中图分类号：TP393 文献标志码：A DOI: 10.16157/j.issn.0258-7998.267942
中文引用格式： 乌吉斯古愣，汪枫云，陈静，等. 基于事件语义关联融合的APT攻击场景重构方法[J]. 电子技术应用，2026，52(7)：68-76.
英文引用格式： Wujisiguleng ，Wang Fengyun，Chen Jing，et al. APT attack scenario reconstruction via fusing event semantic correlations[J]. Application of Electronic Technique，2026，52(7)：68-76.

APT attack scenario reconstruction via fusing event semantic correlations

Abstract： Advanced Persistent Threat (APT) attacks pose severe risks to critical information infrastructure due to their high degree of stealth, persistence, and phased progression. The attack scenarios of APT constitute typical complex attack patterns. Traditional point-based detection methods struggle to effectively reconstruct the complete picture of such attacks from massive and heterogeneous event log sets. This paper proposes an APT attack scenario reconstruction method based on the fusion of event semantic correlations. First, a multi-level, semantic-enhanced event log correlation framework integrated with Large Language Model (LLM) capabilities is designed, by incorporating security entity and attack behavior semantics, it constructs a correlation structure from "attack short chains" to "attack long chains". Second, to address the uncertainty in mapping attack behaviors to attack phases, a Hidden Markov Model (HMM)-based attack phase inference model is constructed. By integrating event semantic information, this model maps attack long chains to standard kill chain phases, thereby identifying complete APT attack chains. Experimental results demonstrate that, on a simulated dataset containing noise and APT attacks, the proposed method can effectively identify complete and partially observed APT attack scenarios, significantly improving the accuracy and robustness of scenario reconstruction.

Key words : Advanced Persistent Threat （APT）；Large Language Model （LLM）；semantic correlation fusion；Hidden Markov Model （HMM）；attack scenario reconstruction