Attack Chain Reconstruction Method Based on LLM Prior-Knowledge Guidance and Heterogeneous Graph Reasoning

Abstract

In the face of multi-stage and cross-device complex network attacks, reconstructing the complete attack link from massive heterogeneous security logs is the core problem of security operation. In the existing methods, the traditional graph model lacks a deep understanding of the semantics of alerts, and large language models (LLMs) have the ability of textual reasoning, but have difficulty effectively using the topology between entities, and have difficulty uniformly representing and globally relating multi-source heterogeneous data. Aiming at the above problems, this paper proposes a heterogeneous graph attack chain reconstruction method based on LLM prior-knowledge guidance. Firstly, ontology schemas of six types of core security entities and four types of relationship types are designed for multi-source security logs, and a unified heterogeneous graph representation is constructed by integrating temporal association, spatial association and semantic association. Events scattered in different devices and time windows are correlated into structured views. Secondly, the domain-adaptive fine-tuned LLM is used to encode the deep semantics of the node attribute text, and it is fused with the structural features to make up for the shortcomings of traditional graph neural networks that only rely on shallow statistical features. On this basis, a heterogeneous graph attention mechanism guided by LLM prior knowledge is designed, the attention weight is modulated by the LLM’s semantic score of edge rationality, and candidate attack links are generated by multi-step path reasoning along high-confidence edges. Finally, the logical verification and attack confirmation of the candidate link were carried out step by step with the help of the chain-of-thought ability of LLM, and the confidence was calibrated by temperature scaling. Experiments on DARPA TC and other datasets show that the integrity rate of attack link reconstruction is 86.4%, the coverage rate of attack phase is 82.1%, and the F1 value of attack confirmation is 90.6%, which is significantly better than the methods based on a probabilistic graph model, Heterogeneous Graph Transformer and pure LLM hint engineering. This verifies the effectiveness of the cooperation between semantic understanding and structural reasoning.