A method and system for detecting false threat intelligence based on dynamic graph contrastive learning

Abstract

This invention proposes a method and system for detecting false threat intelligence based on dynamic graph contrastive learning, belonging to the field of network security technology. The method includes: acquiring CTI reports to construct a heterogeneous CTI subgraph with semantic features; acquiring communication network logs to construct a real-time network behavior graph; fusing the two into a global heterogeneous temporal graph based on IoC anchors; constructing feature encodings for the CTI semantic view and network behavior view using GAT and temporal GNN respectively; minimizing the contrastive loss through a graph contrastive learning (GCL) framework to learn a unified embedding space; and finally calculating the embedding distance of the CTI to be verified under the dual views as an anomaly score for detection. This invention, through a "semantic-behavioral" cross-validation mechanism, solves the problems of existing technologies relying on external reputation, being unable to identify semantic forgery, and lacking local fact verification, significantly improving the accuracy and robustness of threat intelligence detection, and is particularly suitable for scenarios with high data privacy requirements, such as telecommunications operators.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for detecting false threat intelligence based on dynamic graph contrast learning. Background Technology

[0002] Currently, ensuring the safe and stable operation of infrastructure is crucial in the field of cybersecurity for telecommunications operators. With the increasing sophistication of cyberattack methods, Cyber ​​Threat Intelligence (CTI) has become a core component of defense systems. However, the internet is flooded with a large amount of heterogeneous CTI data from multiple sources, including outdated, false alarms, and even deliberately fabricated intelligence by attackers.

[0003] Existing technologies mainly rely on the following two types of methods for CTI verification:

[0004] 1. Text-based analysis methods, such as SecureBERT, utilize NLP models to extract semantic features for classification. These methods ignore the structural information of the attack chain, making it difficult to identify forged intelligence that is semantically coherent but logically contradictory.

[0005] 2. Reputation-based or externally validated methods: such as FeedRank and VeraCTI, which rely on intelligence source reputation scoring or cloud-based large-scale model inference. These methods are subject to latency and are difficult to rely on external cloud services in scenarios such as those involving telecom operators with extremely high requirements for data privacy and compliance.

[0006] In addition, traditional anomaly detection methods (such as autoencoders (AE), isolated forests (IF), and DBSCAN) are mainly based on statistical regularities and lack a deep understanding of the complex semantics and topological structure of CTI, resulting in a high false alarm rate.

[0007] Existing technologies generally suffer from a disconnect between "semantics" and "facts," meaning they can only judge whether intelligence texts are written in a way that sounds real, but cannot verify whether the attack described in the intelligence actually occurred in the local network or whether there is a basis for it to occur. Summary of the Invention

[0008] This invention aims to address the problems of existing technologies being unable to effectively integrate semantic and structural information and lacking localized fact-checking mechanisms, and provides a method and system for detecting false threat intelligence based on dynamic graph contrastive learning.

[0009] The first aspect of this invention discloses a method for detecting false threat intelligence based on dynamic graph contrastive learning; the method includes:

[0010] Step S1: Obtain network threat intelligence (CTI) report data, extract entities and relationships through natural language processing, and construct a heterogeneous CTI subgraph with semantic features;

[0011] Step S2: Obtain real-time log information of the communication network, aggregate network traffic behavior by time window, and construct a real-time network behavior graph;

[0012] Step S3: Based on the Intrusion Indicator (IoC) as the anchor point, perform entity alignment and fusion of the CTI heterogeneous subgraph and the real-time network behavior graph to generate a global heterogeneous time series graph;

[0013] Step S4: Construct a dual-view feature encoding model, wherein the dual views include a CTI semantic view and a network behavior view;

[0014] Step S5: Train the dual-view feature encoding model using the graph contrastive learning (GCL) framework, and learn a unified embedding representation space by minimizing the contrastive loss function;

[0015] Step S6: During the inference phase, calculate the distance between the embedding vector of the CTI report to be verified in the CTI semantic view and the embedding vector in the network behavior view. Calculate the anomaly score based on the distance. If the anomaly score is higher than a preset threshold, the CTI report is determined to be false threat intelligence.

[0016] Preferably, the construction of the CTI heterogeneous subgraph in step S1 specifically includes: extracting heterogeneous nodes from the CTI report using a named entity recognition model, wherein the heterogeneous node types include at least attackers, malware, vulnerabilities, tools, and network entities;

[0017] Based on dependency parsing and the MITRE ATT&CK framework, semantic relationships between entities are matched to generate directed edges;

[0018] The context text corresponding to the node and the relation description corresponding to the directed edge are encoded using a pre-trained language model to generate a high-dimensional semantic embedding vector as a CTI semantic feature.

[0019] Preferably, the construction of the real-time network behavior graph in step S2 specifically includes: setting a fixed time window t and slicing the continuous network log stream;

[0020] Within each time window t, nodes are defined by network IP address or device ID, and edges are defined by communication interaction relationships;

[0021] Aggregate traffic statistics within this time window, including protocol type, traffic volume, connection frequency, and port information, as network behavior characteristics of edges and nodes.

[0022] Preferably, step S3 specifically includes:

[0023] When a new CTI report is received or a new time window is entered, the IoC node in the CTI heterogeneous subgraph is identified with the corresponding node in the real-time network behavior graph;

[0024] The corresponding nodes are merged so that the merged nodes contain both semantic features from CTI reports and network behavior features from network logs, forming a global heterogeneous time series graph that evolves dynamically over time.

[0025] Preferably, in step S4, the dual-view feature encoding model is constructed as follows:

[0026] For CTI semantic view: Graph Attention Network (GAT) is used as encoder to aggregate neighbor information in global heterogeneous temporal graph and generate the first embedding representation of node;

[0027] For the network behavior view: a temporal graph neural network encoder is used, which combines a graph sampling aggregation mechanism with a long short-term memory network (LSTM) to generate a second embedded representation of the node;

[0028] The workflow of the time-series graph neural network encoder includes:

[0029] For node v at the current time t, the GraphSAGE mechanism is used to randomly sample its neighboring nodes at time t;

[0030] Aggregate the embedding states of the neighboring nodes at the previous time t-1 to generate a spatial neighborhood vector;

[0031] The spatial neighborhood vector and the historical state of node v are input into the LSTM unit to update and output the second embedding representation of node v at the current time t. This representation only reflects the dynamic network behavior evolution of the node.

[0032] Preferably, step S5 specifically includes:

[0033] Construct a positive sample pair by combining the first embedding representation of the same node in the CTI semantic view with the second embedding representation in the network behavior view;

[0034] The embedding representations of this node and other different nodes in the same batch are used to construct negative sample pairs;

[0035] Calculate the cosine similarity between positive sample pairs and between negative sample pairs, and optimize using the InfoNCE loss function to force positive sample pairs to be closer in the embedding space and negative sample pairs to be farther apart.

[0036] Preferably, in step S6, the formula for calculating the anomaly score S is:

[0037] in, For embedding vectors under the CTI semantic view, is the embedding vector under the network behavior view, and similarity is the cosine similarity function;

[0038] If S > δ, it is determined to be false information, where δ is a threshold determined based on the verification set.

[0039] A second aspect of this invention discloses a false threat intelligence detection system based on dynamic graph contrastive learning; the system employs the method described in any one of the first aspects above, and the system includes:

[0040] The CTI graph construction module is used to acquire CTI report data and construct CTI heterogeneous subgraphs with semantic features;

[0041] The network behavior graph construction module is used to collect real-time network logs and construct real-time network behavior graphs.

[0042] The graph fusion module is used to fuse CTI heterogeneous subgraphs and real-time network behavior graphs into a global heterogeneous time series graph based on IoC anchor points.

[0043] The dual-view encoding module is equipped with a GAT encoder and a temporal graph neural network encoder, which are used to generate CTI semantic view embeddings and network behavior view embeddings of nodes, respectively.

[0044] The comparison detection module is used to calculate the anomaly score between two view embeddings and determine the authenticity of the CTI report based on the score.

[0045] A third aspect of this invention discloses an electronic device. The electronic device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the false threat intelligence detection method based on dynamic graph contrastive learning according to any one of the first aspects of this disclosure.

[0046] A fourth aspect of this invention discloses a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a false threat intelligence detection method based on dynamic graph contrastive learning, as described in any of the first aspects of this disclosure.

[0047] The beneficial effects of this invention are as follows:

[0048] 1. Context-aware verification: It achieves a leap from "isolated text verification" to "cross-verification of network behavior", using local traffic facts to verify the authenticity of intelligence and significantly reduce the false alarm rate.

[0049] 2. Dynamic and real-time performance: Based on the time sequence graph model, it can capture the evolution of attack activities and achieve near real-time threat detection.

[0050] 3. Strong robustness: The graph contrast learning framework effectively amplifies the difference between benign and malicious patterns, and can still maintain a high F1 score (about 0.813) in the case of very few samples, which is significantly better than traditional unsupervised methods.

[0051] 4. Localized deployment: It does not rely on large cloud models or external reputation databases, meeting the data privacy and compliance requirements of operator networks. Attached Figure Description

[0052] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0053] Figure 1 A flowchart illustrating a false threat intelligence detection method based on dynamic graph contrastive learning according to an embodiment of the present invention;

[0054] Figure 2 A schematic diagram for constructing a global heterogeneous time series graph by fusing CTI heterogeneous subgraphs and network behavior graphs;

[0055] Figure 3 This is a structural diagram of a false threat intelligence detection system based on dynamic graph contrastive learning according to an embodiment of the present invention;

[0056] Figure 4 This is a structural diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0057] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0058] The core idea of ​​this invention is to establish a "semantic-behavioral cross-validation" mechanism. By parsing CTI reports into a semantic view and real-time traffic of the local operator network into a behavioral view, graph contrastive learning (GCL) is used to force the model to learn the consistency between the two. Authentic intelligence should have a semantic description that is consistent with the actual behavioral patterns in the network within the embedding space; while false intelligence will exhibit significant distributional differences.

[0059] The first aspect of this invention discloses a method for detecting false threat intelligence based on dynamic graph contrastive learning.

[0060] Example 1:

[0061] Figure 1 This is a flowchart of a false threat intelligence detection method based on dynamic graph contrastive learning according to an embodiment of the present invention, as shown below. Figure 1 and Figure 2 As shown, the method includes:

[0062] Step S1: Obtain network threat intelligence (CTI) report data, extract entities and relationships through natural language processing, and construct a heterogeneous CTI subgraph with semantic features;

[0063] The construction of the CTI heterogeneous subgraph in step S1 specifically includes: extracting heterogeneous nodes from the CTI report using a named entity recognition model, wherein the heterogeneous node types include at least attackers, malware, vulnerabilities, tools, and network entities;

[0064] Based on dependency parsing and the MITRE ATT&CK framework, semantic relationships between entities are matched to generate directed edges;

[0065] The context text corresponding to the node and the relation description corresponding to the directed edge are encoded using a pre-trained language model to generate a high-dimensional semantic embedding vector as a CTI semantic feature.

[0066] Specifically, this step aims to transform unstructured text into a computer-understandable graph structure, known as a "CTI semantic view".

[0067] 1. Data source: Input multiple unstructured CTI reports, which may contain descriptions such as "Attacker APT28 used the tool bad.exe to attack the target".

[0068] 2. Entity Extraction: Using NLP tools (such as spaCy) combined with regular expressions, predefined heterogeneous entity types are identified, including: attackers, executables, vulnerabilities (such as CVE numbers), tools, and network entities (IP addresses, domain names).

[0069] 3. Relationship Construction: Analyze the syntactic relationships between entities using dependency parse trees and match them against attack templates in the MITRE ATT&CK knowledge base. For example, identify directed edges such as "exploits", "connects to", and "downloads".

[0070] 4. Feature embedding:

[0071] Node features: Extract the context sentences of the nodes in the original text, input them into the BERT model to generate 768-dimensional semantic vectors.

[0072] Edge features: The edge description (such as ATT&CK technical description) is encoded using Sentence Transformers.

[0073] Output: CTI heterogeneous subgraphs with rich semantic features .

[0074] Step S2: Obtain real-time log information of the communication network, aggregate network traffic behavior by time window, and construct a real-time network behavior graph;

[0075] The construction of the real-time network behavior graph in step S2 specifically includes: setting a fixed time window t and slicing the continuous network log stream;

[0076] Within each time window t, nodes are defined by network IP address or device ID, and edges are defined by communication interaction relationships;

[0077] Aggregate traffic statistics within this time window, including protocol type, traffic volume, connection frequency, and port information, as network behavior characteristics of edges and nodes.

[0078] Specifically, this step aims to extract a "network behavior view" from the operator's massive amounts of data.

[0079] 1. Data Acquisition: Real-time acquisition of 5G core network UPF logs (N6 interface), NetFlow, DNS logs, etc.

[0080] 2. Time aggregation: Set a time window t (e.g., 5 minutes).

[0081] 3. Graph construction: Within window t, IP addresses are mapped to nodes, and communication records are mapped to edges.

[0082] 4. Feature Engineering: Statistical characteristics of aggregated edges (total bytes, packet count, protocol distribution, port entropy, etc.) are used as network behavior features. The output is... .

[0083] Step S3: Based on the Intrusion Indicator (IoC) as the anchor point, perform entity alignment and fusion of the CTI heterogeneous subgraph and the real-time network behavior graph to generate a global heterogeneous time series graph;

[0084] Step S3 specifically includes:

[0085] When a new CTI report is received or a new time window is entered, the IoC node in the CTI heterogeneous subgraph is identified with the corresponding node in the real-time network behavior graph;

[0086] The corresponding nodes are merged so that the merged nodes contain both semantic features from CTI reports and network behavior features from network logs, forming a global heterogeneous time series graph that evolves dynamically over time.

[0087] Specifically, this step connects semantics and behavior through IoC anchors.

[0088] Will As an event stream injected into the current Identify identical IoCs (such as IP "192.168.1.1") in both graphs and merge the nodes. The merged node... v Simultaneously possess:

[0089] semantic attributes (BERT vector from CTI, padded with zeros if none exists);

[0090] Behavioral attributes (Statistical vector from web logs, padded with zeros if none exists);

[0091] This forms a global heterogeneous timing diagram. .

[0092] Step S4: Construct a dual-view feature encoding model, wherein the dual views include a CTI semantic view and a network behavior view;

[0093] In step S4, the dual-view feature encoding model is constructed as follows:

[0094] For CTI semantic view: Graph Attention Network (GAT) is used as encoder to aggregate neighbor information in global heterogeneous temporal graph and generate the first embedding representation of node;

[0095] For the network behavior view: a temporal graph neural network encoder is used, which combines a graph sampling aggregation mechanism with a long short-term memory network (LSTM) to generate a second embedded representation of the node;

[0096] The workflow of the time-series graph neural network encoder includes:

[0097] For node v at the current time t, the GraphSAGE mechanism is used to randomly sample its neighboring nodes at time t;

[0098] Aggregate the embedding states of the neighboring nodes at the previous time t-1 to generate a spatial neighborhood vector;

[0099] The spatial neighborhood vector and the historical state of node v are input into the LSTM unit to update and output the second embedding representation of node v at the current time t. This representation only reflects the dynamic network behavior evolution of the node.

[0100] Specifically, in order to make a comparison, the same node needs to be mapped to two different latent spaces.

[0101] 1. View Figure 1 CTI Semantic View Encoding

[0102] Process using Graph Attention Network (GAT) GAT focuses on the semantic neighbor relationships in the graph and aggregates the semantic features of nodes.

[0103] Output embedding: .

[0104] 2. View Figure 2 Network Behavior View Encoding

[0105] Use temporal graph neural networks (GraphSAGE + LSTM) to handle dynamic network behavior.

[0106] Neighbor sampling: for nodes v Random sampling in the current graph structure k a neighbor N ( v ).

[0107] Spatial aggregation: Aggregating neighbors from the previous moment t The embedding state of 1 generates a spatial neighborhood vector. .

[0108] Time-series update: With nodes v Its own historical status Input LSTM cells.

[0109] Formula expression:

[0110]

[0111] This encoder focuses only on the temporal variation patterns of network traffic.

[0112] Step S5: Train the dual-view feature encoding model using the graph contrastive learning (GCL) framework, and learn a unified embedding representation space by minimizing the contrastive loss function;

[0113] Step S5 specifically includes:

[0114] Construct a positive sample pair by combining the first embedding representation of the same node in the CTI semantic view with the second embedding representation in the network behavior view;

[0115] The embedding representations of this node and other different nodes in the same batch are used to construct negative sample pairs;

[0116] Calculate the cosine similarity between positive sample pairs and between negative sample pairs, and optimize using the InfoNCE loss function to force positive sample pairs to be closer in the embedding space and negative sample pairs to be farther apart.

[0117] Specifically, this step is the core of model training.

[0118] 1. Positive sample pair: For any aligned node in the graph v ,in, and This constitutes a positive sample pair. It means that "the role described by the IP in the CTI" should be consistent with its "actual behavior in the network".

[0119] 2. Negative sample pairs: nodes v of With other nodes in the batch u of ,or v Inconsistent historical states constitute negative samples.

[0120] 3. Loss Function: InfoNCE Loss is used. ;

[0121] By minimizing this loss through backpropagation, the model is forced to learn to distinguish between "consistent real intelligence" and "inconsistent false intelligence".

[0122] Step S6: During the inference phase, calculate the distance between the embedding vector of the CTI report to be verified in the CTI semantic view and the embedding vector in the network behavior view. Calculate the anomaly score based on the distance. If the anomaly score is higher than a preset threshold, the CTI report is determined to be false threat intelligence.

[0123] In step S6, the formula for calculating the anomaly score S is:

[0124] in, For embedding vectors under the CTI semantic view, is the embedding vector under the network behavior view, and similarity is the cosine similarity function;

[0125] If S > δ, it is determined to be false information, where δ is a threshold determined based on the verification set.

[0126] In the above reasoning stage:

[0127] 1. Input a new CTI and generate its semantic embedding. .

[0128] 2. Utilize the trained behavior encoder to obtain the behavior embeddings of relevant nodes in the current network. .

[0129] 3. Calculate the anomaly score, formula. .

[0130] 4. If S > 0.95 (preset threshold), the CTI is determined to be false intelligence or unrelated to the local network environment, meaning that no actual attack behavior was observed in the local network.

[0131] Furthermore, based on the above embodiments, if the determination result is false, but the intelligence source is a highly credible source (such as a government report), a manual verification step can be introduced. If the manual verification confirms it as true, the sample is marked as a special case whitelist and added to the training set as a hard positive sample to fine-tune the model, enabling it to learn this type of special covert attack pattern.

[0132] Example 2:

[0133] Step S1: Obtain Cyber ​​Threat Intelligence (CTI) report data, extract entities and relationships through natural language processing, and construct a heterogeneous CTI subgraph with semantic features. ;

[0134] Obtain CTI report data and generate at least one CTI heterogeneous subgraph;

[0135] In one embodiment of the present invention, the CTI report data obtained in step S1 includes IP address, malware hash value, CVE vulnerability number, etc. For example, a threat intelligence report may describe a malicious code snippet found in an compromised website, and may also include all the specific "evidence" that can be used to identify and defend against threats, such as the malware hash value and CVE vulnerability number.

[0136] This threat intelligence describes a malicious code snippet found on a compromised website, intended for phishing or malicious downloads. Attackers may use this protocol to lure users to malicious servers, thereby achieving purposes such as file downloads, command execution, or credential theft.

[0137] A CTI heterogeneous subgraph carries rich "CTI semantic features". The graph structure data is heterogeneous in that nodes are categorized into various types, such as "Actor," "Executable," "Vulnerability," and "Tool." Edges also represent different types of relationships, derived from MITRE ATT&CK template matching, such as "exploits," "uses," or "connects to." A subgraph refers to the graph (…). This represents only a limited range of attack chain information parsed from an unstructured CTI report, not a "global map" containing all intelligence.

[0138] Specifically, it includes:

[0139] Entity Extraction (Node Generation): The system first uses NLP models (such as the natural language processing library spaCy) and regular expressions to scan the text content of the CTI report. It identifies and extracts various predefined heterogeneous entity types, such as "Actor", "Executable", "Network (such as IP and domain names)", "Vulnerability", and "Tool". These identified entities will become nodes of G_{CTI}.

[0140] Relationship Extraction (Edge Generation): After identifying nodes, the system analyzes the syntactic relationships between these entities in the sentence (e.g., using spaCy's dependency parsing) and simultaneously performs matching using an attack pattern template library based on MITRE ATT&CK. For example, when a pattern such as "malware A exploits vulnerability B" or "program C connects to IP" is matched, the system creates a directed edge between the corresponding nodes, with the edge type being "exploit" or "connect to".

[0141] Semantic Feature Extraction (Feature Appending): The system needs to generate "CTI semantic features" for nodes and edges in the graph, including node features: For each node (e.g., "bad.exe"), the system finds its original context sentence in the report and encodes the sentence using a BERT model to generate a high-dimensional (e.g., 768-dimensional) semantic embedding vector as the feature of that node. Edge Features: For each edge (e.g., "connected to"), the system similarly uses models such as Sentence Transformers to encode its context or its representative MITRE ATT&CK description, generating a semantic embedding vector.

[0142] Subgraph Output: Ultimately, this graph, containing multiple types of nodes, multiple types of edges, and rich semantic features generated by BERT and Sentence Transformers, is a heterogeneous subgraph. ) is output.

[0143] For example, when this step obtains a CTI report (in a real scenario, there are multiple CTI reports), and its text description is "The attacker APT used the malware bad.exe, which exploits vulnerability CVE-2024-1234 and connects to the C2 server 192.168.1.1": First, the NLP model (spaCy) extracts the four nodes "APT28", "bad.exe", "CVE-2024-1234", and "192.168.1.1". Next, dependency resolution and the MITRE ATT&CK template match the actions "use", "exploit", and "connect to", thereby generating directed edges (relationships) between nodes. Finally, the BERT model analyzes the contextual text of these entities and relationships, generating high-dimensional semantic embedding vectors for them. This CTI subgraph with rich semantic vectors ( This will be used as the "CTI semantic view".

[0144] Information is extracted from unstructured CTI report text and constructed into a heterogeneous subgraph containing nodes such as attackers, malware, vulnerabilities, and network entities.

[0145] Step S2: Obtain real-time log information of the communication network, aggregate network traffic behavior by time window, and construct a real-time network behavior graph. ;

[0146] Obtain log information from network devices and construct a real-time network behavior graph;

[0147] Among them, the log information of network devices consists of massive, real-time traffic logs (such as NetFlow, IPFIX, sFlow, or 5G N6 interface logs) generated by the network infrastructure of communication operators (such as 5G core network UPF, DNS servers, and routers).

[0148] The output of this step is a network behavior graph aggregated over a time window t. It represents the "online facts" within that time period.

[0149] This step specifically includes:

[0150] Pre-set a fixed time window (e.g., t = 5 minutes) to slice and aggregate continuous log streams;

[0151] Within each time window t, the system creates nodes from network entities (mainly IP addresses, and possibly device IDs) appearing in the logs;

[0152] If the log shows two nodes (e.g.) and When communication occurs within this window, the system creates an edge between them; finally, the system appends aggregated traffic statistics (such as total bytes, protocol type, port number, and number of connections) as features of the edges and nodes (i.e., "network behavior features") to the graph. superior.

[0153] For example, within a 5-minute time window t from 10:00 to 10:05, the 5G core network UPF logs of the telecommunications operator show that user IP '10.1.1.1' initiated 3 TCP connections to server '192.168.1.1', with a total traffic of 5000 bytes; simultaneously, '10.1.1.1' also sent 1 UDP request to DNS server '8.8.8.8', with a traffic of 150 bytes. Step S2 processes these log streams and outputs the aggregated network behavior graph. The graph contains three nodes ('10.1.1.1', '192.168.1.1', and '8.8.8.8') and two edges. The network behavior characteristics of the first edge ('10.1.1.1' <-> '192.168.1.1') are aggregated as [protocol=TCP, total bytes=5000, number of connections=3], and the characteristics of the second edge ('10.1.1.1' <-> '8.8.8.8') are [protocol=UDP, total bytes=150, number of connections=1].

[0154] The original network logs of telecommunications operators are aggregated by time windows to generate a network behavior graph that reflects the communication relationships and behavioral characteristics between network entities.

[0155] Step S3: Based on the Intrusion Indicator (IoC) as the anchor point, perform entity alignment and fusion of the CTI heterogeneous subgraph and the real-time network behavior graph to generate a global heterogeneous time sequence graph; align the CTI heterogeneous subgraph with the real-time network behavior graph and integrate it into the global heterogeneous time sequence graph;

[0156] Dual-source heterogeneous time sequence graph fusion: The CTI semantic graph (including attack tactics, tools, etc.) from unstructured text is fused with the real-time network behavior graph (including traffic, protocols, etc.) from massive data from telecommunications operators to construct a unified, dynamically evolving heterogeneous time sequence graph.

[0157] Specifically, this step generates a global heterogeneous timing graph. When step S1 generates a new When reporting, merge its nodes and edges into The current timestamp t. Aligned with entities (e.g., IP "192.168.1.1" in CTI) and... (The IP "192.168.1.1" node is merged) to enable CTI semantic information to empower network behavior nodes. It also includes semantic features from the CTI in step S1 and behavioral features from the network in step S2.

[0158] It simultaneously carries both CTI semantic information and network behavioral information, specifically including:

[0159] Using IoC (such as IP address or domain name) as an anchor point, Nodes in the network (such as IP "192.168.1.1") and Nodes representing the same entity are merged. After merging, the "192.168.1.1" node in G_F(t) will have two attributes: "semantic features" (such as BERT embedding) from CTI and "behavioral features" (such as traffic bytes) from network logs.

[0160] The process of merging the CTI subgraph from step S1 and the network behavior graph from step S2. By aligning entities (e.g., merging nodes with the same IP address in both graphs), a unified, time-evolving heterogeneous time-series graph is generated.

[0161] This step is a prerequisite for the graph-based learning of the GCL in subsequent step S5. It merges nodes from two sources (from steps S1 and S2 respectively) into a single node using IoC anchors, generating the necessary "positive sample pairs." This is achieved through entity alignment (e.g., The IP address "192.168.1.1" in the text is related to... (The IP address "192.168.1.1" in the node is merged) to enable CTI semantic information to empower network behavior nodes. It also includes semantic features from CTI (step S1) and behavioral features from the network (step S2).

[0162] Step S4: Construct a dual-view feature encoding model, wherein the dual views include a CTI semantic view and a network behavior view;

[0163] Based on a temporal graph neural network encoder, a global heterogeneous temporal graph is encoded into an embedding vector through neighbor sampling and temporal updates. ;

[0164] The input for this step is the dynamic heterogeneous timing diagram generated in step S3, which integrates CTI and network logs. The output is the embedding vector of all nodes at the current time t, representing their "network behavior view". This includes the embedding state of all nodes at the previous time t-1. ,

[0165] The input is a dynamic heterogeneous timing diagram generated in step S3, which integrates CTI and network logs. (Specifically referring to its network behavior characteristics and graph structure), and the embedding state z(t-1) of all nodes at the previous time t-1; the output is a "network behavior view" representing all nodes in the graph at the current time t. ) new embedding The implementation detail is that this step uses a temporal graph neural network encoder (…). ) for the diagram Only features relevant to network behavior are encoded. For scalability, the encoder... First, the neighbor sampling mechanism of GraphSAGE is used to randomly sample a small subset of the neighbors at time t for each node v. And aggregate the embeddings of these neighbors at time t-1. This generates an efficient "spatial neighborhood" vector. Subsequently, to capture temporal characteristics, this "spatial neighborhood" vector is used as the current input, along with node v's own historical memory. Both are fed into an LSTM unit. The LSTM unit is responsible for updating the node state and finally outputting the node's current embedding at time t. Embedded vectors It only reflects the dynamic network behavior of the nodes and is passed to step S5 for comparative learning.

[0166] The temporal graph neural network encoder combines GraphSAGE (used for spatial neighborhood sampling and aggregation of graphs) with LSTM. To handle the scale of operator network graphs, GraphSAGE employs a neighbor sampling mechanism instead of full graph computation. Encoder It contains a GraphSAGE aggregator and an LSTM unit, at time t, the embedding of node v The updated formula is as follows:

[0167] ,in, It is a neighbor of v at time t. and It is a neural network function, and its internal weight parameters are learned by minimizing the loss function during the contrastive learning training process in step S5. Responsible for spatial aggregation, Responsible for time information fusion The function accepts two inputs, including those from... The new aggregated information and the state of node v at its previous timestamp. , It is obtained from the previous calculation in the model. The function also accepts two inputs, including and ,in, It is the set of neighbor nodes of v at time t, which is the graph structure from the current time t. Obtained directly from the middle; This is the set of embedded states of these neighboring nodes at time t-1, which is also historical information obtained from the previous step of the model calculation.

[0168] This step uses an example from a carrier's 5G core network scenario as an example:

[0169] Time (History): A user's mobile phone IP (node ​​v) is behaving normally, and its time-series neural network encoder ( The output embedding is This vector represents the behavioral pattern of "healthy web browsing".

[0170] Moment (Event): The network log suddenly detected that v began sending suspicious, periodic UDP packets (suspected heartbeat packets) to an IP (node ​​k) it had never connected to before. This new connection and behavioral characteristics ([protocol=UDP, bytes=64]) were merged into... middle.

[0171] Time t: Time-series graphical neural network encoder Running for node v, due to the vastness of the carrier network, it doesn't analyze all of v's neighbors, but instead performs neighbor sampling, assuming it has sampled this new neighbor k. Encoder Get the embedding of k at t-1 (The historical state of k) and aggregate this "spatial neighborhood" information. The LSTM unit receives this aggregated "spatial neighborhood" vector as the current input and combines it with v's own historical memory. Since the new neighbor k and its behavior pattern (UDP heartbeat) are completely different from v's historical memory of "benign web browsing", the LSTM updates its state; The final output is the current embedding of v at time t. ,and Vector (i.e.) The position of a portion of the embedded space will deviate significantly. Because it now precisely encodes the latest network behavior of "starting UDP heartbeat communication", this embedding will then be sent to step S5 for comparison.

[0172] The encoder in this step Unlike traditional GNNs that attempt to analyze all of a node's neighbors, The aggregation process begins with neighbor sampling, which involves randomly selecting a fixed number (e.g., 10) of neighbors for node v. Then, it will look at these sampled neighbors in the previous time step. Embedded The vector is aggregated into a single, fixed-dimensional "spatial neighborhood" using an aggregation function (such as mean, max pooling, or LSTM). This vector is a local neighborhood "snapshot" of v at time t and is then fed into an LSTM for time-series updates.

[0173] Step S5: Train the dual-view feature encoding model using the graph contrastive learning (GCL) framework, and learn a unified embedding representation space by minimizing the contrastive loss function;

[0174] Dynamic modeling based on time-series graphs: Using a time-series graph neural network (T-GNN) or a hybrid GNN-LSTM model, dynamic time-series modeling of CTI injection and network behavior changes is performed, which solves the limitation of existing technologies that can only handle static CTI snapshots;

[0175] Model training is achieved through graph contrastive learning and by minimizing the contrastive loss function;

[0176] This step specifically includes:

[0177] Step 51: View Construction. To perform comparative learning, two views need to be constructed, creating two different representations for the same node in the graph (e.g., an IP address):

[0178] First view: via GAT (Graph Attention Network) encoder Based on global heterogeneous time series graph Generate "CTI Semantic View" embedding GAT is a type of graph neural network that cannot process isolated features; it must operate on a graph structure to aggregate neighbor information. GAT operates on a unified graph structure that has already been fused and aligned. .

[0179] Second view: via a time-series neural network encoder The generated "network behavior view" is embedded As The comparison target;

[0180] Using these two views, the representation of the same node is shown in both views. and The positive samples are considered to be similar and are compared with the representations of all other nodes in the batch ("negative samples"). The loss function forces the model to "narrow down" the positive samples and "push away" the negative samples through a mathematical formula, and finally learns a unified representation space, so that the semantic description of the real CTI is highly consistent with its actual behavior in the network.

[0181] Step 52: Compare the loss function calculations and train. and This causes contrast loss. minimize;

[0182] Among them, for Any alignment node v (e.g., an IP), which in Embedded in and in Embedded in Forming positive sample pairs. All other nodes in the same batch ( Embedding of ) and All samples are considered negative. The loss function is as follows:

[0183]

[0184] in For cosine similarity, As a temperature hyperparameter, this loss forces the model to learn a unified representation so that the semantic description of CTI is consistent with its actual behavior in the network.

[0185] In step S5, the backpropagation gradient serves to train and optimize the two parallel encoders in the model (the temporal graph neural network encoder in step S4). and the GAT encoder in this step Specifically, comparing loss functions It will calculate the "CTI semantics" embedding. Embedded with "network behavior" The consistency "error" (i.e., the loss value) between the two encoders is calculated. Backpropagation then transmits this "error" signal back to the two encoders and adjusts their internal neural network parameters (weights). The purpose of this adjustment is to force the encoders to "narrow down" the embedding distance of real information (positive sample pairs) in the two views in the next calculation, while "pushing away" the distance of irrelevant information (negative samples), thus allowing the model to learn how to distinguish between "consistent" real information and "inconsistent" false information. Among them, "backpropagation gradient" is the core feedback mechanism for model self-correction and evolution. It belongs to existing technology, and its essence is to transform the "consistency error" calculated by the contrastive loss function—that is, the embedding vectors of the same entity (such as IP) in the "CTI semantic view" and the "network behavior view" do not reach the expected similarity (positive sample distance is not close enough) or discrimination (negative sample distance is not far enough)—into a precise mathematical guidance signal. This gradient signal is backpropagated along the calculation path, penetrating into the temporal graph neural network encoder ( ) and GAT encoder ( Inside the neural network layers, thousands of trainable weight parameters are fine-tuned according to the chain rule. Through this iterative update, backpropagation forces two parallel encoders to co-evolve, enabling them to learn to map “real” intelligence semantics and “matching” network behavior to neighboring locations in a unified embedding space, thereby maximizing the model’s ability to distinguish between “real” and “fake” intelligence.

[0186] This process is divided into two phases: the training phase and the inference and detection phase. The training phase involves calculating the contrastive loss function. Backpropagation is a computationally intensive process, and this stage is typically trained periodically offline, for example, the system uses dynamic data from the past 24 hours in the background. To "learn" what "semantic-behavioral consistency" is; once the encoder is in the inference detection phase... and Once trained, the detection action is real-time. When a new CTI report (step S1) is injected into the global heterogeneous time sequence graph (step S3), the system can immediately use the trained encoder to calculate its anomaly score S with the current network behavior, thereby achieving near real-time false intelligence identification.

[0187] Step S6: In the inference phase, calculate the distance between the embedding vector of the CTI report to be verified in the CTI semantic view and the embedding vector in the network behavior view. Calculate the anomaly score based on the distance. If the anomaly score is higher than a preset threshold, the CTI report is determined to be false threat intelligence.

[0188] Cross-validation based on contrastive learning: This application introduces a graph contrastive learning (GCL) framework for CTI validation. By constructing a CTI semantic view and a network behavior view, this application transforms the "CTI authenticity verification" problem into a "cross-view" cross-validation problem. Figure 1 The problem of self-supervised learning with "consistency".

[0189] Identify false threat intelligence based on anomaly scores;

[0190] This step involves inputting a CTI report to be verified. Generate its corresponding heterogeneous subgraph Using a pre-trained encoder and ,calculate Embedding of middle nodes in two views and Calculate the average distance (e.g., cosine distance) between the two view representations as the anomaly score S:

[0191]

[0192] Set a threshold (For example, determined by the 95th percentile of the validation set). If This indicates a high degree of inconsistency between the semantic description in the CTI report and its actual behavior patterns (or historical patterns) on the network, leading to a judgment of forgery. If This indicates that the CTI content is consistent with network behavior, and is judged as genuine intelligence. The semantics of this intelligence can be reverse-labeled onto network nodes for use in downstream network intrusion detection.

[0193] In summary, our proposed method demonstrates superior performance in the experiments. Compared to DBSCAN (F1 score approximately 0.547) and Isolation Forest (F1 score approximately 0.697), the F1 score of our method is improved to 0.813. Particularly noteworthy is the fact that, under conditions of scarce labels (training set ratio of only 0.02%), the performance of traditional supervised models drops sharply, while our self-supervised contrastive learning framework maintains approximately 70% of the performance, demonstrating its robustness against novel and unknown threats.

[0194] The second aspect of this invention discloses a false threat intelligence detection system based on dynamic graph contrastive learning. Figure 3 This is a structural diagram of a false threat intelligence detection system based on dynamic graph contrastive learning according to an embodiment of the present invention; as shown below. Figure 3 As shown, the system 100 includes:

[0195] CTI graph construction module 101 is used to acquire CTI report data and construct CTI heterogeneous subgraphs with semantic features;

[0196] The network behavior graph construction module 102 is used to collect real-time network logs and construct a real-time network behavior graph.

[0197] Graph fusion module 103 is used to fuse CTI heterogeneous subgraphs and real-time network behavior graphs into a global heterogeneous time series graph based on IoC anchor points;

[0198] The dual-view encoding module 104 is equipped with a GAT encoder and a temporal graph neural network encoder, which are used to generate CTI semantic view embeddings and network behavior view embeddings of nodes, respectively.

[0199] The dual-view encoding module 104 is also configured to train the dual-view feature encoding model using the graph contrastive learning (GCL) framework, and learn a unified embedding representation space by minimizing the contrastive loss function.

[0200] The comparison detection module 105 is used to calculate the anomaly score between two view embeddings and determine the authenticity of the CTI report based on the score.

[0201] A third aspect of this invention discloses an electronic device. The electronic device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the false threat intelligence detection method based on dynamic graph contrast learning according to any one of the first aspects of this invention.

[0202] Figure 4 This is a structural diagram of an electronic device according to an embodiment of the present invention, such as... Figure 4 As shown, the electronic device includes a processor, memory, communication interface, display screen, and input device connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, Near Field Communication (NFC), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input device can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the device's casing, or an external keyboard, touchpad, or mouse.

[0203] Those skilled in the art will understand that Figure 4The structure shown is merely a structural diagram of the part related to the technical solution of this disclosure and does not constitute a limitation on the electronic device to which the solution of this application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0204] A fourth aspect of this invention discloses a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a false threat intelligence detection method based on dynamic graph contrastive learning, as described in any of the first aspects of this invention.

[0205] Please note that the technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments have been described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification. The above embodiments only illustrate several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the invention patent. It should be pointed out that for those skilled in the art, several modifications and improvements can be made without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for detecting false threat intelligence based on dynamic graph contrastive learning, characterized in that, Includes the following steps: Step S1: Obtain CTI report data, extract entities and relationships through natural language processing, and construct a heterogeneous CTI subgraph with semantic features; Step S2: Obtain real-time log information of the communication network, aggregate network traffic behavior by time window, and construct a real-time network behavior graph; Step S3: Based on the Intrusion Indicator (IoC) as the anchor point, perform entity alignment and fusion of the CTI heterogeneous subgraph and the real-time network behavior graph to generate a global heterogeneous time sequence graph; Step S4: Construct a dual-view feature encoding model, wherein the dual views include a CTI semantic view and a network behavior view; Step S5: Train the dual-view feature encoding model using the graph contrastive learning (GCL) framework, and learn a unified embedding representation space by minimizing the contrastive loss function; Step S6: During the inference phase, calculate the distance between the embedding vector of the CTI report to be verified in the CTI semantic view and the embedding vector in the network behavior view. Calculate the anomaly score based on the distance. If the anomaly score is higher than a preset threshold, the CTI report is determined to be false threat intelligence.

2. The method according to claim 1, characterized in that, The construction of the CTI heterogeneous subgraph in step S1 specifically includes: extracting heterogeneous nodes from the CTI report using a named entity recognition model, wherein the heterogeneous node types include at least attackers, malware, vulnerabilities, tools, and network entities; Based on dependency parsing and the MITRE ATT&CK framework, semantic relationships between entities are matched to generate directed edges; The context text corresponding to the node and the relation description corresponding to the directed edge are encoded using a pre-trained language model to generate a high-dimensional semantic embedding vector as a CTI semantic feature.

3. The method according to claim 1, characterized in that, The construction of the real-time network behavior graph in step S2 specifically includes: setting a fixed time window t and slicing the continuous network log stream; Within each time window t, nodes are defined by network IP address or device ID, and edges are defined by communication interaction relationships; Aggregate traffic statistics within this time window, including protocol type, traffic volume, connection frequency, and port information, as network behavior characteristics of edges and nodes.

4. The method according to claim 1, characterized in that, Step S3 specifically includes: When a new CTI report is received or a new time window is entered, the IoC node in the CTI heterogeneous subgraph is identified with the corresponding node in the real-time network behavior graph; The corresponding nodes are merged so that the merged nodes contain both semantic features from CTI reports and network behavior features from network logs, forming a global heterogeneous time series graph that evolves dynamically over time.

5. The method according to claim 1, characterized in that, In step S4, the dual-view feature encoding model is constructed as follows: For the CTI semantic view: the graph attention network GAT is used as the encoder to aggregate neighbor information in the global heterogeneous temporal graph and generate the first embedding representation of the node; For the network behavior view: a temporal graph neural network encoder is used, which combines a graph sampling aggregation mechanism with a long short-term memory network (LSTM) to generate a second embedded representation of the node; The workflow of the time-series graph neural network encoder includes: For node v at the current time t, the GraphSAGE mechanism is used to randomly sample its neighboring nodes at time t; Aggregate the embedding states of the neighboring nodes at the previous time t-1 to generate a spatial neighborhood vector; The spatial neighborhood vector and the historical state of node v are input into the LSTM unit to update and output the second embedding representation of node v at the current time t. This representation only reflects the dynamic network behavior evolution of the node.

6. The method according to claim 1, characterized in that, Step S5 specifically includes: Construct a positive sample pair by combining the first embedding representation of the same node in the CTI semantic view with the second embedding representation in the network behavior view; The embedding representations of this node and other different nodes in the same batch are used to construct negative sample pairs; Calculate the cosine similarity between positive sample pairs and between negative sample pairs, and optimize using the InfoNCE loss function to force positive sample pairs to be closer in the embedding space and negative sample pairs to be farther apart.

7. The method according to claim 1, characterized in that, In step S6, the formula for calculating the anomaly score S is: in, For embedding vectors under the CTI semantic view, is the embedding vector under the network behavior view, and similarity is the cosine similarity function; If S > δ, it is determined to be false information, where δ is a threshold determined based on the verification set.

8. A false threat intelligence detection system based on dynamic graph contrastive learning, wherein the system employs the method described in any one of claims 1-7, characterized in that, The system includes: The CTI graph construction module is used to acquire CTI report data and construct CTI heterogeneous subgraphs with semantic features; The network behavior graph construction module is used to collect real-time network logs and construct real-time network behavior graphs. The graph fusion module is used to fuse CTI heterogeneous subgraphs and real-time network behavior graphs into a global heterogeneous time series graph based on IoC anchor points. The dual-view encoding module is equipped with a GAT encoder and a temporal graph neural network encoder, which are used to generate CTI semantic view embeddings and network behavior view embeddings of nodes, respectively. The comparison detection module is used to calculate the anomaly score between two view embeddings and determine the authenticity of the CTI report based on the score.

9. An electronic device, characterized in that, The electronic device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the false threat intelligence detection method based on dynamic graph contrast learning according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the false threat intelligence detection method based on dynamic graph contrast learning according to any one of claims 1 to 7.

Images