Abnormality detection method based on attribute graph representation learning

Abstract

The invention discloses an abnormality detection method based on attribute graph representation learning. The method comprises the following steps: acquiring an attribute graph data set; for the similarity between the nodes in the attribute graphs, expanding an attribute graph topological structure in the data set; importing the topological structure data in the attribute graphs into a TransE module to obtain an embedded vector set of nodes; taking the expanded attribute graph data set and the embedded vector set obtained in the previous two steps as input, and operating a coding module to carry out attribute graph coding; performing structure reconstruction decoding on a coded data set obtained by coding; carrying out attribute reconstruction decoding on the coded data set obtained by coding; and predicting and sorting abnormality nodes according to structure reconstruction error and attribute reconstruction error obtained by coding and decoding. According to the method, the problem that node attributes and an attribute graph topological structure are not closely associated is solved. The detection performance of the abnormality detection method based on attribute graph representation learning is significantly improved compared with the performance of the abnormality detection method based on graph convolution in the prior art.

Description

technical field [0001] The invention relates to an anomaly detection method based on attribute graph representation learning, belonging to an anomaly detection system. Background technique [0002] New technologies and applications of network information have been widely used in today's society. However, the security threats and security risks faced by cyberspace are also becoming more and more serious. Especially the APT (Advanced Persistent Threat) attack in the network attack has the characteristics of high persistence, high concealment, and high harm. According to a related research report released by the Fireeye organization, the average attack period of an APT attack exceeds 3 months. Therefore, in response to increasingly sophisticated attacks, enterprises usually deploy a large number of detection devices. These detection devices will generate a large number of logs, and in this huge log file, the log information of normal behavior occupies the vast majority. Ther...

AI Technical Summary

Problems solved by technology

[0007] In order to solve the problem of low recognition accuracy in anomaly inspection due to the above three types of deficiencies in the reconstruction and sorting of graph convolutional networks, the present invention specifically proposes an anomaly detection method based on attribute graph representation learning

Images