Abstract: The attack capability features of malicious samples can reflect the technical tactics of attackers,which is an important clue for advanced persistent threat(APT) attribution analysis.However,the continuous evolution of APT attack techniques tends to cause feature drift,making traditional fixed-feature-engineering methods difficult to adapt to new feature distributions and thereby weakening the model’s generalization ability.To address this issue,a robust attribution framework for attack capability features is proposed.Firstly,a semantic co-occurrence network of attack capability features is constructed,and an inductive graph neural network is introduced to jointly learn the semantics and co-occurrence relationship of features.Semantic clustering is then used to compress the feature space to generate a more stable aggregated feature representation.Secondly,a feature induction method is designed to realize the semantic generalization of unknown features,and a soft voting mechanism is used to integrate the predictions of multiple models,thereby improving the robustness and generalization capability of the attribution analysis.Experiments on a malicious sample dataset containing 91 APT groups show this method achieves macro-average and micro-average F1 scores of 71.46% and 81.15%,respectively,demonstrating its effectiveness.

Key words: Malicious samples, Attack capability features, Advanced persistent threat, Attribution analysis, Semantic co-occurrence network