Apt network attack detection method based on meta-path learning and subgraph sampling

Abstract

An APT network attack detection method based on meta-path learning and subgraph sampling, including the following steps: 1) Construction of a heterogeneous graph based on log data: define the system behavior involved in the system log data, and construct a representation system behavior on this basis 2) Meta-path definition and meta-path learning: Define the meta-path in the heterogeneous graph, and then perform node sequence sampling and node embedding learning based on the meta-path; 3) Construction of detection model based on sub-graph sampling : Sampling the subgraph representing the elements to be detected from the heterogeneous graph, and then using the subgraph to detect network attacks. The invention monitors the APT network attack based on the system log data, which is convenient for discovering the real destructive behavior of the network attack on the system; the heterogeneous graph is used for modeling, which can represent complex system behavior; the sub-graph sampling is used to construct the detection model, which can overcome the The latent nature of APT network attack behavior.

Description

technical field [0001] The invention relates to the technical fields of network security and machine learning, in particular to an APT network attack detection method. Background technique [0002] APT network attack is a planned and continuous network attack launched against the government, core infrastructure, important industries, etc. Compared with traditional network attacks, APT network attacks have the characteristics of high concealment, long incubation period, and various attack methods, which makes it difficult for traditional network traffic-based detection methods to deal with them. Therefore, it is one of the effective means to deal with the concealment and diversity of APT network attacks to conduct all-round monitoring of system behavior to discover the actual damage behavior of APT network attacks on the system. [0003] On the other hand, with the development of machine learning technology, network attack detection methods based on machine learning have rec...

AI Technical Summary

Problems solved by technology

However, due to the complexity of system behavior contained in system log data, it is difficult for general deep learning networks to model it.

However, if artificially predefined features are directly extracted from system log data, it will cause a huge loss of information due to the complexity of APT network attacks

Images