APT network attack detection method based on meta-path learning and subgraph sampling

Abstract

An APT network attack detection method based on meta-path learning and sub-graph sampling comprises the following steps: 1) heterogeneous graph construction based on log data: defining system behaviors involved in system log data, and constructing a heterogeneous graph representing the system behaviors on the basis of the system behaviors; 2) meta-path definition and meta-path learning: defining ameta-path in the heterogeneous graph, and performing node sequence sampling and node embedding learning based on the meta-path; and 3) constructing a detection model based on sub-graph sampling: sampling a sub-graph representing the to-be-detected element from the heterogeneous graph, and performing network attack detection by adopting the sub-graph on the basis. According to the invention, APT network attack monitoring is carried out based on the system log data, so that real damage behaviors of network attacks on the system can be found conveniently; a heterogeneous graph is adopted for modeling, and complex system behaviors can be represented; and a detection model is constructed by adopting subgraph sampling, so that the latency of APT network attack behaviors can be overcome to a certain extent.

Description

technical field [0001] The invention relates to the technical fields of network security and machine learning, in particular to an APT network attack detection method. Background technique [0002] APT network attack is a planned and continuous network attack launched against the government, core infrastructure, important industries, etc. Compared with traditional network attacks, APT network attacks have the characteristics of high concealment, long incubation period, and various attack methods, which makes it difficult for traditional network traffic-based detection methods to deal with them. Therefore, it is one of the effective means to deal with the concealment and diversity of APT network attacks to conduct all-round monitoring of system behavior to discover the actual damage behavior of APT network attacks on the system. [0003] On the other hand, with the development of machine learning technology, network attack detection methods based on machine learning have rec...

AI Technical Summary

Problems solved by technology

However, due to the complexity of system behavior contained in system log data, it is difficult for general deep learning networks to model it.

However, if artificially predefined features are directly extracted from system log data, it will cause a huge loss of information due to the complexity of APT network attacks

Images