evidence objects, focusing on how data from different sources, with different temporal semantics, and different object granularities are transformed into objects that can be jointly mapped and can point back to the original evidence. The processing content of this embodiment can be used as a specific implementation of steps S1 and S2, and can be combined with other steps in Embodiment 1 for execution.

[0120] After bypass mirrored traffic enters the acquisition node, a global acquisition batch identifier is first assigned. A acquisition batch can cover a continuous preset time interval, or it can end early when the storage segment reaches its capacity limit. The storage segment identifier is jointly determined by the acquisition node identifier, batch identifier, and segment sequence number, ensuring that segment identifiers generated by different acquisition nodes do not conflict. Each storage segment consists of a segment header, a message record area, and a segment tail. The segment header stores the acquisition node, interface, start time, and link type; the message record area stores the message position and message bytes; and the segment tail stores the end time, number of messages, segment length, and segment-level digest.

[0121] Session indexes are built upon message location indexes. For Transmission Control Protocol (TCP) protocols, the session reassembler determines session boundaries based on handshake status, sequence number space, direction, and idle interval. In cases of mid-entry access where a complete handshake cannot be observed, the first visible message is used as the observation starting point, a session incompleteness marker is saved, and the corresponding integrity component is reduced. For User Datagram Protocol (UDP) protocols, in addition to normalized bidirectional 5-tuples, Domain Name System (DNS) transaction identifiers, request / response directions, or application protocol session identifiers are used to distinguish concurrent transactions. For address translation (NAT) or load balancing environments, the collection area and the network side can be used as part of the session key to avoid incorrect merging of the same 5-tuple at different observation locations.

[0122] Instead of simply copying all packet bytes, the session payload stores a mapping between ordered payload fragments and packet location references. Each payload fragment includes the flow direction, in-session start sequence number, in-session end sequence number, source packet location set, and retransmission preference state. When retransmissions occur and the byte content is identical, the first arriving packet is retained as the primary reference, and the references for the remaining retransmissions are recorded. When the same sequence number occurs but the byte content is inconsistent, the conflicting fragment is stored, and the integrity component of the relevant protocol object is not set to its maximum value. This process can explain which packets a particular parsed byte originated from during playback and can also identify reassembly ambiguities caused by network evasion behavior.

[0123] The object index is built upon the session index. The resolver assigns an object identifier to each application-layer transaction, storing the resolver type and version. Domain name query objects record the query fields and query message; domain name response objects record the response resource record and response message; Uniform Resource Locator (URL) objects associate both request and response messages; file objects store the order of the payload fragments that constitute the file content. If the response uses content encoding or chunked transmission, the file restorer simultaneously saves the byte range before transmission, the decoding processing type, the byte length after decoding, and the restored content digest, enabling subsequent differentiation between the transmitted bytes and the restored file bytes.

[0124] The event index is built upon the Uniform Evidence Object (UEE) identifier. The `subject_i` and `object_i` of the UEE object are interpreted according to the object type. For domain name resolution objects, the host or session initiating the query is the subject, and the queried domain name is the object; for Uniform Resource Locator (URL) objects, the requesting session is the subject, and the normalized resource locator (URL) is the object; for file recovery objects, the source response object is the subject, and the file content digest is the object; for rule alerts, the session or object triggering the alert is the subject, and the rule judgment is the object; for sandbox analysis results, the file content digest is the subject, and the analysis judgment is the object; for threat intelligence hit results, the hit indicator is the subject, and the intelligence judgment is the object. The types of the subject and object are stored along with `type_i` to prevent the same text value from being mixed among domain names, file names, and rule names.

[0125] The raw evidence reference `raw_ref_i` uses a typed reference set. References for traffic sources include the collection node, storage segment, packet offset, session identifier, and object identifier; references for file sources include the object storage address, file length, digest algorithm, and content digest; references for rule-based alerts include the rule engine identifier, rule version, alert sequence number, and its location message; references for sandboxes and threat intelligence include the external system identifier, query or submission identifier, result version, original report location, and signature verification status; and references for host sessions include the host data source, log sequence number, and original log location. The reference set can contain multiple members, but each member must declare its reference type and verification method.

[0126] The identifier eid_i of a unified evidence object can be composed of the source namespace, object type, original object identifier, and version. For data without a stable original object identifier, an identifier digest is first calculated for the normalized key fields that can be reproducibly reproduced, and then combined with the source namespace to form eid_i. The identifier digest is only used for object deduplication and retrieval; integrity verification still uses hash_i, which contains normalized content, the original evidence digest, and the version. When the same original event is observed by two collection nodes, two unified evidence objects are retained and associated through repeated observation relationships; one source is not deleted due to field similarity.

[0127] This embodiment establishes indexes for arrival time and event time respectively. The event time index is used for attack phase sorting and dynamic correlation window checks, while the arrival time index is used to detect asynchronous results, processing delays, and chain version updates. Taking sandbox results as an example, a file is restored by the traffic session at time t_1, submitted to the sandbox at time t_2, and the analysis results are obtained at time t_3, where t_1≤t_2≤t_3. The event time of file node-related events is t_1. The sandbox alarm node saves the sample's corresponding event time t_1 and result arrival time t_3, and also saves the analysis start and end times in its attributes. Thus, when sandbox results enter the system, they can return to the file's first appearance position, and will not be incorrectly placed at the end of the attack path because t_3 is later than the control session.

[0128] The time correction value Δ_k comes from the periodic time synchronization records between the acquisition node and the unified time source. Each time synchronization record includes the acquisition node time, unified time, round-trip delay estimate, valid start and end times, and record signature. The system performs piecewise interpolation on Δ_k within the valid interval; when it exceeds the valid interval, the most recent valid record is used and ε_i is increased. For data that only provides second-level log times, ε_i is not less than its time resolution; for rule-based alarms that can be located by specific messages, the message capture time is used first, and ε_i is determined with the acquisition time precision. Time uncertainty only affects time proximity and order determination, and does not change the original log record value.

[0129] In evidence quality calculation, completeness q_com,i sets the necessary field set according to the object type. For example, the necessary fields for a file node include content digest, file length, source session, and byte references; the absence of a filename does not affect content identity, but the absence of a content digest will reduce completeness. Integrity q_int,i is determined step-by-step based on segment digest, object digest, file digest, and external result signature; if any referenced level fails verification, the failure level is recorded. Source credibility q_src,i is determined based on the identity of the acquisition node, the identity of the detection component, interface authentication, and the external result signature status. Time credibility q_time,i is determined based on clock offset records, time resolution, and event location method.

[0130] In one configuration, γ_1 = 0.25, γ_2 = 0.35, γ_3 = 0.20, and γ_4 = 0.20 can be chosen. When the integrity of a document's restored object is 0.90, its completeness is 1.00, its source credibility is 0.95, and its time credibility is 0.90, its evidentiary quality value is:

[0131] q_i=0.25×0.90+0.35×1.00+0.20×0.95+0.20×0.90=0.945.

[0132] This calculation is only used to illustrate the weighting method of the four components within a uniform range. If the integrity check fails, q_int,i is set to 0, and the evidence object retains its failed state; even if other components are higher, this object cannot be used as a valid basis for a deterministic content equivalence relationship. In cases where a component is temporarily unavailable, it is not arbitrarily assigned a full value, but rather the missing value handling rule corresponding to the object type is adopted, and the weight normalization method actually used in the calculation is preserved.

[0133] The correlation between file restoration results and sandbox analysis results employs a strict equivalence comparison of digest algorithms and digest values. If the sandbox returns only one digest while the file restorer calculates multiple digests, the comparison is performed under the same algorithm fields. File names, media types, or file lengths that are identical can only be used for candidate retrieval and cannot establish deterministic decision edges. Threat intelligence matching of domain names, addresses, and Uniform Resource Locators (URLs) also requires checking the intelligence version's effective time and indicator normalization rules. The correlation between rule alerts and sessions prioritizes message location or rule engine session identifiers; only when these identifiers are missing are five-tuples and time intervals used to form candidate attributions, and the number of candidates is recorded as a conflict fact.

[0134] To support storage retention planning, the theoretical capacity C_raw of the original packets can be estimated based on average mirrored traffic and retention days:

[0135] C_raw=B_avg×86400×D / (8×10¹²).

[0136] Where B_avg is the average mirrored flow rate in bits per second; D is the retention days (D > 0); 86400 is the number of seconds in a day; dividing by 8 converts bits to bytes, and dividing by 10¹² gives C_raw in decimal terabytes. If B_avg is 1.5 × 10⁻⁶... 9 If bits per second and D is 7 days, then C_raw is approximately 113.4 terabytes. This value does not take into account indexing, redundancy, compression ratio, and storage reservation. During engineering deployment, the capacity should be determined based on this theoretical value and the actual packet distribution, and compression benefits should not be taken as a prerequisite.

[0137] When the original message storage segment reaches its normal retention period, the system queries the event index and evidence chain references. Segments not referenced by a valid evidence chain can be processed according to the retention policy; segments referenced by an evidence chain form a preservation record, which includes the chain identifier, segment identifier, referenced message range, preservation reason, and release condition. The retention period for unified evidence objects, causal attack chain graphs, and standardized alarm logs can be longer than that of the original message, but when the underlying message has been processed according to the policy, the relevant evidence references must be explicitly marked as expired and cannot be displayed as still readable.

[0138] Through the above modeling method, protocol parsing results, file restoration results, rule alerts, sandbox analysis results, threat intelligence hit results, and host session data all possess consistent temporal semantics, object identity, integrity status, and original evidence citations. A hierarchically verifiable relationship is formed between the event index, object index, session index, and packet location index, providing... Figure 3 The causal attack chain graph shown provides the source of nodes, and also... Figure 5 The selective evidence playback shown provides a location entry point.

[0139] Example 3

[0140] This embodiment combines Figures 3 to 5 This document describes the specific implementation methods for constructing a causal attack chain graph, temporal causal reasoning, selective evidence playback, and asynchronous result backfilling. It focuses on how to maintain path interpretability when a fixed time window is insufficient to cover cross-stage activities, shared addresses can easily lead to false associations, and external results are delayed. This embodiment can be combined with the data collection and unified modeling methods described in Embodiment 1 or Embodiment 2.

[0141] The causal attack chain graph is stored using a directed attribute graph. Node records include node identifier, node type, set of unified evidence object identifiers, event time interval, arrival time, attack phase candidate set, and node state. Edge records include source node, destination node, edge type, deterministic state, edge evidence reference, candidate features, scoring result, conflicting facts, scoring version, and valid state. The graph manages fact updates and scoring configuration updates using chain versions and scoring versions respectively. When the facts remain unchanged but the weights or thresholds change, the scoring version can be recalculated without copying the original unified evidence object.

[0142] Before establishing a deterministic edge, an evidence validity check is performed. For session inclusion relationships, the session identifier in the object index must match the session index, and the object's byte range must be within the session payload range. For resolution usage relationships, the domain name response address must match the subsequent session target address, and the session start time must be within the response's valid time. For file derivation relationships, each ordered byte range of the file must map to a response object or session payload. For content determination relationships, the digest algorithm and digest value must be consistent. For rule hit relationships, the alarm location message must belong to the corresponding session. If any requirement is not met, the corresponding deterministic edge is not established; instead, a candidate causal edge is established based on available information.

[0143] The entity continuity K_ij of candidate causal edges is calculated from available entity evidence. Let host identity consistency be k_host, address valid range overlap be k_addr, collection area consistency be k_zone, and user or process continuity be k_proc, with corresponding non-negative weights from κ_1 to κ_4. If all four are available, then:

[0144] K_ij=κ_1×k_host+κ_2×k_addr+κ_3×k_zone+κ_4×k_proc.

[0145] Each component is located between 0 and 1, where κ_1 + κ_2 + κ_3 + κ_4 = 1. If a component is unavailable, it is marked as unavailable, and the remaining available weights are renormalized. If host identity, valid address range, and collection area are all unavailable, candidate causal edges requiring continuity of the same host are not established. This process avoids equating the lack of host proxy data with entity consistency.

[0146] In a shared egress address scenario, the external destination server can only observe egress addresses shared by multiple internal hosts. The system obtains internal host addresses, pre-address translation sessions, and collection areas from mirrored traffic on the internal side, and establishes a correspondence using mapping information available in the same packet or network address translation log. If only egress traffic can be obtained, the shared egress address can only provide low-intensity entity characteristics and cannot alone make K_ij reach the minimum entity continuity condition. When two events have the same egress address and are close in time, but the internal host temporary identifiers or session directions are inconsistent, the conflicting fact c_m is written into C_ij, thereby reducing the candidate causal edge score.

[0147] Data derivation strength D_ij is graded according to the strength of evidence. Complete byte range coverage and strict equivalence of content digests constitute facts that allow for the establishment of deterministic edges. If byte relationships cannot be obtained due to encryption or incomplete capture, but the same protocol transaction identifier, the same content length, and the direction of consecutive sessions exist, a higher but not deterministic data derivation strength can be formed. Only identical filenames, path segments, or media types result in lower strength. Only temporal proximity does not constitute data derivation strength. Each strength level is managed by a configuration table, and the triggering evidence conditions are stored in the edge record.

[0148] The attack phase compatibility P_ij is determined by the phase transition matrix. Phases can include external infrastructure preparation, initial access, file delivery, execution association, control communication, credential or authorization activities, lateral movement, and data transfer. Rows in the transition matrix represent source phases, and columns represent destination phases. Matrix values ​​range from 0 to 1. Directly adjacent transitions that conform to common technical sequences are assigned higher values; transitions that allow crossing a missing phase are assigned intermediate values; and transitions in opposite directions or that are technically incompatible are assigned 0. The matrix version is saved with the scoring version and cannot cancel out phase conflicts where P_ij is 0 by high temporal proximity.

[0149] Rarity R is calculated within a preset historical period, separately calculating the proportion of hosts, sessions, and events involved in the indicator. Domain names can be counted separately by complete domain name and registered domain name; addresses can be counted separately by single address and network prefix; file content digests are counted according to strict equivalence; and Uniform Resource Locators (URLs) can be counted separately by complete value and normalized path. R used to expand the window prioritizes statistical items with clear granularity and verifiable sources; even if the complete path of a common public service domain name is rare, its overall rarity can be reduced through higher host coverage frequency.

[0150] Figure 4 The dynamically associated windows shown are configured with W0_ab, W_min, and W_max for each stage. Domain name resolution to resource access typically uses a shorter base window, file delivery to control communication can use a longer base window, and control communication to subsequent low-frequency control communication can have its base window set based on the identified communication cycle. The dynamic window is only used for candidate generation and does not directly prove causality; candidates generated after window expansion still need to pass entity continuity, data derivation, stage compatibility, evidence quality, and conflict checks.

[0151] Figure 4 The upper part illustrates the dynamic window determination process. Anchor point rules form inference anchor points based on rule-based alarm quality, document judgment conclusions, and threat intelligence risks. The relation type base window W0_ab, indicator rarity R, and existing evidence quality G are jointly input into the dynamic window calculation stage, and the dynamic association window W_ab is obtained according to W_ab = clip(W0_ab × (1 + α × R + β × G), W_min, W_max). W0_ab, W_ab, W_min, W_max, R, and G in the diagram have the same meaning as the formula symbols of the same name in this specification. The inference anchor point and the dynamic association window together limit the time and object range of candidate nodes, forming a candidate subgraph clipped by the window.

[0152] Figure 4 The middle section divides the candidate subgraph into two search directions: pre-attack recovery and post-attack recovery. Pre-attack recovery starts with the anchor-related objects and examines file delivery, resource access, and domain name resolution relationships in reverse order along the corrected event timeline. Post-attack recovery examines control communications, lateral activity, and other internal extended sessions in forward order along the corrected event timeline. The pre- and post-attack fragments obtained from the two-way search are then entered into... Figure 4 In the lower-level causal gating and path selection phase, causal constraints and exclusive conflict determination are first performed. Conflicting branches enter a state of excluding branches without basis. Candidate causal edge scores S_ij are calculated based on the determined branches, and bidirectional path fragments are spliced ​​together. Path scores are sorted using Score(π) and the corresponding acceptance threshold, retaining paths that are continuous during the attack phase and do not exceed resource limits.

[0153] After the candidate causal edges are scored, the search module builds an anchor-related subgraph. When tracing forward, it prioritizes finding the alarm-corresponding file, file source Uniform Resource Locator (URL), resource access session, and previous domain name resolution along deterministic edges, and then searches for possible initial accesses along candidate causal edges that have reached a threshold. When expanding backward, it starts from the affected host and anchor objects, searching for rare targets, periodic sessions, and lateral sessions within the dynamic window. The search uses a queue sorted by the upper bound of the path score, and branches whose score upper bound is below the path acceptance threshold are terminated early.

[0154] The path conflict score C_π is synthesized based on edge conflicts, node entity conflicts, and phase rollback conflicts within the path. Repeated conflicts of the same type are counted only once to prevent an address lease conflict from being amplified by repeated occurrences across multiple adjacent edges. The path phase coverage score H_π reflects whether the preset critical phases are covered by valid nodes or allowed missing markers; the inference anchor matching score M_π reflects whether the path contains anchor objects, objects deterministically connected to the anchors, and the anchor's validity period. All components remain within the range of 0 to 1, and the final path score is limited by the clip function.

[0155] When two paths share the same inference anchor but point to different internal hosts, the system does not force a merger based on similar path scores. If one path has definite session participation edges and file derivation edges, while the other path only relies on similar exit addresses and times, the former retains higher entity continuity and data derivation strength, while the latter is limited by conflict degree and low evidence quality. When both paths reach the threshold, they are output as two separate chain candidates, and the mutually exclusive facts are recorded in the standardized alarm log to avoid generating a single chain that simultaneously affects two hosts without sufficient evidence.

[0156] Selective evidence playback is driven by the evidence list of the confirmation path. Figure 5 The evidence list generation phase only includes path nodes, path edges, and the evidence required for their direct verification, without reading all traffic within the dynamic window. For resolution edges from domain name to session, the domain name response message, response object, session header message, and destination address are read; for derived edges from resource response to file, the response object, restoration processing record, file byte range, and content digest are read; for decision edges from file to sandbox alarm, the file digest and sandbox report references are read. This allows for control over the scope of evidence reading based on the edge type.

[0157] Figure 5The left side further illustrates the order of evidence selection, causal ordering, and consistency verification. The evidence list queries the hierarchical evidence index based on the original evidence references of nodes and edges, selecting traffic storage segments, message ranges, reconstructed sessions, protocol transactions, restored files, and detection results directly related to the path. The selected evidence is first arranged in causal topological order, and then arranged within the same topological layer according to the corrected event time. After re-executing session reconstructing, protocol parsing, file restoration, and detection association, the content summary, protocol transaction identifier, and association results are verified respectively. If all three types of verification are consistent, the corresponding relationship is marked as verified; if there are missing or discrepancies, the missing level, the discrepancy content, and the status pending review are saved, without silently overwriting the original evidence object with the re-parsing results.

[0158] When reorganizing evidence, a partial order relationship is first formed based on deterministic edges, and then the same partial order layer is arranged using the corrected event times. If the parser's re-parsing result is inconsistent with the attributes of the original unified evidence object, the system generates a review difference record, without directly overwriting the original object. When the difference is caused by a change in the parser version, both results and versions are retained; when the difference is caused by a failure in the integrity of the original message, the relevant edges are set to a pending review state and the affected paths are recalculated. The entire processing scope is limited to the anchor-related subgraph and its referenced evidence, without rescanning all historical traffic.

[0159] When asynchronously backfilling results, the system first selects a reverse index based on the object type of the new result. Sandbox analysis results are queried using file content summaries to find file nodes and historical Uniform Resource Locator (URI) nodes; domain name intelligence is queried using normalized domain names to find domain name resolution nodes; address intelligence is queried using addresses and validity periods to find session nodes; and URI intelligence is queried using normalized URIs and matching granularity to find corresponding nodes. Query results must also satisfy the validity period of the intelligence version and the evidence retention status; expired intelligence cannot be unconditionally applied to all historical events.

[0160] After the alarm node corresponding to the new result is written, it is connected to the historical node through content summary equal-value edges, indicator hit edges, or object reference edges, and serves as a new inference anchor point to trigger a local recalculation. The local recalculation scope expands from the new anchor point along deterministic edges and accepted candidate causal edges to a preset depth, and then new candidate nodes are added according to the dynamic window. The old chain version saves the original inference anchor point, original score, and original evidence state; the new chain version saves newly added nodes, invalid nodes, score changes, and triggering reasons. If the new intelligence is later revoked, the alarm node is marked as invalid in the new intelligence version, and a subsequent chain version is generated without deleting the historical version.

[0161] Figure 5The right side illustrates the asynchronous evidence backfilling and version update process. For late sandbox analysis results, historical file nodes are located primarily based on the digest algorithm and file content digest; the submission task identifier serves only as an auxiliary query key and participates in the location only when it can point back to the sample content digest or the original sample reference. For threat intelligence updates, historical nodes are located according to indicator type, normalized indicator value, and intelligence version. After location is complete, the new version unified evidence object is written, and adjacent deterministic edges, candidate subgraphs, and affected causal paths are locally updated, keeping chain_id unchanged and incrementing chain_version. Simultaneously, newly added nodes, failed nodes, score changes, and version trigger reasons are recorded.

[0162] Standardized alarm logs can be transmitted using a hierarchical data structure, but the meaning of their fields does not depend on the specific transmission format. Chain-level records include chain_id, chain_version, anchor_id, score, stage_coverage, affected_host, and generated_time; node-level records include node_id, node_type, event_time, arrival_time, evidence_id, quality, and attributes; edge-level records include from_node, to_node, edge_type, determineinistic, edge_score, reason, conflict, and evidence_ref. Field names can be converted to Chinese or other naming conventions according to the interface specification, but the correspondence between chains, nodes, edges, and evidence references remains unchanged.

[0163] Through the processing in this embodiment, deterministic facts and scoring candidate relationships in the graph are stored separately. The dynamic association window only limits the candidate range, and both candidate causal edge scores and path scores have clear value ranges, weight conditions, and conflict handling methods. For shared exit addresses, host continuity relationships are not established separately for the same address. For late sandbox analysis results or threat intelligence hit results, historical backfilling is completed through reverse indexing and chain versioning, so that new conclusions can point back to the historical messages and object evidence on which they are based.

[0164] Example 4

[0165] This embodiment combines Figure 6This describes a full-traffic causal replay detection system for advanced threats. The system includes a traffic acquisition and evidence retention module, a parsing and detection adaptation module, a unified evidence object module, a causal attack chain graph construction module, a temporal causal reasoning module, a selective evidence replay module, and an alarm output module. The functions of each module correspond to steps S1 to S7 of the method, and they exchange data through unified evidence object identifiers, node identifiers, chain identifiers, and evidence references.

[0166] The traffic acquisition and evidence retention module is used to acquire bypass mirrored traffic, retain packets in segments, perform session reassembly on the packets, and establish a hierarchical evidence index between packets, reassembled sessions, and parsed objects. This module includes a mirror receiving unit, a packet segmentation unit, a session reassembly unit, an object indexing unit, and a retention control unit. The mirror receiving unit receives packets from physical acquisition interfaces, virtual switch mirroring interfaces, or cloud network traffic mirroring interfaces; the packet segmentation unit appends packets to immutable storage segments and generates packet location indexes; the session reassembly unit forms a bidirectional mapping from session and payload fragments to packet locations; the object indexing unit receives parsed objects and establishes object indexes and event indexes; and the retention control unit controls the transfer of storage segments to the ordinary rotation area or the evidence preservation area based on the storage period and the evidence chain citation status.

[0167] In its implementation, the mirror receiving unit can set up multiple parallel receiving queues, each bound to a collection interface or a traffic hash range. The receiving queues are only responsible for timestamp recording, basic packet inspection, and storage distribution; they do not modify the monitored service traffic during congestion. The packet segmentation unit can use local block storage, distributed object storage, or a combination of both, with intra-segment writes appended. The session reassembly unit allocates packets to working partitions according to normalized bidirectional 5-tuples, enabling the same session to be reassembled within the same state processing unit; repeated observations across collection nodes are associated at the upper layer through repeated observation relationships and are not directly discarded during the packet receiving stage.

[0168] The parsing and detection adaptation module is used to acquire protocol parsing results, file restoration results, rule alerts, sandbox analysis results, threat intelligence hit results, and host session data. This module includes a protocol parsing unit, a file restoration unit, a rule alert adaptation unit, a sandbox result adaptation unit, a threat intelligence adaptation unit, and a host session adaptation unit. The protocol parsing unit extracts protocol transaction and object fields from the reconstructed session; the file restoration unit restores the file based on the response payload or file transfer message and saves the byte source; the rule alert adaptation unit converts the output of Snort or an engine using equivalent rule detection methods into a unified input; the sandbox result adaptation unit receives sample judgments and report references; the threat intelligence adaptation unit receives versioned hit results for indicators such as domain name, address, Uniform Resource Locator (URL), and file content summary; and the host session adaptation unit receives asset, connection, and available process or user information.

[0169] The parsing and detection adaptation module configures source identifiers and field mapping versions for different data sources. The field mapping version specifies the correspondence between the original fields and unified fields, the meaning of time fields, object types, null value rules, and the method of evidence citation formation. When the adapter detects a missing required field, it does not generate a fictitious field but outputs an intermediate record with the missing status; when it detects a change in the data source version, it saves the old and new mappings separately. The sandbox and threat intelligence interfaces can use either result retrieval or message push methods; the order of arrival is not considered the order of attack phases.

[0170] The Unified Evidence Object module normalizes the identifiers, timestamps, attributes, and evidence references of data from various sources. This module includes a normalization unit, a time correction unit, an identity resolution unit, an evidence quality unit, an integrity summary unit, and a version management unit. The normalization unit processes addresses, domain names, Uniform Resource Locators (URLs), digest algorithms, and protocol names; the time correction unit distinguishes between event time and arrival time, applies clock correction values ​​from the data acquisition nodes, and forms time uncertainty intervals; the identity resolution unit forms stable identifiers for hosts, sessions, objects, and alarms; the evidence quality unit calculates q_i based on four quality components; the integrity summary unit forms hash_i; and the version management unit stores the versions of the normalization rules, time correction rules, and quality weights.

[0171] The Unified Evidence Object module can be implemented using a streaming queue and an object storage. The streaming queue carries records to be normalized and their source order, while the object storage stores the normalized object content and larger external reports. Each unified evidence object is written to, and an event index record is generated. If writing the object content is successful but writing the index fails, the index is rebuilt using the pending compensation state, and unlocatable objects are not published to the graph construction module. Object updates use an append-only approach, and older versions remain accessible through `version_i` and derivation relationships.

[0172] The causal attack chain graph construction module maps unified evidence objects to host nodes, session nodes, file nodes, domain name resolution nodes, Uniform Resource Locator (URL) nodes, and alarm nodes, and establishes deterministic edges and candidate causal edges. This module includes a node mapping unit, a deterministic relationship unit, a candidate generation unit, a conflict checking unit, and a graph storage unit. The node mapping unit forms six types of nodes based on object type; the deterministic relationship unit verifies session inclusion, parsing usage, byte derivation, digest equivalence, and rule hit relationships; the candidate generation unit forms node pairs to be scored based on time, entity, protocol semantics, and attack phase conditions; the conflict checking unit records identity, address lease, digest, time direction, and phase direction conflicts; and the graph storage unit stores node, edge, and chain versions.

[0173] Graph storage units can utilize graph databases with adjacency indexes, or node tables, edge tables, and evidence reference tables from relational databases. When using a relational database, node tables are indexed by node type, event time, and entity identifier, while edge tables are indexed by source node, destination node, edge type, and valid state. When using a graph database, large fields of evidence objects are still stored in object storage, with stable references only stored in node and edge attributes. Regardless of the storage method used, deterministic state, scoring version, and original evidence references are stored as explicit fields.

[0174] The temporal causal reasoning module uses nodes corresponding to rule-based alerts, sandbox analysis results, or threat intelligence hits as inference anchors to determine dynamic correlation windows, calculate candidate causal edge scores, and search for causal attack paths. This module includes an anchor management unit, a frequency statistics unit, a dynamic window unit, an edge scoring unit, a path search unit, and a local recalculation unit. The anchor management unit verifies the validity of anchor evidence; the frequency statistics unit generates f_host,i, f_session,i, and f_event,i; the dynamic window unit calculates W_ab based on stage pairs, rarity, and evidence quality; the edge scoring unit calculates S_ij; the path search unit calculates Score(π) and performs forward tracing and backward expansion; and the local recalculation unit responds to asynchronous results and score version changes.

[0175] The frequency statistics unit maintains counts according to the statistical period and the collection area, first removing duplicate observations, and then calculating the normalized frequency. During the dynamic window unit's parameter reading phase, it simultaneously verifies that 0 < W_min ≤ W0_ab ≤ W_max; if the configuration does not meet this condition, the version is rejected for release. The edge scoring unit verifies that the sum of positive weights is 1, and records configuration or data anomalies when input components exceed the range of 0 to 1. The clip function then limits the output instead of ignoring the anomalies. The path search unit sets the maximum number of nodes, the maximum number of branches, and the search timeout; when the search stops, it saves the completed paths and the termination reason, preventing resource limitations from being mistakenly represented as the absence of other paths.

[0176] The selective evidence replay module is used to read and reconstruct relevant evidence based on causal attack paths. This module includes an evidence list unit, a hierarchical location unit, an integrity verification unit, a protocol review unit, and a sequence organization unit. The evidence list unit extracts evidence references from path nodes and edges; the hierarchical location unit reads data using event indexes, object indexes, session indexes, and message location indexes; the integrity verification unit recalculates object digests, file digests, and message digests; the protocol review unit reparses selected objects based on the recorded parser version; and the sequence organization unit forms an evidence sequence according to the causal topology and corrected event times.

[0177] The selective evidence replay module executes in an independent analysis resource pool, avoiding the use of real-time acquisition threads for historical protocol parsing and rule review. The message range included in the evidence list is merged according to the edge verification requirements, and overlapping ranges are read only once. For storage segments that have exceeded the normal retention period but have been transferred to the evidence preservation area, the hierarchical positioning unit obtains the new storage location based on the preservation record; for storage segments that have been processed according to the policy, the unreadable status and original index information are output, without replacing them with other traffic of similar time.

[0178] The alarm output module outputs a traceable evidence chain and standardized alarm logs. This module includes a chain assembly unit, a field specification unit, a version difference unit, a log sending unit, and a sending status unit. The chain assembly unit forms chain-level, node-level, and edge-level records; the field specification unit converts the time format, address format, digest algorithm identifier, and attack phase identifier; the version difference unit records changes in nodes, edges, and scores before and after asynchronous backfilling; the log sending unit sends logs to the security information management platform, event response platform, or evidence audit storage; and the sending status unit saves reception confirmations, retries, and the target interface version. External transmission failures do not change the local evidence chain status; upon recovery, the chain is retransmitted idempotently according to the chain identifier and chain version.

[0179] like Figure 6 As shown, the system can be deployed as acquisition nodes, analysis nodes, graph and index nodes, and playback output nodes. Acquisition nodes connect to the mirror interface and are responsible for real-time reception and immutable storage; analysis nodes perform session reassembly, protocol parsing, file restoration, and rule detection; graph and index nodes perform unified modeling, graph construction, and temporal causal reasoning; playback output nodes read evidence related to confirmed paths and output logs. In smaller deployments, these nodes can reside in different processes on the same server; in larger deployments, multiple acquisition and analysis nodes can be expanded according to acquisition areas or session hashes.

[0180] Figure 6 The modules are grouped and labeled from a deployment perspective. In the diagram, the traffic evidence module corresponds to the traffic acquisition and evidence retention module; the detection result adaptation interface is an external interface of the parsing and detection adaptation module; the multi-source parsing modeling module is collaboratively implemented by the parsing and detection adaptation module and the unified evidence object module; the causal graph construction module corresponds to the causal attack chain graph construction module; the candidate subgraph determination module and the causal inference module together constitute the temporal causal inference module, where the candidate subgraph determination module performs anchor point selection, dynamic window calculation, and candidate range pruning, and the causal inference module performs candidate causal edge scoring, conflict determination, and path search; the evidence playback module corresponds to the selective evidence playback module; and the alarm output module corresponds to the module with the same name. The grouped names in the diagram are used to illustrate the deployment division of labor and do not change the boundaries of the various functional modules of the system.

[0181] according to Figure 6The data flow is as follows: the mirrored output of the core switching device enters the bypass acquisition node; packets are written to the full traffic evidence storage and hierarchical evidence index, and session and object references are passed to the analysis server; the rule detection engine, sandbox platform, threat intelligence platform, and host session data source provide external detection data to the multi-source analysis and modeling module through the detection result adaptation interface. The unified modeling results sequentially enter the causal graph construction, candidate subgraph determination, and causal inference processing; the confirmed path, carrying node identifiers and edge evidence references, enters the evidence playback module; the playback verification results are then sent to the security operation and review terminal by the alarm output module. The graph storage saves node, edge, and chain versions, and the evidence references enable the graph records to be located in the traffic evidence storage and index storage.

[0182] The system's components include a processor, memory, and network interfaces. The processor may include a general-purpose processor and a coprocessor unit for high-speed message processing; the memory includes non-volatile memory for storing programs and indexes, volatile memory for session reassembly, and capacity storage for raw messages and object evidence; the network interfaces include a mirrored traffic receiving interface, a management interface, and an external detection result interface. When program instructions are executed by the processor, each module completes its corresponding method steps. Modules can be implemented by logical units of the same program or by multiple processing processes connected through message queues and service interfaces.

[0183] Versioned message communication is used between modules. The traffic acquisition and evidence retention module provides session identifiers and payload references to the parsing and detection adaptation module; the parsing and detection adaptation module provides source records and field mapping versions to the unified evidence object module; the unified evidence object module provides eid_i, version_i, and raw_ref_i to the causal attack chain graph construction module; the causal attack chain graph construction module provides nodes, deterministic edges, and candidate features to the temporal causal inference module; the temporal causal inference module provides chain identifiers, path nodes, and edge evidence references to the selective evidence replay module; and the selective evidence replay module provides verification status and ordered evidence sequences to the alarm output module. When any module retryes, idempotency processing is performed using the object identifier and version.

[0184] This embodiment first describes the functions of each module in the system claims, and then describes the internal units of the modules, data storage, and deployment methods. Each module corresponds to the method steps. The system can be deployed centrally or distributed according to traffic volume. Changes in deployment methods do not change the data relationships between the unified evidence object, the causal attack chain graph, temporal causal reasoning, and selective evidence playback.

[0185] Example 5

[0186] This embodiment combines Figure 6 and Figure 7This invention is explained in the application of the present invention in the scenario of cross-day document delivery and low-frequency control in enterprise networks. The parameters and events in the scenario are used to illustrate the system configuration and execution process, and do not represent fixed values ​​for all networks, nor are they intended as performance statistical conclusions detached from actual test conditions.

[0187] The monitored network includes the internet egress zone, office terminal zone, server zone, and security analysis zone. The internet egress switching equipment provides bidirectional mirrored traffic to the collection nodes. Host session logs from office terminals and servers are sent to the analysis nodes via the management network when available. The rule detection engine and protocol parser read the same reconstructed session. The file restorer saves recoverable objects to object storage. The sandbox platform and threat intelligence platform return asynchronous results through controlled interfaces. The system is not connected in series in the production communication path, and traffic collection failures will not interrupt business connections.

[0188] This scenario requires the preservation of original message evidence for no less than seven days, enabling early domain name resolution and file delivery in cross-day paths to be located when subsequent intelligence arrives; it requires the performance of session reassembly and object resolution on Domain Name System, Hypertext Transfer, Transport Layer Security Handshake, email, and common file transfer protocols; it requires rule-based alerts to be associated with session or message location; it requires sandbox results to be associated with file content summaries; and it requires standardized alert logs to be output to the security management platform, while locally retaining chain version and integrity verification status.

[0189] One feasible hardware configuration includes two acquisition and analysis servers, a set of capacity storage nodes, and one graph playback server. Each acquisition and analysis server is equipped with multiple high-speed mirror receiving interfaces, a multi-core general-purpose processor, memory for session state, and solid-state storage for temporary caching; the capacity storage nodes store immutable segments, restore files, and external reports; the graph playback server is equipped with processors and memory for indexing and graph searching, and reads the capacity storage through an independent storage network. The number of these devices can be adjusted according to mirror traffic and retention period, and the system can also deploy graph and playback functions to an existing traffic analysis cluster.

[0190] Based on an average mirror flow rate of 1.5 × 10 9 Based on bit-per-second and seven-day retention estimates, the theoretical capacity of the raw message, excluding compression and redundancy, is approximately 113.4 terabytes. Engineering configurations reserve space beyond this theoretical capacity for indexing, object evidence, storage redundancy, and growth. Message storage segments can be closed in fixed-capacity or shorter time intervals, ensuring that the failure or preservation of a single storage segment does not affect the entire retention period. Idle timeouts for session states are set separately for transport and application protocols, and are not treated with a single fixed value for all protocols.

[0191] In a set of descriptive parameters, the basic association window W0_ab for file delivery to the initial control communication is set to 30 minutes, the lower window limit W_min to 10 minutes, the upper window limit W_max to 180 minutes, α to 0.50, and β to 0.30; the positive weights of candidate causal edges are set to w_t = 0.20, w_k = 0.20, w_d = 0.25, w_s = 0.20, and w_q = 0.15, and the conflict penalty weight w_c is set to 0.30; the edge acceptance threshold is set to 0.75, the path acceptance threshold is set to 0.80, and the maximum number of nodes in a path is set to 24. Before parameter release, the window boundaries, weight ranges, and the sum of positive weights are checked, and the configuration version is recorded.

[0192] On the first day of the scenario, office terminal H_1 queries domain name D_1 through domain name resolution session S_1 and establishes resource access session S_2 within the response validity period, requesting Uniform Resource Locator U_1. The response object is processed by the file restorer to form file F_1, with the file node storing the content digest, length, source response byte range, and message location set. The rule detection engine does not generate a high-confidence alarm for this download, and the system still converts D_1, S_1, S_2, U_1, and F_1 into a unified evidence object, establishing host participation edge, session inclusion edge, resolution usage edge, and file derivation edge.

[0193] File F_1 is submitted to the sandbox platform. After downloading the file, the sandbox platform returns analysis result A_1, which has the same digest algorithm and content digest as F_1. The sandbox result arrives later than the file's appearance time; the unified evidence object simultaneously saves the event time of the file's first appearance and the arrival time of the result into the system. The system establishes a deterministic decision edge from F_1 to A_1 based on the content digest, and uses A_1 as the inference anchor point to trace back to U_1, S_2, D_1, and H_1.

[0194] Later on Day 1, H_1 establishes a short-duration, low-load outbound session S_3. This session does not hit the independent rule, but the target metrics have low host coverage frequency, session occurrence frequency, and event occurrence frequency in the historical statistical period. Assuming an overall rarity R of 0.86 and existing evidence quality G of 1.00, the dynamic association window is:

[0195] W_ab = clip(30 × (1 + 0.50 × 0.86 + 0.30 × 1.00), 10, 180) = 51.9 minutes.

[0196] If the correction time difference between S_3 and file F_1 is within 51.9 minutes, and they correspond to the same internal host H_1, the system generates a candidate causal edge from F_1 to S_3. The time proximity, entity continuity, phase compatibility, evidence quality, and conflict degree of this edge are calculated and stored separately. Data derivation strength cannot be replaced by identical addresses; when process-level evidence is lacking, it is re-normalized according to available entity components, and the missing process information is recorded in the association reason.

[0197] On the second and third days, H_1 established a few short-term outbound sessions S_4 and S_5, respectively. The system configured the corresponding basic window for the control communication phase based on the observed communication cycles and checked the destination indicators, host identity, direction, and time period. S_3, S_4, and S_5 did not reach the independent high-frequency alarm conditions in their respective single sessions, but their file delivery paths associated with the A_1 anchor point showed phase continuity. The path search expanded backward from A_1, through F_1 to S_3, S_4, and S_5, while retaining the scores and communication cycle evidence for each candidate edge.

[0198] In a shared egress scenario, another office terminal, H_2, shares the same public network egress address as H_1 and accesses the same public cloud service around the same time. The system uses the internal address, collection area, and valid address range in the mirrored traffic to distinguish between H_1 and H_2. Although H_2's session has the same public network address on the egress side, it does not have the same file derivation relationship as F_1, and the internal host identities are also different. Therefore, a deterministic relationship between H_1's file node and H_2's session is not established; candidates formed solely based on the egress address are excluded before scoring if they do not meet the minimum entity continuity condition. This avoids incorporating ordinary access after the shared egress into H_1's attack path.

[0199] On the fourth day, the threat intelligence platform releases a new version of intelligence, A_2, containing either D_1 or S_3 target indicators. The threat intelligence adaptation unit records the indicator type, normalized value, version, effective time, and arrival time, and queries historical unified evidence objects from the first to the third day using a reverse index. A_2 establishes an indicator hit edge with the corresponding domain name resolution node or session node, and triggers a local recalculation as a new inference anchor point. The recalculation scope includes the original A_1 chain and nodes deterministically connected to A_2, without rescanning all traffic unrelated to the indicator.

[0200] After partial recalculation, the system generates a new chain version. The old chain version retains the sandbox anchor A_1, accepted paths, and the original score; the new chain version adds the threat intelligence anchor A_2 and the domain name resolution or control session relationships it supports. If new evidence improves the anchor matching degree or stage coverage, the path score is recalculated according to the current formula; if conflicts occur, such as address lease non-overlapping or intelligence validity time not covering historical events, C_ij or C_π is added, and the path may be removed from the acceptance state. The new version records the reasons for the changes and does not overwrite the old version.

[0201] After path confirmation, the selective evidence replay module reads the D_1 response message, S_2 request response, U_1 object, F_1 ​​byte range, A_1 sandbox report reference, S_3 to S_5 session messages, and A_2 intelligence version. The module verifies the storage segment digest, message digest, file content digest, and external result signature status item by item, re-parses protocol objects directly related to the path edges, and organizes the evidence according to the topological order of parsing usage, file derivation, sandbox determination, and subsequent sessions. Traffic from other office terminals unrelated to the path is not included in the replay evidence list.

[0202] Figure 7 The comparison is based on processing relationships rather than unverified performance values. The fixed window and single-point alarm processing methods, as well as the processing method of this invention, can be compared using the verifiable outputs shown in the table below:

[0203] Figure 7 Subgraph (a) illustrates the fixed-time-window processing method. Domain name resolution events, ordinary resource access events, and file events enter the fixed window according to their address and occurrence time. Events within the window are aggregated into single-point alarms. File deliveries and low-frequency control communications that cross window boundaries cannot continue to be connected, while ordinary accesses that are close in time but have no data derivation relationship may be merged into the same event set. This subgraph represents the fixed-window processing path and its verifiable association boundaries, and does not represent the statistical performance of the fixed-window processing method across all networks.

[0204] Figure 7 Subgraph (b) illustrates the causal constraint path in this embodiment. Domain name resolution, resource access, file delivery, inference anchors, and low-frequency control communication are connected according to resolution usage relationships, data derivation relationships, detection attribution relationships, dynamic association windows, and entity continuity relationships; ordinary accesses that are close to the attack path in time but conflict with data derivation enter the rejection association branch. Therefore, the dynamic association window only expands the scope of candidate checks, and whether to accept them is still jointly determined by deterministic relationships, candidate causal edge scores, and exclusive conflicts.

[0205] Figure 7Subgraph (c) illustrates the replay verification process. Confirmed causal paths output node and edge evidence references. A hierarchical evidence index is used to locate the original message and object evidence. Selective evidence replay re-executes path-related session reassembly, protocol parsing, file restoration, and correlation detection. Relationships that can be directly verified by original bytes, content digests, or object attribution are recorded as deterministic relationships verified; relationships accepted by multiple constraint scores and with consistent replay results are recorded as candidate causal relationships verified; relationships with missing evidence or inconsistent results are recorded as pending review, and their verification status is retained in the evidence chain and standardized alarm log.

[0206] When comparing subgraphs (a) and (b), the same bypass mirror traffic, the same host identity mapping, the same observation period, and the same event set are used. The fixed window processing method adopts address and time aggregation. This embodiment adopts deterministic edges, candidate causal edges, dynamic association windows, and selective evidence playback. Figure 7 The comparison focuses on processing mechanisms, path continuity, exclusion of unfounded branches, and evidence location and verification capabilities, excluding fictitious accuracy, detection rate, or latency values. When quantitative evaluation is required, it should be recalculated based on on-site collected, tested, or offline playback data, while simultaneously preserving the data range, anomaly exclusion rules, basis for manual review, indicator definitions, and calculation methods.

[0207] Comparison Objects Fixed window and single-point alarm handling methods The processing method in this embodiment Verifiable evidence Cross-day low-frequency conversations Each session is saved separately, and the relationship outside the fixed window is interrupted. The candidate pool is expanded in a bounded manner based on the stage, window size, rarity, and quality of existing evidence. Window configuration version, R, G and W_ab calculation records Shared exit address Multiple internal hosts may be aggregated due to the same public IP address. The internal hosts, valid address ranges, and collection areas were checked; candidates that did not meet the minimum contiguous condition were excluded. Host nodes, session participation edges, and conflict records Documents and External Judgments Separation of document records from sandbox or intelligence results Deterministic edges are established based on the digest algorithm and content digest equivalence. Document summary, report citations, and integrity verification results Late arrival threat intelligence Forming new isolated alarms Update the affected subgraph using the reverse index and generate a new chain version. Differences in arrival time, intelligence version, and chain version Alarm Review It mainly relies on alarm fields and manual retrieval. Locate messages, sessions, objects, and external results according to the path and organize the evidence sequence. Hierarchical evidence index, side evidence citation, and replay verification status

[0208] The table above compares the processing mechanism and verifiable output. Actual deployment can be tested by recording the number of candidates, manual review results, successful evidence location status and processing latency within the same observation period. However, the test data and results should be saved along with the specific network conditions.

[0209] During system operation, real-time acquisition paths and selective evidence playback paths utilize independent resource queues. The real-time acquisition queue has a higher priority than the historical playback queue; when playback reading reaches the storage bandwidth limit, new playback tasks are paused without blocking message reception. When the graph search reaches the maximum number of nodes, the maximum number of branches, or the processing time limit, the standardized alarm log records the reason for the search termination and the completed paths, without interpreting the resource termination status as the absence of other related events.

[0210] The standardized alert log output in this scenario includes the chain identifier, two chain versions, sandbox anchor A_1, threat intelligence anchor A_2, affected host H_1, domain name resolution node D_1, resource access node U_1, file node F_1, session nodes S_1 to S_5, each deterministic edge and candidate causal edge, edge score, path score, evidence location, and integrity verification result. Security analysts can read the corresponding unified evidence object from any node, then sequentially locate the resolved object, reconstruct the session and original message, thereby verifying cross-day file delivery and low-frequency control paths.

[0211] As seen in this application scenario, this invention does not rely on a single session necessarily matching an independent rule. Instead, it establishes an evidentiary foundation using deterministic relationships such as file derivation, digest equivalence, and parsing usage. It then connects low-frequency stages using bounded dynamic association windows and multi-component causal scoring. For shared exit points and late arrival intelligence, the association scope is controlled through entity continuity conditions, conflict degree, reverse indexing, and chain versioning, respectively. The entire process can form a path-level traceable evidence chain without retransmitting messages to the business network.

[0212] The above description is merely a specific embodiment of the present invention, used to illustrate the technical solution of the present invention and not to limit its scope of protection. Those skilled in the art can adjust or replace the acquisition interface form, protocol parsing type, storage structure, scoring parameters, graph storage method, and log transmission format without departing from the technical concept of the present invention; as long as the adopted technical solution still forms a hierarchical evidence index and a unified evidence object based on bypass mirror traffic, performs temporal causal reasoning based on the causal attack chain graph, and completes selective evidence playback according to the obtained path, its scope of protection should be determined according to the claims of the present invention.

Claims

1. A full-traffic causal replay detection method for advanced threats, characterized in that, include: S1, acquire the bypass mirror traffic, segment and retain the packets in the bypass mirror traffic, perform session reassembly and protocol parsing on the packets, and establish a hierarchical evidence index between the packets, reassembly sessions and parsing objects; S2 acquires protocol parsing results, file restoration results, rule alerts, sandbox analysis results, threat intelligence hit results, and host session data. It normalizes the identifiers, times, attributes, and evidence references of data from various sources to form a unified evidence object. S3, map the unified evidence object to host nodes, session nodes, file nodes, domain name resolution nodes, unified resource locator nodes and alarm nodes to form a set of nodes in the causal attack chain graph; S4. Establish deterministic edges based on the temporal sequence, entity continuity, data derivation, and attack phase constraints between nodes, and establish candidate causal edges for node pairs that do not satisfy the deterministic relationship but meet the candidate association conditions. S5 uses nodes corresponding to rule alerts, sandbox analysis results, or threat intelligence hit results as inference anchors, and determines dynamic association windows based on the attack stage of the node and the rarity of related indicators. S6, perform causal scoring on the candidate causal edges in the dynamic association window, and search for causal attack paths consisting of multiple attack stages in combination with the deterministic edges; S7. Based on the causal attack path, locate relevant messages, reconstruct sessions, parse objects and external detection results through the hierarchical evidence index, perform selective evidence playback according to the corrected event time and causal topology order, and output a traceable evidence chain and standardized alarm log.

2. The full-traffic causal replay detection method for advanced threats according to claim 1, characterized in that, In step S1, continuous messages are divided into multiple immutable storage segments according to acquisition time and storage capacity. For each message, the storage segment identifier, segment offset, acquisition time, acquisition length, and message digest are recorded. A reassembly session is formed based on the bidirectional 5-tuple, transmission protocol status, and time interval. The sequence number range or offset set of the messages contained in the reassembly session is recorded. A parsing object is formed based on the protocol parsing position, message boundary, and object byte range, so that any parsing object can sequentially point back to the corresponding reassembly session, message set, and immutable storage segment. The hierarchical evidence index includes an event index, object index, session index, and message position index. Each level of index stores the upper-level object identifier and the lower-level evidence reference.

3. The full-traffic causal replay detection method for advanced threats according to claim 1, characterized in that, In step S2, the unified evidence object includes evidence object identifier, source type, object type, event start time, event end time, arrival time, subject identifier, object identifier, attribute set, original evidence reference, integrity summary, evidence quality value, and version identifier; the clock offset of different collection nodes is corrected, and an event time uncertainty interval is formed according to the accuracy of the time source; the evidence quality value is determined by weighted normalized components of completeness, integrity, source credibility, and time credibility; for file restoration results, the sandbox analysis results and threat intelligence hit results are associated through content summary; for rule alarms, the corresponding traffic evidence is associated through session identifier, message location, or object identifier.

4. The full-traffic causal replay detection method for advanced threats according to claim 1, characterized in that, In steps S3 and S4, the host node stores the asset identifier and address set, the session node stores the bidirectional quintuple, protocol, and time interval, the file node stores the content summary, byte range, and restoration source, the domain name resolution node stores the query name and resolution result, the Uniform Resource Locator (URL) node stores the normalized resource locator (URL) and its associated session, and the alarm node stores the alarm source, alarm type, judgment result, and evidence citation. A deterministic edge is established when there are relationships between nodes such as same session inclusion, URL resolution result being used by subsequent connections, URL response bytes deriving files, or file content summary being equal to sandbox analysis results or threat intelligence hit results. Candidate causal edges are established when nodes only satisfy partial constraints related to time, entity, protocol semantics, or attack phase, and the edge attributes store the association reason, evidence citation, and scoring version.

5. The full-traffic causal replay detection method for advanced threats according to claim 1, characterized in that, In step S5, the dynamic association window W_ab from attack phase a to attack phase b is determined according to the following formula: W_ab=clip(W0_ab×(1+α×R+β×G), W_min, W_max); Where clip(x, l, u) = min(max(x, l), u), W0_ab is the basic correlation window from attack phase a to attack phase b, R is the rarity of the correlation index, G is the quality of existing evidence, α and β are non-negative dimensionless adjustment coefficients, W_min and W_max are the lower and upper limits of the window, respectively, 0 < W_min ≤ W0_ab ≤ W_max; R and G are both between 0 and 1, and all window quantities use the same time unit; the rarity of the correlation index is determined by the normalized results of the historical host coverage frequency, session occurrence frequency, and event occurrence frequency.

6. The full-traffic causal replay detection method for advanced threats according to claim 1, characterized in that, In step S6, the candidate causal edge score S_ij from node i to node j is determined according to the following formula: S_ij=clip(w_t×T_ij+w_k×K_ij+w_d×D_ij+w_s×P_ij+w_q×Q_ij-w_c×C_ij, 0, 1); Where T_ij represents temporal proximity, K_ij represents entity continuity, D_ij represents data derivation strength, P_ij represents attack phase compatibility, Q_ij represents evidence quality, C_ij represents conflict degree, and w_t, w_k, w_d, w_s, w_q, and w_c are non-negative dimensionless weights, and w_t + w_k + w_d + w_s + w_q = 1; each score component is between 0 and 1; candidate causal edges whose scores reach the edge acceptance threshold are combined with the deterministic edges to form a search subgraph; constrained path search is performed in the search subgraph by tracing back and expanding backward from the inference anchor point; and path scores are formed based on the mean edge score, attack phase coverage, anchor point matching degree, and path conflict degree; and the path that reaches the path acceptance threshold is selected as the causal attack path.

7. The full-traffic causal replay detection method for advanced threats according to claim 1, characterized in that, In step S7, an evidence list is generated based on the node identifiers and edge evidence references in the causal attack path. The unified evidence object is located using the event index, the protocol message or the file is located using the object index, the reconstructed session is located using the session index, and the relevant message in the immutable storage segment is located using the message location index. Integrity checks are performed on the read messages, objects, and external detection results; duplicate evidence references are deduplicated and the repeated observation relationships between different collection sources are preserved; the verified evidence is arranged in causal topological order and in the same topological layer according to the corrected event time. When time uncertainty intervals overlap and there is no data derivation direction, the undetermined order state is saved; the selective evidence playback includes evidence sequence reconstruction, protocol object re-parsing, and detection result re-verification, without resending messages to the monitored service network.

8. The full-traffic causal replay detection method for advanced threats according to claim 1, characterized in that, When the sandbox analysis result or threat intelligence hit result arrives later than the corresponding traffic event, the historical unified evidence object is queried based on the file content summary, domain name, address, or Uniform Resource Locator (URL). The late result is used as a new inference anchor point to re-execute local graph construction and path search. The scope of the local graph construction is expanded along deterministic edges and accepted candidate causal edges from the new inference anchor point, and candidate nodes are added in the corresponding dynamic association window. A new version of the evidence chain is generated while retaining the original version, recording newly added nodes, invalid nodes, and score changes. The standardized alarm log includes chain identifier, chain version, attack stage, affected host, associated session, domain name resolution record, URL, URL, file content summary, alarm judgment, causal edge score, path score, association reason, original evidence location, integrity verification result, and generation time.

9. A full-traffic causal replay detection system for advanced threats, characterized in that, It includes a traffic collection and evidence retention module, a parsing and detection adaptation module, a unified evidence object module, a causal attack chain graph construction module, a time-series causal reasoning module, a selective evidence playback module, and an alarm output module; The traffic acquisition and evidence retention module is used to acquire bypass mirror traffic, retain packets in segments, and establish a hierarchical evidence index between packets, reassembled sessions, and parsed objects. The parsing and detection adaptation module is used to obtain protocol parsing results, file restoration results, rule alerts, sandbox analysis results, threat intelligence hit results, and host session data; The unified evidence object module is used to normalize data from various sources; The causal attack chain graph construction module is used to form six types of nodes and establish deterministic edges and candidate causal edges; The temporal causal reasoning module is used to determine the dynamic association window, calculate the candidate causal edge score, and search for causal attack paths. The selective evidence playback module is used to read and reconstruct relevant evidence based on the causal attack path; The alarm output module is used to output a traceable evidence chain and standardized alarm logs. Each module transmits data of the same attack process through unified evidence object identifier, node identifier, chain identifier and evidence reference.

10. The full-traffic causal replay detection system for advanced threats according to claim 9, characterized in that, The system is deployed on a traffic analysis device or server cluster that includes a processor, memory and network interface. The memory is configured with a raw message storage area, a reconstructed session storage area, a parsed object storage area, a unified evidence object storage area, a causal attack chain graph storage area and a standardized alarm log storage area. The raw message storage area stores messages in an immutable storage segment. The processor executes instructions from the memory to enable the system to complete bypass mirror traffic acquisition, protocol parsing, file restoration, rule alarm adaptation, sandbox analysis result adaptation, threat intelligence hit result adaptation, host session normalization, causal attack chain graph construction, temporal causal reasoning, and selective evidence playback. The selective evidence playback is executed by a processing queue isolated from real-time acquisition. When the playback task reaches the resource limit, the termination status is recorded and mirror traffic reception is not blocked. The network interface is used to receive mirror traffic and asynchronous detection results, and send the standardized alarm log to the security management platform, saving the sending confirmation status corresponding to the chain identifier and chain version.

Images