基於遮罩式圖自編碼器之進階持續性威脅偵測與攻擊情境重建

Abstract

進階持續性威脅 (APT) 是長期執行的網路攻擊，其過程隱密且不易被察覺。由於攻擊者的策略雖然相似但手段不同，常見的入侵偵測系統在偵測攻擊時容易被規避，亦無法關聯長期的潛伏行為；異常偵測系統則無法有效辨別已知攻擊，亦需時常調整偵測策略以適應系統正常行為的變化避免模型漂移，使得系統維護成本提升。為了解決上述問題，我們在本論文中提出基於遮罩式圖自編碼器的攻擊偵測系統，用於從系統審計日誌生成的溯源圖中檢測 APT 和重建攻擊情境。遮罩式圖自編碼器從溯源圖中代表系統實體的節點提取多跳行為資訊並作為其特徵，透過重建圖的遮蔽部分實現自監督學習並提高處理大量節點的效率。本系統抽取隱含在圖中的攻擊模式並將其抽象化為節點特徵，解決了過去無法偵測攻擊變體的問題，並作為攻擊偵測模組的基礎。我們的攻擊偵測模組使用監督式學習搭配重抽樣攻擊節點數據以增強模型偵測穩定性，可以有效辨別節點特徵中的惡意行為模式，以從正常系統活動中區分出攻擊。最後，我們提出最大二子圖和兩跳重建策略以重建攻擊情境，重建出的情境圖可提供不同警報間的關聯性，並進一步消除潛在的誤報使攻擊情境圖更加精簡。實驗結果顯示本系統的 AUC 分數約為 0.9，比基於規則的檢測器高18％。攻擊情境重建模組涵蓋了73%的攻擊活動，顯示系統能夠捕獲大多數的異常系統實體，並最大限度地減少冗餘資訊。

Advanced Persistent Threats (APTs) are cyberattacks executed over a long period, and the process can be subtle and not easily detectable. Traditional Intrusion Detection Systems (IDSs) are not always effective in detecting APTs because these attack measures vary although they share similar strategies. To address these problems, we propose a system utilizing Masked Graph Autoencoders (MGAE) with a Multilayer Perceptron (MLP) attack detector for APT detection and attack scenario reconstruction from system audit logs. The MGAE extracts multi-hop behavioral information from nodes representing system entities in the provenance graph and produces node representations. By reconstructing the masked part of the graph, the MGAE realizes self-supervision and reduces computation overhead. The learned node representations address the problem of traditional IDSs not detecting the variants of attacks by abstracting the attack patterns into node representations, and serve as the foundation for our attack detection module. Conceptually aligned with misuse detection, our MLP attack detector was trained to learn malicious behavioral patterns encoded in the node representations to differentiate between benign and malicious activities. Lastly, we proposed a largest-two-subgraphs and two-hop reconstruction strategy to recover the attack scenario, removing potential false positives to keep the results more concise. Experimental evaluation demonstrates that the detector achieves an AUC score of approximately 0.9, which is competitive with other learning-based detectors and is 18% higher than a policy-based detector. The reconstruction module achieves 73% coverage of attack campaigns, comparable to previous works and signifying its ability to capture the majority of compromised entities while minimizing redundant information.