The invention belongs to the field of
network attack detection, and particularly relates to an APT
attack detection method based on
traceability graph behavior information. The method comprises the following four steps: step 1, data preprocessing; step 2, generating a sub-graph; step 3, behavior
feature extraction; performing
feature extraction on each sub-graph, wherein the
feature extraction comprises node feature extraction and edge feature extraction; 4, designing and training a classification model, and performing
anomaly detection; and training and testing the classification model, sequentially classifying the type of each edge by using the trained model, and when a certain edge cannot be correctly classified by any existing sub-model, judging that the edge is abnormal, and outputting a behavior
structure diagram of the edge. According to the method, behavior attributes and structural information thereof are introduced into the modeling of the
traceability graph, and the category of traditionally paying attention to entity interaction relationships is exceeded; by introducing a
pooling method and graph representation learning, the expression ability of the model is improved, important information in a behavior structure is more effectively captured, and
continuous optimization is performed on the basis of initial structure information.