Lateral movement attack detection method and system based on heterogeneous graph network

Abstract

The invention relates to a lateral movement attack detection method and system based on a heterogeneous graph network. According to the method, based on an authentication log of an intranet, a login behavior graph between a user and a host is structured, a user login graph and a source host path graph are constructed, and then two-stage anomaly detection is performed on the graphs. In the first stage, based on a user login graph, a mutual information maximization graph neural network algorithm is used to learn a behavior pattern of a host, and then a partial abnormal sample is calculated through a local abnormal factor algorithm; and in the second stage, based on the source host path diagram and the labeled sample obtained in the first stage, semi-supervised learning is performed by using a heterogeneous diagram attention network algorithm, and a lateral movement attack behavior is detected. According to the method, the lateral movement attack behavior can be simply and effectively detected without sample labels, the effect exceeds that of most supervised learning methods, and the method has a high recall rate and a low false alarm rate.

Description

Technical field [0001] The present invention relates to the field of computer network security, and is used to counter the lateral moving attack behavior implemented in advanced persistent threats, more specifically, a transverse moving attack detection method and system based on heterogeneous network. Background technique [0002] In recent years, with the rapid development of the Internet, the network environment has become increasingly complex, and the network attack is increasingly presenting a high-frequency situation. Among them, Advanced Persistent Threat, APT benefits from the progress of the attack technique and the improvement of attack organizationality, and the attack is increasingly frequent. Compared to other attacks, APT attacks have longer latent cycles and greater destructive power, such as intervention in US elections, destroying grids. Its attack technique is also more comprehensive and able to develop customized attack tools through long-term observation of th...

AI Technical Summary

Problems solved by technology

[0005] In summary, lateral movement attacks usually operate by stealing user credentials and pretending to be normal users, which is highly concealed and difficult to detect

Existing research methods for lateral movement attack detection usually convert it to the detection of abnormal users or hosts in the intranet, but there are still the following shortcomings and deficiencies: First, the massive multi-source security logs make the false positives of existing methods rate is usually higher

Second, in the actual network environment, it is often impossible or only a small part of abnormal users or hosts can be observed, and this part of abnormal users or hosts has not been fully utilized; third, the intranet is essentially a network composed of users and hosts. The association graph of the graph, and the detection of lateral movement attacks on the graph remains to be studied

Images