信息网络安全

信息网络安全 ›› 2023, Vol. 23 ›› Issue (6): 91-103.doi: 10.3969/j.issn.1671-1122.2023.06.009

• 技术研究 • 上一篇    下一篇

威胁情报驱动的动态威胁狩猎方法

吴尚远1,2, 申国伟1,2(), 郭春1,2, 陈意1,2   

  1. 1.贵州大学文本计算与认知智能教育部工程研究中心，贵阳 550025
    2.贵州大学省部共建公共大数据国家重点实验室，贵阳 550025
  • 收稿日期:2023-04-28 出版日期:2023-06-10 发布日期:2023-06-20
  • 通讯作者: 申国伟 gwshen@gzu.edu.cn
  • 作者简介:吴尚远（1997—），男，广西，硕士研究生，主要研究方向为威胁狩猎|申国伟（1986—），男，湖南，教授，博士，主要研究方向为网络与信息安全、大数据、高性能网络和体系建模仿真|郭春（1986—），男，贵州，教授，博士，主要研究方向为恶意软件分析、入侵检测和数据挖掘|陈意（1991—），男，贵州，副教授，博士，主要研究方向为信息隐藏和数字水印
  • 基金资助:
    国家自然科学基金(62062022);贵州省省级科技计划(黔科合基础-ZK[2023]重点011)

Threat Intelligence-Driven Dynamic Threat Hunting Method

WU Shangyuan1,2, SHEN Guowei1,2(), GUO Chun1,2, CHEN Yi1,2   

  1. 1. Engineering Research Center for Text Computing and Cognitive Intelligence, Ministry of Education, Guizhou University, Guiyang 550025, China
    2. State Key Laboratory of Public Big Data, Guizhou University, Guiyang 550025, China
  • Received:2023-04-28 Online:2023-06-10 Published:2023-06-20

RichHTML

27

PDF (PC)

127

摘要：

近年来，随着开源威胁情报自动化提取技术的发展，在威胁情报驱动下对溯源图（Provenance Graph）进行威胁狩猎有着无需专家知识且能提供完整攻击场景的优势，是一种有效的威胁检测手段。然而，现有的威胁狩猎方法仍存在以下不足：一方面，现有方法依赖威胁指标（Indicators of Compromise，IOC）进行威胁搜索，难以在攻击逃避检测的情况下对威胁进行有效检测；另一方面，现有方法鲜有考虑持续狩猎的应用场景，忽视了持续狩猎导致的高开销。为解决以上问题，文章提出一种威胁情报驱动的动态威胁狩猎方法（Threat Intelligence-Driven Dynamic Threat Hunting Method，DyHunter），可以在攻击逃避检测导致威胁情报与真实攻击不一致的情况下进行持续的威胁狩猎。DyHunter使用复合的候选子图选择算法避免攻击节点与攻击子图被遗漏，使用一种多层图相似性学习方法分别对拓扑结构相似性与节点属性相似性进行学习以提高模型鲁棒性，生成并维护一个可疑子图以减少持续狩猎的开销。实验结果表明，与已有方法相比，DyHunter可以有效保证在攻击逃避检测的情况下的高准确性，并在持续狩猎过程中减少94.1%以上的空间开销。

关键词: 威胁情报, 溯源图, 威胁狩猎, 图相似性学习

Abstract:

In recent years, with the development of automatic extraction technology of open source threat intelligence, threat hunting on Provenance Graph driven by threat intelligence has the advantages of not requiring expert knowledge and providing complete attack scenarios, which is an effective threat detection method. However, existing threat hunting methods still suffer from several limitations. On the one hand, they rely on Indicators of Compromise (IOC) for threat searches, which makes them difficult to effectively detect threats in cases where the attack evades detection; on the other hand, existing methods often neglect the application scenarios of continuous hunting, ignoring the high costs associated with such hunting. To address these issues, this paper proposed a Threat Intelligence-Driven Dynamic Threat Hunting Method (DyHunter), which can perform continuous threat hunting even when threat intelligence is inconsistent with the actual attack due to attack evasion. DyHunter used a composite candidate subgraph selection algorithm to avoid missing attack nodes and attack subgraphs, and employed a multi-layer graph similarity learning method to learn topology and node attribute similarity to improve model robustness. It generated and maintained a suspicious subgraph to reduce the cost of continuous hunting. Experimental results show that, compared with existing methods, DyHunter can effectively ensure high accuracy under the impact of attack evasion, and reduce more than 94.1% of space overhead during the continuous hunting process.

Key words: threat intelligence, provenance graph, threat hunting, graph similarity learning

中图分类号: