A method for predicting the evolution of APT attacks based on entity role migration and incremental causal residual certificates.

Abstract

This invention relates to the field of APT attack evolution prediction, and discloses an APT attack evolution prediction method based on entity role migration and incremental causal residual certificates. The method constructs causal prefixes from source events in a multi-source system, forms provable attack facts through a local attack-state evidence gate, and generates a causal residual certificate that stores the executor, target entity, causal preconditions, role migration, evidence support, and residual costs. New events undergo in-situ certificate resolution after passing through the evidence gate, and future attack evolution predictions are output only within the legitimate certificate candidates according to five layers of conditional probability: future target, active executor, executable frontier, executor-target endpoint, and semantic path class. This invention provides a provable, incrementally updatable APT attack evolution prediction method with continuous entity binding, providing verifiable prediction results for future attack behaviors and attack paths without allowing statistical or inference paths that have not passed evidence constraints to enter the candidate set.

Description

Technical Field

[0001] This invention relates to the field of APT attack evolution prediction, specifically to an APT attack evolution prediction method based on entity role migration and incremental causal residual certificates. Background Technology

[0002] Advanced persistent threats (APTs) are typically multi-stage, cross-host, and cross-process. System source graphs can record the causal relationships between processes, files, network connections, and security alerts. Existing methods are mainly used for attack detection, attack chain recovery, or prediction of the next action, but they struggle to simultaneously guarantee that prediction candidates have credible evidence, continuous entity bindings, and complete causal preconditions. Especially in lateral movement, remote access, and process forgery scenarios, continuing to use the capabilities or permissions of the executor before migration can easily lead to false cross-entity associations; unlabeled or untrusted events directly participating in inference can also incorrectly close attack conditions. Summary of the Invention

[0003] Purpose of the invention: To address the problems mentioned in the background art, this invention discloses an APT attack evolution prediction method based on entity role migration and incremental causal residual certificates. It provides a provable, incrementally updatable APT attack evolution prediction method with entity binding continuity, which provides verifiable prediction results for future attack behaviors and attack paths without allowing statistical or inference paths that have not passed evidence constraints to enter the candidate set.

[0004] Technical solution:

[0005] This invention discloses an APT attack evolution prediction method based on entity role migration and incremental causal residual certificates. The method steps are as follows:

[0006] S1 retrieves the system source events prior to the current prediction time, determines the executor and target entity of the activity based on the calling subject and the affected entity, and constructs a causal prefix in chronological order;

[0007] S2 performs evidence gating on the system's tracing events, encoding the events that pass through evidence gating into provable facts with gating records and entity bindings;

[0008] S3 instantiates an attack evolution rule with causal preconditions and role migration mapping based on the provable facts of the active actor, binds the active actor as the entity, and expands the unmet rule preconditions from the future behavior target to generate a causal residual certificate.

[0009] S4 When the role migration fact in the provable fact matches the pending migration step in the causal residual certificate, the corresponding migration relationship is written into the role migration chain, and the causal successor step of the pending migration step is rebound to the migration endpoint.

[0010] S5 extracts the causal executable frontier from the causal residual certificate, and groups the causal residual certificates that are equivalent to future action targets, entity bindings, causal partial orders, and role migration chains into semantic path classes; only the causal residual certificates generated by provable facts through evidence gating and satisfying entity binding and causal precursor constraints are used as prediction candidates, and the conditional probabilities of future target action families, action executors, frontier actions, executor-target endpoints, and semantic path classes are calculated in sequence according to the residual cost to obtain the prediction results of future attack evolution.

[0011] Further, step S1 identifies the process executing the system call as the active executor and the process, file, host, or network endpoint receiving the system call as the target entity; the causal prefix is ​​constructed according to the event time and the directed causal relationship increment, and the bridging relationship that appears after the split time does not merge the task components before the split time in reverse.

[0012] Further, step S2 performs evidence gating on the system tracing events according to a pre-configured local attack-state evidence strategy. The local attack-state evidence strategy includes trusted evidence sources, attack classification or labels, evidence basis, confidence threshold, field integrity, and context labeling. Events that do not meet any of the conditions are marked as context facts and are not used to instantiate attack evolution rules or reduce residual costs. Events that pass the evidence gating are only used to resolve the pending step when they meet the entity binding, time window, and causal precursor conditions of the pending step.

[0013] Furthermore, the provable facts described in step S3 are selected as rule preconditions based on entity type and the most recent support time. The same rule variable is bound to the same entity in different preconditions, and variables of different entity types cannot be unified with each other. When there is no observed entity for the rule variable, an observed entity with the corresponding entity type and temporary tag is generated. The causal residual certificate records the future behavior target, the binding between the activity executor and the target entity, the pending steps with causal partial order, the role migration chain, the gated evidence support, and the residual cost.

[0014] Further, the role migration chain in step S4 includes at least one of the migration edges from source process to target host, target host to target process, and parent process to child process; before the provable facts of the target process arrive, the target host or network endpoint is marked as a temporary migration endpoint, and the preconditions for the capabilities, permissions, or resources after migration remain unmet; when the migration endpoint changes, the causal successor steps of the migration step are rebound, and the preconditions of the causal successor steps are reviewed according to the rebound activity executor, so that the fact of entity binding before migration cannot eliminate the pending steps after migration.

[0015] Furthermore, the residual cost in step S5 includes the basic cost of the pending step, the gap cost of the unclosed environmental conditions, and the evidence time consistency cost; the facts used to resolve the pending step must have gating records and be consistent with the initial executor of the step or the executor after role migration; the evidence time consistency cost is calculated in a bounded manner based on the obsolescence of the valid supporting facts relative to the most recent supporting time of the same step.

[0016] Further, step S5 determines the corresponding causal residual certificates as equivalent certificates and merges them into the same semantic path class. The equivalence relation of the equivalent certificates ignores the rule name, certificate identifier, local variable name, evidence arrival order, and the arrangement order of mutually independent steps, and distinguishes certificates with different future behavior targets, activity executors, necessary causal edges, or role migration endpoints. Each layer of conditional probability is normalized only among causal residual certificates compatible with the same parent term. Equivalent certificates in the same semantic path class do not repeatedly increase the probability quality of future target behavior families.

[0017] Furthermore, the method also includes, in response to a new system tracing event, performing evidence gating on the new system tracing event, dissolving pending steps where causal precursors are satisfied and entity bindings are compatible only with the newly added provable facts, and updating gating evidence support, residual cost, causal executable frontier, semantic path class, and conditional probability; when the activity executor binding changes, updating the relevant causal residual certificate according to the changed binding.

[0018] Furthermore, the causal residual certificate establishes search checkpoints that store open nodes, lower bounds of open node costs, and fact dependencies, and establishes an inverted index from provable facts to pending steps; when a new provable fact arrives, the relevant pending steps are updated through the inverted index and the search continues from the search checkpoint; if the search is not truncated due to boundary constraints, when open nodes are exhausted or the residual cost of the Kth semantic path class is not greater than the lower bound of the costs of the remaining open nodes, the search result is marked as accurate; when the processed event identifier arrives again, the certificate status and prediction result are not changed.

[0019] Beneficial effects:

[0020] Compared with the prior art, the present invention has at least the following effects:

[0021] 1. This invention prevents untrusted events from becoming evidence of an attack through evidence gates; maintains the continuity of executors in cross-host and cross-process scenarios through role migration chains; clarifies the unmet conditions between the current state and future behavior through causal residual certificates; expresses hierarchical prediction from the attack target to the specific path through five-layer conditional probability; supports incremental event stream processing through in-situ resolution and checkpoint reuse, and retains verifiable evidence chains.

[0022] 2. This invention reverse-engineers unmet rule preconditions from the future behavioral target, generating a causal residual certificate that records the future behavioral target, the binding of the executor and the target entity, the pending steps with causal partial order, the role migration chain, gated evidence support, and residual costs. The residual costs consist of the basic costs of the pending steps, the gap costs of unclosed environmental conditions, and the cost of evidence temporal consistency. This quantifies the distance of future attack behaviors into a comparable cost indicator, providing a unified quantitative basis for candidate ranking and conditional probability calculation. The certificate simultaneously stores both the proven and unproven parts, enabling the prediction results to have a complete chain of evidence for interpretation, achieving interpretable attack evolution prediction, and facilitating understanding and review by security auditors.

[0023] 3. When the facts of role migration match the pending migration steps in the certificate, this invention writes the migration relationship into the role migration chain and rebinds the causal successor steps of the pending steps to the migration endpoint. The preconditions of the causal successor steps are then reviewed according to the rebound activity executor, ensuring that the fact of entity binding before migration cannot negate the pending steps after migration. Before the provable facts of the target process arrive, the target host or network endpoint only serves as a temporary migration endpoint, and the preconditions for the capabilities, permissions, or resources after migration remain unmet. Therefore, the permissions and resource facts of the source process will not be incorrectly used to close the pending steps on the target host or target process, effectively avoiding misjudgments of attack paths caused by incorrect cross-entity associations. Attached Figure Description

[0024] Figure 1 This is a flowchart of the method of the present invention;

[0025] Figure 2 This is a flowchart of the causal residual certificate generation and prediction process of the present invention;

[0026] Figure 3 This invention adds flowcharts for event gating, role migration, and incremental certificate updates;

[0027] Figure 4 This is a flowchart of the checkpoint continuation search and re-contextualization process of the present invention.

[0028] Figure 5 The certificate status changes, search workload, and equivalence verification results of this invention at different event prefix stages are shown in the figure. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are all within the protection scope of the present invention.

[0030] like Figure 1 As shown, this invention is divided into an event and fact processing layer, a certificate construction and entity constraint layer, and an incremental update and prediction output layer according to the data flow. The event and fact processing layer receives multi-source system tracing events, performs attack-state evidence gating after direction correction and causal prefix construction: events that pass the gating enter the provable attack fact domain, while those that fail enter the context fact domain. The certificate construction and entity constraint layer feeds the provable attack facts and attack evolution rules into the rule unification and bounded entity binding process, generates causal residual certificates, and updates the target entity binding based on role migration facts. The incremental update and prediction output layer takes newly added provable facts and existing causal residual certificates as input, performs in-situ resolution or checkpoint continuation search, updates the executable frontier and semantic path class, and outputs the future behavior, attack stage or attack path, and corresponding evidence chain after five layers of conditional probability calculation.

[0031] like Figure 2 As shown, the system reads events prior to the current prediction time, corrects the event direction, constructs causal prefixes, and simultaneously reads trusted sources and threshold policies to perform evidence gating. Events that fail to pass the evidence gate are marked as contextual facts and do not participate in certificate resolution; events that pass form provable facts and are recorded in the gating system. The system reads attack evolution rules and determines future behavioral targets, unifies provable facts with rules, and binds them to bounded entities. It then expands backward from the target to pre-set unmet rules, generating a causal residual certificate that stores entity bindings, migration chains, evidence support, and residual costs. Subsequently, it extracts the causal executable frontier, forms semantic path classes according to certificate equivalence relations, performs five-layer conditional probability normalization, and outputs the probability and evidence chain of future attack behaviors, attack stages, or attack paths.

[0032] like Figure 3As shown, the system receives new system tracing events and first performs idempotency judgment based on stable event identifiers. Processed events directly retain the current certificate, checkpoint, and prediction result. Unprocessed events undergo the same evidence gating as the initial stage. Those that fail are written to the context fact domain without changing the current certificate, checkpoint, and prediction; those that pass are written to the provable fact domain and the gating record is saved. If the fact belongs to a role migration fact, the migration relationship is written to the role migration chain, and the causal successor step is rebound to the migration endpoint; otherwise, the current entity binding is maintained. For pending steps where the causal predecessor is satisfied and the entity binding is compatible, the system performs in-situ resolution and updates the evidence support and residual cost; if no compatible pending step is hit, the provable fact is retained without performing local step resolution. Subsequently, based on changes in the binding frontier and checkpoint dependencies, re-contextualization, checkpoint continuation search, or reuse is performed, and the executable frontier, semantic path class, and five-layer probability are updated, outputting the prediction result and evidence chain.

[0033] like Figure 4 As shown, when the fact set or binding frontier changes, the system first determines whether the binding frontier of the activity executor, migration endpoint, or free variables has changed. If it has changed, the system re-contextualizes the affected target set, updating certificate dependencies, candidate sets, and semantic path classes. If it has not changed, the system determines whether the lower bound of the open node cost can still prove the accuracy of the current result. If the lower bound can prove accuracy, the current prediction and checkpoint are reused; if it cannot prove accuracy but a valid checkpoint exists, the search continues from the checkpoint or the relevant targets are rearranged; if the search cannot continue, the target set is re-contextualized. Each branch finally updates the checkpoint and outputs the prediction result and evidence chain.

[0034] The system described in this embodiment includes a causal prefix construction module, an evidence gate module, a causal residual certificate module, a role migration module, an incremental update module, and a conditional probability module. The evidence gate module provides the causal residual certificate module with provable facts containing gating records and entity bindings. The role migration module updates the active actor bindings in the certificate based on the provable migration facts. The incremental update module updates the certificate status using the newly added provable facts. The conditional probability module only uses the updated legitimate causal residual certificates as candidates and outputs the future attack evolution prediction results according to five levels: future target behavior family, active actor, frontier behavior, actor-target endpoint, and semantic path class.

[0035] Evidence Gate and Fact Settlement

[0036] The evidence gate generates a gated record for each original event, consisting of attack classification, evidence source, basis, confidence level, and context labeling. Attack classification can be provided by pre-configured detection rules, verified alarms, or manually confirmed tags; evidence source confirms whether the event originates from an authorized audit sensor; basis stores alarm rules, association rules, or manually confirmed records; and confidence level filters out low-reliability events. The gate fails if any necessary field is missing, the source is unreliable, evidence basis is missing, the confidence level is below a threshold, or the event is marked as a context event. Entity type, entity binding, time window, and causal precursors are checked by subsequent rule unification and pending step resolution processes and are not used as criteria for determining the original event's evidence gate.

[0037] Events that pass gating are converted into verifiable facts with event identifiers, timestamps, active actors, target entities, relationship types, and gating records. Active actors are the processes or account entities that actually initiate system calls, network connections, process creation, or file access; target entities are the accessed files, network streams, hosts, processes, or account entities. Contextual events can be retained for audit visualization and time window positioning, but cannot generate facts about attack capabilities, attack stages, privileges, resource impact, or role migrations, nor can they mitigate the residual cost of any certificates. Therefore, predictive candidates always have a traceable source of fact.

[0038] Rule instantiation and role migration

[0039] The attack evolution rules consist of the target behavior and its preceding atoms. Preceding atoms can represent that the executor possesses a certain capability, holds certain permissions, can access a certain resource, has a communication relationship with the target entity, or has completed the previous attack phase. The system first selects a limited number of candidate entities based on entity type and recent activity time, and then unifies variables of the same type across different preceding atoms into the same landing entity. Process variables must not be unified with host, file, or network flow variables; if there is no corresponding observed fact, only an entity to be observed with a temporary tag is generated, and it is not considered as having met the conditions.

[0040] Role migration includes remote migration from the source process to the target host, local migration from the target host to the target process, and derivative migration from the parent process to the child process. When evidence of remote login, remote execution, or message reception establishes the first migration edge, the target host only serves as a temporary migration endpoint; a second migration edge is established only after the target process evidence within the target host passes through the evidence gate. Subsequent steps must use the migrated target process or child process as the active executor and the migration endpoint as the host or network endpoint constraint, re-examining capabilities, permissions, resources, and timing conditions. This eliminates the possibility of source process permissions being incorrectly inherited by the target process.

[0041] Causal residual certificates and candidate generation

[0042] Causal residual certificates store the currently proven and unproven portions for a given future action goal. Each pending step records the step type, required facts, causal predecessors, initial executor, currently bound executor, target entity, time window, supporting fact set, and cost item. Only pending steps in the certificate whose predecessors are all satisfied, whose executor bindings are consistent, and whose entity types are compatible can enter the causal executable frontier. For certificates with the same future goal, current executor, necessary causal edge, and migration endpoint, the system groups them into the same semantic path class to avoid duplicate counting caused by synonymous rule names, local variable names, or independent step arrangements.

[0043] The residual cost consists of the fixed base cost of the pending steps, environmental gap penalties, and relative evidence time consistency penalties. Environmental gaps characterize critical permissions, critical resources, or communication conditions that are not yet provable; time consistency penalties are anchored to the most recent time when the same step effectively supports the fact, imposing bounded penalties on obviously obsolete capabilities, stages, or resource facts. Candidate ranking uses only certificate residual costs and their deterministic rules, disallowing high-frequency paths that have not passed the evidence gates from entering the candidate set.

[0044] Five-layer probability and prediction output

[0045] After obtaining a valid candidate, the system performs a five-layer conditional normalization based on certificate compatibility. The first layer is the future target behavior family; the second layer is the current activity executor compatible with the target; the third layer is the currently executable frontier behavior; the fourth layer is the endpoints of the executor and the target entity; and the fifth layer is the semantic path class. Each parent layer only assigns probability mass among its compatible children, so adding irrelevant entities, synonymous rules, or duplicate events will not directly increase the probability of the future target behavior.

[0046] The system output includes at least the following: future attack behavior, next executable attack behavior, attack phase, active actor, target entity, semantic path class, joint probability, and certificate interpretation. Certificate interpretation includes gating pass records, satisfied predecessors, unsatisfied predecessors, role migration chains, and residual costs. For candidates with the same objective but different actors or different migration endpoints, the system outputs separate results, enabling auditors to differentiate subsequent risks across different hosts and processes.

[0047] Incremental updates and checkpoint reuse

[0048] In an event stream environment, the system deduplicates events based on their identifiers. When a processed event arrives again, the fact domain, step state, evidence support, residual cost, or probability remains unchanged. For newly arriving events that pass gating, the system uses the fact-step inverted index to locate potentially resolved pending steps and only updates certificates that depend on that fact. If a pending step is resolved, the predecessor satisfaction state of its successor is updated; if a new fact changes the endpoint of a role migration or the binding of a rule variable, incompatible successor bindings are cleared, and the affected certificate is re-contextualized with the new endpoint.

[0049] The system stores open nodes, lower bounds of node costs, fact dependencies, and precise checkpoint labels. If the search is not truncated due to boundary constraints, the result can be marked as precise when open nodes are exhausted, or when the maximum residual cost of the current top K valid semantic path classes is not greater than the lower bound of all open nodes; if the precise condition is not met, the search continues from the checkpoint. Checkpoints and path classes unaffected by new events can be directly reused, reducing redundant reasoning. The above update process only uses new facts that have passed the evidence gate, therefore it will not change the confirmed attack state due to noise events.

[0050] Algorithm 1: Initial Causal Residual Certificate Generation and Prediction

[0051] The input is the event prefix up to the current prediction time. Local evidence strategy A fixed set of attack evolution rules R and parameters It outputs a set of valid certificates, a five-layer predicted distribution, and an evidence audit chain. Specifically, it includes:

[0052] For each event x, subject orientation correction and entity type parsing are performed to obtain the executor, target entity, and timestamp; according to the evidence gate closed by the execution failure according to formula (1), they are written into the attack fact domain respectively. Or context fact domain .

[0053] Read future behavior targets from post-rule atoms, and filter them according to target executor declaration type, most recent activity time, and role migration endpoint, up to a maximum of Each activity executor; for each rule's pre-atom call formula (3), type safety is uniform, and at most, only one type of executor is retained. Each fact is bound together. When a rule variable appears in multiple preceding atoms, it maintains the same substitution; if no real fact exists for the corresponding type, a temporary entity is generated.

[0054] Construct a reverse demand graph from candidate targets to current facts. This will include existing... The requirement is marked as satisfied, the requirement without supporting facts is established as a pending step, and the rule that generated the requirement continues to expand backward until the expansion limit L is reached or all requirements are satisfied.

[0055] Establish role migration chains for remote access, remote execution, and process derivation rules. First, bind and migrate the source process to the target host according to formula (4), and then migrate the target process to the target process after the target process evidence passes the gating; when the migration endpoint changes, all subsequent steps are re-unified according to the new endpoint.

[0056] For each candidate certificate, calculate the residual cost of Equation (6), retaining open nodes and their lower bounds. Truncated searches must not be marked as exact; when a search exhausts or satisfies the lower bound condition of Equation (7), retain the lowest cost frontier. A semantic path class.

[0057] For each certificate calculation specification object, semantic equivalence merging is performed according to Equation (8), and the certificate with the lowest residual cost is retained in each target and semantic class. Five-level conditional normalization is performed according to Equation (9), and joint probability is formed according to Equation (10). Then, the target behavior, the next executable behavior, and the executor-target entity probability are marginalized by Equations (11) to (13).

[0058] Algorithm 2: In-situ certificate resolution and continuation search for newly added events

[0059] Input is the saved running state. and the increase in new events First, an idempotency check is performed using a stable event flag; if the flag already exists, the process returns directly. Otherwise, apply the same evidence gate to the new event according to Equation (1), and only query the "fact-certificate steps" inverted index for the attack facts that pass the gate.

[0060] Steps for index hit The system sequentially checks the behavioral relationships, the executor of the activity, the target entity, the entity type, the host affiliation, the relative time window, and all causal predecessors of equation (5). If all are true, the step status is updated from pending to satisfied, and the newly added event is added. Update the certificate cost according to Equation (6) and add the steps that the predecessor in the causal successor has already satisfied to the executable frontier. If only the behavior type is the same but the entity or predecessor is different, then the step is not eliminated.

[0061] If new facts establish new role migration edges, or change the fact binding set of rule free variables, then re-contextualize the affected target set; if the binding domain remains unchanged and the lower bound of the open node can still prove the current result, then the checkpoint is reused; otherwise, the search continues from the corresponding checkpoint or only the affected targets are rearranged. After the update is completed, Equations (8) to (13) are re-executed, and optionally, the candidate intra-statistical sorting of Equations (14) to (16) is re-executed.

[0062] Core computational relationships

[0063] The evidence was determined as follows:

[0064] (1)

[0065] in These represent attack classification, out-of-band authentication source, evidentiary basis, confidence level, and contextual markers, respectively. The fact domain is:

[0066] (2)

[0067] Regular atoms The unity with fact f satisfies:

[0068] (3)

[0069] The role migration chain satisfies:

[0070] (4)

[0071] The second mapping must be triggered by evidence from the target process on the target host. In-situ resolution of the steps satisfies:

[0072] (5)

[0073] Certificate residual cost satisfies:

[0074] (6)

[0075] In the formula, Steps to be determined The basic cost, This is the set of valid supporting facts for the dynamic prerequisites related to this step. For the facts The last support time; when When not empty, For the most recent supporting time among the supporting facts, when When the value is empty, the corresponding time consistency penalty is set to zero; For evidence on a relative time scale For time consistency weight, For Certificate At any moment An unclosed set of environmental conditions. For environmental conditions The cost of the gap.

[0076] The checkpoint precision conditions are met:

[0077] (7)

[0078] In the formula, Indicate target Is the search truncated due to boundary constraints? Indicates whether the number of open nodes has been exhausted. Indicates the first The residual cost of each semantic path class is not greater than the lower bound of the cost of the remaining open nodes; the result is marked as exact only if the search is not truncated and the open nodes are exhausted or the lower bound condition is met.

[0079] The certificate specification object is defined as:

[0080] (8)

[0081] The five levels of variables are, in order, the target behavior family. Activity executor Cutting-edge behavior Executor-Target Endpoint and semantic path class The probability of layer l is:

[0082] (9)

[0083] In the formula, For the past Minimum residual cost for certificate with layer-value compatibility. When the parent layer has a value, the first The set of compatible sub-items of a layer The temperature parameter is a probability-smoothed parameter.

[0084] The joint probability is:

[0085] (10)

[0086] The probability of the future target behavior is:

[0087] (11)

[0088] The probability of the next executable action is:

[0089] (12)

[0090] The probability of executor-target entity is:

[0091] (13)

[0092] In the formula, This represents the possible values ​​for the future target behavior family. Indicates the next executable action. and These represent the executor of the activity and the target entity, respectively.

[0093] The valid candidate set for optional intra-candidate statistical calibration is:

[0094] (14)

[0095] when When the set is empty, the system does not execute equations (15) and (16), and outputs an empty prediction candidate set and an insufficient evidence flag; subsequent smoothing and candidate sorting are only performed when the set of legal candidates is not empty.

[0096] Smoothing of legitimate candidates:

[0097] (15)

[0098] The final sorted score is:

[0099] (16)

[0100] In the formula, The base candidate probabilities are obtained by marginalizing the five-layer certificate probabilities. For the current certificate status context, For this context to candidates The number of historical transfers For smoothing parameters, To calculate the ranking weights, To prevent undefined positive logarithms, the statistical term only changes the internal order of legitimate candidates, and does not change the certificate candidate set, the five-layer target probability, entity binding, or the chain of evidence.

[0101] Certificate status and exception handling

[0102] Causal residual certificates have at least five states: pending verification, partially satisfied, executable, completed, and invalid. The pending verification state indicates that the target behavior has been determined but there are not yet sufficient preceding facts; the partially satisfied state indicates that one or more preceding facts have been proven by credible evidence; the executable state indicates that all necessary preceding facts are satisfied and the candidate entity binding is compatible; the completed state indicates that the target behavior has been closed by new provable facts; and the invalid state indicates that there is a conflict in entity type, migration endpoint, time window, or evidence gate condition. Invalid certificates are not subject to probability normalization, but their invalidation reasons can be retained for auditing.

[0103] When the same event supports multiple pending steps, the system establishes a shared support index based on fact type, step type, entity binding, and causal partial order, without copying the original event content. A fact is only included in the support set of the corresponding step if its gating record matches the step binding. If two candidate steps have different executors, even if they reference the same file or the same network stream, separate evidentiary relationships are established to prevent shared resources from being misinterpreted as shared executors.

[0104] When event timestamps arrive out of order, the system does not directly rewrite dependent certificates already marked as accurate. For affected inaccurate certificates, the preceding certificates are re-examined according to the event time and causal partial order. For duplicate events, undo events, or field correction events, the system uses the event version number and stable event identifier to maintain idempotent state. If the correction causes the original gating result to become invalid, the contribution of the event to the step support set and residual cost is revoked, and the affected subsequent steps are recalculated.

[0105] System Interfaces and Deployment Methods

[0106] The system input interface receives the event identifier, event time, subject entity, object entity, relationship type, attack classification, evidence source, alarm basis, and confidence level fields; the rule interface receives the target behavior, prerequisite atoms, entity type, role migration edge, and environmental conditions; the output interface returns the candidate behavior, stage, path, probability, certificate identifier, evidence support set, migration chain, and unmet prerequisites. Each interface can be implemented using message queues, file batch processing, or in-memory event streams.

[0107] In offline analysis, the system reads historical traceability files chronologically, periodically saves checkpoints, and outputs the prediction results for each time slice. In real-time analysis, sensors send events to the evidence gating module, the certificate module only updates the affected local states, and the probability module re-normalizes the changed candidates. Processors and memory can be deployed on the same security analysis host, or sensors, certificate calculation, and audit visualization can be deployed on different nodes; events transmitted across nodes must retain stable identifiers and complete gating fields.

[0108] The following are optional candidate sorting implementation methods in this embodiment:

[0109] Without altering certificate generation, evidence gating, entity binding, and permission checks, the system can maintain a historical transition frequency table for the current certificate state context and use the smoothed historical transition probabilities as a ranking aid within the same legitimate candidate. This ranking aid cannot generate new candidates, cannot allow paths that have not passed the evidence gate to enter the candidate set, and cannot cover the legitimacy constraints determined by the certificate residual cost. This approach utilizes historical behavior distribution to improve ranking within the same certificate candidate while maintaining the core protection boundary of this invention as a combination of evidence gates, role migration, and causal residual certificates.

[0110] To demonstrate the effectiveness of this invention, the method of this invention was experimentally verified:

[0111] In an attack flow involving remote access and process forking, the initial process becomes the active executor after passing through the evidence gate. The system establishes a migration edge from the source process to the target host based on the remote access event. Before the target process evidence arrives, only a temporary migration endpoint is generated; therefore, the source process's permissions and resource facts are not used to close the target step. Once the target process evidence passes through the evidence gate, the certificate rebinds the subsequent steps and updates the prediction. Tests are conducted for duplicate events, low-confidence events, and events from untrusted sources. Duplicate events do not increase probability quality, and untrusted events do not enter the provable fact domain. Experiments use small-scale source tracing event replay to verify cross-entity false association constraints, incremental certificate resolution, checkpoint reuse, and the interpretability of prediction results. Specific parameters can be configured according to the deployment environment.

[0112] Parameter settings and experimental verification

[0113] In the experimental environment, the causal prefix can be limited to a fixed time window prior to the current prediction time, and the upper limit of the active actor candidates, the upper limit of the pre-rule fact binding, and the number of outputs for the top K semantic path classes can be set. The set of trusted sources, the set of attack classifications, and the confidence threshold are fixed before the start of the prediction period. For different deployment environments, the time window can be set according to the audit granularity, and the candidate upper limit can be set according to the host memory and real-time requirements; these parameters only affect the search scale and do not change the logical relationship between evidence gates, role migration, and residual certificates.

[0114] The following metrics can be used to verify this invention: Top-1 hit rate and Top-K hit rate of future behavior prediction, used to evaluate the ranking of target behaviors; path coverage rate, used to evaluate whether the correct attack path is retained in the semantic path class; cross-entity false association rate, used to count the proportion of target steps after the source executor’s factual error closure migration; certificate validity rate, used to count the proportion of output candidates with complete gating records, entity bindings and causal predecessors; and average update time per event, used to evaluate incremental processing overhead.

[0115] During the comparison and verification, a comparison scheme can be set up that does not execute the evidence gate, does not enable role migration rebinding, directly counts using the original path, and recalculates the entire process for each new event. Compared with the scheme that does not execute the evidence gate, this invention can prevent low-confidence and untrusted source events from participating in condition closure; compared with the scheme that does not perform rebinding, this invention can avoid directly using the source process permissions as the target process permissions; compared with the original path counting scheme, the semantic path class can suppress the probability inflation caused by the repetition of synonymous paths; compared with the full recalculation scheme, the incremental step state and the fact-step inverted index can reduce redundant calculations. Search checkpoints are used to save open nodes and cost lower bounds, and resume the search when the continuation search conditions are met; the correctness of the checkpoints is verified by the consistency between the incremental results and the full recalculation results.

[0116] In the replay, the system first inputs prefix events including remote access, target host login, and target process creation. After the remote access event passes through the evidence gate, the system generates a pending migration certificate from the source process to the target host, but the relevant steps for the target process remain unfulfilled. When the target process creation and file access events arrive and pass through the gating in sequence, the system establishes a complete migration chain, resolves the corresponding prerequisites, and includes possible credential access, persistence, or data collection behaviors after the lateral movement in the executable frontier. If the subsequent event is only a low-confidence network flow or an alarm from an untrusted source, the event is retained as context and does not change the prediction result.

[0117] In another simulated scenario, an attacker first accesses the target host through a controlled account, and then the target host launches a child process to read sensitive files. The system encodes account authentication, remote connection, target host reception, and child process creation as different relationships, avoiding directly substituting the account entity for the process entity. The child process only becomes the new executor of the activity when the child process creation fact passes the evidence gate and satisfies the parent-child process prerequisite relationship. At this point, the certificate-based subsequent steps for reading sensitive files are bound to the child process, not the original source process.

[0118] In a privilege escalation event, the process initially possesses only ordinary user privileges. Subsequent privilege escalation events are confirmed through both trusted alerts and system calls. Before the privilege escalation event occurs, the system reserves future steps requiring higher privileges as environmental gaps, preventing them from being closed simply because an ordinary user process previously accessed the same resource. After the privilege escalation event occurs, the system only reduces the environmental gap for the certificate corresponding to the same executor of the activity and its migration endpoint. If the source of the privilege escalation event is untrustworthy, the event serves only as context and does not change the certificate cost.

[0119] The experimental results are as follows:

[0120] Each input set consists of an event stream constructed under the same set of attack rules. The control variables only change one entity, type, host, time window, or causal predecessor condition. "False resolution" refers to incorrectly using events that do not satisfy integrity constraints in the certificate closure step. The comparison results of entity binding, role migration, and causal predecessor constraint mechanisms are shown in Table 1.

[0121] Table 1

[0122] Comparison method Number of counterexamples Number of erroneous solutions Results Explanation Match by event type only 1000 1000 Unable to distinguish between the executor, target entity, and endpoint of the role migration. Executor identity plus target entity type 1000 800 It can filter some types of conflicts, but cannot fully verify the host, time window, and causal predecessor. The entity binding, role migration, and causal precursor joint constraint of this invention 1000 0 Events that fail to pass any constraint cannot resolve pending steps or form corresponding valid candidates. This invention provides in-situ resolution of legitimate sensitive read events. 200 0 All 200 legitimate events have been correctly updated with their corresponding steps and subsequent developments.

[0123] For the same semantic certificate, the certificate name, rule variable name, independent step arrival order, and input prefix segmentation method were changed respectively; the target entity, migration endpoint, or migration edge was changed or the sample was deleted. The results of residual certificate normalization, role migration rebinding, and incremental consistency are shown in Table 2.

[0124] Table 2

[0125] Validate Project Sample size Maintain or differentiate quantity Verification conclusions Certificate name and variable name changed 200 200 / 200 Canonical objects do not depend on surface naming The order of arrival of independent steps changes 200 200 / 200 Maintaining consistency between step state, five-layer probability, and evidence chain. Incremental updates of the same prefix segment and a brand new search 450 450 / 450 consistent Each of the nine prefix states was repeated 50 times, and the residual cost was consistent with the prediction result. Change the target, migration endpoint, or delete the migration edge. 600 600 / 600 distinction Inequivalent certificates will not be incorrectly merged.

[0126] The incremental method of this invention maintains the evidence index, step state, role migration chain, and open lower bound; the prefix-by-prefix full recalculation method reinitializes and performs a complete search for each prefix. In the table, p50 represents the median update latency, and p95 represents the 95th percentile of the update latency. This table compares the implementation of this invention with the full recalculation implementation, not with the performance ranking of external paper systems. The comparison results of the processing efficiency of incremental certificate update and full recalculation are shown in Table 3.

[0127] Table 3

[0128] method Update count p50 latency p95 delay Total search count Search node expansion Incremental method of the present invention 400 times 0.4505 ms 1.0605 ms 50 times 1400 times Prefix-by-prefix full recalculation 400 times 1.3603 ms 1.6009 ms 450 times 2850 times This invention is a relative full recalculation - Reduced by 66.88% Reduced by 33.75% Reduced by 88.89% Reduced by 50.88%

[0129] The above results demonstrate that the technical effectiveness of the method of this invention mainly stems from the joint constraints of legitimate evidence boundaries, actor role migration, causal residual certificates, and incremental checkpoints: it avoids error closure in the constructed 1000 cross-entity counterexamples, maintains certificate consistency under semantic equivalence and arrival order perturbations, and reduces redundant searches. Verification of the above mechanisms is not equivalent to claiming leading Top-1 prediction accuracy on all public datasets; in-candidate statistical calibration can only be considered as an optional implementation to improve ranking within legitimate certificate candidates and cannot generate or allow candidates that have not been verified by certificates.

[0130] like Figure 5 As shown, this embodiment processes the nine event prefix stages in chronological order. Figure 5 (a) shows the processing latency changes of the incremental method and the prefix-by-prefix full recalculation method at each event stage. The initial stage includes state initialization overhead, and in subsequent stages, the incremental method performs in-situ updates or local processing based on the scope of the event's impact. Figure 5(b) shows the number of certificate search nodes actually performed by the incremental method at each event stage. Events such as discovery, credentials, and irrelevant noise did not trigger new search nodes, while events involving changes in state such as login path, target process, and data collection triggered corresponding certificate searches. Figure 5 (c) shows the change in the number of causal residual certificates, which remains at 1 in the first 5 event phases, increases to 3 as new role migration facts or causal precursor conditions are met, and then remains unchanged. Figure 5 (d) shows that the incremental processing results of the nine event prefix stages are all certificate equivalent to the full recalculation results of each prefix, with a certificate equivalence retention rate of 100%. Combined with the comparison of the number of searches and node expansions shown in Table 3, it can be seen that this invention can reduce unnecessary repeated searches while maintaining consistency in certificate representation results.

[0131] The above embodiments are only used to illustrate the technical concept and features of the present invention, and are intended to enable those skilled in the art to understand the content of the present invention and implement it accordingly, and should not be used to limit the scope of protection of the present invention. All equivalent substitutions, simple transformations or modifications made in accordance with the spirit and essence of the present invention should be covered within the scope of protection of the present invention.

Claims

1. A method for predicting the evolution of APT attacks based on entity role migration and incremental causal residual certificates, characterized in that, The steps are as follows: S1 retrieves the system source events prior to the current prediction time, determines the executor and target entity of the activity based on the calling subject and the affected entity, and constructs a causal prefix in chronological order; S2 performs evidence gating on the system's tracing events, encoding the events that pass through evidence gating into provable facts with gating records and entity bindings; S3 instantiates an attack evolution rule with causal preconditions and role migration mapping based on the provable facts of the active executor, binds the active executor as the entity, and expands the unmet rule preconditions from the future behavior target in reverse to generate a causal residual certificate. S4 When the role migration fact in the provable fact matches the pending migration step in the causal residual certificate, the corresponding migration relationship is written into the role migration chain, and the causal successor step of the pending migration step is rebound to the migration endpoint. S5 extracts the causal executable frontier from the causal residual certificate, and groups the causal residual certificates that are equivalent to future action targets, entity bindings, causal partial orders, and role migration chains into semantic path classes; only the causal residual certificates generated by provable facts through evidence gating and satisfying entity binding and causal precursor constraints are used as prediction candidates, and the conditional probabilities of future target action families, action executors, frontier actions, executor-target endpoints, and semantic path classes are calculated in sequence according to the residual cost to obtain the prediction results of future attack evolution.

2. The APT attack evolution prediction method based on entity role migration and incremental causal residual certificates according to claim 1, characterized in that, Step S1 identifies the process executing the system call as the active executor and the process, file, host, or network endpoint receiving the system call as the target entity; the causal prefix is ​​constructed according to the event time and the directed causal relationship increment, and the bridging relationship that appears after the split time does not merge the task components before the split time in reverse.

3. The APT attack evolution prediction method based on entity role migration and incremental causal residual certificates according to claim 2, characterized in that, Step S2 performs evidence gating on the system tracing event according to the pre-configured local attack state evidence strategy. The local attack state evidence strategy includes trusted evidence sources, attack classification or labels, evidence basis, confidence threshold, field integrity and context labeling. Events that do not meet any of the conditions are marked as contextual facts and are not used to instantiate attack evolution rules or reduce residual costs; Events gated by evidence are used to resolve a pending step only if the entity binding, time window, and causal precursor conditions of the pending step are met.

4. The APT attack evolution prediction method based on entity role migration and incremental causal residual certificates according to claim 1, characterized in that, The provable facts described in step S3 are selected as rule preconditions based on entity type and the most recent support time. The same rule variable is bound to the same entity in different preconditions, and variables of different entity types cannot be unified with each other. When there is no observed entity for the rule variable, an unobserved entity with the corresponding entity type and temporary tag is generated. The causal residual certificate records the future behavior target, the binding between the activity executor and the target entity, the pending steps with causal partial order, the role migration chain, the gated evidence support, and the residual cost.

5. The APT attack evolution prediction method based on entity role migration and incremental causal residual certificates according to claim 1, characterized in that, The role migration chain in step S4 includes at least one of the migration edges from source process to target host, target host to target process, and parent process to child process; before the provable facts of the target process arrive, the target host or network endpoint is marked as a temporary migration endpoint, and the preconditions for the capabilities, permissions, or resources after migration remain unmet; when the migration endpoint changes, the causal successor steps of the migration step are rebound, and the preconditions of the causal successor steps are reviewed according to the rebound activity executor, so that the fact of entity binding before migration cannot eliminate the pending steps after migration.

6. The APT attack evolution prediction method based on entity role migration and incremental causal residual certificates according to claim 1, characterized in that, The residual cost in step S5 includes the basic cost of the pending step, the gap cost of the unclosed environmental conditions, and the evidence time consistency cost; the facts used to resolve the pending step must have gating records and be consistent with the initial executor of the step or the executor after role migration; the evidence time consistency cost is calculated in a bounded manner based on the obsolescence of the valid supporting facts relative to the most recent supporting time of the same step.

7. The APT attack evolution prediction method based on entity role migration and incremental causal residual certificates according to claim 1, characterized in that, Step S5 determines the corresponding causal residual certificates as equivalent certificates and merges them into the same semantic path class. The equivalence relation of the equivalent certificates ignores the rule name, certificate identifier, local variable name, evidence arrival order, and the arrangement order of mutually independent steps, and distinguishes certificates with different future behavior targets, activity executors, necessary causal edges, or role migration endpoints. Each layer of conditional probability is normalized only among causal residual certificates compatible with the same parent term. Equivalent certificates in the same semantic path class do not repeatedly increase the probability quality of future target behavior families.

8. The APT attack evolution prediction method based on entity role migration and incremental causal residual certificates according to claim 1, characterized in that, The method further includes, in response to a new system tracing event, performing evidence gating on the new system tracing event, resolving pending steps where the causal precursor is satisfied and the entity binding is compatible only with the newly added provable facts, and updating the gating evidence support, residual cost, causal executable frontier, semantic path class, and conditional probability; when the activity executor binding changes, updating the relevant causal residual certificate according to the changed binding.

9. The APT attack evolution prediction method based on entity role migration and incremental causal residual certificates according to claim 1 or 8, characterized in that, The causal residual certificate establishes search checkpoints that store open nodes, lower bounds of open node costs, and fact dependencies, and builds an inverted index from provable facts to pending steps. When a new provable fact arrives, the relevant pending steps are updated through the inverted index, and the search continues from the search checkpoint. If the search is not truncated due to boundary constraints, when open nodes are exhausted or the residual cost of the Kth semantic path class is not greater than the lower bound of the costs of the remaining open nodes, the search result is marked as accurate. When a processed event identifier arrives again, the certificate status and prediction result are not changed.

Images