An APT Attack Detection Method and Device Based on Masked Graph Autoencoders

Abstract

The present invention belongs to the technical field of machine learning, and specifically relates to an APT attack detection method and device based on a masked graph autoencoder. The method of the present invention includes: preprocessing the security log data to be detected, constructing a network attack traceability graph, and extracting the original categories of nodes and edges; constructing and training a graph attention autoencoder based on masked node feature reconstruction and structure reconstruction as a feature extraction model; inputting the traceability graph to be detected into the feature extraction model to obtain the feature vectors of the nodes in the traceability graph; and using an unsupervised outlier detection algorithm to detect abnormal nodes and identify APT attacks according to the feature vectors of the nodes or the traceability graph itself. The present invention can greatly reduce the dependence of APT attack detection on scarce attack data, reduce the computational cost of structure reconstruction, and improve the representation ability of the masked graph autoencoder for the graph structure. The APT attack detection accuracy of the present invention is significantly higher than that of existing APT attack detection methods, and the computational overhead is significantly lower.

Description

Technical Field

[0001] The present invention belongs to the technical field of machine learning, and particularly relates to an APT attack detection method and device. Background Art

[0002] Advanced Persistent Threat (APT) is a network attack pattern that has been continuously increasing in recent years. It infiltrates into the system internally through concealed and deceptive means, and uses a series of operations to obtain sensitive data, seize system permissions, or introduce external programs. APT attack detection technology is based on the security log data obtained by log collection devices and software, and uses anomaly detection technology to identify the possible APT attack traces contained therein. APT attack detection technology is of great significance in the field of network security, and also has important application scenarios and potential.

[0003] Early APT attack detection technologies detected end-to-end by manually collecting and analyzing APT attack patterns, using heuristic rules or statistical methods; or based on the common processes of APT attacks, summarized and extracted APT attack stages, and used the matching algorithm on the traceability graph to achieve attack detection. However, these methods cannot comprehensively and deeply extract the features in the security logs, and at the same time have poor generalization ability, and are not ideal in dealing with concealed attacks, detecting new attack patterns, etc.

[0004] In recent years, with the emergence and popularity of deep learning methods and graph neural networks, many corresponding methods have been applied to the research of APT attack detection, and certain progress has been made in both detection accuracy and generalization ability. Its main process is to construct a traceability graph using training log data, input it into a graph neural network for training, and use the trained graph neural network to extract features from the traceability graph constructed by the log to be detected, obtain the feature representation vectors of the traceability graph or the nodes in the graph, and then use a classifier or anomaly detection method to achieve APT attack detection.

[0005] The feature dimensions contained in the traceability graph are relatively high, and traditional deep neural networks are difficult to handle the information contained in the graph structure. Graph neural networks can effectively extract the graph structure and its corresponding features. Some researchers have achieved high recognition rates on multiple APT attack data sets using graph neural networks.

[0006] However, common APT detection methods based on graph neural networks require a large amount of training data, especially attack data, for the learning of graph neural network models. Therefore, these supervised detection methods are difficult to handle scenarios lacking attack data and cannot identify unlearned APT attack patterns. At the same time, common self-supervised graph autoencoder methods face the problem of rapid expansion of computational complexity and memory overhead as the size of the traceability graph increases due to the introduction of structure reconstruction loss. When applied to the detection of attacks in large-scale log data (such as when the constructed traceability graph is huge and there are many original features), it is more likely to have problems such as long computing time and excessive memory occupation. This not only increases the hardware requirements for completing APT attack detection but also increases the computational overhead required for model training and may even make the training process almost impossible to complete. Summary of the Invention

[0007] The purpose of the present invention is to provide an APT attack detection method and device that can achieve APT attack detection in scenarios lacking training attack data and have small computational overhead.

[0008] The APT attack detection method proposed by the present invention is based on the masked graph autoencoder technology. The feature vectors of the nodes in the network attack traceability graph are obtained through the graph autoencoder, and the outliers are found based on the feature vectors to detect APT attacks. The specific steps are as follows:

[0009] Step S1: Preprocess the determined security log data to be inspected to obtain the corresponding network attack traceability graph, and extract the original categories of nodes and edges;

[0010] Step S2: Construct a masked graph autoencoder with structure reconstruction, and use completely non-attack security log data to perform quantization training on the masked graph autoencoder; use the trained masked graph autoencoder model as a feature extraction model, and save the output of the model on the training log;

[0011] Step S3: Input the traceability graph obtained by preprocessing into the feature extraction model to obtain the feature vectors corresponding to the nodes in the traceability graph and the feature vector corresponding to the traceability graph itself respectively;

[0012] Step S4: According to the feature vectors of the nodes in the traceability graph and the feature vector of the traceability graph, apply an adaptive outlier detection algorithm to detect abnormal nodes or abnormal traceability graphs and identify APT attacks.

[0013] Among them:

[0014] In step S1, the following sub-steps are included:

[0015] Step S1-1: According to the data format of the traceability log, construct a log parser to extract information such as entities, entity types, interactions between entities, interaction types, and interaction timestamps in the security log data;

[0016] Step S1-2: Crop the entities, and delete the entities that do not participate in any interaction. Sort the interactions in ascending order of timestamp and crop them, delete the duplicate relationships between the same entity pairs, and only retain the single interaction with the smallest timestamp.

[0017] Step S1-3: Construct a cyber-attack traceability graph. Each entity corresponds to a node in the traceability graph. Each interaction corresponds to a directed edge in the traceability graph.

[0018] Step S1-4: Supplement the cyber-attack traceability graph. The original feature vectors of the nodes and edges in the graph are filled with one-hot encodings of the corresponding types of the nodes or edges.

[0019] In step S2, the following sub-steps are included: Step S2-1: Construct a masked graph autoencoder model with structure reconstruction. The graph autoencoder model includes an embedding layer, a graph attention layer, a structure reconstruction module, a fully connected layer, and an average pooling layer. The main functions of each module are as follows: The embedding layer inputs the original categories of nodes and edges and extracts the original feature vectors of nodes and edges. The graph attention layer inputs the traceability graph to be detected and the feature vectors of nodes and edges, performs graph convolution operations based on the graph attention mechanism, and obtains the output feature vectors of nodes. The structure reconstruction module samples the node pairs in the traceability graph based on the extracted node features and reconstructs the edges between the node pairs. The parameters in the parameter matrices of each part are randomly set. Its structure is shown in Figure 2 Among them, the graph attention layer is divided into 2 categories, denoted as: the graph attention encoding layer and the graph attention decoding layer, where:

[0020] After the embedding layer, there are 2 sequentially connected graph attention encoding layers; the graph attention encoding layer has a total of 4 attention heads.

[0021] After the graph attention encoding layer, there is a parallel configuration of 1 average pooling layer, 1 fully connected layer, and 1 structure reconstruction module. The fully connected layer connects the graph attention encoding layer and the graph attention decoding layer and converts the output feature vectors of the encoding layer into the input feature vectors of the decoding layer.

[0022] After the fully connected layer, there is 1 graph attention decoding layer, and the graph attention decoding layer has a total of 4 attention heads.

[0023] In each of the above layers, there are calculation weight values (i.e., parameters) for calculating the data transmitted to the next layer. Next, train the masked graph autoencoder model:

[0024] Step S2-2: Use the preprocessed cyber-attack traceability graph as the training set, randomly mask the nodes in the traceability graph, record the masked nodes, and then input them into the graph autoencoder model.

[0025] Step S2-3: Perform forward propagation on the masked graph autoencoder model and calculate the error based on the results of the structure reconstruction module and the graph attention decoding layer;

[0026] Step S2-4: Use the backpropagation method to propagate the error and update the parameters;

[0027] Step S2-5: Repeat steps S2-2 to S2-4 until the training requirement conditions are met, and obtain the trained masked graph autoencoder as the feature extraction model;

[0028] Step S2-6: Use the feature extraction model obtained in step S2-5, take the unmasked training set as the input, and save the outputs of the graph attention encoding layer and the average pooling layer in the model.

[0029] Among them, in step S4, the following sub-steps are included:

[0030] Step S4-1: Based on the different application scenarios, select the outputs of different modules from the saved training set outputs in step S2-6 and the detected traceability graph outputs in step S3 as the inputs of the outlier detection method:

[0031] When fine-grained detection of the subject and object in the log is required, select the output of the graph attention encoding layer;

[0032] When overall detection of the log is required, select the output of the average pooling layer;

[0033] Step S4-2: Based on the training set input selected in step S4-1, train the K-nearest neighbor outlier detection model;

[0034] Step S4-3: Based on the to-be-detected traceability graph output selected in step S4-1 and the outlier detection model obtained in step S4-2, detect abnormal nodes or abnormal traceability graphs and identify APT attacks.

[0035] In the present invention, the preprocessing method has the following technical feature: for security log entries, as long as the type data of the interacting subject, object, and the interaction itself are available, it can be applied to the present invention, expanding the applicable scope of the present invention.

[0036] In the present invention, the masked graph autoencoder has the following technical feature: while reconstructing the original features of the masked nodes using the graph attention decoding layer, the structure reconstruction module is used to learn the structural features of the traceability graph, improving the graph structure representation ability of the masked graph autoencoder.

[0037] In the present invention, the masked graph autoencoder further has the following technical feature: the structure reconstruction module adopts negative sampling reconstruction based on node pairs to replace the commonly used adjacency matrix reconstruction method, which significantly reduces the computational amount and memory overhead while maintaining the same effect.

[0038] In the present invention, the graph attention layer further has the following technical feature: when performing graph convolution, an additive attention mechanism based on source node features, edge features, and target node features is used to calculate the attention weights, which learns the features of the edges in the graph without increasing the computational amount and increases the representation ability of the model.

[0039] In the present invention, both the masked graph autoencoder model and the K-nearest neighbor outlier detection algorithm are self-supervised models, which only require non-attack security log data for training, expanding the applicable scope of the present invention and reducing the dependence of the present invention on attack data.

[0040] In the present invention, batch normalization is performed on the output of each layer of the graph attention encoding layer in step S2, and the output of each layer is normalized to a normal distribution of N(0,1) to prevent the problem of gradient disappearance during the backpropagation process.

[0041] In the present invention, random dropout is performed on the output of the embedding layer in step S2 to reduce the dependence of the model on the original features of the input nodes.

[0042] In the present invention, the training completion condition in step S2-5 is: a predetermined number of loops have been completed, the parameters have converged, or the training error has been eliminated.

[0043] The present invention further includes an APT attack detection device based on the above method, which includes: a security log preprocessing module, a masked graph autoencoder model construction and training module, a feature extraction module, and an outlier detection module. These four modules perform the operations of steps S1, S2, S3, and S4 in the APT attack detection method in sequence.

[0044] The method of the present invention adopts a masked graph autoencoder model and a general traceability graph construction method, which expands the applicable scope of the model and reduces the dependence on attack data; at the same time, a structure reconstruction loss based on negative sampling is introduced, which reduces the computational amount and memory overhead, enables the model calculation to be completed faster, and allows lower hardware requirements. The APT attack detection accuracy obtained by this method on multiple data sets is higher than that of existing APT attack detection methods, and at the same time, the computational amount, calculation time, and memory overhead are significantly reduced. Description of the Drawings

[0045] Figure 1 is a flowchart of the APT attack detection method based on the masked graph autoencoder according to the embodiment of the present invention.

[0046] Figure 2 It is a schematic diagram of the mask graph autoencoder model structure according to an embodiment of the present invention.

[0047] Figure 3 It is a schematic diagram of the graph attention encoding layer according to an embodiment of the present invention.

[0048] Figure 4 It is a schematic diagram of the structure reconstruction module according to an embodiment of the present invention.

[0049] Figure 5 It is a schematic diagram of the graph attention decoding layer according to an embodiment of the present invention. Specific implementation manner

[0050] The following describes the specific implementation manner of the present invention in conjunction with the accompanying drawings and embodiments.

[0051] In this embodiment, the model construction and the like are all implemented on a Linux platform, and this platform is supported by at least one graphics processing unit (GPU) card.

[0052] Figure 1 It is a flowchart of the APT attack detection method based on the mask graph autoencoder according to an embodiment of the present invention. The APT attack detection method based on the mask graph autoencoder includes the following steps:

[0053] Step S1: Preprocess the security log data that has been determined to be to be inspected to obtain the corresponding network attack traceability graph, and extract the original categories of nodes and edges;

[0054] In this embodiment, the security logs used as the training set come from the dataset Unicorn Wget. There are 150 security logs in the dataset, including 100 training logs without APT attacks and 25 detection logs each without APT attacks and with APT attacks. Among the 100 logs for training, each log contains an average of 968,502 log entries. Each entry provides information on the interaction subject, interaction object, subject type, object type, and interaction type. There are 14 types of subject and object types in total, and 4 types of interaction types in total. The detection task on this dataset is for the overall detection of a single log data. The preprocessing includes the following steps:

[0055] Step S1-1: According to the data format of the traceability logs, construct a log parser to extract information such as entities, entity types, interactions between entities, interaction types, and interaction timestamps in the security log data. In this embodiment, an existing open-source data format, Prov-json, is used to construct the log parser;

[0056] Step S1-2: Crop the entities obtained in step S1-1 and delete the entities that do not participate in any interactions. Sort the interactions obtained in step S1-1 in ascending order of timestamps. Then crop the sorted interaction information and delete the duplicate relationships between the same entity pairs, only retaining the single interaction with the smallest timestamp;

[0057] Step S1-3: Construct a network attack traceability graph based on the entities and interaction information obtained in step S1-2. Each entity corresponds to a node in the traceability graph. Each interaction corresponds to a directed edge in the traceability graph from the node corresponding to the interaction subject to the node corresponding to the interaction object;

[0058] Step S1-4: Supplement the network attack traceability graph obtained in step S1-3. The original feature vectors of the nodes in the graph are filled with one-hot encodings (i.e., One-hot encodings) of the entity types corresponding to the nodes. The original feature vectors of the edges in the graph are filled with one-hot encodings (i.e., One-hot encodings) of the interaction types corresponding to the edges.

[0059] Step S2: Training of the masked graph autoencoder model, that is, constructing a masked graph autoencoder with structure reconstruction, and using completely non-attacked security log data to perform quantization training on this masked graph autoencoder. The trained masked graph autoencoder model is used as a feature extraction model, and the output of this model on the training log is saved. The construction and training of this model include the following steps:

[0060] Step S2-1: Construct the model. The model adopted in this embodiment is a masked graph autoencoder model with structure reconstruction. This graph autoencoder model contains an embedding layer, a graph attention layer, a structure reconstruction module, a fully connected layer, and an average pooling layer. Its structure is shown in Figure 2 Among them, the graph attention layer is divided into 2 categories, denoted as: graph attention encoding layer and graph attention decoding layer.

[0061] The masked graph autoencoder first inputs the traceability graph into the embedding layer, and after the embedding layer are 2 sequentially connected graph attention encoding layers. In each graph attention encoding layer, there are three fully connected layers in sequence, denoted as FC_S, FC_E, and FC_D, a three-way additive attention layer, and an output layer. Among them, the input of FC_S is the feature of the source node, the input of FC_E is the feature of the edge, and the input of FC_D is the feature of the target node. The input of the three-way additive attention layer is the outputs of FC_S, FC_E, and FC_D. The output of the 2nd graph attention encoding layer is the output at the node level of the model.

[0062] After the graph attention encoding layer, there is one average pooling layer, one fully connected layer, and one structure reconstruction module arranged in parallel; the average pooling layer is used to perform average pooling on the output of the graph attention encoding layer as the output at the model log level. The fully connected layer connects the graph attention encoding layer and the decoding layer, and converts the output feature vector of the encoding layer into the input feature vector of the decoding layer.

[0063] The structure reconstruction module consists of a sampling module and a reconstruction module. The sampling module randomly performs positive and negative balanced sampling on node pairs from the traceability graph, so that the number of node pairs with edges and the number of node pairs without edges are the same, thereby reducing the computational complexity and memory overhead of structure reconstruction. When the number of edges in the traceability graph is less than the sampling threshold, the total number of samples is the total number of edges; when the number of edges in the traceability graph is greater than the sampling threshold, the total number of samples is the sampling threshold. The reconstruction module consists of a connection layer and a feedforward neural network classifier in sequence. The connection layer concatenates the features of the two nodes in the node pair, and the feedforward neural network classifier inputs the concatenated features and outputs the probability of whether there is an edge in the node pair.

[0064] After the fully connected layer is a graph attention decoding layer. Compared with the graph attention encoding layer, this decoding layer does not perform batch normalization and activation on the output, but uses the decoding layer to replace the output layer. This decoding layer converts the three-way additive attention layer to the same dimension as the original category of the node, and is used to calculate the node feature reconstruction error. And the dimension of the input feature vector is the same as the output of the last graph attention encoding layer, and the dimension of the output feature vector is the same as the input of the first graph attention encoder. Each of the above layers and modules contains calculation weight values (i.e., parameters) for calculating the data passed to the next layer.

[0065] In this embodiment, the parameters of each layer of the masked graph autoencoder model are shown in Table 1 below.

[0066] Table 1

[0067]

[0068]

[0069] It can be seen from Table 1 that after the model of this embodiment is constructed, the training set can be used to train it.

[0070] Step S2-2: Use the preprocessed network attack traceability graph as the training set, randomly mask the nodes in the traceability graph, record the masked nodes, and then input them into the graph autoencoder model;

[0071] Step S2-3: Perform forward propagation on the masked graph autoencoder model and calculate the error based on the results of the structure reconstruction module and the graph attention decoding layer;

[0072] Step S2-4: Use the backpropagation method to propagate the error and update the parameters;

[0073] Step S2-5: Repeat steps S2-2 to S2-4 until the training requirement conditions are met, and obtain the trained masked graph autoencoder as the feature extraction model;

[0074] Step S2-6: Use the feature extraction model obtained in step S2-5, take the unmasked training set as the input, and save the outputs of the graph attention encoding layer and the average pooling layer in the model.

[0075] To accelerate the model training speed and make full use of computing resources, the above training process in this embodiment adopts a batch input processing method. That is, the training set logs are divided into 30 batches, with 5 logs input in each batch, and then steps S2-2 to S2-4 are processed for each batch respectively; after all batches have completed the input and processing, one cycle is completed, and then the batch input processing process of the next cycle can be carried out.

[0076] In this embodiment, the total number of cycles is 10. In addition, the learning rate of the model is set to 0.005, and L2 regularization with a weight decay coefficient of 0.0005 is implemented for the model weights during training. The model is supervised by the cross-entropy loss function of structure reconstruction and the scaled cosine loss of node feature reconstruction, and the parameters are updated by backpropagation through the settings in step S1-5.

[0077] Through the above steps, the masked graph autoencoder model of this embodiment is completed in construction and training and can be used for APT attack detection. In this embodiment, the trained masked graph autoencoder model is used as a feature extraction model to extract the feature vectors of the traceability graph to be detected and the nodes in the graph, and the obtained feature vectors can be used to judge the abnormal conditions of the traceability graph or the nodes in the graph, so as to detect potential APT attacks in the security logs.

[0078] Step S3: Input the preprocessed traceability graph to be detected into the feature extraction model to obtain the feature vectors corresponding to the nodes in the traceability graph and the feature vector corresponding to the traceability graph itself respectively; among them, the feature vectors of the nodes in the traceability graph are obtained from the output of the graph attention encoding layer of the masked graph autoencoder model, and the feature vector corresponding to the traceability graph itself is obtained from the output of the average pooling layer of the masked graph autoencoder model.

[0079] Step S4: According to the feature vectors of the nodes in the traceability graph and the feature vector of the traceability graph, apply the adaptive outlier detection algorithm to detect abnormal nodes or abnormal traceability graphs and identify APT attacks.

[0080] Among them, in step S4, the following sub-steps are included:

[0081] Step S4-1: Based on different application scenarios, select the outputs of different modules from the output of the training set saved in step S2-6 and the output of the traceability graph to be detected in step S3 as the input of the outlier detection method:

[0082] For fine-grained detection of the subject and object in the log, select the output of the graph attention encoding layer;

[0083] For overall detection of the log, select the output of the average pooling layer;

[0084] Step S4-2: Based on the training set input selected in step S4-1, train a K-nearest neighbor outlier detection model;

[0085] Step S4-3: Based on the output of the traceability graph to be detected selected in step S4-1 and the outlier detection model obtained in step S4-2, detect abnormal nodes or abnormal traceability graphs and identify APT attacks.

[0086] In this embodiment, to reduce model bias, the input of the K-nearest neighbor outlier detection model is normalized based on the training input. After normalizing the feature vector of the target to be detected, calculate the average Euclidean distance between the target and its K nearest neighbors. When this distance is greater than the outlier distance threshold, it is determined that the target to be detected belongs to an outlier, and a potential APT attack is detected.

[0087] In this embodiment, the K-nearest neighbor outlier detection model has the following characteristics: the number of nearest neighbors K is taken as 10; the outlier distance threshold is set to 10 times the average nearest neighbor distance of the training set.

[0088] Table 2 shows the determination test results of the APT attack detection method based on the masked graph autoencoder in this embodiment of the invention and the comparison of the model accuracy with existing related methods. Among them, "ProvDetector", "Unicorn", "Prov-Gem", and "ThreaTrace" are all related APT attack detection methods. And the APT attack detection methods "Prov-Gem" and "ThreaTrace" both require attack logs to complete training and belong to supervised methods, while "ProvDetector", "Unicorn", and the method of the present invention do not require attack logs to complete training and belong to unsupervised or self-supervised methods.

[0089] Table 2

[0090] Method Name F1 Score ProvDetector 0.68 Unicorn 0.90 Prov-Gem 0.90 ThreaTrace 0.95 The present invention 0.97

[0091] The APT attack detection method based on the masked graph autoencoder in this embodiment has a high recognition accuracy, exceeding the accuracy of other APT attack detection methods in the prior art, and can complete the training of the model without scarce attack logs.

[0092] Function and Effect of Embodiment

[0093] According to this embodiment, by adopting the masked graph autoencoder model and a general traceability graph construction method, the dependence on attack data is reduced; at the same time, a structure reconstruction loss based on negative sampling is introduced, and a three-way additive attention mechanism is used to extract the features of the edges in the traceability graph, greatly reducing the computational amount, computational time, and memory overhead, enabling the model calculation to be completed faster, allowing for lower hardware requirements, and enabling the extraction of feature vectors using the trained model to be completed faster, thereby accelerating both the model training speed and the log detection speed of APT attack detection.

[0094] The above embodiments are only used to illustrate the specific implementation manners of the present invention and are not limitations on the present invention.

[0095] According to this method, the present invention can also provide a corresponding APT attack detection device, including: a preprocessing module for preprocessing the security log to be detected, an APT attack detection model construction and training module formed by encapsulating the masked graph autoencoder model obtained through the above construction and training, a feature extraction module for feature extraction, and an outlier detection module for performing attack detection based on the target feature vector to be detected extracted by the feature extraction module. The functions of these four modules sequentially perform the operations of steps S1, S2, S3, and S4 of the APT attack detection method.

[0096] In the embodiment, the K-nearest neighbor outlier detection model uses the Euclidean distance to measure the similarity between the target to be detected and its K-nearest neighbors. In the present invention, other similarity measurement methods can also be used to calculate the similarity between the target to be detected and its K-nearest neighbors.

[0097] In the embodiment, in order to accelerate the model training speed and make full use of computing resources, the training process adopts a batch input processing method. However, when using a log or other training sets with a small number of entries in the log, the batch input processing method may not be adopted, but the entire training set can be directly input at once, and then the processing process of steps S2-2 to S2-4 is performed.

Claims

1. A method for detecting APT attacks based on a masked graph autoencoder, characterized in that Obtain the feature vectors of the nodes in the network attack traceability graph through a graph autoencoder, and find outliers and detect APT attacks based on the feature vectors. The specific steps are as follows: Step S1: Preprocess the security log data determined to be to be inspected to obtain the corresponding network attack traceability graph, and extract the original categories of nodes and edges; Step S2: Construct a masked graph autoencoder with structure reconstruction, and use completely non - attack security log data to perform quantization training on the masked graph autoencoder; use the trained masked graph autoencoder model as a feature extraction model, and save the output of the model on the training log; Step S3: Input the traceability graph obtained by preprocessing into the feature extraction model to obtain the feature vectors corresponding to the nodes in the traceability graph and the feature vector corresponding to the traceability graph itself respectively; Step S4: According to the feature vectors of the nodes in the traceability graph and the feature vector of the traceability graph, apply an adaptive outlier detection algorithm to detect abnormal nodes or abnormal traceability graphs and identify APT attacks.

2. The APT attack detection method according to claim 1, wherein Step S1 includes the following sub - steps: Step S1 - 1: According to the data format of the traceability log, construct a log parser to extract entity, entity type, entity - to - entity interaction, interaction type, and interaction timestamp information from the security log data; Step S1 - 2: Clip the entities to delete entities that do not participate in any interactions; sort the interactions in ascending order of timestamp and clip them to delete duplicate relationships between the same entity pair, and only retain the single interaction with the smallest timestamp; Step S1 - 3: Construct a network attack traceability graph; each entity corresponds to a node in the traceability graph; each interaction corresponds to a directed edge in the traceability graph; Step S1 - 4: Supplement the network attack traceability graph; the original feature vectors of the nodes and edges in the graph are filled with one - hot encodings of the corresponding types of the node or edge.

3. The APT attack detection method according to claim 2, wherein Step S2 includes the following sub - steps: Step S2 - 1: Construct a masked graph autoencoder model with structure reconstruction. This graph autoencoder model contains an embedding layer, a graph attention layer, a structure reconstruction module, a fully - connected layer, and an average pooling layer; the functions of each module are as follows: the embedding layer inputs the original categories of nodes and edges and extracts the original feature vectors of nodes and edges; the graph attention layer inputs the traceability graph to be detected and the feature vectors of nodes and edges, and performs graph convolution operations based on the graph attention mechanism to obtain the output feature vectors of nodes; The structure reconstruction module samples node pairs in the traceability graph based on the extracted node features and reconstructs the edges between the node pairs; the parameters in the parameter matrices of each part are randomly set; among them, the graph attention layer is divided into 2 categories, denoted as: the graph attention encoding layer and the graph attention decoding layer, where: After the embedding layer are 2 sequentially connected graph attention encoding layers; the graph attention encoding layer has a total of 4 attention heads; After the graph attention encoding layer are a parallel - configured average pooling layer, a fully - connected layer, and a structure reconstruction module; the fully - connected layer connects the graph attention encoding layer and the graph attention decoding layer and converts the output feature vectors of the encoding layer into the input feature vectors of the decoding layer; After the fully - connected layer is 1 graph attention decoding layer, and the graph attention decoding layer has a total of 4 attention heads; Each of the above layers contains calculation weight values for calculating data transmitted to the next layer, that is, parameters; the following is the training of the masked graph autoencoder model: Step S2-2: Use the preprocessed network attack traceability graph as the training set, randomly mask the nodes in the traceability graph, record the masked nodes, and then input them into the graph autoencoder model; Step S2-3: Perform forward propagation on the masked graph autoencoder model and calculate the error based on the results of the structure reconstruction module and the graph attention decoding layer; Step S2-4: Use the backpropagation method to transmit the error and update the parameters; Step S2-5: Repeat steps S2-2 to S2-4 until the training requirement conditions are met, and obtain the trained masked graph autoencoder as the feature extraction model; Step S2-6: Use the feature extraction model obtained in step S2-5, take the unmasked training set as the input, and save the outputs of the graph attention encoding layer and the average pooling layer in the model.

4. The APT attack detection method according to claim 3, wherein Step S4 includes the following sub-steps: Step S4-1: Based on the different application scenarios, select the outputs of different modules from the outputs of the model saved in step S2-6 and the outputs of the traceability graph to be detected obtained in step S3 as the input of the outlier detection method: When fine-grained detection of the subject and object in the log is required, select the output of the graph attention encoding layer; When overall detection of the log is required, select the output of the average pooling layer; Step S4-2: Based on the training set input selected in step S4-1, train the K-nearest neighbor outlier detection model; Step S4-3: Based on the output of the traceability graph to be detected selected in step S4-1 and the outlier detection model obtained in step S4-2, detect abnormal nodes or abnormal traceability graphs and identify APT attacks.

5. An APT attack detection device based on the method according to any one of claims 1-4, comprising: A security log preprocessing module, a masked graph autoencoder model construction and training module, a feature extraction module, and an outlier detection module; These four modules respectively perform the operations of steps S1, S2, S3, and S4 in the APT attack detection method.

Images