Attack detection and traceback method and apparatus, and electronic device and storage medium

Abstract

An attack detection and traceback method and apparatus, and an electronic device and a storage medium. The method comprises: acquiring entities in a target network environment and interaction event information between the entities, and constructing a network event graph from the entities and the interaction event information; on the basis of a preset attack feature recognition model, determining graph embedding vectors of each piece of interaction event information in the network event graph as feature information, and on the basis of the feature information, determining an attack event in the network event graph; and determining the degree of dependency between the attack event and remaining interaction event information in the network event graph, and on the basis of the degree of dependency, searching for corresponding interaction event information as traceback information for the attack event.

Description

Attack detection and tracing method, device, electronic equipment and storage medium

[0001] The present application claims priority to the Chinese patent application No. 2024107077455, filed on June 3, 2024, with the Chinese Patent Office, the whole content of which is incorporated herein by reference. TECHNICAL FIELD

[0002] The present application relates to the technical field of network security, for example, to an attack detection and tracing method, device, electronic equipment and storage medium. BACKGROUND

[0003] In recent years, with the continuous evolution of multi-step complex attacks, attack means are increasingly complex and diverse, often using unknown vulnerabilities, supply chain penetration and social engineering and other advanced technologies, with high concealment, targeting and persistence. This type of attack poses a serious threat to computer networks, and traditional detection methods are difficult to accurately capture and timely block related threats.

[0004] In related technologies, a graph neural network method can be used to detect attack events, which learns the deep representation of network event graph structure and combines an anomaly detection algorithm to realize attack detection. However, the opaque nature of the graph neural network model is in conflict with the traceability and explainability of attack detection in production environments. The graph neural network is trained by a large amount of data, and there are millions of neurons, the high complexity of the internal structure makes it difficult for people to understand the decision of the neural network, resulting in that the detection result is difficult to trust, and the attack event cannot be traced. Therefore, how to trace the attack event in the network has become a problem to be solved at present. SUMMARY

[0005] The present application provides an attack detection and tracing method, device, electronic equipment and storage medium to solve the problem of inaccurate attack event monitoring results and inability to correctly trace in related technologies.

[0006] According to an aspect of the present application, an attack detection and tracing method is provided, wherein the method comprises:

[0007] Obtaining entities in a target network environment and interaction event information between the entities, and constructing a network event graph based on the entities and the interaction event information;

[0008] Determining a graph embedding vector of each of the interaction event information in the network event graph as feature information based on a preset attack feature recognition model, and determining an attack event in the network event graph according to the feature information;

[0009] determine a dependency degree of the attack event and remaining interaction event information in the network event graph, and find corresponding interaction event information as the attack event's trace information according to the dependency degree.

[0010] According to another aspect of the present application, an attack detection and trace device is provided, wherein the device comprises:

[0011] an event graph construction module configured to acquire entities in a target network environment and interaction event information between the entities, and construct a network event graph based on the entities and the interaction event information;

[0012] an attack event determination module configured to determine graph embedding vectors of each of the interaction event information in the network event graph as feature information based on a preset attack feature recognition model, and determine an attack event in the network event graph according to the feature information;

[0013] an information trace module configured to determine a dependency degree of the attack event and remaining interaction event information in the network event graph, and find corresponding interaction event information as the attack event's trace information according to the dependency degree.

[0014] According to another aspect of the present application, an electronic device is provided, which comprises:

[0015] at least one processor; and

[0016] a memory connected to the at least one processor in communication; wherein,

[0017] the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the attack detection and trace method according to any one of the embodiments of the present application.

[0018] According to another aspect of the present application, a computer readable storage medium is provided, which stores computer instructions for enabling a processor to implement the attack detection and trace method according to any one of the embodiments of the present application when executed.

[0019] The technical scheme of the embodiment of the application is characterized in that: the entity in the target network environment and the interaction event information between the entities are acquired, a network event graph is constructed by using the entity and the interaction event information, a graph embedding vector of each interaction event information in the network event graph is determined as feature information based on a preset attack feature recognition model, an attack event in the network event graph is determined according to the feature information, the automatic determination of the attack event is realized, and the attack event recognition capability is improved; the dependence degree of the attack event and the remaining interaction event information in the network event graph is determined, the corresponding interaction event information is found as the attack event traceability information according to the dependence degree, the accuracy of the traceability information is improved, and the potential attack behavior in the target network environment can be found in time, the defense and response can be performed in advance, and the safety of the target network environment is ensured. BRIEF DESCRIPTION OF DRAWINGS

[0020] FIG. 1 is a flowchart of an attack detection and traceability method according to some implementations of the application;

[0021] FIG. 2 is a flowchart of a preset attack feature recognition model training method according to some implementations of the application;

[0022] FIG. 3 is a flowchart of another attack detection and traceability method according to some implementations of the application;

[0023] FIG. 4 is a training structure block diagram of an attack detection and traceability system according to some implementations of the application;

[0024] FIG. 5 is a schematic diagram of an attack sample determination method according to some implementations of the application;

[0025] FIG. 6 is an attack traceability example diagram according to some implementations of the application;

[0026] FIG. 7 is a structural schematic diagram of an attack detection and traceability apparatus according to some implementations of the application;

[0027] FIG. 8 is a structural schematic diagram of an electronic device implementing an attack detection and traceability method according to some implementations of the application. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the application scheme, the technical scheme in the embodiments of the application will be described clearly and completely below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only a part of the embodiments of the application, rather than all the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor should be within the scope of protection of the application.

[0029] It is to be understood that the terminology "first", "second" and the like used in the specification and the claims of the application as well as the preceding description of the drawings is merely used to distinguish similar objects and does not necessarily imply a specific order or chronology. It is to be understood that the data thus used can be interchanged, where appropriate, so that the embodiments of the application described herein can be carried out in a different order than the one described here. Furthermore, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, processes, methods, systems, products or devices that comprise a list of steps or elements as non-limiting examples can include other steps or elements not expressly listed or inherent to such processes, methods, products or devices.

[0030] Fig. 1 is a flowchart of a method of attack detection and tracing according to some implementations of the application, which can be applied to the case of detecting and tracing attack events in a network environment, which can be performed by an attack detection and tracing apparatus, which can be implemented in the form of hardware and / or software, and which can be configured in an electronic device. As shown in Fig. 1, the method comprises:

[0031] S110, obtaining entity information and interaction event information between entities in a target network environment, and constructing a network event graph based on the entity information and the interaction event information.

[0032] The target network environment can be understood as a network environment that needs to be monitored for network security. For example, the target network environment can include, but is not limited to, an intranet environment, an extranet environment, and a local area network environment, etc. The entity can include all devices and users participating in network activities, such as computer devices, servers, network devices, and data centers, etc. The interaction event information between entities can be understood as the data interaction behavior information between any two entities. For example, the interaction event information can include event occurrence direction and event type, such as data transmission, access request and response, service invocation, fault and repair, and traffic control, etc. The network event graph is a graphical representation for visually displaying and analyzing events and relationships between entities in the target network environment.

[0033] In one possible implementation, log information in the target network environment can be extracted, and entity information and interaction event information between entities in the log information can be extracted. Alternatively, network traffic, connection state, and other information in the target network environment can be monitored in real time, and entity information and interaction event information between entities in the target network environment can be captured. Then, the entities are taken as nodes, and the interaction event information is taken as edges connecting the two entities, and a network event graph is generated.

[0034] S120, determine the graph embedding vector of each interaction event information in the network event graph as feature information based on the preset attack feature recognition model, and determine the attack event in the network event graph according to the feature information.

[0035] The preset attack feature recognition model can be understood as a model pre-trained for attack events in a device network event graph. In a possible implementation, the preset attack feature recognition model can be generated based on an encoder-decoder architecture. In actual operation, the network event graph can be input into the preset attack feature recognition model to automatically determine the attack event in the network event graph. The attack event can be understood as a specific behavior or activity initiated by a malicious actor in a target network environment, aiming to cause harm, damage, theft, or interference to the network system, device, data, or user, and other adverse effects. For example, the attack event can include, but is not limited to, tampering with data, distributed denial of service attack (DDoS), and virus attack. The feature information can refer to the attributes and functions that distinguish the network event graph from other network event graphs. For example, the feature information can include the graph embedding vector of the interaction event information, the embedding vector of the entity, and the like.

[0036] In a possible implementation, the network event graph can be input into the preset attack feature recognition model, and the network event graph can be graph embedded by the preset attack feature recognition model to obtain the graph embedding vector of each interaction event information as feature information. When the probability that the feature information belongs to abnormal information is determined, if the probability exceeds a preset threshold, the interaction event information is considered as an attack event. In actual operation, the node matrix composed of entities in the network event graph and the graph adjacency matrix composed of interaction event information can be input into the encoder to generate the node embedding vector of each node according to the node matrix and the graph adjacency matrix. Then, the node embedding vectors associated with the interaction event information are aggregated to obtain the graph embedding vector of the interaction event information, which is used as the feature information. Alternatively, each row in the graph adjacency matrix can be directly regarded as a graph embedding vector as the feature information. In a possible implementation, when it is determined that there is an attack event in the network environment, an attack alarm can be generated to prompt the user to handle the attack event in a timely manner.

[0037] S130, determine the dependence degree of the attack event and the remaining interaction event information in the network event graph, and find the corresponding interaction event information as the attack event trace information according to the dependence degree.

[0038] The dependency degree can be understood as the association degree of the attack event and the remaining interaction event information in the network event graph, and the dependency degree can be an association probability. The traceability information refers to information for finding an attack source, and the traceability information can include one or more pieces of interaction event information.

[0039] In a possible implementation, the dependency degree of the attack event and the remaining interaction event information in the network event graph can be determined in turn. For example, the dependency degrees of the remaining interaction event information and the attack event can be determined in turn, the interaction event information can be combined, the dependency degree of the combined information and the attack event can be determined, and at least one piece of interaction event information corresponding to the maximum dependency degree is used as the traceability information of the attack event. In a possible implementation, the dependency degree of the attack event and the remaining interaction event information can be determined by using a preset traceability model. Alternatively, the dependency degree of the attack event and the remaining interaction event information can be determined by using an artificial confirmation method. In a possible implementation, the interaction event information can be used to generate a Markov blanket, so as to facilitate display of the traceability information.

[0040] According to the embodiments of the present application, the entities and the interaction event information between the entities in the target network environment are acquired, the network event graph is constructed based on the entities and the interaction event information, the graph embedding vector of each piece of interaction event information in the network event graph is determined as the feature information based on a preset attack feature recognition model, the attack event in the network event graph is determined based on the feature information, the automatic determination of the attack event is implemented, and the attack event recognition capability is improved. The dependency degree of the attack event and the remaining interaction event information in the network event graph is determined, the corresponding interaction event information is found as the traceability information of the attack event based on the dependency degree, the interaction event information associated with the attack event is facilitated to be found, the traceability of the attack event is implemented, the accuracy of the traceability information is improved, and the potential attack behavior in the target network environment can be found in time, so that the defense and response can be performed in advance, and the safety of the target network environment is ensured.

[0041] FIG. 2 is a flowchart of a preset attack feature recognition model training method according to some implementations of the present application. The present embodiment is a technical improvement of the above-mentioned embodiment, and a method for training a preset attack feature recognition model is provided, as shown in FIG. 2. The training of the preset attack feature recognition model includes the following steps.

[0042] In S210, open source network threat intelligence is acquired, a natural language processing technology is used to extract first entities and interaction event information between the first entities in the open source network threat intelligence, each first entity is used as a first node, and the interaction event information between the first entities is used as an edge to construct an attack graph.

[0043] The open-source network threat intelligence refers to information related to network threats collected, analyzed and sorted from publicly available resources. For example, the open-source network threat intelligence can be obtained from social media platforms, research institution reports and news websites. The first entity can be understood as a network entity included in the open-source network threat intelligence, such as a device, a server and a user, etc. The interaction event information between the first entities refers to information interaction events between the first entities.

[0044] In a possible implementation, the open-source network threat intelligence can be extracted from a public platform, and the first entities included in the open-source network threat intelligence and the interaction event information between the first entities can be extracted. Each first entity is taken as a first node, and the interaction event information between the first entities is taken as an edge to construct an attack graph.

[0045] In a possible implementation, the open-source network threat intelligence can be extracted from a public platform, and the first entities included in the open-source network threat intelligence and the interaction event information between the first entities can be extracted. Each first entity is taken as a first node, and the interaction event information between the first entities is taken as an edge to construct an attack graph.

[0046] The traffic log can be understood as an event record generated by entities such as network devices, systems and service programs in the network environment when they are in operation. The second entity can be understood as a network entity included in the traffic log, such as a device, a server and a user, etc.

[0047] In a possible implementation, a storage area in the network environment can be accessed to obtain the traffic log in the network environment, and the interaction event information included in the traffic log can be extracted. Each interaction event information corresponds to a second entity, the second entity is taken as a second node, and the interaction event information between the second entities is taken as an edge to construct an event graph.

[0048] S230, matching each first node with each second node to obtain a matching node, determining a target attack path between the matching nodes, and generating an initial attack graph according to the target attack path.

[0049] The matching node can be understood as a second node matched with the first node in the event graph, or a first node matched with the second node in the attack graph. In actual operation, the second node with the same or similar attribute information as the first node can be taken as the matching node. For example, the first node and the second node with the same name can be taken as the matching nodes. Alternatively, when the names are different, the first node and the second node with the same type can be taken as the matching nodes. Alternatively, the first node and the second node with the same feature information can be taken as the matching nodes.

[0050] In a possible implementation, each first node can be sequentially matched with a second node in the event graph, the matched node is taken as a matched node, the matched nodes in the event graph are connected as a target attack path, and the target attack paths are sequentially connected to generate an initial attack graph.

[0051] In a possible implementation, the matched nodes are obtained according to the matching of each first node with each second node, the target attack paths between the matched nodes are determined, and the initial attack graph is generated according to the target attack paths, including:

[0052] The attribute information of the first node is determined, and the associated points in the second nodes of the event graph are matched as matched nodes according to the attribute information, where the attribute information at least includes a first node name, a type, and characteristic information;

[0053] Any matched node is taken as a starting node, and the remaining matched nodes are found by traversing the event graph, and the attack paths between the matched nodes are determined;

[0054] The number of nodes in each attack path is determined, and the attack paths with a node number less than or equal to a preset number are taken as target attack paths between the matched nodes;

[0055] The matched nodes and the target attack paths are connected to generate an initial attack graph.

[0056] The attribute information of the first node can be understood as information indicating the attribute of the first node, and the attribute information can at least include a first node name, a type, and characteristic information. The influence score can be understood as the possibility that an attacker can control an attack path, that is, the possibility that an attack path can be generated in an attack process.

[0057] In a possible implementation, attribute information of the first node, such as a first node name, a type, and feature information, can be determined, the attribute information is matched with the second nodes of the event graph, and a matching associated point is taken as a matching node. In actual operation, attribute information of each second node can be determined, a similarity degree of attribute information of the first node and attribute information of the second node is determined, and it is determined that the first node is associated with the second node when the similarity degree is greater than or equal to a preset similarity threshold. Alternatively, the first node and the second node with the same name can be taken as the matching nodes. Alternatively, the first node and the second node with the same type can be taken as the matching nodes when the names are different. Alternatively, the first node and the second node with the same feature information can be taken as the matching nodes. Any matching node is taken as a starting node, and the remaining matching nodes are found by traversing the event graph, and an attack path between each matching node is determined. In a possible implementation, a depth-first strategy can be used to search the attack path between each matching node, and the attack path between each matching node can include at least one. The number of nodes in each attack path is determined, and an attack path with a node number less than or equal to a preset number is taken as a target attack path between the matching nodes. Alternatively, the attack path with the least number of nodes between each two matching nodes can be determined as the target attack path. The matching nodes and the target attack path are connected to generate an initial attack graph.

[0058] In a possible implementation, the similarity score between the attack graph and the initial attack graph is determined, a target attack graph in the initial attack graph is determined according to the similarity score, and the target attack graph is data-augmented as an attack sample.

[0059] The similarity score is used to indicate a similarity degree of the attack graph and the initial attack graph, and the higher the similarity score is, the higher the similarity degree of the attack graph and the initial attack graph can be considered.

[0060] In actual operation, the similarity score between the attack graph and the initial attack graph can be calculated, and the initial attack graph with a similarity score greater than or equal to a preset similarity score is taken as the target attack graph. The target attack graph is data-augmented as the attack sample, so as to increase the number of attack samples. In a possible implementation, the target attack graph can be data-augmented by using a node disturbance, an edge disturbance, attribute masking, and random subgraph sampling.

[0061] In a possible implementation, the similarity score between the attack graph and the initial attack graph is determined, a target attack graph in the initial attack graph is determined according to the similarity score, and the target attack graph is data-augmented as an attack sample, including:

[0062] Determine the connection paths of each matched node in the attack graph, determine the number of nodes in each connection path, determine the reciprocal of the number of nodes in the connection path corresponding to the two matched nodes, and take the maximum value of the reciprocal as the influence score of the two matched nodes.

[0063] Determine the total sum of the number of all connection paths, and add up the influence scores to obtain an influence score sum;

[0064] Take the product of the influence score sum and the total sum as the similarity score.

[0065] When the similarity score is greater than or equal to a preset similarity score, determine the initial attack graph as a target attack graph, and perform data augmentation on the target attack graph as an attack sample.

[0066] In a possible implementation, each matched node can be connected in the attack graph, and the connection paths between the matched nodes can be determined. For each two matched nodes, the number of connection paths can be one or more. The number of nodes in each connection path can be determined, the reciprocal of the number of nodes in the connection path corresponding to the two matched nodes can be determined, and the maximum value of the reciprocal can be taken as the influence score of the two matched nodes. The total sum of the number of connection paths can be determined, the influence score corresponding to each edge can be added to obtain an influence score sum, and the influence score sum and the total sum can be multiplied to obtain a product, which is taken as a similarity score. When it is determined that the similarity score is greater than or equal to a preset similarity score, the initial attack graph is determined as a target attack graph. Data augmentation can be performed on the target attack graph as an attack sample. The data augmentation includes at least one of the following: node perturbation, edge perturbation, attribute masking, and random subgraph sampling. For example, part of the nodes and associated edges in the random target attack graph can be discarded, or additional associated nodes and associated edges can be randomly selected in the random target attack graph and added to the target attack graph; or part of the edge elements in the target attack graph can be randomly discarded, or the associated edges corresponding to the events can be randomly selected and added to the target attack graph; or part or all of the attribute information of part of the nodes in the target attack graph can be randomly masked; or the associated nodes and associated edges in the target attack graph can be combined to realize random subgraph sampling through random walk, so that the attack sample generated by the data augmentation is closer to the real network attack behavior.

[0067] S250, acquire entity and interaction event information between entities in a network environment at at least one time, and construct a positive sample event graph according to the entity and the interaction event information.

[0068] In a possible implementation, the traffic log of the network environment at at least one time can be acquired, the entity and the interaction event information between entities in the traffic log can be extracted, the entity can be taken as a node, and the interaction event information can be taken as an edge to construct a positive sample event graph.

[0069] S260, extract the real network attack sample in the configuration file, input the positive sample event graph, the real network attack sample and the attack sample into the preset attack feature recognition model, and train the preset attack feature recognition model.

[0070] The real network attack sample can be understood as an existing attack sample in a network environment, and can be pre-stored.

[0071] In a possible implementation, the positive sample event graph, the real network attack sample and the attack sample can be input into the preset attack feature recognition model to train the preset attack feature recognition model.

[0072] In a possible implementation, the positive sample event graph, the real network attack sample and the attack sample are input into the preset attack feature recognition model to train the preset attack feature recognition model, including S261-S267.

[0073] S261, the positive sample event graph and the attack sample are used as pre-training samples, the pre-training samples are input into the preset attack feature recognition model, local features of the pre-training samples are extracted by the preset attack feature recognition model respectively, and the local features are aggregated as global features.

[0074] The preset attack feature recognition model is based on an encoder-decoder architecture.

[0075] In a possible implementation, the positive sample event graph and the attack sample can be used as pre-training samples to pre-train the preset attack feature recognition model. The local features of the pre-training samples can include edge embedding vectors in the pre-training samples, and the local features can be aggregated as global features. In a possible implementation, the positive sample event graph can be represented as (X, A), where X is a node feature matrix of the positive sample event graph, and A is an adjacency matrix of the positive sample event graph. The attack sample is represented as Wherein is a node feature matrix of the attack sample, is an adjacency matrix of the attack sample. The encoder uses message passing, aggregation, memory update and embedding generation to obtain the local features H = ε (X, A) = (h1, h2,..., hn) of the positive sample event graph, where ε represents the encoder, and h1-hn represents the embedding representation of the nodes in the positive sample event graph. n ), where ε represents the encoder, and h1-hn represents the embedding representation of the nodes in the positive sample event graph. n The local features of the attack sample Wherein ε represents the encoder, represents the embedding representation of the nodes in the attack sample. The readout function is used again to aggregate all obtained local features as global features. The readout function averages the local features of all nodes of the positive sample event graph as Let R(H) be the global feature of the positive sample event graph, denoted by s; the local feature of all nodes of the attack sample is averaged as Let denote the global feature of the attack sample.

[0076] S262, determine the loss value of the preset attack feature recognition model based on the preset pre-training network loss function.

[0077] The pre-training network loss function at least includes binary cross entropy.

[0078] In a possible implementation, the loss value of the preset attack feature recognition model can be determined by the pre-set pre-training network loss function. For example, the pre-training network loss function can include Where F represents a discriminator function for scoring local features and global features. For example, when the pre-training sample is a positive sample event graph, the value of F(h i ,s) is large, and when the pre-training sample is an attack sample, the value of F(h i ,s) is small; conversely, when the pre-training sample is a positive sample event graph, the value of F(h is small, and when the pre-training sample is an attack sample,N and M represent the number of nodes in the positive sample event graph and the attack sample, respectively. (X,A) E denotes the mathematical expectation of the positive sample event graph; denotes the mathematical expectation of the attack sample.

[0079] S263, iterate the preset attack feature recognition model through the loss value until the iteration number is reached, and adjust the parameters of the preset attack feature recognition model in the iteration process to obtain the pre-training completed preset attack feature recognition model.

[0080] In actual operation, the preset attack feature recognition model can be iterated according to the loss value until the iteration number is reached, and the learning rate and step size of the preset attack feature recognition model are adjusted in the iteration process, and the pre-training completed preset attack feature recognition model.

[0081] S264, generate a real network attack sample graph by taking entities in a real network attack sample as nodes and taking event information between entities as edges, label attack events in the real network attack sample graph with attack labels, and input the real network attack sample graph and the attack labels into the pre-training completed preset attack feature recognition model.

[0082] In a possible implementation, entities in the real network attack sample and event information between the entities can be determined, the entities in the real network attack sample are taken as nodes, and the event information between the entities is taken as edges, a real network attack sample graph is generated, and an attack event in the real network attack sample graph is marked with an attack label to indicate the attack event in the real network attack sample. The real network attack sample graph and the attack label are input into the pre-trained preset attack feature recognition model for training.

[0083] S265, determining, by the full connection layer of the initial model, a probability that each edge belongs to an attack event, and determining that event information corresponding to the edge is an attack event when the determined probability is greater than or equal to a preset threshold.

[0084] In a possible implementation, an embedding mapping of each edge in the real network attack sample graph can be determined, and the embedding mapping of the edge is mapped to a probability that the edge belongs to an attack event through a full connection layer. When the determined probability is greater than or equal to a preset threshold, it is determined that the event information corresponding to the edge is an attack event.

[0085] S266, determining that the judgment mark of the attack event is 1 when it is determined that the attack event exists the attack label, and determining that the judgment mark of the attack event is 0 when it is determined that the attack event does not exist the attack label.

[0086] S267, determining a product of a natural logarithm of each probability and a corresponding judgment mark as a first parameter when it is determined that the judgment mark is 1, and determining a natural logarithm of a probability that does not belong to an attack event as a second parameter when it is determined that the judgment mark is 0. The sum of the first parameter and the second parameter corresponding to the real network attack sample graph is taken as a loss function value of the pre-trained preset attack feature recognition model, and the parameters of the preset attack feature recognition model are optimized according to the loss function value.

[0087] In a possible implementation, when it is determined that the judgment mark is 1, it can be considered that the model judges the real situation, and the product of the natural logarithm of the probability and the corresponding judgment mark is determined as the first parameter. When it is determined that the judgment mark is 0, it can be considered that the model does not judge the real situation, and the natural logarithm of the probability that does not belong to the attack event is determined as the second parameter. The sum of the first parameter and the second parameter corresponding to the real network attack sample is taken as a loss function value of the pre-trained preset attack feature recognition model, and the parameters of the preset attack feature recognition model are optimized according to the loss function value. That is, each edge in the real network attack sample graph is judged, and the sum of the first parameter or the second parameter determined for each edge is taken as a loss function value of the pre-trained preset attack feature recognition model. In a possible implementation, the determination manner of the loss function value is Loss = å x [y xlog(p x )+(1-y x log(1-p) x )], where y x p represents a flag indicating whether edge x is an attack event. x This represents the predicted probability that x belongs to the attack event.

[0088] In this embodiment, a preset attack feature recognition model is pre-trained using positive sample event graphs and attack samples. Then, the pre-trained preset attack feature recognition model is re-trained using real network attack samples to improve the accuracy of the preset attack feature recognition model. This allows for more accurate judgment of attack events based on the preset attack feature recognition model, thereby improving the accuracy of attack detection.

[0089] Figure 3 is a flowchart of another attack detection and tracing method provided according to some implementations of this application. This embodiment is a further optimization and extension of the above-described embodiments and can be combined with various optional technical solutions in the above embodiments. As shown in Figure 3, the method includes:

[0090] S310. Obtain information on entities and their interactions in the target network environment, and construct a network event graph from the entity and interaction information.

[0091] S320: Based on a preset attack feature recognition model, extract the node matrix composed of entities in the network event graph and the graph adjacency matrix composed of interaction event information.

[0092] Among them, the node matrix is ​​a matrix used to represent the nodes in the graph; the graph adjacency matrix is ​​a matrix used to represent the connection relationship between nodes in the graph.

[0093] In one possible implementation, a node matrix and a graph adjacency matrix can be pre-constructed according to the network event graph. The node matrix composed of entities in the network event graph and the graph adjacency matrix composed of interaction event information can be extracted by a pre-set attack feature recognition model.

[0094] S330. Determine the node embedding vector of each node according to the node matrix and the graph adjacency matrix.

[0095] In this context, node embedding vectors can be understood as mapping each node in the graph to a vector in a low-dimensional vector space. The purpose of node embedding is to transform nodes in a network event graph into vectors.

[0096] In one possible implementation, after determining the node matrix and the graph adjacency matrix, the node embedding vector of each node can be determined based on a preset attack feature identification model. For example, a graph embedding algorithm can be used to determine the node embedding vector of each node.

[0097] S340, splice the node embedding vectors associated with the interaction event information to obtain a graph embedding vector of the interaction event information, and take the graph embedding vector as the feature information.

[0098] In a possible implementation, each node associated with the interaction event information can be determined, a node embedding vector of the node can be determined, the node embedding vectors associated with the interaction event information can be spliced as a graph embedding vector of the interaction event information, and the graph embedding vector can be taken as the feature information.

[0099] S350, confirm the probability that each feature information belongs to the attack event, and take the interaction event information corresponding to the feature information with a probability greater than or equal to a preset probability threshold as the attack event.

[0100] In a possible implementation, each feature information can be mapped to a probability of an attack event through a full connection layer of a preset attack feature recognition model. When it is determined that the probability is greater than or equal to a preset probability threshold, the interaction event information corresponding to the feature information is determined as the attack event.

[0101] S360, input the attack event and the network event graph into a preset traceability model; wherein the preset traceability model is constituted based on a Bayesian network.

[0102] S370, determine a correlation probability of the attack event and at least one remaining interaction event information in the network event graph as a dependence degree through the preset traceability model, and take at least one remaining interaction event information with the highest dependence degree as traceability information of the attack event.

[0103] In a possible implementation, the dependence degree of the attack event and the remaining interaction event information in the network event graph can be determined through the preset traceability model. For example, the dependence degree of the remaining interaction event information and the attack event can be determined in turn, the interaction event information can be combined, the dependence degree of the combination and the attack event can be determined, and at least one interaction event information corresponding to the maximum value of the dependence degree can be taken as the traceability information of the attack event. In a possible implementation, the quantitative dependence relationship between the attack event and other interaction event information can be expressed in the form of conditional probability, and attack traceability can be achieved.

[0104] The embodiment of the application obtains entities in a target network environment and interaction event information between the entities, constructs a network event graph from the entities and the interaction event information, extracts a node matrix composed of entities and a graph adjacency matrix composed of interaction event information in the network event graph based on a preset attack feature recognition model, determines node embedding vectors of each node according to the node matrix and the graph adjacency matrix, splices node embedding vectors associated with the interaction event information to obtain a graph embedding vector of the interaction event information, takes the graph embedding vector as feature information, confirms a probability that each feature information belongs to an attack event, and takes interaction event information corresponding to feature information with a probability greater than or equal to a preset probability threshold as an attack event, thereby accurately confirming the attack event. The attack event and the network event graph are input into a preset traceability model, the correlation probability of the attack event and at least one remaining interaction event information in the network event graph is determined as a dependence degree by polling the preset traceability model, and at least one remaining interaction event information with the highest dependence degree is taken as traceability information of the attack event, thereby determining the traceability information and improving the accuracy and convenience of determining the traceability information.

[0105] In a possible implementation, the training of the preset traceability model comprises:

[0106] The attack event output by the preset attack feature recognition model and the network event graph input into the preset attack feature recognition model are extracted, the attack event and the network event graph are taken as samples for data augmentation, and a training sample is obtained;

[0107] The Markov blanket of the attack event in the training sample is determined according to a growth shrink algorithm, and data in the Markov blanket is taken as sample data;

[0108] The sample quantity of the sample data and the log-likelihood value of the sample data and model parameters are determined, the product of the natural logarithm of the sample quantity and the dimension of the model parameters is determined, and the difference between the product and the log-likelihood value is taken as the Bayesian information criterion score of the sample data and the model parameters in the preset attack feature recognition model;

[0109] The model parameters are adjusted based on the Bayesian information criterion score until the Bayesian information criterion score reaches a target score, and the training of the preset traceability model is completed.

[0110] The Markov blanket is an algorithm for determining the dependency relationship between training samples. In actual operation, the Grow-Shrink (GS) algorithm or the like can be used for determination. The log-likelihood value can be used to measure the likelihood of sample data under model parameters, and can be used to compare the fitting degree of different model parameter settings to sample data. Adjusting the parameters to maximize the log-likelihood value can obtain the optimal preset attack trace model fitting. The Bayesian Information Criterion (BIC) score is a standard for measuring the goodness of the preset attack trace model fitting. When the Bayesian Information Criterion score reaches the target score, it can be considered that the training of the preset attack trace model is completed.

[0111] In a possible implementation, the attack events output by the preset attack feature recognition model and the network event graph input by the preset attack feature recognition model can be extracted, that is, the input and output of the preset attack feature recognition model are obtained, the input and output of the feature recognition model are taken as samples, data augmentation is performed, and training samples are obtained. In actual operation, the data augmentation method can include but is not limited to node perturbation, edge perturbation, attribute masking, and random subgraph sampling. The Markov blanket of the attack event in the training sample is determined according to the Grow-Shrink algorithm, and the data in the Markov blanket is taken as sample data. That is, important variables can be screened out and unimportant variables can be filtered. The sample quantity of the sample data and the log-likelihood value of the sample data and the model parameters are determined, and the product of the natural logarithm of the sample quantity and the dimension of the model parameters is determined. The difference between the product and the log-likelihood value is taken as the Bayesian Information Criterion score of the sample data and the model parameters in the preset attack feature recognition model. The model parameters can be adjusted according to the Bayesian Information Criterion score until the Bayesian Information Criterion score reaches the target score, and the training of the preset attack trace model is completed.

[0112] FIG. 4 is a training structure block diagram of an attack detection and tracing system according to some implementations of the present application. The present embodiment is further illustrated for the training of the attack detection and tracing system, which is composed of a preset attack feature recognition model and a preset attack trace model. As shown in FIG. 4, the attack detection and tracing system includes a preset attack feature recognition model and a preset attack trace model, wherein the preset attack feature recognition model is composed of an encoder and a decoder; and the preset attack trace model is composed of a Bayesian network explanation model. The training of the attack detection and tracing system includes:

[0113] Various entities in a network environment and various interaction behaviors between the entities at each moment in continuous time are acquired, and a dynamic heterogeneous event graph is constructed. The dynamic heterogeneous event graph is taken as a positive sample event graph.

[0114] By collecting known open-source cyber threat intelligence related to cyber attacks and using natural language processing techniques to extract entities and interactions between entities involved in known cyber attacks, a corresponding attack graph, i.e., an abstract representation of attack paths and context information of known attack behaviors, is formed, denoted as G a An event graph generation method of "subject-action-object-time" is adopted to model the traffic logs and other information of the target network into an event graph, denoted as G e Further, a depth-first graph traversal algorithm is used to search for the attack graph G e in the event graph G a , and an initial attack graph is obtained.

[0115] In one possible implementation, for each node v a in the attack graph G k , all matching nodes (v k,i )(i = 1, …, n a ) in the event graph G k are found according to the name, type, and attributes of the node, denoted as (v k,i , v a ), and n a is the number of nodes in G a . For each node v k in the attack graph G e , each matching node v k,i of the node in the event graph G e is sequentially taken as a starting node for searching, and the event graph G a is traversed until a matching node v k ' of the next node v e ' in the attack graph G k,i in the event graph G i is found. At this time, the search is performed based on a depth-first strategy, i.e., the current matching node is taken as a starting point, and the above steps are repeated until a backtracking is performed when a next matching node cannot be found.

[0116] For a path between nodes v j and v min , the influence score represents the possibility that an attacker can control the entire attack path, and is defined as follows:

[0117] where N i (e j → e i ) represents the minimum number of nodes that need to be controlled by an attacker in order to control all nodes on the path e j → e i , and the value is equal to ei →e j The minimum number of common ancestor nodes of all nodes involved in the attack path; N thr is a pre-set threshold value. When , it is considered that the attack path does not exist. When the influence score between the current node and the search starting node is 0, the search is stopped. In order to improve the search efficiency, the influence score of each path is calculated to prune.

[0118] For the attack graph Ga, the set of initial attack graphs matched in the middle of the event graph Ge is {G a,e}. The target attack graph is screened by calculating the similarity score between the attack graph Ga and the initial attack graph {G a,e}. The similarity score is calculated as follows:

[0119] Where v i , v j are nodes in Ga, v k , v l are nodes in Ga, e, v i → v j is an attack path from node v i to node v j in Ga, M(Ga, e) represents the set of corresponding paths in the similar subgraph Ga, e of all paths in Ga, and |M(Ga, e)| represents the number of corresponding paths. Under the condition that node v k matches v i and v l matches v j , the formula first calculates the sum of the influence scores between all node pairs (k, l) in the graph Ga, e that satisfy at least one path from node v k to v l . Then, by dividing the sum by the maximum possible value |M(Ga, e)|, the number of paths in Ga, e, it is standardized. Since the maximum value of the influence score I between two nodes is equal to 1, the number of paths automatically represents the maximum value of the sum of the influence scores. When Sim(Ga, Ga, e) = 0, Ga and Ga, e do not have any similarity (i.e., there are neither matching nodes, nor paths between corresponding matching nodes); when Sim(Ga, Ga, e) = 1, Ga and Ga, e are isomorphic. Therefore, when the similarity score Sim(Ga, Ga, e) exceeds the pre-set threshold value S thr , the initial attack graph is added to the set of target attack graphs.

[0120] ​On the basis of the searched target attack graph, based on the event graph, combined with the graph data perturbation method, various variants of the attack subgraph with prior knowledge are embedded into the normal network entity behavior to obtain the attack sample, that is, the construction of strong negative examples. In a possible implementation manner, the node perturbation manner can be adopted, part of the nodes and associated edges in the target attack graph are randomly discarded, or additional associated nodes and associated edges in the event graph Ga are randomly selected and added to Ga,e; the edge perturbation manner can also be adopted, part of the edge elements in the target attack graph Ga,e are randomly discarded, or the associated edges in the event Ga are randomly selected and added to Ga,e; or the attribute masking manner is adopted, part or all of the attribute information of part of the nodes in the target attack graph Ga,e is randomly masked; or the random subgraph manner is adopted, the associated nodes and associated edges in the event graph Ga are combined, and the attack sample, that is, the negative sample event graph is obtained through random walk sampling.

[0121] In a possible implementation manner, FIG. 5 is a schematic diagram of a method for determining an attack sample according to some implementations of the present application. As shown in FIG. 5, after the attack graph is determined according to the threat intelligence and the event graph is determined according to the system and traffic logs, the matching nodes in the event graph can be determined through the nodes in the attack graph, an initial attack graph is obtained, and data augmentation is performed on the initial attack graph to obtain an attack sample.

[0122] Taking the file copy in the data set as an example, the normal behavior sequence is "log in computer -> insert U disk -> copy file -> pull out U disk -> log out computer", and the negative sample behavior sequence that can be generated includes "log in computer -> insert U disk -> execute malicious code -> copy file -> establish CC channel -> pull out U disk -> log out computer".

[0123] The preset attack feature recognition model is a continuous time dynamic heterogeneous graph network based on an encoder-decoder paradigm. The encoder of the preset attack feature recognition model is pre-trained by inputting the generated positive sample event graph and negative sample event graph through a contrast learning method.

[0124] The positive sample event graph is represented as (X, A), where X is a node feature matrix of the positive sample event graph, and A is an adjacency matrix of the positive sample event graph. The negative sample event graph generated based on (X, A) is represented as wherein is a node feature matrix of the negative sample event graph, is an adjacency matrix of the negative sample event graph. The preset attack feature recognition model uses message passing, aggregation, storage update and embedding generation to obtain local features H = ε (X, A) = (h1, h2,..., hn), where ε represents an encoder, and h1-hn represent the local features of the nodes in the event graph. n n ​denotes the embedding representation of a node in the positive sample event graph; denotes the local feature of a node in the negative sample event graph where ε denotes the encoder, denotes the embedding representation of a node in the positive sample event graph; denotes the local feature of a node in the negative sample event graph denotes the global feature of the positive sample event graph; denotes the global feature of the negative sample event graph denotes the global feature of the positive sample event graph; denotes the global feature of the negative sample event graph as the global feature of the attack sample, by denotes. The pre-training of the preset attack feature recognition model is completed using the standard binary cross entropy loss function.

[0125] where the loss function can be:

[0126] where F denotes the discriminator function, which is used to score the local features and global features. For example, when the pre-training sample is a positive sample event graph, the value of F(h i ,s) is large, and when the pre-training sample is an attack sample, the value of F(h i ,s) is small; conversely, when the pre-training sample is a positive sample event graph, the value of F(h is small, and when the pre-training sample is an attack sample, the value of F(h is large. N and M respectively denote the number of nodes in the positive sample event graph and the attack sample. E (X,A) denotes the mathematical expectation of the positive sample event graph; denotes the mathematical expectation of the attack sample.

[0127] Based on the rare real complex network attack samples, strong negative sample event graphs are generated, and the above pre-trained preset attack feature recognition model is further fine-tuned to make it more sensitive to complex network attack behaviors, and a trained preset attack feature recognition model is obtained.

[0128] The fine-tuning stage inherits the parameters of the encoder in the pre-training stage, and continues to train the detection model using real attack samples. The embedding of each edge in the real attack sample is obtained by splicing the embeddings of the nodes on both sides of the edge. Then, the embedding of the edge is mapped to the probability space of the attack event it belongs to through a fully connected layer. The fine-tuning stage uses the following cross-entropy loss function to complete the training of the preset attack feature recognition model. Loss =∑ x [y x log(p x )+(1-yx ) log(1 - p x )];

[0129] where y x represents whether the edge x is the true case of the attack event, p x represents the predicted probability that x belongs to the attack event.

[0130] Based on the above preset attack feature recognition model output result, the original graph, and the attack sample, a preset traceability model is further trained, which expresses the dependence degree between the attack event and other process events in the form of conditional probability.

[0131] Obtain the attack event output by the preset attack feature recognition model and the network event graph input by the preset attack feature recognition model, and take the attack event and the network event graph as samples. Disturb the network event graph, record the prediction of the anomaly on these graphs, which is called disturbed data (that is, generate → pre-process → record a set of predicted

input, output

[0132] A set of disturbed sampling data D et (corresponding to the disturbed data variable in the probabilistic graph network with bold D et (represented), that is, the set of

input, output

[0133] It is difficult to find an optimal preset traceability model in the full amount of disturbed data, because the L-hop neighbor set Neighb(et, Ge) of the target event et on the event graph Ge can contain thousands of nodes, and the calculation amount of searching for an optimal preset traceability model is very large. Therefore, in order to reduce the number of variables in the filtered data, it can be determined which variables are not important and eliminated. The Markov blanket corresponding to the attack event et can be used to represent all events important to the attack event et. That is, the Markov blanket can contain all the statistical information of the attack event et. Therefore, in the disturbed sampling data D et , important data is selected and unimportant data is filtered, which is equivalent to reducing the L-hop neighbor events Neighb(et, Ge) of the attack event et to the Markov blanket M(et) of the attack event et, thereby realizing the reduction of the calculation space of the optimal preset traceability model learned by the explanation model. The Markov blanket M(et) is calculated by the related algorithm Grow-Shrink (GS). The data in the Markov blanket is taken as sample data.

[0134] The preset causal model B for the target event et is learned as input sample data, and the objective function is the Bayesian information criterion (BIC) score OBJ et (B). Under the premise that the sample satisfies the independent and identically distributed assumption, the log-likelihood is used to measure the fitting degree of the network structure β and the observed data D et [M(et)]. et (B) = BICscore(β, D et [M(et)]). B et [M(et)].

[0135] Wherein, D et [M(et)] is the data corresponding to the variable M(et), n is the sample size of D et [M(et)], and Dim[B] is the dimension of the model parameters to be estimated by the Bayesian network B. The function L(θ′ B , D et [M(et)]) is the log-likelihood between D et [M(et)] and θ′ B . θ β is the parameter of the Bayesian network, and is the value of θ β when the log-likelihood is maximized, i.e. the maximum likelihood estimator.

[0136] Based on the BIC objective function, the preset causal model can be solved using the exhaustive method, which reflects the dependency of the target event and other events through the network.

[0137] ​In a possible implementation, FIG. 6 is an example diagram of attack tracing according to some embodiments of the present application. An employee logs into another employee's machine and searches for a copy of a private file, for example, and sends it to a private mailbox by email. When the detection finds that the t7 event is an abnormal event, the attention scores of the neighbor nodes are analyzed, and the node E with the highest attention score is found. The data set is queried to find that the node E sends the private file by email. In this way, the neighbor node attention scores of the node E are further explored and recursively traced forward, and it is found that the source of the attack behavior is that the employee logs into the computer E of another employee at t4, sends a job-seeking email to F at t5, accesses the private file at t6, and sends the private file by email at t7, and finally forms a complete abnormal behavior. As a comparison, the causal chain closer to the real cognition is obtained by using the explanation model based on the spatiotemporal probability graph. The behavior chain formed by t1, t4, t5, and t6 has a gain effect on the abnormality determination probability of the t7 event, which is consistent with the result of the attention score method. For example, the output of the preset tracing model can be a conditional probability table: p(e t7 |e t6 )=0.754;p(e t7 |e t5 e t6 )=0.775;p(e t7 |e t4 e t5 e t6 )=0.790;p(e t7 |e t1 e t4 e t5 e t6 )=0.809. As can be seen from the conditional probability table, the preset tracing model can show the Markov blanket of the target event, filter unimportant events, and is more intuitive than the attention score method which needs to be recursively traced level by level.

[0138] FIG. 7 is a structural schematic diagram of an attack detection and tracing apparatus according to some embodiments of the present application. As shown in FIG. 7, the apparatus includes an event graph construction module 71, an attack event determination module 72, and an information tracing module 73.

[0139] The event graph construction module 71 is configured to acquire entities and interaction event information between the entities in a target network environment, and construct a network event graph based on the entities and the interaction event information.

[0140] The attack event determination module 72 is configured to determine a graph embedding vector of each interaction event information in the network event graph as feature information based on a preset attack feature recognition model, and determine an attack event in the network event graph based on the feature information.

[0141] The information tracing module 73 is configured to determine a dependency degree of the attack event and remaining interaction event information in the network event graph, and find corresponding interaction event information as the trace information of the attack event according to the dependency degree.

[0142] In the embodiment of the application, the event graph construction module obtains entities and interaction event information between the entities in the target network environment, constructs a network event graph based on the entities and the interaction event information, the attack event determination module determines graph embedding vectors of the interaction event information in the network event graph as feature information based on a preset attack feature recognition model, and determines an attack event in the network event graph according to the feature information, so as to automatically determine the attack event and improve the recognition ability of the attack event. The information tracing module determines a dependency degree of the attack event and remaining interaction event information in the network event graph, and finds corresponding interaction event information as the trace information of the attack event according to the dependency degree, so as to facilitate the search for interaction event information associated with the attack event, trace the attack event, improve the accuracy of the trace information, and facilitate the timely discovery of potential attack behaviors in the target network environment, so as to provide defense and response in advance and ensure the safety of the target network environment.

[0143] In a possible implementation, the attack event determination module 72 includes:

[0144] The matrix determination unit is configured to extract a node matrix composed of entities in the network event graph and a graph adjacency matrix composed of interaction event information based on a preset attack feature recognition model.

[0145] The vector determination unit is configured to determine a node embedding vector of each node according to the node matrix and the graph adjacency matrix.

[0146] The feature information determination unit is configured to splice the node embedding vectors associated with the interaction event information to obtain a graph embedding vector of the interaction event information, and take the graph embedding vector as the feature information.

[0147] The attack event determination unit is configured to determine a probability that each feature information belongs to the attack event, and take interaction event information corresponding to feature information with a probability greater than or equal to a preset probability threshold as the attack event.

[0148] In a possible implementation, the attack detection and tracing apparatus further includes:

[0149] The attack graph determination module is configured to obtain open source network threat intelligence, extract first entities and interaction event information between the first entities in the open source network threat intelligence by using a natural language processing technology, take each first entity as a first node, take the interaction event information between the first entities as an edge, and construct an attack graph.

[0150] The event graph determination module is configured to extract a traffic log of a network environment, extract interaction event information contained in the traffic log, take a second entity corresponding to each piece of interaction event information as a second node, take interaction event information between the second entities as an edge, and construct an event graph;

[0151] The initial graph generation module is configured to obtain matched nodes according to matching between each first node and each second node, determine a target attack path between the matched nodes, and generate an initial attack graph according to the target attack path.

[0152] The sample determination module is configured to determine a similarity score of the attack graph and the initial attack graph, determine a target attack graph in the initial attack graph according to the similarity score, and perform data augmentation on the target attack graph as an attack sample.

[0153] The positive sample determination module is configured to obtain entities and interaction event information between the entities in the network environment at at least one time point, and construct a positive sample event graph according to the entities and the interaction event information.

[0154] The model training module is configured to extract real network attack samples in a configuration file, input the positive sample event graph, the real network attack samples, and the attack sample into a preset attack feature recognition model, and train the preset attack feature recognition model.

[0155] In a possible implementation, the initial graph generation module is configured to:

[0156] Determine attribute information of the first nodes, and match and associate points in the second nodes of the event graph according to the attribute information as matched nodes; wherein the attribute information at least includes a first node name, a type, and feature information.

[0157] Take any matched node as a starting node, find remaining matched nodes by traversing the event graph, and determine attack paths between the matched nodes.

[0158] Determine a number of nodes in each attack path, and determine a target attack path between the matched nodes, wherein the target attack path is an attack path with a number of nodes less than or equal to a preset number.

[0159] Connect the matched nodes and the target attack path to generate an initial attack graph.

[0160] In a possible implementation, the sample determination module is configured to:

[0161] Determine connection paths of the matched nodes in the attack graph, determine a number of nodes in each connection path, determine an inverse of the number of nodes in the connection paths corresponding to two matched nodes, and take a maximum value of the inverses as an influence score of the two matched nodes.

[0162] determining a sum of the number of all connection paths and adding the influence scores to obtain an influence score sum;

[0163] multiplying the influence score sum by the number sum as a similarity score;

[0164] determining the initial attack graph as a target attack graph when the similarity score is greater than or equal to a preset similarity score, and performing data augmentation on the target attack graph as an attack sample; wherein the data augmentation includes at least one of node perturbation, edge perturbation, attribute masking, and random subgraph sampling.

[0165] In a possible implementation, the model training module is configured to:

[0166] input the positive sample event graph and the attack sample as pre-training samples into a preset attack feature recognition model, extract local features of the pre-training samples through the preset attack feature recognition model, and aggregate the local features as global features; wherein the preset attack feature recognition model is based on an encoder-decoder architecture;

[0167] determine a loss value of the preset attack feature recognition model based on a preset pre-training network loss function; wherein the pre-training network loss function at least includes binary cross entropy;

[0168] perform iteration on the preset attack feature recognition model through the loss value until a number of iterations is reached, adjust parameters of the preset attack feature recognition model in the process of iteration, and obtain a pre-training completed preset attack feature recognition model;

[0169] generate a real network attack sample graph by taking entities in a real network attack sample as nodes and taking event information between the entities as edges, label attack events in the real network attack sample graph with attack labels, and input the real network attack sample graph and the attack labels into the pre-training completed preset attack feature recognition model;

[0170] determine a probability that each edge belongs to an attack event through a fully connected layer of the initial model, and determine that event information corresponding to the edge is an attack event when the determined probability is greater than or equal to a preset threshold;

[0171] determine a judgment mark of the attack event as 1 when it is determined that the attack event has the attack label, and determine the judgment mark of the attack event as 0 when it is determined that the attack event does not have the attack label;

[0172] When it is determined that the judgment mark is 1, the natural logarithm of each probability and the corresponding judgment mark are determined as the first parameter, when it is determined that the judgment mark is 0, the natural logarithm of the probability that does not belong to the attack event is determined as the second parameter, the sum of the first parameter and the second parameter corresponding to the real network attack sample graph is determined as the loss function value of the preset attack feature recognition model after pre-training, and the parameters of the preset attack feature recognition model are optimized according to the loss function value.

[0173] In a possible implementation, the information tracing module 73 comprises:

[0174] The model input unit is configured to input the attack event and the network event graph into the preset tracing model; and the preset tracing model is constituted based on a Bayesian network.

[0175] The information tracing unit is configured to determine the correlation probability of at least one remaining interaction event information in the attack event and the network event graph as the dependence degree through polling of the preset tracing model, and take the at least one remaining interaction event information with the highest dependence degree as the tracing information of the attack event.

[0176] In a possible implementation, the attack detection and tracing apparatus further comprises:

[0177] The sample generation module is configured to extract the attack event output by the preset attack feature recognition model and the network event graph input into the preset attack feature recognition model, perform data augmentation on the attack event and the network event graph as samples, and obtain training samples.

[0178] The data determination module is configured to determine the Markov blanket of the attack event in the training samples according to a growing-shrinking algorithm, and take the data in the Markov blanket as sample data.

[0179] The score determination module is configured to determine the sample quantity of the sample data and the log-likelihood value of the sample data and the model parameters, determine the product of the natural logarithm of the sample quantity and the dimension of the model parameters, and take the difference between the product and the log-likelihood value as the Bayesian information criterion score of the sample data and the model parameters in the preset attack feature recognition model.

[0180] The parameter adjustment module is configured to adjust the model parameters based on the Bayesian information criterion score until the Bayesian information criterion score reaches a target score, and complete the training of the preset tracing model.

[0181] The attack detection and tracing apparatus provided in the embodiments of the present application can execute the attack detection and tracing method provided in any of the embodiments of the present application, and has the functions and advantages of the attack detection and tracing method.

[0182] FIG. 8 is a structural diagram of an electronic device implementing an attack detection and tracing method according to an embodiment of the present application. The electronic device is intended to represent a variety of forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular telephones, smart phones, wearable devices (e.g., headsets, glasses, watches, etc.), and other similar computing devices. The components shown here, their connections, and their functions, as described above, are meant to be examples only, and are not intended to limit the implementations of the present application as described and / or claimed herein.

[0183] As shown in FIG. 8, the electronic device 10 includes at least one processor 11, and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., connected to the at least one processor 11 in communication, where the memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes according to the computer programs stored in the read-only memory (ROM) 12 or loaded into the random access memory (RAM) 13 from the storage unit 18. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0184] A plurality of components in the electronic device 10 are connected to the I / O interface 15, including an input unit 16, such as a keyboard, a mouse, etc., an output unit 17, such as various types of displays, speakers, etc., a storage unit 18, such as a magnetic disk, an optical disk, etc., and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunications networks.

[0185] The processor 11 can be various general and / or special-purpose processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs various methods and processes described above, such as an attack detection and tracing method.

[0186] In some embodiments, an attack detection and tracing method can be implemented as a computer program tangibly embodied in a computer readable storage medium, e.g., storage unit 18. In some embodiments, parts or all of the computer program can be loaded and / or installed onto electronic device 10 via, e.g., ROM 12 and / or communication unit 19. When the computer program is loaded onto RAM 13 and executed by processor 11, one or more steps of an attack detection and tracing method as described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to perform an attack detection and tracing method by other means, e.g., with the aid of firmware.

[0187] Various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a programmable logic device (PLD), a computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0188] Computer programs used to implement the methods of the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the computer program, when executed by the processor of the machine, implements the functions / acts specified in the flowcharts and / or block diagrams. The computer program can be executed entirely on a machine, partially on a machine, partially on a machine and partially on a remote machine or entirely on a remote machine or server.

[0189] In the context of this application, a computer readable storage medium can be a tangible medium that can contain or store computer programs for use by or in connection with an instruction execution system, apparatus, or device. Computer readable storage media can include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. Alternatively, a computer readable storage medium can be a machine readable signal medium. More specific examples of the machine readable storage medium will include a one or more lines of a electrical connection, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0190] To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the electronic device. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0191] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), blockchain network, and the Internet.

[0192] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system, to solve the defects of large management difficulty and weak business scalability in traditional physical host and VPS service.

Claims

1. An attack detection and tracing method, comprising: obtaining entities in a target network environment and interaction event information between the entities, and constructing a network event graph based on the entities and the interaction event information; determining graph embedding vectors of each of the interaction event information in the network event graph as feature information based on a preset attack feature recognition model, and determining an attack event in the network event graph according to the feature information; determining a dependency degree of the attack event and the remaining interaction event information in the network event graph, and searching for corresponding interaction event information as the attack event according to the dependency degree.

2. The method of claim 1, wherein, The method comprises: extracting a node matrix composed of the entities and a graph adjacency matrix composed of the interaction event information in the network event graph based on the preset attack feature recognition model; determining a node embedding vector of each node according to the node matrix and the graph adjacency matrix; splicing the node embedding vectors associated with the interaction event information to obtain a graph embedding vector of the interaction event information, and taking the graph embedding vector as the feature information; confirming a probability that each of the feature information belongs to an attack event, and taking the interaction event information corresponding to the feature information with a probability greater than or equal to a preset probability threshold as the attack event.

3. The method of claim 1, wherein, The training of the preset attack feature recognition model comprises: obtaining open source network threat intelligence, extracting first entities and interaction event information between the first entities in the open source network threat intelligence by using natural language processing technology, taking each of the first entities as a first node, and taking the interaction event information between the first entities as an edge to construct an attack graph; extracting a traffic log of a network environment, extracting interaction event information contained in the traffic log, taking second entities corresponding to each of the interaction event information as second nodes, and taking interaction event information between the second entities as edges to construct an event graph; obtaining a matching node by matching each of the first nodes with each of the second nodes, and determining a target attack path between the matching nodes, and generating an initial attack graph according to the target attack path; determining a similarity score of the attack graph and the initial attack graph, determining a target attack graph in the initial attack graph according to the similarity score, and data augmenting the target attack graph as an attack sample; obtaining entities in a network environment at at least one time and interaction event information between the entities, and constructing a positive sample event graph according to the entities and the interaction event information; extracting real network attack samples in a configuration file, inputting the positive sample event graph, the real network attack samples and the attack sample into the preset attack feature recognition model, and training the preset attack feature recognition model.

4. The method of claim 3, wherein, According to the matching of each first node and each second node, a matching node is obtained, and a target attack path between the matching nodes is determined, and an initial attack graph is generated according to the target attack path, including: Determine the attribute information of the first node, and match the associated points in the second nodes of the event graph as matching nodes according to the attribute information; wherein the attribute information at least includes first node name, type and characteristic information; Take any of the matching nodes as a starting node, and find the remaining matching nodes by traversing the event graph, and determine the attack paths between the matching nodes; Determine the number of nodes in each attack path, and take the attack path with the number of nodes less than or equal to the preset number as the target attack path between the matching nodes; Connect each of the matching nodes and the target attack path to generate an initial attack graph.

5. The method of claim 3, wherein, Determine the similarity score of the attack graph and the initial attack graph according to the similarity score, determine the target attack graph in the initial attack graph according to the similarity score, and data augment the target attack graph as an attack sample, including: Determine the connection path of each matching node in the attack graph, determine the number of nodes in each connection path, determine the reciprocal of the number of nodes in the connection path corresponding to two matching nodes, and take the maximum value of the reciprocal as the influence score of the two matching nodes; Determine the total number of all connection paths, and add each influence score to obtain an influence score sum; Take the product of the influence score sum and the total number as the similarity score; When the similarity score is greater than or equal to a preset similarity score, determine the initial attack graph as a target attack graph, and data augment the target attack graph as the attack sample; wherein the data augmentation includes at least one of the following: node disturbance, edge disturbance, attribute masking and random subgraph sampling.

6. The method of claim 3, wherein, Input the positive sample event graph, the real network attack sample and the attack sample into the preset attack feature recognition model, train the preset attack feature recognition model, including: Take the positive sample event graph and the attack sample as a pre-training sample, input the pre-training sample into the preset attack feature recognition model, extract local features of the pre-training sample through the preset attack feature recognition model, and aggregate the local features as global features; wherein the preset attack feature recognition model is based on an encoder-decoder architecture; Determine the loss value of the preset attack feature recognition model based on a preset pre-training network loss function; wherein the pre-training network loss function at least includes binary cross entropy; Iterate the preset attack feature recognition model through the loss value until the iteration times are reached, adjust the parameters of the preset attack feature recognition model in the iteration process, and obtain a pre-training completed preset attack feature recognition model; The entities in the real network attack sample are taken as nodes, and the event information between the entities is taken as edges to generate a real network attack sample graph, the attack events in the real network attack sample graph are labeled with attack labels, and the real network attack sample graph and the attack labels are input into the pre-trained preset attack feature recognition model; The probability that each edge belongs to an attack event is determined through the full connection layer of the initial model, and when it is determined that the probability is greater than or equal to a preset threshold, it is determined that the event information corresponding to the edge is an attack event; When it is determined that the attack event has an attack label, the determination mark of the attack event is determined to be 1, and when it is determined that the attack event does not have an attack label, the determination mark of the attack event is determined to be 0; When it is determined that the determination mark is 1, the natural logarithm of each probability and the corresponding determination mark are determined as a first parameter, and when it is determined that the determination mark is 0, the natural logarithm of the probability that does not belong to an attack event is determined as a second parameter. The sum of the first parameter and the second parameter corresponding to the real network attack sample graph is taken as the loss function value of the pre-trained preset attack feature recognition model, and the parameters of the preset attack feature recognition model are optimized according to the loss function value.

7. The method according to any one of claims 1-6, wherein, The determination of the dependence degree of the attack event and the remaining interaction event information in the network event graph, and the searching of the corresponding interaction event information as the attack event traceability information according to the dependence degree, comprises: The attack event and the network event graph are input into a preset traceability model; wherein the preset traceability model is based on a Bayesian network; The correlation probability of the attack event and at least one remaining interaction event information in the network event graph is determined as a dependence degree through polling of the preset traceability model, and the at least one remaining interaction event information with the highest dependence degree is taken as the traceability information of the attack event.

8. The method of claim 7, wherein, The training of the preset traceability model comprises: The attack event output by the preset attack feature recognition model and the network event graph input into the preset attack feature recognition model are extracted, and the attack event and the network event graph are taken as samples for data augmentation to obtain training samples; The Markov blanket of the attack event in the training samples is determined according to a growth and shrink algorithm, and the data in the Markov blanket is taken as sample data; The sample quantity of the sample data and the log-likelihood value of the sample data and model parameters are determined, the natural logarithm of the sample quantity and the product of the model parameter dimension are determined, and the difference between the product and the log-likelihood value is taken as the Bayesian information quantity criterion score of the sample data and the model parameters in the preset attack feature recognition model; The model parameters are adjusted based on the Bayesian information quantity criterion score until the Bayesian information quantity criterion score reaches a target score, and the training of the preset traceability model is completed.

9. An attack detection and traceability device, comprising: An event graph construction module configured to obtain entities in a target network environment and interaction event information between the entities, and construct a network event graph based on the entities and the interaction event information; An attack event determination module configured to determine, based on a preset attack feature recognition model, graph embedding vectors of each of the interaction event information in the network event graph as feature information, and determine an attack event in the network event graph according to the feature information; An information tracing module configured to determine a dependency degree of the attack event and remaining interaction event information in the network event graph, and find corresponding interaction event information as tracing information of the attack event according to the dependency degree.

10. An electronic device, comprising: at least one processor; and a memory connected to the at least one processor in communication; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the attack detection and tracing method of any one of claims 1-8.

11. A computer readable storage medium storing computer instructions for causing a processor to execute the attack detection and tracing method of any one of claims 1-8 when executed.

Images