Internal threat detection method based on hypergraph representation learning

Abstract

The invention relates to an internal threat detection method based on hypergraph representation learning. The internal threat detection method comprises the steps of calculating behavior duration and integrating data; preprocessing the data and dividing a data set; training the hypergraph neural network through the training set; in the test set, judging whether the nodes exist in the training set, and if so, performing node vector representation; otherwise, performing hypergraph neural network representation learning; feature construction; comprising the following steps: calculating cosine similarity between every two attribute features, and calculating an average value and a variance of the cosine similarity as new features; training and testing a classification model; and outputting an abnormal behavior detection result. The hypergraph neural network is applied to internal threat anomaly detection for the first time. And time is greatly saved. Meanwhile, the hypergraph neural network belongs to an inductive learning method, nodes which do not appear can be concluded according to an existing model, and therefore judgment of a new node behavior event is improved.

Description

Technical Field

[0001] The invention relates to an internal threat detection method based on hypergraph representation learning, and belongs to the technical field of internal threat detection. Background Art

[0002] With the rapid development of information technology and the continuous expansion of data scale, enterprises and organizations are facing more and more complex security threats. Internal threats have become an important research direction in the field of information security. Internal threats are usually caused by internal personnel with legitimate access rights, who may damage the sensitive information and systems of the enterprise due to negligence, malicious behavior or coercion by external forces. Traditional anomaly detection methods have many shortcomings in dealing with internal threats and it is difficult to effectively identify complex threat patterns. As an emerging graph neural network technology, hypergraph neural network can model complex high-order relationships and interactions, providing a new technical approach for internal threat detection.

[0003] Anomaly detection in graphs has been an important research direction in recent years and has been widely used in network security, financial anti-fraud, behavioral analysis and other fields. Graph-based anomaly detection methods identify potential abnormal patterns by mining the complex relationships between nodes and edges. Graph structured data consists of nodes and edges. Nodes represent entities, and edges represent the relationships between entities. Graph neural networks update the feature representation of nodes by aggregating information about node neighbors, thereby capturing the relationships between nodes and graph structure information.

[0004] A hypergraph is an extended form of a graph, where a hyperedge can connect two or more nodes, not just two nodes. Hypergraphs are used to represent more complex multivariate relationships and are suitable for handling interactions and associations involving multiple entities. Hypergraph neural networks implement message passing between nodes through hyperedges, and each node receives and sends messages from its connected hyperedges. The update formula for HGNN is D v is the diagonal matrix of node degrees, D e is the diagonal matrix of the hyperedge, W is the unit matrix of the weights assigned to each hyperedge, Θ (l) It is a fully connected layer operation that transforms the dimension of X. The degree of a node is the sum of the hyperedge connected to the node and the weight of the hyperedge, and the degree of the hyperedge is the number of connected nodes.

[0005] Existing graph-based anomaly detection methods construct attribute graphs by mining the co-occurrence relationship between behavioral attributes, and at the same time introduce event space to construct event composite models. After graph neural network training, the node feature vector representation is learned, and then the similarity between two nodes and its mean variance are calculated as new features. The original attribute features and new features are input into the subsequent classifier for anomaly detection.

[0006] The existing technology affects abnormal detection for normal new features in abnormal behavior events, increasing the false negative rate. Before building the graph, it is necessary to build co-occurrence relationship pairs and event spaces, which consumes a lot of time. Time features are not fully considered, only absolute time is used. Attributes are directly used as nodes, and the graph structure is relatively complex. Nodes that have not appeared are assigned empty values, resulting in a large loss of information. Summary of the invention

[0007] In view of the shortcomings of the prior art, the present invention proposes an internal threat detection method based on hypergraph representation learning;

[0008] Terminology explanation:

[0009] 1. The CERT dataset is a publicly accessible employee behavior dataset based on insider threats. The CERT department of the Software Engineering Institute of Carnegie Mellon University maintains a database of more than 1,000 real case studies of insider threats, and uses scenarios containing traitor instances and disguised activities to generate a series of synthetic insider threat datasets called CERT datasets. There are six major versions of the CERT dataset (r1 to r6), of which the CERT-r4.2 dataset is the most commonly used version in recent years. The dataset includes activity logs of 1,000 employees collected over 18 months. The activity logs of these employees include logins, devices, files, http and email files, as well as some organizational information such as employee departments and roles. Each file consists of columns related to user ID, timestamp, and activity.

[0010] 2. Co-occurrence refers to the situation where two or more objects appear at the same time in the same context or the same event. Co-occurrence is often used in various data mining and text analysis tasks to identify and quantify the associations and interactions between objects. Hypergraph Neural Network (HGNN) is an extension of traditional Graph Neural Network (GNN) for processing hypergraph structured data. Unlike traditional graphs, hypergraphs allow a hyperedge to connect multiple nodes, not just two nodes. This enables hypergraphs to better represent complex relationships and high-order interactions, such as in applications in social networks, recommendation systems, bioinformatics, and other fields.

[0011] 3. Property Graph is a graph model used to represent data. It can directly attach properties to vertices and edges, making the data model more intuitive and flexible.

[0012] 4. XGBoost, the full name is eXtreme Gradient Boosting, which is an optimized distributed gradient boosting library designed to be efficient, flexible and portable.

[0013] 5. Hypergraph neural network HGNN, a data structure that can connect any number of nodes, breaking through the limitations of traditional graph networks. In traditional graphs, an edge must be established between a researcher and each paper he publishes, which will lead to problems such as an increase in the number of edges and an increase in the amount of computation. In a hypergraph, a researcher and all his papers are connected by only one hyperedge, which can be represented as a collection of papers published by the researcher. By introducing hypergraphs, we can understand and process these complex data relationships more effectively.

[0014] Hypergraph neural network HGNN is a framework for data representation learning in hypergraph structures. It can encode high-order data correlation in hypergraph structures and use hyperedge convolution operations to handle data correlation in the representation learning process. The main advantage of HGNN is that it can learn hidden layer representations that take into account high-order data structures. The basic working principle of HGNN is: the neighborhood matrix and node features of the hypergraph are input into the network, and the node-edge-node conversion is performed through the HGNN layer to obtain the output label of the node. In this process, the HGNN layer performs two key steps: node feature extraction and hyperedge feature aggregation.

[0015] 6. Xgboost is an optimized gradient boosting decision tree algorithm. It improves GBDT by making improvements in the second-order Taylor expansion of the loss function, the addition of regularization terms, parallel computing, and missing value processing, thereby increasing the training speed and model generalization ability.

[0016] The basic components of XGBoost are decision trees. These decision trees are called "weak learners" and together they form XGBoost. And there is a sequence between these decision trees that make up XGBoost: the generation of the next decision tree will take into account the prediction results of the previous decision tree, that is, the deviation of the previous decision tree is taken into account, so that the training samples that the previous decision tree made mistakes will receive more attention in the future, and then the next decision tree will be trained based on the adjusted sample distribution.

[0017] The process is as follows

[0018] 1) Divide the training data into multiple blocks, each block contains one or more samples.

[0019] 2) Build the first decision tree to predict the labels of the training data.

[0020] 3) Calculate the loss function value of the first decision tree and record it as the residual.

[0021] 4) Build a second decision tree to predict the residual. The goal of this tree is to minimize the residual of the first decision tree.

[0022] 5) Calculate the loss function value of the second decision tree and record it as the new residual.

[0023] 6) Repeat steps 3-5 until the preset number of iterations is reached or the residual reaches a satisfactory level.

[0024] The goal of Xgboost is to minimize the following expression:

[0025]

[0026] Where n is the number of training samples, T is the number of decision trees, and λ t and γ t is the regularization parameter, x i is the feature vector of sample i, y i is the true label of sample i, is the predicted label of sample i, h t (x i ) and g t (x i ) are the first-order and second-order feature derivatives of the t-th decision tree for sample i.

[0027] 7. Word2vec is a model for natural language processing that can transform words into computable and structured high-dimensional vectors. The core idea of ​​the Word2vec model is to learn the vector representation of words through the context information of words.

[0028] Word2vec has two models: CBOW and Skip-gram

[0029] CBOW (Continuous Bag of Words) model: predicts the target word through context words. Given a context window of a word (e.g. two words before and after), predict the word at the center of the window.

[0030] Skip-gram model: predict context words through target words. Given a word, the goal of the Skip-gram model is to predict the words in the context window of the word.

[0031] The training process of the Word2vec model can be divided into the following steps:

[0032] 1) Build a vocabulary: Extract all the different words from the training corpus and build a vocabulary.

[0033] 2) Initialize word vectors: Randomly initialize a word vector for each word in the vocabulary.

[0034] 3) Construct training samples: Construct training samples from the training corpus, each sample contains a central word and its context words.

[0035] 4) Train the neural network: Use training samples to train the neural network model and optimize word vectors.

[0036] 5) Extract word vectors: After training is completed, extract the word vector corresponding to each word as the final result.

[0037] 8. Cosine similarity is a measure of the degree of directional similarity between two vectors in a high-dimensional space. It is often used in text analysis and information retrieval to compare the similarity of two texts.

[0038] The technical solution of the present invention is:

[0039] An internal threat detection method based on hypergraph representation learning, comprising:

[0040] Calculate behavior duration and aggregate data;

[0041] Data preprocessing and data set partitioning;

[0042] Train the hypergraph neural network using the training set;

[0043] In the test set, determine whether the node exists in the training set. If so, perform node vector representation; otherwise, perform hypergraph neural network representation learning;

[0044] Feature construction: including: calculating the cosine similarity between two attribute features, and calculating the average and variance of these cosine similarities as new features;

[0045] Classification model training and testing;

[0046] Output abnormal behavior detection results.

[0047] Preferably according to the present invention, the data set is the CERT-r4.2 data set.

[0048] Preferably, according to the present invention, the behavior duration is calculated and the data is integrated; comprising:

[0049] Calculate the time difference between two actions of the same user and use it as a new attribute duration, that is, the duration of the action.

[0050] According to the preferred embodiment of the present invention, data preprocessing includes:

[0051] First, sort the event files according to user and date, and calculate the behavior duration; at the same time, add an attribute indicating the file type to each event file;

[0052] Next, integrate the attribute values ​​with commonality to reduce the number of attribute values;

[0053] Finally, the event file is sorted by date to ensure that the events occur in time, and then the date attribute is deleted; the event file is sorted by time and includes all events of type, user, pc, activity, duration, week, hour, and sign attributes.

[0054] Further preferably, integrating common attribute values; including:

[0055] Count the number of times each user uses the PC, and use the PC with the most usage as the user's personal PC. Simplify the PC attribute value into two nodes: "Use personal PC" and "Use other people's PC";

[0056] For the activity attribute whose type is email, change the attribute value of the activity attribute to two nodes: "Internal Email Address" and "External Email Address";

[0057] Count the number of hourly values ​​of events that occur, define the time when events frequently occur as working hours, and the rest of the time as off-get off work hours; working hours are further divided into morning, afternoon, and evening;

[0058] For duration, it is divided according to the time point, and each period of time is divided into a stage;

[0059] According to the threat event summary table, a sign attribute is added to the event file, wherein the sign attribute value of the threat event is 1, and the sign value of the normal event is 0.

[0060] Preferably according to the present invention, the data set is divided into a training set and a test set.

[0061] Preferably, according to the present invention, training a hypergraph neural network through a training set comprises:

[0062] The type, user, pc, activity, duration, week, and hour attributes are used to represent behavioral events, and the sign attribute is used to indicate whether the event is abnormal; construct a hypergraph in, is a set of nodes, ε is a set of hyperedges, and W is a diagonal matrix composed of hyperedge weights. In a hypergraph, hyperedges connect multiple nodes.

[0063] In the training set, the behavior events are deduplicated, and a hyperedge set is constructed based on the deduplicated behavior events. All non-repeated attribute values ​​are taken as node sets, and all non-repeated behavior events are used to construct a hyperedge set, forming an H association matrix with a dimension of a*b to represent the hypergraph, where a refers to the number of nodes and b refers to the number of hyperedges. Each element in the H association matrix is ​​represented as If the node and belongs to an edge, then the position value of the node and the hyperedge is 1; at this time, we have the H association matrix, and then calculate the degree of the node and the degree of the hyperedge;

[0064] definition At this time X (l+1) =σ(GX (l) Θ (l) ), where D e is the diagonal matrix of hyperedge degree, D v is the diagonal matrix of node degrees, W is the unit matrix of weights assigned to each hyperedge, and the result of matrix calculation related to the hypergraph structure is defined as G matrix, X (l) is the node representation vector of the lth layer, Θ (l) It is a fully connected layer operation, which transforms the dimension of X. σ is the activation function, and the ReLU function f(x) = max(0, x) is used. After calculation, the node representation vector X of the l+1 layer is obtained. (l+1) ;

[0065] Calculate the G matrix, assign an initial vector to each node based on the pre-trained word vector, and send the X and G matrices as input to HGNN for training;

[0066] The node attribute type is regarded as the node label and the cross entropy loss function is used for optimization. The formula is: Where C is the number of categories, y i and are the actual label and predicted probability of the i-th category respectively; the feature vector of each node is saved before the output of the fully connected layer; after multiple rounds of training, the feature vectors of these nodes become feature vectors that can better capture the graph structure and the relationship between nodes.

[0067] Further preferably, in the training set and the test set, the cosine similarity between the attributes is calculated based on the original behavior events, i.e., the behavior events before deduplication;

[0068] At the same time, the average and variance of these cosine similarities are calculated, and the average and variance of these cosine similarities are used as new features of the behavioral events.

[0069] Preferably according to the present invention, the classification model is Xgboost.

[0070] Preferably, the classification model training and testing according to the present invention includes:

[0071] Anomaly detection is considered as a binary classification problem, where behavioral events are classified into normal and abnormal based on the sign attributes;

[0072] Import the training set into Xgboost for training;

[0073] Input the test set into the trained classification model to obtain the probability that each behavior event in the test set is an abnormal behavior;

[0074] A threshold is set according to the original behavior type and work experience, and the probability of a behavior event obtained from the test set being an abnormal behavior is compared with the threshold. When the probability of a behavior event being an abnormal behavior is greater than the threshold, the behavior event is considered abnormal, otherwise, the behavior event is normal.

[0075] Further preferably, the threshold is set based on experiments, or the threshold is directly set between 0.0001 and 0.001.

[0076] A computer device includes a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of an internal threat detection method based on a hypergraph when executing the computer program.

[0077] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a hypergraph-based internal threat detection method.

[0078] The beneficial effects of the present invention are:

[0079] 1. The present invention applies the hypergraph neural network to internal threat anomaly detection for the first time. The internal attributes are used as nodes, and the behavioral events are used as rules to construct hyperedges. Using behavioral events as edges in the rule construction graph retains information at the event level. At this time, the co-occurrence relationship already exists, and there is no need to continue to build co-occurrence pairs, which greatly saves time. A hyperedge connects all the attributes in a behavioral event, making the information transmission between nodes closer, so that the abnormal nodes affect the normal nodes connected to them, so that the normal nodes are accompanied by more abnormal information, which will appear as abnormalities in subsequent detections. At the same time, the hypergraph neural network belongs to an inductive learning method, which can summarize nodes that have never appeared based on existing models, thereby improving the judgment of new node behavioral events.

[0080] 2. The present invention reduces the number of nodes in the graph by integrating nodes with commonality, thereby reducing the complexity of the graph.

[0081] 3. The present invention takes both absolute time and relative time into consideration, and improves the time feature by taking the duration of the behavior event into consideration as a new attribute. Classification is performed according to the attribute value of the same attribute, and the new category is used as the value of the attribute, thereby reducing the number of attribute values. This method not only reduces the number of nodes, but also simplifies the complexity of the graph. BRIEF DESCRIPTION OF THE DRAWINGS

[0082] Figure 1 It is a schematic diagram of the process of the internal threat detection method based on the hypergraph of the present invention;

[0083] Figure 2 Schematic diagram of nodes and hyperedges;

[0084] Figure 3 Schematic diagram of ROC curve comparison of the present invention. DETAILED DESCRIPTION

[0085] The present invention will be further defined below in conjunction with the accompanying drawings and embodiments, but is not limited thereto.

[0086] Example 1

[0087] A method for detecting insider threats based on hypergraph representation learning, such as Figure 1 As shown, including:

[0088] Calculate behavior duration and aggregate data;

[0089] Data preprocessing and data set partitioning;

[0090] Train the hypergraph neural network using the training set;

[0091] In the test set, determine whether the node exists in the training set. If so, perform node vector representation; otherwise, perform hypergraph neural network representation learning; node vector representation includes: after hypergraph neural network training, save the final node representation vector matrix X, which contains the representation vectors of all nodes in the data set. X is a matrix of the number of nodes * node vector dimensions, and each row represents a node representation vector. An encoding mapping operation is performed for each attribute, and the encoded result corresponds one-to-one with the rows of the X matrix. For example, the 0th row represents the representation vector of the attribute with an attribute value of 0. According to the corresponding rules, all attributes are transformed from numerical form to vector representation.

[0092] Feature construction: including: calculating the cosine similarity between two attribute features, and calculating the average and variance of these cosine similarities as new features;

[0093] Classification model training and testing;

[0094] Output abnormal behavior detection results.

[0095] Example 2

[0096] The difference between the internal threat detection method based on hypergraph representation learning described in Example 1 is that:

[0097] The dataset is the CERT-r4.2 dataset.

[0098] Calculate behavior duration and aggregate data; including:

[0099] Calculate the time difference between two actions of the same user and use it as a new attribute duration, that is, the duration of the action.

[0100] Integrating data means: adding a new attribute type to different behavior event files as the identifier of different files, for example, adding a type attribute with the attribute value "logon" to the logon.csv file. Merging 5 behavior event files into a total behavior event file.

[0101] Data preprocessing; including:

[0102] First, sort the event files by user and date, and calculate the duration of the behavior; at the same time, add an attribute indicating the file type to each event file; for example, add a type attribute with the attribute value "logon" to the logon.csv file. Keep the type, user, date, pc, activity, and duration attributes in each file, and integrate all event files into a complete file. Based on the year, month, day, hour, minute, and second information contained in the date attribute, calculate the day of the week and the specific time point when each event occurred, and add new attributes week and hour.

[0103] Next, integrate the attribute values ​​with commonality to reduce the number of attribute values;

[0104] Finally, the event file is sorted by date to ensure that the events occur in time, and then the date attribute is deleted; each attribute may exist in string form or different attributes may have the same value. Each attribute is encoded and mapped in the attribute_attribute value format, so that each attribute is in numerical form and the same attribute value between different attributes represents different meanings.

[0105] Table 1. Behavior event data table of cert dataset;

[0106] Field Name Data Types Field Description type String Behavior operation type, such as logon, http, etc. user String Username of the operator of the action pc String Is the user using a personal PC or someone else's PC? week Integer The day of the week the behavior occurred hour String The time period during which the behavior occurred duration Integer Duration of the behavior activity String Specific operations of behavioral events sign Integer Whether the behavior is abnormal, 1 is abnormal and 0 is normal

[0107] Finally, the event file is sorted by time and includes all events with type, user, pc, activity, duration, week, hour, and sign attributes.

[0108] Integrate common attribute values; including:

[0109] Count the number of times each user uses the PC, and use the PC with the most usage as the user's personal PC. Simplify the PC attribute value into two nodes: "Use personal PC" and "Use other people's PC";

[0110] For the activity attribute whose type is email, change the attribute value of the activity attribute to two nodes: "Internal Email Address" and "External Email Address";

[0111] Count the number of hourly values ​​of events that occur, define the time when events frequently occur as working hours, and the rest of the time as off-get off work hours; working hours are further divided into morning, afternoon, and evening;

[0112] For duration, it is divided according to the time point, and each time period (for example, 10 minutes) is divided into a stage;

[0113] According to the threat event summary table, a sign attribute is added to the event file, wherein the sign attribute value of the threat event is 1, and the sign value of the normal event is 0.

[0114] The dataset is divided into training set and test set in a ratio of 7:3.

[0115] Train the hypergraph neural network through the training set; including:

[0116] The type, user, pc, activity, duration, week, and hour attributes are used to represent behavioral events, and the sign attribute is used to indicate whether the event is abnormal; construct a hypergraph in, is a set of nodes, ε is a set of hyperedges, and W is a diagonal matrix composed of hyperedge weights. In a hypergraph, hyperedges connect multiple nodes. Figure 2 Schematic diagram of nodes and hyperedges, where small circles represent different attribute nodes and large circles represent a hyperedge between these small circles.

[0117] In the training set, we remove duplicate behavior events and build a hyperedge set based on the removed behavior events; in this way, the behavior events have shown a multi-co-occurrence relationship, that is, the seven attributes appear at the same time, avoiding the need to continue to construct two-by-two co-occurrence pairs, thus saving time. All non-repeated attribute values ​​are taken as node sets, and all non-repeated behavior events are used to build hyperedge sets, forming an H association matrix with a dimension of a*b to represent the hypergraph, where a refers to the number of nodes and b refers to the number of hyperedges. Each element in the H association matrix is ​​represented as If the node and belongs to an edge, then the position value of the node and the hyperedge is 1; at this time, we have the H association matrix, and then calculate the degree of the node and the degree of the hyperedge;

[0118] According to the update formula of HGNN definition At this time x (l+1) =σ(GX (l) Θ (l) ), where D e is the diagonal matrix of hyperedge degree, D v is the diagonal matrix of node degrees, W is the unit matrix of weights assigned to each hyperedge, and the result of matrix calculation related to the hypergraph structure is defined as G matrix, X (l) is the node representation vector of the lth layer, Θ (l) It is a fully connected layer operation, which transforms the dimension of X. σ is the activation function, and the ReLU function f(x) = max(0, x) is used. After calculation, the node representation vector X of the l+1 layer is obtained. (l+1) ;

[0119] Calculate the G matrix, treat the same behavior as a sentence, and different attributes as different words. Use Word2vec to train word vectors to obtain the word vector representation of each attribute value. According to the pre-trained word vectors, assign an initial vector to each node, and construct the node representation vector matrix X according to the order of attribute values. The dimension of X is the number of nodes * the dimension of the node vector, where the nth row represents the word vector representation of the attribute value n. Send X and the G matrix as input to HGNN for training;

[0120] When training a hypergraph neural network, a node may appear in both normal and abnormal events, that is, a user can generate abnormal events as well as normal events. Therefore, the labels of behavioral events cannot be simply assigned to nodes. One of the main goals of existing algorithms is to preserve the network structure. Therefore, the node attribute type is regarded as the label of the node. This is a multi-classification problem, which is optimized using the cross entropy function loss. The formula is: Where C is the number of categories, y i and are the actual label and predicted probability of the i-th category respectively; since the output of the training is the attribute category of each node, but our goal is to obtain a high-dimensional vector representation of each node, the feature vector of each node is saved before the output of the fully connected layer; after multiple rounds of training, the feature vectors of these nodes become feature vectors that can better capture the graph structure and the relationship between nodes. This can be used for downstream detection tasks.

[0121] Now we have the trained node feature vectors. In the training set and the test set, we calculate the cosine similarity between the attributes based on the original behavior events, i.e., the behavior events before deduplication.

[0122] The complete training set is needed for binary classification. In the above text, the training set is deduplicated based on the behavior events. The original behavior events here are the behavior events before deduplication. There are 7 attribute features in the data set. When representing the node vector, each attribute (i.e., node) of all the behavior events is assigned a vector value. The attributes are represented by high-dimensional vectors instead of the original numerical representation:

[0123] The cosine similarity formula is:

[0124]

[0125] A R and B R is the value of the i-th dimension; the cosine similarity of the seven attribute features is calculated in pairs according to the formula;

[0126] At the same time, the average and variance of these cosine similarities are calculated and used as new features of the behavior events to achieve the purpose of data enhancement.

[0127] For the test set, there may be new nodes that have not appeared in the training set. As an inductive representation learning algorithm, HGNN can still obtain information from other nodes through the hyperedges connected to them. After multiple layers of propagation, its useful feature vectors are obtained to make up for the lost information. At this time, the final behavior event is already obtained.

[0128] The classification model is Xgboost.

[0129] Classification model training and testing; including:

[0130] Anomaly detection is considered as a binary classification problem, where behavioral events are classified into normal and abnormal based on the sign attributes;

[0131] Then use XGboost as the required classifier and import the training set into Xgboost for training;

[0132] Input the test set into the trained classification model to obtain the probability that each behavior event in the test set is an abnormal behavior;

[0133] A threshold is set according to the original behavior type and work experience, and the probability of a behavior event obtained from the test set being an abnormal behavior is compared with the threshold. When the probability of a behavior event being an abnormal behavior is greater than the threshold, the behavior event is considered abnormal, otherwise, the behavior event is normal.

[0134] At the same time, the recall rate, precision rate and F1 index are calculated to judge the feasibility of the method of the present invention, which is superior to previous studies. The present invention detects abnormal behavior, so that relevant departments can make corresponding responses.

[0135] Set the threshold yourself based on experiments, or directly set the threshold between 0.0001-0.001.

[0136] The CERT-r4.2 dataset is used as the dataset to verify this method. The dataset contains 1,000 users, 70 of which are threat users. It contains 5 types of behavior event files, device.csv, email.csv, file.csv, http.csv, logon.csv, a total of 32,770,227 behavior events, of which 7,323 are threat events. Each file contains multiple attributes such as user, id, date, pc, etc.

[0137] like Figure 3 As shown in the figure, the ROC curve is an important tool for evaluating the performance of a binary classification model. It helps us understand the classification ability of a model by showing the performance of the model at different thresholds. The horizontal axis of the ROC curve is FPR (false positive rate) and the vertical axis is TPR (true positive rate). When using HGNN, the recall rate of TP (true positive), FN (false negative), FP (false positive), and TN (true negative) is 93.9%, the precision rate is 87.0%, and the F1 value is 90.3%. In the experiment, the hypergraph neural network was compared with the traditional graph neural network algorithm and it was found that the hypergraph neural network has advantages.

[0138] Example 3

[0139] A computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the internal threat detection method based on a hypergraph described in Example 1 or 2 are implemented.

[0140] Example 4

[0141] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the hypergraph-based internal threat detection method described in Example 1 or 2.

Claims

1. An internal threat detection method based on hypergraph representation learning, characterized in that: include: Calculate behavior duration and aggregate data; Data preprocessing and data set partitioning; Train the hypergraph neural network using the training set; In the test set, determine whether the node exists in the training set. If so, perform node vector representation; Otherwise, perform hypergraph neural network representation learning; Feature construction: including: calculating the cosine similarity between two attribute features, and calculating the average and variance of these cosine similarities as new features; Classification model training and testing; Output abnormal behavior detection results; Further preferably, the data set is the CERT-r4.2 data set.

2. According to claim 1, the method for detecting internal threats based on hypergraph representation learning is characterized in that: Calculate behavior duration and aggregate data; including: Calculate the time difference between two actions of the same user and use it as a new attribute duration, that is, the duration of the action.

3. The method for detecting internal threats based on hypergraph representation learning according to claim 1, characterized in that: Data preprocessing; including: First, sort the event files according to user and date, and calculate the behavior duration; at the same time, add an attribute indicating the file type to each event file; Next, integrate the attribute values ​​with commonality to reduce the number of attribute values; Finally, the event file is sorted by date to ensure that the events occur in time, and then the date attribute is deleted; the event file is sorted by time and includes all events of type, user, pc, activity, duration, week, hour, and sign attributes.

4. The method for detecting internal threats based on hypergraph representation learning according to claim 3, characterized in that: Integrate common attribute values; including: Count the number of times each user uses the PC, and use the PC with the most usage as the user's personal PC. Simplify the PC attribute value into two nodes: "Use personal PC" and "Use other people's PC"; For the activity attribute whose type is email, change the attribute value of the activity attribute to two nodes: "Internal Email Address" and "External Email Address"; Count the number of hourly values ​​of events that occur, define the time when events frequently occur as working hours, and the rest of the time as off-get off work hours; working hours are further divided into morning, afternoon, and evening; For duration, it is divided according to the time point, and each period of time is divided into a stage; According to the threat event summary table, a sign attribute is added to the event file, wherein the sign attribute value of the threat event is 1, and the sign value of the normal event is 0.

5. The method for detecting internal threats based on hypergraph representation learning according to claim 1, characterized in that: Train the hypergraph neural network through the training set; including: The type, user, pc, activity, duration, week, and hour attributes are used to represent behavioral events, and the sign attribute is used to indicate whether the event is abnormal; construct a hypergraph in, is a set of nodes, ε is a set of hyperedges, and W is a diagonal matrix composed of hyperedge weights. In a hypergraph, hyperedges connect multiple nodes. In the training set, the behavior events are deduplicated, and a hyperedge set is constructed based on the deduplicated behavior events. All non-repeated attribute values ​​are taken as node sets, and all non-repeated behavior events are used to construct a hyperedge set, forming an H association matrix with a dimension of a*b to represent the hypergraph, where a refers to the number of nodes and b refers to the number of hyperedges. Each element in the H association matrix is ​​represented as If the node and belongs to an edge, then the position value of the node and the hyperedge is 1; at this time, we have the H association matrix, and then calculate the degree of the node and the degree of the hyperedge; definition At this time X (l+1) =σ(GX (l) Θ (l) ), where D e is the diagonal matrix of hyperedge degree, D v is the diagonal matrix of node degrees, W is the unit matrix of weights assigned to each hyperedge, and the result of matrix calculation related to the hypergraph structure is defined as G matrix, X (l) is the node representation vector of the lth layer, Θ (l) It is a fully connected layer operation, which transforms the dimension of X. σ is the activation function, and the ReLU function f(x) = max(0, x) is used. After calculation, the node representation vector X of the l+1 layer is obtained. (l+1) ; Calculate the G matrix, assign an initial vector to each node based on the pre-trained word vector, and send the X and G matrices as input to HGNN for training; The node attribute type is regarded as the node label and the cross entropy loss function is used for optimization. The formula is: Where C is the number of categories, y , and are the actual label and predicted probability of the i-th class respectively; the feature vector of each node is saved before the output of the fully connected layer; after multiple rounds of training, the feature vectors of these nodes become feature vectors that can better capture the graph structure and the relationship between nodes; Further preferably, the data set is divided into a training set and a test set.

6. The method for detecting internal threats based on hypergraph representation learning according to claim 5, characterized in that: In the training set and the test set, the cosine similarity between the two attributes is calculated based on the original behavior events, i.e., the behavior events before deduplication; At the same time, the average and variance of these cosine similarities are calculated, and the average and variance of these cosine similarities are used as new features of the behavioral events.

7. The method for detecting internal threats based on hypergraph representation learning according to claim 1, characterized in that: The classification model is Xgboost.

8. The method for detecting internal threats based on hypergraph representation learning according to any one of claims 1 to 7, characterized in that: Classification model training and testing; including: Anomaly detection is considered as a binary classification problem, where behavioral events are classified into normal and abnormal based on the sign attributes; Import the training set into Xgboost for training; Input the test set into the trained classification model to obtain the probability that each behavior event in the test set is an abnormal behavior; A threshold is set according to the original behavior type and work experience, and the probability of a behavior event obtained from the test set being an abnormal behavior is compared with the threshold. When the probability of a behavior event being an abnormal behavior is greater than the threshold, the behavior event is considered abnormal, otherwise, the behavior event is normal; Further preferably, the threshold is set based on experiments, or the threshold is directly set between 0.0001 and 0.

001.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the hypergraph-based internal threat detection method are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the hypergraph-based internal threat detection method are implemented.

Images