Summary graph generation method of system log dependency graph for attack investigation and restoration

Abstract

The invention provides a summary graph generation method of a system log dependency graph for attack investigation and restoration, comprising: determining a system entity dependency graph of an attack event to be investigated and restored, the dependency graph comprising system entity nodes associated with the attack event and a call relationship between the system entity nodes; the system entity nodes comprise process nodes and resource nodes; executing hierarchical random walk on process nodes in the dependency graph, and determining behavior representation of the process nodes; clustering the process nodes based on the behavior representation, and dividing the dependency graph into at least one first sub-graph based on a clustering result; compressing each first sub-graph to obtain at least one second sub-graph; generating a summary corresponding to each second sub-graph, and obtaining a summary graph corresponding to the dependency graph. According to the method, the dependency graph is divided into the sub-graphs, and the simple summary is provided for each sub-graph to generate the summary graph, so that the summary of related system activities and the summary information of the sub-graphs related to attacks can be conveniently checked.

Description

technical field [0001] The present invention relates to the technical field of network security, in particular to a method for generating a summary graph of a system log dependency graph for attack investigation and restoration. Background technique [0002] In response to cyber attacks, causal analysis based on system monitoring has become an important method for attack investigation. [0003] The causal analysis method uses the system entity dependency graph to represent system call events. Based on the system entity dependency graph, the context information of the attack can be investigated by reconstructing the event chain leading to the POI (Point of Interesting) event. Such context information can Effectively reveal incidents related to attacks. However, due to the dependency explosion problem, it is difficult to efficiently extract the required contextual information from a huge graph, requiring extensive manual inspection. [0004] Aiming at the problem of dependen...

AI Technical Summary

Problems solved by technology

However, due to the dependency explosion problem, it is difficult to efficiently extract the required contextual information from a huge graph, requiring extensive manual inspection

[0004] For the problem of dependency explosion, existing methods mainly include technologies such as automatically filtering irrelevant events in the dependency graph and revealing attack-related events. Although these attack investigation techniques based on the dependency graph of system entities have achieved good results, there are still manual attacks. investigation, making the scope of practical application more limited

Images