Network space security threat detection method and system based on heterogeneous graph embedding

Abstract

The embodiment of the invention provides a heterogeneous graph embedding-based network space security threat detection method and system. The method comprises the steps of obtaining entity behavior data; associating all data items in the entity behavior data according to the meta-attribute association relationship to obtain a data item sequence, and constructing a heterogeneous graph based on thedata item sequence; converting each node in the heterogeneous graph into a low-dimensional vector based on a graph embedding learning method, and obtaining vectorized expression of each node; and analyzing and processing the features of the vectorized expression to judge whether the data item corresponding to the vectorized expression is a malicious behavior or not. According to the embodiment, the heterogeneous graph for threat detection is established, entity behavior data items are simplified and represented in a vectorized mode, data item level threat detection for network space security is provided, later manual correction is not needed, labeled data items serve as training samples, and the detection precision and the detection feasibility are effectively improved.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a method and system for detecting cyberspace security threats based on heterogeneous graph embedding. Background technique [0002] Modern information systems have become an important and irreplaceable part of today's enterprises and organizations. However, the system is always at risk of cyberspace security threats. The main cyberspace security threats are manifested in two aspects, one is internal attack threat, and the other is advanced persistent threat (APT attack). [0003] Insider attack threats usually come from internal malicious employees who have legitimate access to information systems and have the threat of using access rights to destroy the confidentiality, integrity, or availability of information systems. The threat subject of an APT attack usually first infiltrates into the hosts in the target network and steals legal accounts and permissions, and then uses th...

AI Technical Summary

Problems solved by technology

[0011] The embodiment of the present invention provides a cyberspace security threat detection method and system based on heterogeneous graph embedding to solve the defects of single cyberspace s

Images