Risk detection method, device, equipment and storage medium

Abstract

The embodiment of the present invention proposes a risk detection method, device, device, and storage medium, wherein the method includes obtaining the subgraph structure of the target node, and the subgraph structure includes the node neighbors of the target node at multiple time points within a preset time period Snapshot, the node neighbor snapshot includes the association relationship between the target node and at least one associated node of the target node; obtain the time series vector list of the target node according to the subgraph structure; input the time series vector list into the risk detection model to obtain the risk detection result of the target node. The method of the embodiment of the present invention can integrate multi-source heterogeneous threat intelligence data, thereby constructing a time-series association network formed by node characteristics and node association relationships under long-term performance, and realizing node sceneization through association learning and time series prediction risk prediction.

Description

technical field [0001] The present invention relates to the technical field of information security, in particular to a risk detection method, device, equipment and storage medium. Background technique [0002] With the increasing amount of information, there are more and more malicious documents, malicious webpages, malicious execution files, etc. Therefore, it is extremely important to carry out risk detection on intelligence information to improve information security. For risk detection of intelligence information, graph structure information can be extracted by artificially constructing features. For example: artificially construct measurement indicators such as degree centrality, betweenness centrality and close centrality, use statistical values ​​such as the number of accounts associated with devices, and combine the characteristics of a certain node neighborhood of the associated network to conduct risk analysis. This scheme is based on artificially constructed fea...

AI Technical Summary

Problems solved by technology

Its disadvantage is that iterative calculation is usually required, and the calculation overhead is high on massive data sets, the results are difficult to converge, and the interpretability is poor.

Images