Attack source tracing method and apparatus, device, and medium

Abstract

The present application provides an attack source tracing method and apparatus, a device, and a medium. The method comprises: acquiring data related to an attack event, using the data related to the attack event to update a pre-constructed Bayesian attack graph, and determining an attack path with the maximum reachable probability in the updated Bayesian attack graph as a target attack path, wherein the pre-constructed Bayesian attack graph is a Bayesian attack graph constructed on the basis of data related to a historical attack event; and performing feature extraction from the data related to the attack event and the updated Bayesian attack graph, matching the extracted features with pre-formed feature clusters, and determining an attacker corresponding to the successfully matched feature cluster as a target attacker, wherein the pre-formed feature clusters are feature clusters which are formed by clustering the data related to the historical attack event and features extracted from the pre-constructed Bayesian attack graph and represent different attackers. According to the present application, the Bayesian attack graph and the feature clustering are utilized, effectively realizing rapid source tracing of the attack path and the attacker.

Description

Attack source tracing method, device, equipment, and medium Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an attack tracing method, apparatus, device, and medium. Background Art

[0002] Attack tracing technology refers to the use of various means to restore the attack path, track the initiators of network attacks, locate the source of attacks, combine network forensics and threat intelligence, and promptly formulate and implement targeted defense measures, striving to eliminate hidden dangers before damage is caused, thereby improving the initiative and effectiveness of network defense. It has very important practical significance in the field of network security.

[0003] Traditional attack tracing methods require users to acquire large amounts of network security-related data in real time and analyze this data to generate a real-time attack graph corresponding to the current network attack. This graph is then used to determine the attack path. However, network security data is complex and voluminous. If the entire network data must be re-acquired and analyzed each time a network system is attacked, and a new attack graph is generated, this consumes significant computing resources and time, resulting in inefficient tracing. This in turn prevents users from responding to network attacks in a timely manner, compromising network security.

[0004] At the same time, traditional attack tracing methods lack the ability to accurately identify attackers based on their attack characteristics. As a result, in actual network environments, the determination of the attacker's identity is often restricted and timely and effective countermeasures cannot be provided.

[0005] Summary of the Invention

[0006] To overcome the problems existing in the related art, this specification provides an attack tracing method, device, equipment and medium.

[0007] According to a first aspect of an embodiment of this specification, a method for tracing an attack source is provided, the method comprising:

[0008] Acquire data related to the attack event, and use the data related to the attack event to update a pre-constructed Bayesian attack graph, and determine that the attack path with the highest reachable probability in the updated Bayesian attack graph is a target attack path, wherein the pre-constructed Bayesian attack graph is a Bayesian attack graph constructed based on data related to historical attack events, and the reachable probability is the probability of successful attack behavior between all nodes in the attack path;

[0009] Feature extraction is performed from the data related to the attack event and the updated Bayesian attack graph, and the extracted features are matched with pre-formed feature clusters, and the attacker corresponding to the successfully matched feature cluster is determined to be the target attacker, wherein the pre-formed feature cluster is a number of feature clusters representing different attackers formed by clustering the features extracted from the data related to the historical attack event and the pre-constructed Bayesian attack graph.

[0010] Optionally, the data related to historical attack events include historical attack events and corresponding historical attack alarm data;

[0011] Constructing the pre-constructed Bayesian attack graph based on data related to historical attack events includes:

[0012] Using the attack initiation node and the attack target node in the historical attack event as nodes of the pre-constructed Bayesian attack graph;

[0013] Determine the attack relationship between nodes based on the attack behaviors in the historical attack events, establish directed edges of the pre-constructed Bayesian attack graph, and use the attack behaviors in the historical attack events as the attack behaviors corresponding to the directed edges of the pre-constructed Bayesian attack graph;

[0014] The historical attack alarm data is used to calculate the attack behavior probability of each attack behavior in the pre-constructed Bayesian attack graph, where the attack behavior probability is the probability of the attack behavior successfully occurring.

[0015] Optionally, clustering the data related to the historical attack events and the features extracted from the pre-constructed Bayesian attack graph to form the pre-formed feature clusters includes:

[0016] Based on a preset density clustering algorithm, determine the core objects among the features extracted from the data related to the historical attack events and the pre-built Bayesian attack graph, wherein the core objects are features within a preset domain that contain at least other features with a preset density;

[0017] Starting from the core object, constructing a density reachable set, wherein the density reachable set is formed based on the density reachable relationship of the core object;

[0018] All features included in the density-reachable set are divided into feature clusters representing the same attacker, forming a number of feature clusters representing different attackers.

[0019] Optionally, the attack event-related data includes the attack event and corresponding attack alarm data;

[0020] Using data related to the attack event, update the pre-built Bayesian attack graph, including:

[0021] Determining the number of attack behaviors in the attack event;

[0022] If the number of the attack behaviors exceeds one, the pre-constructed Bayesian attack graph is updated by using the attack events after deleting the attack behaviors whose attack behavior complexity levels are inconsistent with the corresponding attacker capability levels, and the attack alarm data.

[0023] Optionally, determining an attack behavior complexity level of the attack behavior based on the CVSS evaluation standard;

[0024] Determine the attacker's capability level based on preset attack technology indicators, target selection capability indicators, and penetration capability indicators.

[0025] Optionally, matching the extracted features with pre-formed feature clusters and determining the attacker corresponding to the successfully matched feature cluster as the target attacker includes:

[0026] Based on a preset metric, the similarity between the extracted features and the core objects of the pre-formed feature cluster is calculated;

[0027] The attacker corresponding to the feature cluster whose similarity is within a preset range is determined as the target attacker.

[0028] According to a second aspect of an embodiment of this specification, an attack source tracing device is provided, including:

[0029] a target attack path determination module, configured to obtain data related to attack events, and using the data related to the attack events to update a pre-constructed Bayesian attack graph, and determine that the attack path with the highest reachable probability in the updated Bayesian attack graph is the target attack path, wherein the pre-constructed Bayesian attack graph is a Bayesian attack graph constructed based on data related to historical attack events, and the reachable probability is the probability of successful attack behavior between all nodes in the attack path;

[0030] The target attacker determination module extracts features from the data related to the attack event and the updated Bayesian attack graph, matches the extracted features with pre-formed feature clusters, and determines that the attacker corresponding to the successfully matched feature cluster is the target attacker, wherein the pre-formed feature cluster is a number of feature clusters representing different attackers formed by clustering the features extracted from the data related to the historical attack event and the pre-constructed Bayesian attack graph.

[0031] According to a third aspect of the embodiments of this specification, a computer device is provided, including: a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the above-mentioned attack tracing method.

[0032] According to a fourth aspect of the embodiments of this specification, a computer-readable storage medium is provided, storing a computer program, which implements the steps of the above-mentioned attack tracing method when executed by a processor.

[0033] According to a fifth aspect of the embodiments of this specification, a computer program product is provided, including a computer program, which implements the steps of the above-mentioned attack tracing method when executed by a processor.

[0034] The technical solutions provided by the embodiments of this specification may have the following beneficial effects:

[0035] In the embodiments of this specification, a Bayesian attack graph is pre-constructed using data related to historical attack events, and then the Bayesian attack graph is updated based on data related to current attack events. The attack path is inferred through the attack relationship and probability of each node in the attack graph, and rapid tracing of the attack path is achieved. At the same time, by clustering the features of historical attack events, feature clusters representing different attackers are formed, so that when a new attack is launched, it is only necessary to compare the features of the new attack with the known attack feature clusters to achieve rapid tracing of the attacker of the attacked node.

[0036] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the specification and, together with the description, serve to explain the principles of the specification.

[0038] FIG1 is a flowchart of an attack source tracing method according to an exemplary embodiment of this specification;

[0039] FIG2 is a flowchart of steps for constructing a pre-built Bayesian attack graph in an attack tracing method according to an exemplary embodiment of this specification;

[0040] FIG3 is a flowchart of steps for forming a pre-formed feature cluster in an attack source tracing method according to an exemplary embodiment of this specification;

[0041] FIG4 is a schematic diagram of a density-reachable set in an attack source tracing method according to an exemplary embodiment of this specification;

[0042] FIG5 is a flowchart of the steps of updating a pre-built Bayesian attack graph in an attack tracing method according to an exemplary embodiment of this specification;

[0043] FIG6 is an example of a specific Bayesian attack graph in an attack source tracing method according to an exemplary embodiment of this specification;

[0044] FIG7 is a flowchart of steps for determining a target attacker in an attack tracing method according to an exemplary embodiment of this specification;

[0045] FIG8 is a schematic diagram of the structure of a computer device where an attack source tracing device is located according to an exemplary embodiment of this specification;

[0046] FIG9 is a block diagram of an attack source tracing device according to an exemplary embodiment of the present specification. DETAILED DESCRIPTION

[0047] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with this specification. Rather, they are merely examples of apparatus and methods consistent with certain aspects of this specification, as detailed in the appended claims.

[0048] The terms used in this specification are for the purpose of describing specific embodiments only and are not intended to limit this specification. As used in this specification and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0049] It should be understood that although the terms first, second, third, etc. may be used in this specification to describe various information, such information should not be limited to these terms. These terms are merely used to distinguish information of the same type from one another. For example, first information may also be referred to as second information, and similarly, second information may also be referred to as first information without departing from the scope of this specification. Depending on the context, the term "if" as used herein may be interpreted as "when," "when," or "in response to determining."

[0050] Traditional attack tracing methods require users to acquire large amounts of network security-related data in real time, such as complete network logs, traffic data, and threat intelligence. These data must then be analyzed to generate a real-time attack graph corresponding to the current network attack. This analysis then identifies the attack path. However, network security data is complex and voluminous. If the entire network data must be re-acquired and analyzed each time a network system is attacked, and a new attack graph generated, this consumes significant computing resources and time, resulting in inefficient tracing. This in turn prevents users from promptly responding to network attacks, compromising network security.

[0051] Taking this issue into consideration, the inventors of this application conducted in-depth research and found that the Bayesian network is a probabilistic model that can represent the relationship between various variables in a probabilistic manner. If the Bayesian network is combined with the attack graph, the attack relationship between network nodes can be used to calculate and infer the reachability probability of each network node and the probability of the attack path, thereby achieving rapid tracing of the attack path of the attacked node.

[0052] At the same time, the inventors of this application also found that, under normal circumstances, each attacker or attack organization has its own specific attack characteristics when launching a network attack, such as specific attack behaviors, attack modes, attack tools or attack path sequences, etc. Therefore, by analyzing the attack characteristics, the identity of the corresponding attacker can be accurately identified. In this application, the historical known attacks on the network system can be clustered to form attack feature clusters that characterize different attackers. When a new attack is launched, the attack characteristics of the new attack can be compared with the known attack feature clusters, thereby achieving rapid tracing of the attacker of the attacked node.

[0053] Next, the embodiments of this specification are described in detail.

[0054] As shown in FIG1 , FIG1 is a flowchart of an attack source tracing method according to an exemplary embodiment of this specification, including the following steps:

[0055] Step S101: Acquire data related to the attack event, and use the data related to the attack event to update a pre-constructed Bayesian attack graph, and determine that the attack path with the highest reachable probability in the updated Bayesian attack graph is the target attack path, wherein the pre-constructed Bayesian attack graph is a Bayesian attack graph constructed based on data related to historical attack events, and the reachable probability is the probability of successful attack behavior between all nodes in the attack path.

[0056] The data related to historical attack events can be multi-dimensional data related to network attacks suffered by the network system at all previous historical moments, such as attack events, attack alert data, network vulnerability information, network threat intelligence, network traffic data, etc. Pre-constructing a Bayesian attack graph can include multiple steps to initialize the Bayesian attack graph, including determining the nodes of the Bayesian attack graph, directed edges between nodes, attack behaviors between nodes, and attack behavior probabilities.

[0057] Step S102: extract features from the data related to the attack event and the updated Bayesian attack graph, match the extracted features with pre-formed feature clusters, and determine that the attacker corresponding to the successfully matched feature cluster is the target attacker, wherein the pre-formed feature cluster is a number of feature clusters representing different attackers formed by clustering the features extracted from the data related to the historical attack event and the pre-constructed Bayesian attack graph.

[0058] Specifically, the features extracted from the data related to the historical attack events and the pre-built Bayesian attack graph can be all historical attack features that can be used to characterize and distinguish the identity of the attacker, for example, the attacker's login method, data access mode, permissions and other attack behavior features, or attack mode features such as DDoS and phishing, or attack tool features such as malware and SQL injection tools, or, based on the attack path, the path and sequence features of the attack behavior, or the source IP address, target IP address, transmission protocol, port number and other features in the network traffic data, or the hash value, API call sequence, code structure and other features of the file in the behavior and code analysis of the malware, or the operation steps and access path and other features of the attacker on the target system.

[0059] Clustering the data related to the historical attack events and the features extracted from the pre-built Bayesian attack graph is actually classifying them according to the similarity between the historical attack features. Therefore, the historical attack features classified into the same feature cluster are highly similar, so the attackers they represent can be considered to be the same. Then, when a new attack occurs, it is only necessary to match the new attack features with the known feature clusters to identify the new attacker. Among them, there are many clustering methods, such as K-means clustering, hierarchical clustering, density clustering, etc., which are not limited in this application.

[0060] In addition, attack event-related data refers to multi-dimensional data related to network attacks that the network system has newly suffered at the current moment, such as new attack events, new attack alarm data, new network vulnerability information, new network threat intelligence, new network traffic data, etc.

[0061] Using data related to attack events to update the pre-built Bayesian attack graph means supplementing the newly occurred attack data with the Bayesian attack graph previously constructed using data related to historical attack events to form a Bayesian attack graph that covers the current newly occurring attacks.

[0062] The reachability probability of an attack path refers to the probability of successful attack between all nodes in the attack path. It can be calculated by multiplying the reachability probability of nodes on the attack path and the probability of attack between them. The formula is as follows:

[0063] P=∏P(S j |Par(S j ))=∏P(A K )×P(S1)

[0064] Among them, S1 is the starting node of the Bayesian attack graph, P1(S1) can be assigned the initial reachability probability P1(S1) = p according to expert experience, Sj is the jth node in the Bayesian attack graph, Par(S j ) is the parent node of Sj, A K Nodes are attack behaviors between nodes in the Bayesian attack graph.

[0065] The path with the highest reachability probability means that all attack behaviors in the attack path have the highest probability of success. Therefore, the attack path is most likely to be the target attack path of the current new attack.

[0066] The features extracted from the data related to the attack event and the updated Bayesian attack graph may correspond to any one or more of the above-mentioned historical attack features, and are used to match the feature clusters formed by the historical attack features to identify the target attacker of the new attack.

[0067] Furthermore, referring to FIG. 2 , the process of constructing the pre-constructed Bayesian attack graph in step S101 of an exemplary embodiment of this specification is described in detail.

[0068] Regarding step S101, in one embodiment, the data related to historical attack events include historical attack events and corresponding historical attack alarm data;

[0069] Constructing the pre-constructed Bayesian attack graph based on data related to historical attack events includes:

[0070] Step S201: Using the attack initiating node and the attack target node in the historical attack event as nodes of the pre-constructed Bayesian attack graph;

[0071] Step S202: Determine the attack relationship between nodes based on the attack behaviors in the historical attack events, establish directed edges of the pre-constructed Bayesian attack graph, and use the attack behaviors in the historical attack events as the attack behaviors corresponding to the directed edges of the pre-constructed Bayesian attack graph;

[0072] Step S203: Calculate the attack behavior probability of each attack behavior in the pre-built Bayesian attack graph using the historical attack alarm data, where the attack behavior probability is the probability of the attack behavior successfully occurring.

[0073] In this embodiment, historical attack alarm data refers to the alarm data generated by the system when a historical attack occurs, which may include the detection rate of the intrusion detection system when an attack occurs, the false alarm rate of the intrusion detection system when an attack occurs, the missed alarm rate of the intrusion detection system when an attack occurs, the probability of the system receiving an alarm from the intrusion detection system when an attack occurs, the correct alarm rate of the intrusion detection system when an attack occurs, etc.

[0074] Through historical attack alarm data, the attack behavior probability of each attack behavior in the Bayesian attack graph can be accurately calculated, that is, the probability of an attack behavior occurring when an attack alarm is received.

[0075] The following example uses attack alarm data, including detection rate, false alarm rate, and missed alarm rate, to calculate the attack behavior probability:

[0076] P(Attack|Alarm)=P(Alarm|Attack)*P(Attack) / P(Alarm)

[0077] Assume that the false alarm rate is P1, the detection rate is P2, and the missed alarm rate is P3;

[0078] P(Attack|Alarm) represents the probability of an attack occurring when an attack alarm is received, i.e., the attack probability. P(Alarm|Attack) represents the probability of the intrusion detection system issuing an alarm when an attack occurs, i.e., the detection rate, set to P2. P(Attack) represents the prior probability of an attack occurring. P(Alarm) represents the probability of receiving an intrusion detection system alarm, which can be considered in two cases:

[0079] The probability of a false alarm from the intrusion detection system is P1*(1-P3), which is the complement of the false alarm rate multiplied by the false alarm rate;

[0080] The probability that the intrusion detection system detects an attack and issues an alarm is P2*(1-P3), which is the complement of the detection rate multiplied by the false negative rate.

[0081] Therefore, P(Alarm)=P1*(1-P3)+P2*(1-P3).

[0082] Substituting the above information into the attack behavior probability calculation formula, we can get:

[0083] P(Attack|Alarm)=P2P(Attack) / [P1(1-P3)+P2*(1-P3)]

[0084] Among them, P(Attack) is the prior probability of attack behavior, which can be determined through historical data, experience, and opinions of domain experts.

[0085] Furthermore, referring to FIG. 3 , the process of forming the pre-formed feature cluster in step S102 of an exemplary embodiment of this specification is described in detail.

[0086] In one embodiment, step S102 includes:

[0087] Step S301: Based on a preset density clustering algorithm, determine the core objects among the features extracted from the data related to the historical attack events and the pre-built Bayesian attack graph, wherein the core objects are features within a preset domain that contain at least other features with a preset density;

[0088] Step S302: Starting from the core object, construct a density reachable set, where the density reachable set is formed based on the density reachable relationship of the core object;

[0089] Step S303: Divide all features included in the density reachable set into feature clusters representing the same attacker, forming several feature clusters representing different attackers.

[0090] In this embodiment, a density clustering algorithm is selected to cluster historical attack features. High-density areas can be identified by calculating the distance and density between historical attack features to form feature clusters. High-density areas represent areas with high similarity between historical attack features, that is, the historical attack features in this area are likely to represent the same attacker.

[0091] For the density clustering algorithm, the historical attack features can be quantized first, and the appropriate distance measurement method and number of clusters can be selected. The distance measurement method is used to measure the similarity between historical attack features, and can include Euclidean distance, Manhattan distance, Chebyshev distance, cosine distance and other different distance measurement methods. This application does not impose any restrictions here. The number of clusters can be the number of attack feature clusters manually specified according to needs or automatically determined by the algorithm.

[0092] Next, the core object in the historical attack feature is determined, that is, the historical attack feature that contains at least other historical attack features of a preset density within a preset domain.

[0093] For example, for the preset domain ε and the preset density MinPts, given a data set D = {x1, x2, ..., xn}, dist represents the preset distance metric, and the domain of xi is defined as:

[0094] N ∈ (x i )={x j ∈D|dist(x i ,x j )<∈}

[0095] If the domain of xi includes at least MinPts other data, then xi is the core object of the dataset.

[0096] Afterwards, starting from the core object, a density reachable set is constructed, and the density reachable set is formed based on the density reachable relationship of the core object. Density reachable is used to describe the reachable relationship between feature points. For example, feature point A is in the neighborhood of feature point B, and feature point B is also in the neighborhood of feature point C, then feature point A and feature point C are density reachable. The role of density reachable is to help discover the connection relationship between feature points, thereby forming a density reachable set. By constructing a density reachable set, similar feature points can be more completely grouped into the same cluster and high-density areas can be identified. Figure 4 is a schematic diagram of feature points xi and xk in the density reachable set.

[0097] Furthermore, referring to FIG. 5 , the process of updating the pre-built Bayesian attack graph in step S101 of an exemplary embodiment of this specification is described in detail.

[0098] Regarding step S101, in one embodiment, the attack-related data includes attack events and corresponding new attack alarm data;

[0099] Using the attack-related data, update the pre-built Bayesian attack graph, including:

[0100] Step S401: Determine the number of attack behaviors in the attack event;

[0101] Step S402: If the number of attack behaviors exceeds one, the pre-built Bayesian attack graph is updated by using the attack events after deleting the attack behaviors whose attack behavior complexity levels are inconsistent with the corresponding attacker capability levels, and the attack alarm data.

[0102] The attack behavior complexity level represents the vulnerability complexity of network nodes, while the attacker capability level represents the attacker's capability level and attack methods.

[0103] In real-world network attacks, an attacker's actual attack behavior is limited by their ability level and attack methods. Only when the attacker's ability level matches the complexity level of their attack behavior can they successfully launch a corresponding attack against a network node. If the attack data shows an inconsistency between the attacker's ability level and the complexity level of their attack behavior, it is likely that the data acquired by the system is incorrect. Therefore, when updating the Bayesian attack graph based on new attack data, it is necessary to promptly delete any attack behaviors that may be erroneous data—that is, those with inconsistent attacker ability levels and complexity levels—in order to more accurately simulate network attacks using the Bayesian attack graph.

[0104] Specifically, node vulnerabilities can be scored based on the CVSS evaluation standard to determine the complexity of the attack behavior and divide it into two levels: high and low;

[0105] The attacker's capability level of the attack behavior can be determined based on preset attack technical indicators, target selection capability indicators, and penetration capability indicators.

[0106] Among them, attack technology can represent the complexity, sophistication and effectiveness of the attack technology and tools mastered by the attacker, target selection ability can represent the ability and accuracy of the attacker to select targets, whether the attacker understands the system vulnerabilities and penetration ability can represent whether the attacker can successfully bypass the defense measures of the target system. The quantitative analysis of the three indicators can be set as shown in the following table. The score of the attacker's ability is calculated by multiplying the three indicators. Finally, the attacker's ability level is artificially divided into high for those exceeding the preset threshold and low for those below the preset threshold, or the calculated attacker's ability is divided into two parts, one part is set to high level and the other part is set to low level. This application does not limit the specific complexity of the attack behavior and the way of dividing the attacker's ability level.

[0107] Table 1 Attacker capability level indicators

[0108] 6 , the following briefly describes the steps of updating the attack graph and determining the target attack path in the above steps through a specific Bayesian attack graph example.

[0109] In Figure 6, A represents an attack behavior and S represents a node. Assuming that the initial reachability probability P(S1) is assigned to 0.95 based on expert experience, the attack behavior probabilities of A1 to A8 are 0.9, 0.8, 0.7, 0.6, 0.5, 0.4, 0.3, and 0.2, respectively.

[0110] Take S2→S5 and S4→S5 as two new attack events. Both of these new attack events have two new attack behaviors. Determine the attacker's attack capability level and attack behavior level for each new attack behavior. Delete the new attack behaviors with inconsistent attacker capability level and attack behavior level, assuming they are A3 and A8 in the figure.

[0111] Finally, starting from S5, traverse the parent node upward to generate a set of possible attack paths L for node S5. The possible cases of L are as follows: L = {S5}, L = {S2S5, S3S5, S4S5}, L = {S1S2S5, S2S3S5, S1S4S5}, L = {S1S2S5, S1S2S3S5, S1S4S5}. Use the reachable probability formula of the attack path to multiply the reachable probabilities of all nodes on the path to obtain the reachable probability of each attack path, and determine the attack path with the largest reachable probability as the target attack path of S5.

[0112] In this example, the attack path S1S2S5 has the highest reachability probability, specifically P(S1)*P(A1)*P(A5)=0.4275, so the target attack path is S1->A1->S2->A5->S5.

[0113] Furthermore, referring to FIG. 7 , the process of determining the target attacker in step S102 of an exemplary embodiment of this specification is described in detail.

[0114] Regarding step S102, in one embodiment, matching the extracted features with pre-formed feature clusters and determining the attacker corresponding to the successfully matched feature cluster as the target attacker includes:

[0115] Step S501: Calculate the similarity between the extracted features and the core objects of the pre-formed feature cluster based on a preset metric method;

[0116] Step S502: Determine the attacker corresponding to the feature cluster whose similarity is within a preset range as the target attacker.

[0117] In this embodiment, the preset measurement method can be all measurement methods for measuring similarity, such as a distance measurement method or a correlation coefficient measurement method. The distance measurement method can include Euclidean distance, Manhattan distance, Chebyshev distance, cosine distance, etc., and the correlation coefficient measurement method can include cosine similarity, Pearson correlation coefficient, mutual information, etc. This application does not limit the choice of measurement method.

[0118] Corresponding to the embodiments of the aforementioned method, this specification also provides embodiments of an attack tracing device and a terminal to which it is applied.

[0119] The embodiment of the attack tracing device in this specification can be applied to a computer device, such as a server or terminal device. The embodiment of the device can be implemented by software, hardware, or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of the electronic device in which it is located reading the corresponding computer program instructions in the non-volatile memory into the memory and running them. From the hardware level, as shown in Figure 8, it is a hardware structure diagram of the computer device in which the attack tracing device in the embodiment of this specification is located. In addition to the processor 101, memory 102, network interface 103, and non-volatile memory 104 shown in Figure 8, the server or electronic device in which the device is located in the embodiment can also include other hardware according to the actual function of the computer device, which will not be described in detail.

[0120] As shown in FIG9 , FIG9 is a block diagram of an attack source tracing device according to an exemplary embodiment of this specification, the device including:

[0121] The target attack path determination module 201 is configured to obtain data related to attack events, and use the data related to the attack events to update a pre-constructed Bayesian attack graph, and determine that the attack path with the highest reachable probability in the updated Bayesian attack graph is the target attack path, wherein the pre-constructed Bayesian attack graph is a Bayesian attack graph constructed based on data related to historical attack events, and the reachable probability is the probability of successful attack behavior between all nodes in the attack path;

[0122] The target attacker determination module 202 is used to extract features from the data related to the attack event and the updated Bayesian attack graph, and match the extracted features with pre-formed feature clusters, and determine that the attacker corresponding to the successfully matched feature cluster is the target attacker, wherein the pre-formed feature cluster is a number of feature clusters representing different attackers formed by clustering the features extracted from the data related to the historical attack event and the pre-constructed Bayesian attack graph.

[0123] Accordingly, this specification also provides a computer device, including: a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the above-mentioned attack tracing method.

[0124] Accordingly, this specification also provides a computer-readable storage medium storing a computer program, which implements the steps of the above-mentioned attack tracing method when executed by a processor.

[0125] Accordingly, this specification also provides a computer program product, including a computer program, which implements the steps of the above-mentioned attack tracing method when executed by a processor.

[0126] The implementation process of the functions and effects of each module in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0127] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to the partial description of the method embodiments. The device embodiments described above are merely illustrative, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this specification. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0128] The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0129] Other embodiments of the present invention will readily occur to those skilled in the art upon consideration of the present invention and practice of the invention claimed herein. This specification is intended to cover any variations, uses, or adaptations of the present invention that follow the general principles of this specification and include common knowledge or customary techniques in the art not claimed herein. The description and examples are to be considered as exemplary only, with the true scope and spirit of the present invention being indicated by the following claims.

[0130] It should be understood that the present description is not limited to the exact structure that has been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present description is limited only by the appended claims.

[0131] The above description is only a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of this specification should be included in the scope of protection of this specification.

Claims

1. A method for tracing the source of an attack, characterized in that: The method comprises: Acquire data related to the attack event, and use the data related to the attack event to update a pre-constructed Bayesian attack graph, and determine that the attack path with the highest reachable probability in the updated Bayesian attack graph is a target attack path, wherein the pre-constructed Bayesian attack graph is a Bayesian attack graph constructed based on data related to historical attack events, and the reachable probability is the probability of successful attack behavior between all nodes in the attack path; Feature extraction is performed from the data related to the attack event and the updated Bayesian attack graph, and the extracted features are matched with pre-formed feature clusters, and the attacker corresponding to the successfully matched feature cluster is determined to be the target attacker, wherein the pre-formed feature cluster is a number of feature clusters representing different attackers formed by clustering the features extracted from the data related to the historical attack event and the pre-constructed Bayesian attack graph.

2. The method according to claim 1, characterized in that The data related to the historical attack events include historical attack events and corresponding historical attack alarm data; Constructing the pre-constructed Bayesian attack graph based on data related to historical attack events includes: Using the attack initiation node and the attack target node in the historical attack event as nodes of the pre-constructed Bayesian attack graph; Determine the attack relationship between nodes based on the attack behaviors in the historical attack events, establish directed edges of the pre-constructed Bayesian attack graph, and use the attack behaviors in the historical attack events as the attack behaviors corresponding to the directed edges of the pre-constructed Bayesian attack graph; The historical attack alarm data is used to calculate the attack behavior probability of each attack behavior in the pre-constructed Bayesian attack graph, where the attack behavior probability is the probability of the attack behavior successfully occurring.

3. The method according to claim 1, characterized in that Clustering the data related to the historical attack events and the features extracted from the pre-constructed Bayesian attack graph to form the pre-formed feature clusters, including: Based on a preset density clustering algorithm, determine the core objects among the features extracted from the data related to the historical attack events and the pre-built Bayesian attack graph, wherein the core objects are features within a preset domain that contain at least other features with a preset density; Starting from the core object, constructing a density reachable set, wherein the density reachable set is formed based on the density reachable relationship of the core object; All features included in the density-reachable set are divided into feature clusters representing the same attacker, forming a number of feature clusters representing different attackers.

4. The method according to claim 1, wherein The attack event-related data includes the attack event and the corresponding attack alarm data; Using data related to the attack event, update the pre-built Bayesian attack graph, including: Determining the number of attack behaviors in the attack event; If the number of the attack behaviors exceeds one, the pre-constructed Bayesian attack graph is updated by using the attack events after deleting the attack behaviors whose attack behavior complexity levels are inconsistent with the corresponding attacker capability levels, and the attack alarm data.

5. The method according to claim 4, characterized in that Determine the attack complexity level of the attack behavior based on the CVSS evaluation standard; Determine the attacker's capability level based on preset attack technology indicators, target selection capability indicators, and penetration capability indicators.

6. The method according to claim 3, characterized in that Match the extracted features with pre-formed feature clusters and determine the attacker corresponding to the successfully matched feature cluster as the target attacker, including: Based on a preset metric, the similarity between the extracted features and the core objects of the pre-formed feature cluster is calculated; The attacker corresponding to the feature cluster whose similarity is within a preset range is determined as the target attacker.

7. An attack tracing device, characterized in that: The device comprises: a target attack path determination module, configured to obtain data related to attack events, and using the data related to the attack events to update a pre-constructed Bayesian attack graph, and determine that the attack path with the highest reachable probability in the updated Bayesian attack graph is the target attack path, wherein the pre-constructed Bayesian attack graph is a Bayesian attack graph constructed based on data related to historical attack events, and the reachable probability is the probability of successful attack behavior between all nodes in the attack path; The target attacker determination module extracts features from the data related to the attack event and the updated Bayesian attack graph, matches the extracted features with pre-formed feature clusters, and determines that the attacker corresponding to the successfully matched feature cluster is the target attacker, wherein the pre-formed feature cluster is a number of feature clusters representing different attackers formed by clustering the features extracted from the data related to the historical attack event and the pre-constructed Bayesian attack graph.

8. A computer device comprising a memory, a processor, and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images