CN116232708A - A text-based threat intelligence-based attack chain construction and attack source tracing method and system - Google Patents

Abstract

The invention provides an attack chain construction and attack tracing method and system based on text threat information. The method comprises the following steps: collecting text threat information of an attack event of a known attack organization, and performing data preprocessing operation on the collected data to enable the collected data to meet the requirement of subsequent analysis; secondly, extracting network security entities and relations by using the collected text threat information to form a network security event description triplet; then, for the network security event description triplets, constructing a security event attack chain based on the time line and the logic sequence; and finally, training an attack organization feature model by utilizing a security event attack chain, and carrying out traceability prediction of unknown source attack events based on the model. The invention starts from text threat information, extracts the network security event attack chain from the text threat information, combines the known attack sources to describe the attack characteristic model for attack organizations, and can effectively serve the tracing and responsibility tracing work of network security personnel on network security events with unknown sources.

Description

A text-based threat intelligence-based attack chain construction and attack source tracing method and system

technical field

The invention proposes a text-based threat intelligence-based attack chain construction and attack source tracing method and system, belonging to the technical field of network security.

Background technique

With the rapid development of network information technology, the frequency and intensity of network attacks are increasing, and the requirements for network security monitoring and prevention capabilities continue to increase. The traceability of attack events is an important part of monitoring and prevention work. However, with the continuous improvement of network attack technology, network attacks have gradually evolved from single attacks to organized and planned multi-step attacks, such as advanced persistent attacks (APT). In recent years, it has always been a difficult problem in the field of network security to use big data analysis, machine learning and other technologies to discover various malicious behaviors and their correlations in the network attack chain, and to gradually realize the recovery and traceability of the attack chain. At present, attack event description information mainly flows in the network security industry in the form of text-based threat intelligence. The conversion of unstructured data such as text-based threat intelligence to attack chain information is usually done manually, with a low degree of automation. Therefore, it is necessary to Based on natural language processing technology, it realizes the automatic extraction of network security event attack chains from unstructured text information such as text-based threat intelligence, and improves the efficiency of network security event analysis.

The traditional attack chain-based traceability work analyzes the attack chain of a single security event, lacks horizontal comparison and correlation analysis with other security events, and lacks correlation analysis with the attacking organization behind the security event. However, there are many different ways to achieve the same attack goal, and each attack organization has its own unique attack chain preference, personnel, and weapon arsenal. These characteristic information of attack organizations are of great significance to the identification of attack organizations. Therefore, it is necessary to model known attacking organizations based on the attack chain information, and use the attacking organization model to realize the traceability prediction of future security event attack chains, and provide basis and support for network security traceability and accountability work.

Contents of the invention

The present invention proposes a text-based threat information-based attack chain construction and attack traceability method and system, based on text-based threat information provided by security organizations such as network security service providers, extracting security event attack chains, and establishing attack path models for attacking organizations. In this way, the traceability and prediction of the attack chain of future security events can be realized.

In order to achieve the above purpose, the present invention proposes a text-based threat intelligence-based attack chain construction and attack traceability method, including the following steps:

Collect text-based threat intelligence on attack events of known attacking organizations, and perform data preprocessing operations on the collected text-based threat intelligence to meet subsequent analysis requirements;

Use the collected text-based threat intelligence to extract network security entities and relationships to form a network security event description triplet;

For the extracted network security event description triplets, build a security event attack chain based on the timeline and logical sequence;

Use the security event attack chain of known attack organizations to train the attack organization characteristic model, and perform traceability prediction of unknown source attack events based on the trained attack organization characteristic model.

Further, the data preprocessing operation includes performing operations such as completion, deduplication, and correction on the data.

Further, the formation of a network security event description triplet includes the following steps: according to the text-based threat intelligence obtained through collection and processing, using natural language processing technologies such as BERT and bidirectional long-short-time neural network, to extract attacking organizations, IP, attack tools, attack methods and other network security entities, and use the remote supervision learning method to extract the relationship between entities, and form entity-relationship-entity format network security event description triplets.

Further, the construction of the security event attack chain includes the following steps: based on the artificially set attack sub-event definition, dividing the network security event description triple into different network security sub-events, and based on the timeline and text description logic , arrange the network security sub-events according to the actual sequence of occurrence and causal logic to form an attack chain description of this network security incident.

Further, the training attack organization feature model using the security event attack chains of known attack organizations includes the following steps: forming a Bayesian conditional probability network of network security sub-event categories, and inputting the security event attack chains of known attack organizations , the conditional probability of each node is trained as the attack characteristic portrait of the attack organization, that is, the attack organization characteristic model.

Further, the source-tracing prediction of unknown-source attack events based on the trained attacking organization feature model includes: for unknown-sourced attack event text-based threat intelligence, through the aforementioned steps, convert it into a security event attack chain, and match known attacking organization According to the attack feature portrait, the attack organization with the highest confidence is selected as the traceability prediction result.

Based on the same inventive concept, the present invention also provides a text-based threat intelligence-based attack chain construction and attack traceability system using the above method, which includes:

The data collection and preprocessing module is used to collect text-based threat intelligence of attack events of known attack organizations, and perform data preprocessing operations on the collected text-based threat intelligence to make it meet the subsequent model analysis requirements;

The entity and relationship extraction module is used to extract network security entities and relationships to form a network security event description triplet;

The attack chain generation module is used to summarize the network security sub-events, and based on the timeline and logical sequence, build a security event attack chain and describe the security event process;

The feature model training and traceability prediction module is used to train the attack organization feature model based on the generated security event attack chain, and perform traceability prediction for network security events with unknown attack sources.

The present invention starts from text-based threat intelligence, extracts network security event attack chains from it, describes the process and internal logic of security events as a whole, and combines known attack sources to describe attack characteristic models for attacking organizations, effectively serving the network security personnel. Source tracing and accountability of network security incidents from unknown sources.

Description of drawings

FIG. 1 is a flowchart of a text-based threat intelligence-based attack chain construction and attack source tracing method of the present invention.

Detailed ways

In order to make the technical solution of the present invention more comprehensible, specific embodiments and accompanying drawings are described in detail as follows.

A text-based threat intelligence-based attack chain construction and attack source tracing method of the present invention, the process of which is shown in Figure 1, including the following steps:

Step 1: Data Acquisition and Preprocessing

Security event text-based threat intelligence includes the sequence of actions, the impact on the attacked system, and indicators of damage (IOCs). bigger. The data preprocessing process removes irrelevant data, repeated data, abnormal symbols, etc. in the text-based threat intelligence, completes some incomplete information based on the existing network security database, and solves the problem of information inconsistency, so as to improve the quality of collected data and ensure Completeness and accuracy of collected data. Data cleaning includes but is not limited to the following:

1) It should support the processing of missing information in the collected data, such as information that is not given in detail or marked as unknown information in the threat intelligence, but can be found in the existing network security database;

2) It should support abnormal information processing of collected data. Abnormal information includes repeated information and error information. When merging text-based threat intelligence from multiple sources, repeated information may appear. Error information may be due to the insufficient soundness of the data acquisition module. The received threat information contains wrong characters or garbled characters;

3) It should support the cleaning of non-required information in the collected data. In order to avoid the interference of the redundancy of information on the accuracy of the algorithm, it is necessary to delete the non-required information in the collected data.

Step 2: Extract network security event description triplets

This embodiment is based on relevant standards and specifications in the field of network security, such as ISO/IEC 27000 information security management system standard family, network security threat information format specification GB/T36643-2018, information security technical terms GB/T25069-2019, information security Technical network attack definition and description specification GB/T37027-2018, and some public security industry standards, etc., to determine the core ontology, concepts and terms in the field of network security, establish a network security knowledge ontology model, and clarify the set of attributes.

For example:

(1) Network assets: including various hardware devices, software devices, network environments, virtual personnel, etc. in cyberspace.

(2) Vulnerability: including vulnerability vulnerability, vulnerability vulnerability, such as vulnerability, system configuration, protection software, etc.

(3) Cyber attacks: including attackers, attack methods, utilization tools, attack events, attack consequences, etc. Attackers include individuals, groups, or hacker organizations; attack methods include attack methods, such as denial of service attacks, backdoor attacks, vulnerability attacks, network scanning eavesdropping, phishing, interference events, advanced threat events, and other network attack events; Tools include both benign and malware.

The specific implementation methods for extracting network security event description triplets include:

1) Network Security Entity Extraction

First, the input text-based threat intelligence text is divided into character sequences S={s ₁ , s ₂ ,...,s _n } according to the characters, and the BERT model is used to embedding the characters as vectors, among which special proper nouns and English words Embed as a character. In order to obtain richer features, the input E _i of the BERT model is the sum of the vectors of a character in the three dimensions of symbol embedding, segment embedding and position embedding. The model is pre-trained using the masked language model method. During the training process, the characters in the training sequence are replaced with mask marks with a probability of 15%, and then the original words at the position of the mask marks are predicted, while the words covered by the mask marks In the part, 80% are replaced by "[MASK]" marks, and 20% are replaced by random other characters, so as to ensure that BERT remains sensitive to all characters and improve the efficiency of vector embedding.

In the next step, the character vector sequence X={x ₁ ,x ₂ ,...,x _n } output by BERT is used as the input of the BiLSTM neural network. BiLSTM consists of two forward and backward LSTM networks. During feature extraction, X is input into the forward and backward two LSTM networks at the same time, and the hidden layer vector sequence at the current moment is calculated for splicing, and then the formula o is used for the vector _t = tanh(W _h h _t + b _o ) for activation function operation, where o _t is the output at the current moment, h _t is the hidden layer vector at the current moment, W _t and b _o are the weight matrix and bias of the output gate respectively item.

Finally, the entity information in the natural language text is manually labeled, and the conditional random field is used to constrain the appearance order of the label symbols, and the output of the BiLSTM neural network is used as input. For each predicted sequence of the character sequence, its score is equal to the predicted score of the character itself and the character sequence. The sum of the transition scores among them, and finally select the prediction sequence with the highest score as the model output.

2) Network security event relationship extraction

First, set the type of relationship to be extracted and the definition of head and tail entities according to actual needs, and then build a PCNN (Piecewise Convolutional Neural Network, piecewise convolutional neural network) relationship extraction model based on remote supervised learning to extract relationships from the overall sample. Specific implementation methods include:

First, small-scale samples are manually labeled, and then for a large number of unlabeled samples, all labeled entity pairs are labeled as human-labeled relationships, and entity pairs with the same relationship are put into a sentence bag. Subsequent model training uses bag-of-sentence as the basic unit. Then, for each entity pair in the sentence bag, divide it into three sections at the position of the two entities, each section is put into the CNN network as a sentence for training, and the input of the CNN network is the character embedding vector and the character and The spliced vector of the relative distance between two entities is output as the confidence of the sentence in each relationship category, and finally the sentence with the highest confidence is selected as the feature of the sentence bag, and used as the judgment of the entity relationship standard.

Step 3: Build a security event attack chain

The security event attack chain is composed of a series of attack behaviors, which is used to describe the action sequence and logic of the attacker in this attack event. In this embodiment, the attack behavior is limited to fixed types of network attack techniques, including illegal tampering, brute force cracking, remote control, data theft, DoS attacks, scanning detection, website hanging horses, etc. (these are network security sub-events), while adding attack The start and attack end markers serve as the head and tail of the attack chain in order to extract the characteristic information of the first attack and the final purpose. Specific implementation methods include:

First, experts are organized to build an attack behavior judgment rule base based on the attack behavior process, and on this basis, an attack behavior judgment model is constructed to realize the abstraction and extraction of network security event description triplets. Among them, the method of "constructing an attack behavior determination rule base" is: manually analyzing the attack behavior process, and constructing the corresponding relationship between the entity relationship and the attack behavior. Among them, the method of "constructing an attack behavior judgment model" is: using the constructed attack behavior judgment rule base, searching for entities and relationships conforming to the rules in the entity instance graph, and marking them as corresponding attack behaviors.

Attack behaviors are then sorted based on timeline and logical order. The specific method is: for each identified attack behavior, retrieve the time information of the paragraph it is in, and mark it as the occurrence time of the attack behavior, and sort it according to the order of time; if there is no explicit time information, manually mark it Logical words (first, second, then, last, etc.) in the natural language text are extracted, and the logical order is artificially set, and the attack behaviors are sorted based on this.

Step 4: Feature model training and traceability prediction

According to the attack chain information of the known attack source (attack organization) obtained in step 3, input it into the Bayesian network for training. The specific implementation method is to maintain a matrix M _m*m , where m represents the type of known attack behavior, and each element M _ij in the matrix represents the probability that the next attack after attack behavior i is attack behavior j, and the calculation method is:

For subsequent text-based threat intelligence of network security events from unknown attack sources, first go through the process of step 1 to step 3 to process and obtain the attack chain information of this attack event X={x ₁ ,x ₂ ,...,x _t }, and then calculate its confidence for each attack organization based on the existing Bayesian network, the calculation method is:

Among them, t represents the length of the attack chain, and k represents the iteration variable.

Finally, the attack organization with the highest confidence is selected as the traceability prediction result.

Another embodiment of the present invention provides a text-based threat intelligence-based attack chain construction and attack traceability system using the above method, which includes:

The data collection and preprocessing module is used to collect text-based threat intelligence of attack events of known attack organizations, and perform data preprocessing operations on the collected text-based threat intelligence to make it meet the subsequent model analysis requirements;

The entity and relationship extraction module is used to extract network security entities and relationships to form a network security event description triplet;

The attack chain generation module is used to summarize the network security sub-events, and based on the timeline and logical sequence, build a security event attack chain and describe the security event process;

The feature model training and traceability prediction module is used to train the attack organization feature model based on the generated security event attack chain, and perform traceability prediction for network security events with unknown attack sources.

For the specific implementation process of each module, refer to the foregoing description of the method of the present invention.

Another embodiment of the present invention provides a computer device (computer, server, smart phone, etc.), which includes a memory and a processor, the memory stores a computer program configured to be executed by the processor, Said computer program comprises instructions for carrying out the steps in the method of the invention.

Another embodiment of the present invention provides a computer-readable storage medium (such as ROM/RAM, magnetic disk, optical disk), the computer-readable storage medium stores a computer program, and when the computer program is executed by a computer, the method of the present invention is implemented each step.

The specific embodiments of the present invention disclosed above are intended to help understand the content of the present invention and implement it accordingly. Those skilled in the art can understand that various replacements, changes and changes can be made without departing from the spirit and scope of the present invention. Modifications are possible. The present invention should not be limited to the content disclosed in the embodiments of this specification, and the scope of protection of the present invention is subject to the scope defined in the claims.

Claims (10)

1. A text-based threat intelligence-based attack chain construction and attack source tracing method, characterized in that it comprises the following steps: Collect text-based threat intelligence on attack events of known attacking organizations, and perform data preprocessing operations on the collected text-based threat intelligence to meet subsequent analysis requirements; Use the collected text-based threat intelligence to extract network security entities and relationships to form a network security event description triplet; For the extracted network security event description triplets, build a security event attack chain based on the timeline and logical sequence; Use the security event attack chain of known attack organizations to train the attack organization characteristic model, and perform traceability prediction of unknown source attack events based on the trained attack organization characteristic model. 2. The method according to claim 1, wherein the text-based threat intelligence includes the sequence of actions, the impact on the system under attack, and damage indicators, wherein the attack action sequence of the attacker in this attack event is related to The description of the target is more valuable for subsequent analysis and modeling; the data preprocessing operation removes irrelevant data, repeated data, and abnormal symbols in the text-based threat intelligence, and completes some incomplete information based on the existing network security database. Solve the inconsistency of information to improve the quality of collected data and ensure the integrity and accuracy of collected data. 3. The method according to claim 1, wherein said extracting network security entities and relationships by using the collected text-based threat intelligence to form a network security event description triplet comprises: according to the collected text-based threat information, Use natural language processing technology to extract network security entities, and use distance supervision learning to realize the relationship extraction between entities, and form entity-relationship-entity format description triples of network security events. 4. The method according to claim 3, wherein the extraction of network security entities using natural language processing technology is to use the BERT-BiLSTM-CRF network to realize network security entity extraction, and the steps include: Segment the input text-based threat intelligence text into character sequences S={s ₁ ,s ₂ ,...,s _n }, and use the BERT model to embedding characters as vectors, in which special proper nouns and English words are used as A character is embedded; Use the character vector sequence X={x ₁ ,x ₂ ,...,x _n } output by BERT as the input of the BiLSTM neural network; Manually annotate entity information in natural language text, and use conditional random field to constrain the order of appearance of annotation symbols, and use BiLSTM neural network output as input. For each predicted sequence of character sequence, its score is equal to the predicted score of the character itself and the difference between the character sequence. The sum of the transfer scores, and finally select the predicted sequence with the highest score as the model output. 5. The method according to claim 3, wherein the step of using remote supervised learning to realize inter-entity relationship extraction comprises: First, small-scale samples are manually labeled, and then for a large number of unlabeled samples, all labeled entity pairs are labeled as human-labeled relationships, and entity pairs with the same relationship are put into a sentence bag. Subsequent model training uses sentence bags as the basic unit; Then, for each entity pair in the sentence bag, divide it into three sections at the position of the two entities, each section is put into the CNN network as a sentence for training, and the input of the CNN network is the character embedding vector and the character and The concatenated vector of the relative distance between two entities is output as the confidence of the sentence in each relationship category, and finally the sentence with the highest confidence is selected as the feature of the sentence bag, and used as the criterion for determining the entity relationship. 6. The method according to claim 1, wherein the step of building a security event attack chain comprises: first organizing experts to build an attack behavior judgment rule base based on the attack behavior process, and building an attack behavior judgment model on this basis , so as to realize the abstraction and extraction of network security event description triplets, and then sort the attack behaviors based on the timeline and logical order. 7. The method according to claim 1, wherein the training attacking organization characteristic model using the security event attack chain of known attacking organizations comprises: forming a Bayesian conditional probability network of network security sub-event categories, Input the security event attack chain of a known attack organization, and train the conditional probability of each node as the attack characteristic image of the attack organization, that is, the attack organization characteristic model; the traceability prediction of unknown source attack events is performed based on the trained attack organization characteristic model , including: for text-based threat intelligence of attack events from unknown sources, convert it into a security event attack chain, match the attack feature portrait of known attack organizations, and select the attack organization with the highest confidence as the traceability prediction result. 8. A text-based threat intelligence-based attack chain construction and attack traceability system using the method of any one of claims 1 to 7, characterized in that it includes: The data collection and preprocessing module is used to collect text-based threat intelligence of attack events of known attack organizations, and perform data preprocessing operations on the collected text-based threat intelligence to make it meet the subsequent model analysis requirements; The entity and relationship extraction module is used to extract network security entities and relationships to form a network security event description triplet; The attack chain generation module is used to summarize the network security sub-events, and based on the timeline and logical sequence, build a security event attack chain and describe the security event process; The feature model training and traceability prediction module is used to train the attack organization feature model based on the generated security event attack chain, and perform traceability prediction for network security events with unknown attack sources. 9. An electronic device, characterized in that it comprises a memory and a processor, the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program includes a computer program for performing claims 1- 7. Instructions for the method of any one of claims. 10. A computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a computer, the method according to any one of claims 1-7 is realized.

Images