An attack type identification method and device, electronic equipment and storage medium

Abstract

The application provides an attack type identification method and device, electronic equipment and a storage medium. The method comprises the following steps: extracting a plurality of characteristic attribute values from each alarm log in a plurality of alarm logs to be processed to obtain a plurality of groups of characteristic attribute values; constructing a graph structure by taking the alarm log as a node and taking the similarity between the groups of characteristic attribute values as an edge; encoding each alarm log in the plurality of alarm logs to obtain an encoding vector of the node; and identifying the type of the graph structure by using a graph attention network model according to the encoding vector of the node, thereby obtaining the attack type of the graph structure. Since the graph attention network model has learned the rules of all historical alarm logs in the training process, it is not necessary to manually write new rules, so the graph attention network model can effectively predict unknown attacks.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, computer security and network security, in particular to an attack type identification method and device, electronic equipment and storage medium. BACKGROUND

[0002] At present, the attack type identification method of the alarm log is mostly to use a rule fingerprint library or a rule template library to match the attack type of the alarm log. For example, Pcap software is used to collect alarm logs, and the alarm logs are preprocessed (for example, event format unification, filtering of useless security events, and repeated event merging processing), to obtain preprocessed logs. Then, the rule fingerprint library or the rule template library is used to match the attack type corresponding to the preprocessed logs. In the specific practice process, it is found that it is difficult to predict unknown attack types using the rule fingerprint library or the rule template library. SUMMARY

[0003] The purpose of the embodiments of the present application is to provide an attack type identification method and device, electronic equipment and storage medium, to improve the problem of difficulty in predicting unknown attack types.

[0004] The embodiments of the present application provide an attack type identification method, which comprises: extracting a plurality of feature attribute values from each alarm log in a plurality of alarm logs to be processed, to obtain a plurality of groups of feature attribute values; constructing a graph structure with the alarm logs as nodes and the similarity between the plurality of groups of feature attribute values as edges; encoding each alarm log in the plurality of alarm logs to obtain an encoding vector of the node; and using a graph attention network model to identify the type of the graph structure according to the encoding vector of the node, to obtain the attack type of the graph structure. In the implementation process of the above scheme, since the graph attention network model has learned all the rules of the historical alarm logs in the training process, there is no need to manually write new rules, so the graph attention network model is used for type identification, thereby avoiding the case of adding new rules of unknown attack types manually written in the rule fingerprint library or the rule template library, and thus the graph attention network model effectively predicts unknown attacks.

[0005] Optionally, in the embodiments of the present application, the encoding of each alarm log in the plurality of alarm logs comprises: using One-Hot encoding to encode each alarm log in the plurality of alarm logs.

[0006] Optionally, in the embodiments of the present application, the construction of the graph structure comprises: judging whether the similarity between the feature attribute values of any two nodes in the graph structure is greater than a similarity threshold value; if yes, creating an edge connecting the two nodes in the graph structure.

[0007] Optionally, in the embodiment of the present application, the type of the graph structure is identified according to the encoding vector of the node by using the graph attention network model, comprising: generating an adjacency matrix of the alarm log according to the graph structure; and identifying the type of the adjacency matrix according to the encoding vector of the node by using the graph attention network model. In the implementation process of the above scheme, the type of the adjacency matrix is identified according to the encoding vector of the node by using the graph attention network model, thereby avoiding the problem of large calculation amount and excessive memory consumption caused by directly using the graph structure to participate in the calculation, and effectively reducing the calculation complexity and memory consumption.

[0008] Optionally, in the embodiment of the present application, before the type of the graph structure is identified according to the encoding vector of the node by using the graph attention network model, the method further comprises: obtaining sample data and sample labels, wherein the sample data comprises the graph structure and the encoding vector corresponding to the sample log, and the sample labels are the attack types of the graph structure; and training the graph attention network by taking the sample data as the training data and the sample labels as the training labels to obtain the graph attention network model. In the implementation process of the above scheme, the graph attention network model is obtained by training the graph attention network, and the types of the graph structure and the encoding vector of the alarm log are identified by using the graph attention network model, thereby avoiding the case that new rules of unknown attack types are manually written in the rule fingerprint library or the rule template library, and therefore the unknown attack types can be effectively predicted by using the graph attention network model.

[0009] Optionally, in the embodiment of the present application, the training of the graph attention network comprises: predicting the graph structure and the encoding vector corresponding to the sample log by using the graph attention network to obtain the predicted type of the graph structure; calculating the loss value between the predicted type of the graph structure and the attack type in the sample labels; and training the graph attention network according to the loss value.

[0010] The embodiment of the present application also provides an attack type identification device, comprising: an alarm log extraction module, configured to extract a plurality of characteristic attribute values from each of a plurality of alarm logs to be processed to obtain a plurality of groups of characteristic attribute values; a characteristic attribute determination module, configured to construct a graph structure by taking the alarm log as a node and the similarity between the plurality of groups of characteristic attribute values as an edge; an encoding vector obtaining module, configured to encode each of the plurality of alarm logs to obtain an encoding vector of the node; and an attack type identification module, configured to identify the type of the graph structure according to the encoding vector of the node by using a graph attention network model to obtain the attack type of the graph structure.

[0011] Optionally, in the embodiment of the present application, the encoding vector obtaining module comprises: a One-Hot encoding submodule, configured to encode each of the plurality of alarm logs by using One-Hot encoding.

[0012] Optionally, in the embodiment of the present application, the node edge graph construction unit comprises: a similarity degree judgment subunit configured to judge whether the similarity degree between the feature attribute values of any two nodes in the graph structure is greater than a similarity threshold; and a node edge creation subunit configured to create an edge connecting the two nodes in the graph structure if the similarity degree between the two nodes is greater than the similarity threshold.

[0013] Optionally, in the embodiment of the present application, the attack type identification module comprises: an adjacency matrix generation submodule configured to generate an adjacency matrix of the alarm log according to the graph structure; and a network model identification submodule configured to use a graph attention network model to identify the type of the adjacency matrix according to the encoding vector of the node.

[0014] Optionally, in the embodiment of the present application, the attack type identification apparatus further comprises: a data label acquisition module configured to acquire sample data and sample labels, wherein the sample data comprises a graph structure corresponding to a sample log and an encoding vector, and the sample labels are attack types of the graph structure corresponding to the sample log; and a network model training module configured to train the graph attention network using the sample data as training data and the sample labels as training labels, to obtain the graph attention network model.

[0015] Optionally, in the embodiment of the present application, the network model training module comprises: a predicted category obtaining submodule configured to use the graph attention network to predict the graph structure corresponding to the sample log according to the encoding vector of the sample log, to obtain a predicted type of the graph structure; a loss value calculation submodule configured to calculate a loss value between the predicted type of the graph structure and the attack type in the sample label; and an attention network training submodule configured to train the graph attention network according to the loss value.

[0016] The embodiment of the present application also provides an electronic device comprising: a processor and a memory, wherein the memory stores machine readable instructions executable by the processor, and the machine readable instructions are executed by the processor to perform the method described above.

[0017] The embodiment of the present application also provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is executed by a processor to perform the method described above.

[0018] Other features and advantages of the embodiments of the present application will be described in the following description, and some will become apparent from the description, or will be understood through implementation of the embodiments of the present application. BRIEF DESCRIPTION OF DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. It should be understood that the following drawings only show some of the embodiments of the present application, and therefore should not be regarded as a limitation on the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0020] Figure 1 The flowchart of the attack type identification method provided by the embodiments of the present application is shown.

[0021] Figure 2 The schematic diagram of the graph structure of the alarm log construction provided by the embodiments of the present application is shown.

[0022] Figure 3 The structural schematic diagram of the attack type identification device provided by the embodiments of the present application is shown.

[0023] Figure 4 The structural schematic diagram of the electronic device provided by the embodiments of the present application is shown. DETAILED DESCRIPTION

[0024] The technical solutions of the embodiments of the present application will be described clearly and completely in the following with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. The components of the embodiments of the present application described and shown in the drawings herein can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the claimed present application, but only represents selected embodiments of the present application. Based on the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of the present application.

[0025] It can be understood that the "first", "second" in the embodiments of the present application are used to distinguish similar objects. Those skilled in the art can understand that the "first", "second" and the like do not limit the number and execution order, and the "first", "second" and the like do not necessarily mean different.

[0026] Before introducing the attack type identification method provided by the embodiments of the present application, some concepts involved in the embodiments of the present application are introduced.

[0027] Intrusion Detection Systems (IDS) refers to a software system that monitors the running status of network and system according to a certain security policy, and discovers various attack attempts, attack behaviors or attack results as much as possible, so as to ensure the confidentiality, integrity and availability of network system resources.

[0028] Intrusion Prevention System (IPS), also known as intrusion detection and prevention system (IDPS), is a computer network security facility, which is a supplement to antivirus software and firewall.

[0029] Network Security Device (NSD) refers to a group of software and hardware devices deployed between the internal network and the external network, and between the private network and the public network, which are used to form a protective barrier on the interface between the internal network and the external network, and between the private network and the public network. The NSD here can include horizontal isolation device, vertical encryption authentication device, firewall, antivirus system, intrusion detection system (IDS) or intrusion prevention system (IPS) and the like.

[0030] It should be noted that the attack type identification method provided by the embodiments of the present application can be executed by an electronic device, where the electronic device refers to a device terminal or a server having the function of executing a computer program, such as a smart phone, a personal computer, a tablet computer, a personal digital assistant or a mobile Internet device. The server refers to a device that provides computing services through a network, such as an x86 server and a non-x86 server, which includes a mainframe, a minicomputer and a UNIX server.

[0031] The application scenario to which the attack type identification method is applicable will be introduced below, which includes but is not limited to: using the attack type identification method to improve or enhance the function of network security device (NSD) such as horizontal isolation device, vertical encryption authentication device, firewall, antivirus system, intrusion detection system (IDS) or intrusion prevention system (IPS), so that the NSD can not only identify whether there is an attack, but also identify known attack types and unknown attack types according to the alarm log, and take different security defense measures for different attack types (known attack types and / or unknown attack types), thereby better improving the security of the electronic device or the security of the network.

[0032] Please refer to Figure 1The flowchart of the attack type identification method provided by the embodiment of the application is shown; the main idea of the attack type identification method is that, since the graph attention network model has learned the rules of all historical alarm logs in the training process, the unknown attack in the graph structure can be identified by using the graph attention network model, thereby overcoming the defect that unknown attacks cannot be identified. The implementation of the attack type identification method described above can include:

[0033] Step S110: Extract a plurality of feature attribute values from each alarm log in the plurality of alarm logs to be processed to obtain a plurality of groups of feature attribute values.

[0034] The optional implementation of step S110 described above includes that, before extracting a plurality of feature attribute values from each alarm log in the plurality of alarm logs to be processed, the alarm log described above can also be collected, for example, assuming that the alarm log is an alarm log collected by an IDS device, and the alarm log includes 11 feature attributes. Then, the log collection and processing program module can be used to extract 9 classification feature attributes and 2 numerical value feature attributes from the alarm log, the 9 classification feature attributes are: log identifier (sid), generation identifier (gid), reception time (rev), log content (msg), log source (src), source port (srcport), target device (dst), target port (dstport), and time to live (TTL), and the numerical value feature attributes can include: length (dgmlen) and IP packet size (iplen). It can be understood that the log identifier (sid), the generation identifier (gid), the reception time (rev), and the log content (msg) can be used as a unique identifier of a joint primary key, and the unique identifier can be used to index the alarm log, so the unique identifier can be stored in a rule index file. Therefore, a plurality of feature attribute values (such as the 11 feature attribute values described above) are extracted from each alarm log collected, the plurality of feature attribute values of each alarm log are determined as a group of feature attribute values, and a plurality of groups of feature attribute values are obtained.

[0035] Step S120: Construct a graph structure with the alarm log as a node and the similarity between the plurality of groups of feature attribute values as an edge.

[0036] Please refer to Figure 2 The graph structure constructed by the alarm log provided by the embodiment of the application is shown; it can be understood that there are many implementation methods of constructing the graph structure in step S120 described above, including but not limited to: if the alarm log is a plurality of alarm logs, the plurality of alarm logs can be directly constructed into a graph structure, for example: the alarm log is a node, and the similarity between the plurality of groups of feature attribute values is an edge, and the graph structure described above is constructed. Therefore, the implementation of step S120 is described in detail below.

[0037] Step S130: Encode each alarm log in the multiple alarm logs to obtain the node's encoding vector.

[0038] Step S140: Use a graph attention network model to identify the type of graph structure based on the encoding vectors of the nodes, and obtain the attack type of the graph structure.

[0039] Graph Attention Network (GAN) is a type of graph neural network that utilizes graph attention mechanisms. Unlike spectral domain-based graph convolutional neural networks, which introduce attention mechanisms into spatial domain-based graph neural networks, GANs do not require complex calculations using Laplacian matrices; instead, they update node features solely through the representations of their first-order neighbors. It's important to understand that a GAN model refers to the neural network model after it has been trained. When using a GAN model, it can be retrieved from a serialized model file on disk.

[0040] In the implementation of the above scheme, since the graph attention network model has learned the rules of all historical alarm logs during the training process, there is no need to manually write new rules. Therefore, the graph attention network model is used to identify the type of the graph structure corresponding to the alarm log, thereby avoiding the situation of manually writing new rules for unknown attack types in the rule fingerprint library or rule template library. Therefore, the graph attention network model can effectively predict unknown attack types.

[0041] As a first optional implementation of step S120 above, a graph structure can be constructed based on the alarm log and its historical log. This implementation may include:

[0042] Step S121: Construct a graph structure based on the alarm log and the corresponding historical log.

[0043] An example of the implementation of step S121 above is as follows: Please refer to Figure 2 First, the alarm logs and their corresponding historical logs are identified as nodes in the graph structure. Then, the attribute vectors of the alarm logs and the historical logs are obtained, and the formula is used... Calculate the similarity between two nodes; where a i and a j Let represent two distinct nodes, namely the i-th node and the j-th node, where k represents the attribute number in the attribute vector of that node, i.e., the k-th attribute vector in that node, and w k w represents the weight of the k-th attribute vector. k It can be set as a constant vector. This indicates the data used to calculate alarm log a.i The k-th attribute vector and the historical log a j The similarity between the k-th attribute vectors is calculated. A graph structure is constructed using alarm logs or historical logs as nodes and similarity scores as edges. The similarity score can be calculated using cosine distance, Euclidean distance, Hamming distance, or information entropy, etc., or you can calculate it yourself. The specific calculation process for the similarity score will be explained in detail below.

[0044] As an optional implementation of step S121 above, when constructing the graph structure, it can be constructed based on the similarity between multiple feature attribute values. This implementation may include:

[0045] Step S121a: Calculate the similarity between any two feature attribute values ​​among multiple feature attribute values.

[0046] A specific example of implementing step S121a above is as follows: For any two nodes in the graph structure, first use the formula... Calculate the similarity between two nodes; where a i and a j This represents the attribute vectors of two nodes, where k represents the attribute number in the attribute vector, i.e., the k-th attribute vector in that node, and w k w represents the weight of the k-th attribute vector. k It can be set as a constant vector. This indicates the data used to calculate alarm log a. i The k-th attribute vector and alarm log a j The similarity between the k-th attribute vectors. This similarity is also known as similarity score, and the calculation of similarity score can be performed using the formula... To calculate, where a i and a j This represents the attribute vectors of two nodes, where k represents the attribute number in the attribute vector, i.e., the kth attribute vector in that node.

[0047] Step S121b: Construct a graph structure using alarm logs as nodes and the similarity between alarm logs as edges.

[0048] The implementation method for constructing the graph structure in step S121b above may include: determining whether the similarity between two nodes is greater than a similarity threshold. If the similarity between two nodes is greater than the similarity threshold, then an edge connecting the two nodes is created in the graph structure; that is, for a preset similarity threshold s... threshold For example, if alarm log node ai The k-th attribute and alarm log node a j The similarity between the k-th attributes is greater than the similarity threshold s threshold Then at node a i and node a j Create an edge between them to complete the graph structure.

[0049] As a second optional implementation of step S120 above, the alarm log can be multiple alarm logs. Therefore, in this case, the graph structure can be directly constructed based on the multiple alarm logs. This implementation may include:

[0050] Step S122: Construct a graph structure using alarm logs as nodes and the similarity between the feature attribute values ​​of the first alarm log and the feature attribute values ​​of the second alarm log as edges.

[0051] The specific implementation of step S122 above is as follows: First, multiple alarm logs are identified as nodes in a graph structure. Then, the feature attribute values ​​of each alarm log are obtained, and the similarity between the feature attribute values ​​of two nodes is calculated (i.e., the similarity between a set of feature attribute values ​​of the first alarm log and two sets of feature attribute values ​​of the second alarm log is calculated; the calculation process for the similarity here is similar to that above, so it will not be repeated here). A graph structure is constructed using alarm logs as nodes and the similarity between a set of feature attribute values ​​of the first alarm log and two sets of feature attribute values ​​of the second alarm log as edges.

[0052] As an optional implementation of step S130 above, when encoding the alarm logs, One-Hot encoding can be used to encode each alarm log in multiple alarm logs. This implementation may include:

[0053] Step S131: Use One-Hot encoding to encode multiple feature attribute values ​​of each alarm log in multiple alarm logs to obtain the encoding vector of the alarm log.

[0054] For example, the implementation of step S131 above can be as follows: The encoding vector of the alarm log can be directly one-hot encoded from multiple feature attribute values ​​(e.g., 11 feature attribute values) in the alarm log, or it can be one-hot encoded from a few feature attribute values ​​selected from the multiple feature attribute values ​​in the alarm log (e.g., 4 feature attribute values ​​selected from 11 feature attribute values), thereby obtaining the encoding vector corresponding to the alarm log in the graph structure, that is, the encoding vector of the alarm log. Specifically, for example, each node in the graph structure is initialized as a zero vector of length n, where n is the total number of quadruplets in the rule index file. Then, one-hot encoding is generated based on the log representation (sid), generation identifier (gid), reception time (rev), and log content (msg) of the node. That is, one-hot encoding is used to encode the log representation (sid), generation identifier (gid), reception time (rev), and log content (msg) of the alarm log. Then, the one-hot encoding of the alarm log node is used as the encoding vector of the alarm log.

[0055] As one of the two optional implementations of step S130 above, when encoding the alarm logs, a variational auto-encoder (VAE) can be used to encode each alarm log in multiple alarm logs. This implementation may include:

[0056] Step S132: Use a variational autoencoder (VAE) to encode each alarm log in the multiple alarm logs to obtain the encoding vector of the alarm log.

[0057] The implementation of step S131 above is as follows: First, a variational autoencoder (VAE) is trained to obtain a trained VAE. The VAE may include a decoder and an encoder. Then, the encoder in the trained VAE can be used to encode each alarm log in multiple alarm logs to obtain the encoded vector of the alarm log. Here, VAE refers to a deep generative model, which is also an unsupervised learning algorithm. The main function of VAE is to learn a function (model) that makes the distribution of the output data approximate the original data distribution as closely as possible.

[0058] As an optional implementation of step S140 above, when using a graph attention network model to perform type recognition on graph structure and encoding vector, the graph structure can first be converted into an adjacency matrix, and then the adjacency matrix and encoding vector can be used for recognition. This implementation may include:

[0059] Step S141: Generate the adjacency matrix of the alarm log based on the graph structure.

[0060] For example, to reduce computational complexity and memory consumption, in a specific implementation, the graph structure can be first converted into a sparse adjacency matrix, that is, the adjacency matrix of the alarm log can be generated based on the graph structure, and then a graph attention network model can be used to perform type recognition on the adjacency matrix and the encoding vector. The adjacency matrix can be represented by A, and specifically, the formula can be used. To calculate and obtain; where a i and a j Let s represent two distinct nodes, namely the i-th node and the j-th node. threshold This represents the preset similarity threshold, s(a i ,a j The value represents the similarity between the i-th node and the j-th node. 1 indicates that the similarity between the i-th node and the j-th node is greater than the similarity threshold, so an adjacency edge needs to be added between the i-th node and the j-th node. 0 indicates that no adjacency edge needs to be added between the i-th node and the j-th node.

[0061] Step S142: Use a graph attention network model to identify the type of the adjacency matrix based on the encoding vector of the nodes, and obtain the attack type of the graph structure corresponding to the alarm log.

[0062] The implementation of step S142 above is as follows: First, the trained graph attention network model is loaded from the serialized file on the device disk. Then, the trained graph attention network model is used to perform type identification on the adjacency matrix based on the encoding vector. That is, the encoding vector and the adjacency matrix are fed to the graph attention network model. The graph attention network model can output the attack type corresponding to the warning log within a fixed-size time window, thereby obtaining the attack type of the graph structure corresponding to the warning log. It can be understood that when the graph attention network model performs type identification on the adjacency matrix based on the encoding vector, if the adjacency matrix is ​​constructed from a warning log and the corresponding historical logs, then after the graph attention network model outputs the attack types corresponding to all logs, the attack types of historical logs can be filtered out from the attack types corresponding to all logs to obtain the attack type of the warning log. The reason for filtering out the attack types of historical logs is that since the attack types of historical logs are known, and each log has a unique encoding corresponding to the attack type, the attack types of historical logs can be filtered out from the attack types corresponding to all logs.

[0063] As an optional implementation of step S140 above, the graph attention network model can be trained before or after type recognition of the graph structure and encoding vector using the graph attention network model. This implementation may include:

[0064] Step S143: Obtain sample data and sample labels. The sample data includes the graph structure and encoding vector corresponding to the sample log. The sample label is the attack type of the graph structure corresponding to the sample log.

[0065] An example implementation of step S143 above is as follows: Sample logs are obtained from a network security device (NSD). These sample logs can be multiple alarm logs (also known as warning logs) stored in a file. The alarm logs in this file can be constructed into a graph structure. Each node in the graph structure represents an alarm log, and the edges between nodes in the graph structure represent the similarity value between two nodes (this similarity value is determined based on the similarity between the feature attribute values ​​of the nodes). Specifically, for example: each alarm log in the file is identified as a node in the graph structure, and multiple feature attribute values ​​(e.g., 11 feature attribute values) of the alarm log are used as the attribute vectors of the nodes in the graph. Then, the similarity between the attribute vector of each node and the attribute vectors of other nodes is calculated. For any two nodes in the graph structure, it is determined whether the similarity between the two nodes is greater than a similarity threshold. If the similarity between the two nodes is greater than the similarity threshold, an edge connecting the two nodes is created in the graph structure.

[0066] The sample labels mentioned above can be obtained manually or automatically by machine learning algorithms. For example, if the attack type of the sample log is DDoS attack, the sample label of the sample log is 0; if the attack type of the sample log is HTTPTunnel, the sample label of the sample log is 1; if the attack type of the sample log is DNSTunnel, the sample label of the sample log is 2; and the sample label of other attack types is 3.

[0067] It is understandable that the encoding vector of the sample log mentioned above can be obtained by directly performing one-hot encoding on multiple feature attribute values ​​(e.g., 11 feature attribute values) in the sample log, thereby obtaining the encoding vector corresponding to the sample log in the graph structure, that is, the encoding vector of the sample log. Specifically, for example, each node in the graph structure is initialized as a zero vector of length n, where n is the total number of quadruplets in the rule index file. Then, a one-hot encoding is generated based on the log representation (sid), generation identifier (gid), reception time (rev), and log content (msg) of the node, and the one-hot encoding of the node is used as the encoding vector of the sample log.

[0068] Step S144: Use the sample data as training data and the sample labels as training labels to train the graph attention network and obtain the graph attention network model.

[0069] As an optional implementation of step S144 above, the implementation of training the graph attention network may include:

[0070] Step S144a: Use a graph attention network to predict the graph structure corresponding to the sample log based on the encoding vector of the sample log, and obtain the predicted type of the graph structure corresponding to the sample log.

[0071] An example implementation of step S144a above is as follows: The graph attention network model can train a shared weight matrix W for all nodes, mapping the feature F of each node in the weight matrix corresponding to the graph structure to F'. When calculating the attention in the graph structure, the features F of node i and its neighboring node j are compared. i and F j Mapping to F using the weight matrix respectively i 'and F j The two output vectors are concatenated. Then, a feedforward neural network 'a' in the graph attention network maps the concatenated vector to real numbers. To preserve information about node i during attention computation, the graph attention network uses LeakyReLU as the activation function to activate the output vector, obtaining the activated feature vector. Finally, softmax is used to normalize the activated feature vector to obtain the final prediction type with attention coefficients.

[0072] Step S144b: Calculate the loss value between the prediction type corresponding to the sample log and the attack type in the sample label.

[0073] The implementation of step S144b above includes, for example, using mean square error (MSE), cross-entropy loss function, squared loss function, exponential loss function, zero-one loss function, or absolute value loss function, etc., to calculate the loss value between the predicted type of the sample log and the attack type in the sample label.

[0074] Step S144c: Train the graph attention network based on the loss value.

[0075] The implementation of step S144c above includes: using sample data as training data and sample labels as training labels, when training the graph attention network, the graph attention network predicts the attack type of the sample data to obtain the predicted attack type. Then, a loss function is used to calculate the loss value between the predicted attack type and the attack type in the sample label. Finally, the graph attention network is trained according to the loss value until the accuracy of the neural network no longer increases or the number of iterations (epochs) is greater than a preset threshold, and the graph attention network model can be obtained. The preset threshold can also be set according to specific circumstances, such as 100 or 1000, etc.

[0076] Please see Figure 3 The diagram shown is a structural schematic of the attack type identification device provided in an embodiment of this application; this application embodiment provides an attack type identification device 200, including:

[0077] The alarm log extraction module 210 is used to extract multiple feature attribute values ​​from each of the multiple alarm logs to be processed, and obtain multiple sets of feature attribute values.

[0078] The feature attribute determination module 220 is used to construct a graph structure with alarm logs as nodes and the similarity between multiple sets of feature attribute values ​​as edges.

[0079] The encoding vector acquisition module 230 is used to encode each alarm log in multiple alarm logs to obtain the encoding vector of the node. The attack type identification module 240 is used to use a graph attention network model to identify the type of the graph structure based on the encoding vector of the node, and obtain the attack type of the graph structure.

[0080] Optionally, in embodiments of this application, the encoding vector acquisition module includes:

[0081] The One-Hot encoding submodule is used to encode each alarm log in a set of multiple alarm logs using One-Hot encoding.

[0082] Optionally, in this embodiment of the application, the node edge graph construction unit includes:

[0083] The similarity judgment subunit is used to determine whether the similarity between the feature attribute values ​​of any two nodes in the graph structure is greater than the similarity threshold.

[0084] The edge creation sub-unit of a node is used to create an edge connecting two nodes in the graph structure if the similarity between the two nodes is greater than a similarity threshold.

[0085] Optionally, in this embodiment of the application, the attack type identification module includes:

[0086] The adjacency matrix generation submodule is used to generate the adjacency matrix of alarm logs based on the graph structure.

[0087] The network model recognition submodule is used to identify the type of the adjacency matrix based on the encoding vector of the nodes using a graph attention network model.

[0088] Optionally, in this embodiment of the application, the attack type identification device further includes:

[0089] The data tag acquisition module is used to acquire sample data and sample tags. The sample data includes the graph structure and encoding vector corresponding to the sample log, and the sample tag is the attack type of the sample log.

[0090] The network model training module is used to train the graph attention network using sample data as training data and sample labels as training labels to obtain the graph attention network model.

[0091] Optionally, in this embodiment of the application, the network model training module includes:

[0092] The prediction category acquisition submodule is used to use a graph attention network to predict the graph structure corresponding to the sample log based on the encoding vector of the sample log, and obtain the prediction type of the graph structure corresponding to the sample log.

[0093] The loss calculation submodule is used to calculate the loss value between the predicted type of the graph structure and the attack type in the sample label.

[0094] The attention network training submodule is used to train the graph attention network based on the loss value.

[0095] It should be understood that this device corresponds to the attack type identification method embodiment described above and is capable of performing the various steps involved in the above method embodiment. The specific functions of this device can be found in the description above, and detailed descriptions are omitted here to avoid repetition. The device includes at least one software functional module that can be stored in memory or embedded in the device's operating system (OS) in the form of software or firmware.

[0096] Please see Figure 4 The diagram shows a structural schematic of an electronic device provided in an embodiment of this application. An electronic device 300 provided in this application includes a processor 310 and a memory 320. The memory 320 stores machine-readable instructions executable by the processor 310. When the machine-readable instructions are executed by the processor 310, the method described above is performed.

[0097] This application embodiment also provides a computer-readable storage medium 330, on which a computer program is stored. This computer program is executed by a processor 310 to perform the methods described above. The computer-readable storage medium 330 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0098] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For apparatus embodiments, since they are basically similar to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0099] It should be understood that the disclosed apparatus and methods can also be implemented in other ways, as provided in the embodiments of this application. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in the flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the accompanying drawings. For example, two consecutive blocks may actually be executed substantially in parallel, or they may sometimes be executed in reverse order, depending primarily on the functions involved.

[0100] Furthermore, the functional modules of each embodiment in this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part. In addition, in the description of this specification, the reference to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., means that the specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described can be combined in a suitable manner in any one or more embodiments or examples. Furthermore, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0101] The above description is only an optional implementation of the embodiments of this application, but the protection scope of the embodiments of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the embodiments of this application should be covered within the protection scope of the embodiments of this application.

Claims

1. An attack type identification method, characterized in that, include: Extract multiple feature attribute values ​​from each of the multiple alarm logs to be processed to obtain multiple sets of feature attribute values; A graph structure is constructed using the alarm logs as nodes and the similarity between the multiple sets of feature attribute values ​​as edges; Encode each alarm log in the multiple alarm logs to obtain the encoding vector of the node; The graph attention network model is used to identify the type of the graph structure based on the encoding vector of the node, thereby obtaining the attack type of the graph structure; the graph attention network model has learned the rules of all historical alarm logs during the training process; The step of constructing a graph structure using the alarm logs as nodes and the similarity between the multiple sets of feature attribute values ​​as edges includes: The alarm logs and their corresponding historical logs are identified as nodes in the graph structure; Obtain the attribute vectors of the alarm logs and the historical logs, and use the formula... Calculate the similarity between two nodes; where, and This represents two distinct nodes, namely the first node. i The node and the first j 1 node This represents the attribute number in the attribute vector of this node, that is, the first attribute in this node. k A vector of attributes Indicates the first The weights of the attribute vectors, A constant vector, This indicates the data used to calculate alarm logs. The Individual attribute vectors and historical logs The The degree of similarity between attribute vectors; Construct a graph structure using alarm logs or historical logs as nodes and similarity as edges.

2. The method according to claim 1, characterized in that, The encoding of each alarm log among the multiple alarm logs includes: Each alarm log in the multiple alarm logs is encoded using One-Hot encoding.

3. The method according to claim 1, characterized in that, The construction graph structure includes: For any two nodes in the graph structure, determine whether the similarity between the feature attribute values ​​of the two nodes is greater than a similarity threshold; If so, then create an edge in the graph structure connecting the two nodes.

4. The method according to claim 1, characterized in that, The method of using a graph attention network model to identify the type of the graph structure based on the encoding vectors of the nodes includes: Generate the adjacency matrix of the alarm log based on the graph structure; The adjacency matrix is ​​type-identified using a graph attention network model based on the encoding vectors of the nodes.

5. The method according to claim 1, characterized in that, Before using the graph attention network model to perform type recognition on the graph structure based on the encoding vectors of the nodes, the method further includes: Obtain sample data and sample labels. The sample data includes: the graph structure and encoding vector corresponding to the sample log. The sample label is the attack type of the graph structure corresponding to the sample log. The graph attention network model is obtained by training the graph attention network using the sample data and the sample labels as training labels.

6. The method according to claim 5, characterized in that, The training of the graph attention network includes: The graph attention network is used to predict the graph structure corresponding to the sample log based on the encoding vector of the sample log, so as to obtain the prediction type of the graph structure. Calculate the loss value between the predicted type of the graph structure and the attack type in the sample labels; The graph attention network is trained based on the loss value.

7. An attack type identification device, characterized in that, include: The alarm log extraction module is used to extract multiple feature attribute values ​​from each of the multiple alarm logs to be processed, and obtain multiple sets of feature attribute values. The feature attribute determination module is used to construct a graph structure with the alarm logs as nodes and the similarity between the multiple sets of feature attribute values ​​as edges; wherein, constructing the graph structure with the alarm logs as nodes and the similarity between the multiple sets of feature attribute values ​​as edges includes: determining the alarm logs and the corresponding historical logs as nodes in the graph structure; obtaining the attribute vectors of the alarm logs and the attribute vectors of the historical logs, and using the formula... Calculate the similarity between two nodes; where, and This represents two distinct nodes, namely the first node. i The node and the first j 1 node This represents the attribute number in the attribute vector of this node, that is, the first attribute in this node. k A vector of attributes Indicates the first The weights of the attribute vectors, A constant vector, This indicates the data used to calculate alarm logs. The Individual attribute vectors and historical logs The The similarity between attribute vectors; using alarm logs or historical logs as nodes and similarity as edges, construct a graph structure; The encoding vector acquisition module is used to encode each alarm log in the multiple alarm logs to obtain the encoding vector of the node; the attack type identification module is used to use a graph attention network model to identify the type of the graph structure based on the encoding vector of the node to obtain the attack type of the graph structure; the graph attention network model has learned the rules of all historical alarm logs during the training process.

8. The apparatus according to claim 7, characterized in that, The encoding vector acquisition module includes: The One-Hot encoding submodule is used to encode each alarm log in the multiple alarm logs using One-Hot encoding.

9. An electronic device, characterized in that, include: A processor and a memory, the memory storing machine-readable instructions executable by the processor, which, when executed by the processor, perform the method as described in any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the method as described in any one of claims 1 to 6.

Images