The application provides a
negative sample enhancement APT
attack detection method based on graph
structure learning, mainly solving the problem that the existing
data set compatibility, edge information utilization and insufficient negative samples of the
data set lead to poor detection effect. The scheme comprises the following steps: 1) obtaining a heterogeneous
data set and constructing a visual
traceability graph; 2) preprocessing the
traceability graph, dividing it into snapshots according to the time stamp, and constructing a
training set and a
test set; 3) designing an
encoder and a decoder of the graph neural network, taking the time window, the node feature, the
adjacency matrix and the edge feature as the input of the
encoder, and generating the reconstructed
adjacency matrix through the decoder; 4) designing a
loss function, and training the graph neural network through RNN; and 5) inputting the to-be-detected data into the trained model, identifying abnormal
attack traffic, and completing the detection. The application can effectively improve the accuracy and robustness of APT
attack detection, and can be used for the development and deployment of the APT attack detection and defense
system in the
network security field.