Node analysis method and device based on threat analysis graph

Abstract

An embodiment of the present invention provides a node analysis method and device based on a threat analysis graph, relating to the field of network security technology. The method includes: extracting target data from source data and using the target data as a seed node; the target data is data with security risks; extracting target subgraph data associated with the seed node from a threat analysis graph stored in a graph database; determining a node representation of the target node in the target subgraph data; the node representation of the target node includes the node data of the target node and the node data of the target node's neighboring nodes; and analyzing the target node based on the node representation of the target node. The present invention only determines the node representation of the target node in the target subgraph data associated with the seed node, eliminating the need to calculate and analyze all graph data in the threat analysis graph, thereby improving the efficiency of data analysis.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a node analysis method and device based on a threat analysis graph. Background Art

[0002] In the field of network security technology, the activities of Advanced Persistent Threat (APT) organizations are very covert, but the network traffic controlled by APT organizations can be obtained through network layer detection, so the attack behavior of APT organizations can be analyzed based on network layer detection.

[0003] In related technologies, log data is usually obtained through network layer detection, the log data is analyzed, and threat intelligence is obtained from massive log data.

[0004] However, in the above-mentioned related technologies, although the obtained log data is very rich, the redundancy is high, so directly analyzing the massive log data will reduce the efficiency of data analysis. Summary of the Invention

[0005] In response to the problems in the prior art, embodiments of the present invention provide a node analysis method and device based on a threat analysis graph.

[0006] Specifically, the embodiments of the present invention provide the following technical solutions:

[0007] In a first aspect, an embodiment of the present invention provides a node analysis method based on a threat analysis graph, comprising:

[0008] Extracting target data from source data and using the target data as a seed node; the target data is data with security risks;

[0009] Extracting target subgraph data associated with the seed node from the threat analysis graph stored in the graph database;

[0010] Determine a node representation of a target node in the target subgraph data; the node representation of the target node includes node data of the target node and node data of neighboring nodes of the target node;

[0011] Analyze the target node based on the node representation of the target node

[0012] Furthermore, extracting target subgraph data associated with the seed node from the threat analysis graph stored in the graph database includes:

[0013] Searching for target association data of a preset number of hops associated with the seed node in the threat analysis graph; the target association data includes node data and edge data;

[0014] The node data of the seed node and the target associated data are combined to obtain the target subgraph data.

[0015] Furthermore, the determining of the node representation of the target node in the target subgraph data includes:

[0016] Determining a graph embedding vector for each node in the target subgraph data;

[0017] The node representation of the target node is determined based on the graph embedding vector of each node.

[0018] Furthermore, determining the graph embedding vector of each node in the target subgraph data includes:

[0019] Get the current business scenario;

[0020] When the current business scenario includes a business scenario of searching for structurally similar nodes, determining a graph embedding vector of each node in the target subgraph data based on a structural similarity algorithm;

[0021] When the current business scenario includes a business scenario of searching for content-similar nodes, a graph embedding vector of each node in the target subgraph data is determined based on a content similarity algorithm.

[0022] Furthermore, determining a node representation of a target node based on the graph embedding vector of each node includes:

[0023] Inputting the graph embedding vector of each of the nodes into the target graph neural network model to obtain a node representation of the target node output by the target graph neural network model;

[0024] The target graph neural network model is obtained by training based on graph embedding vector samples of multiple nodes.

[0025] Furthermore, the target graph neural network model includes an acquisition module and an aggregation module;

[0026] Inputting the graph embedding vector of each node into the target graph neural network model to obtain a node representation of the target node output by the target graph neural network model includes:

[0027] Inputting the graph embedding vector of each node into the acquisition module, collecting the node data of each neighbor node of the target node from the graph embedding vector of each node through the acquisition module, and sending the node data of each neighbor node and the node data of the target node to the aggregation module;

[0028] Aggregating the node data of each neighbor node and the node data of the target node through the aggregation module to obtain node aggregation information;

[0029] The node aggregation information is determined as the node representation of the target node.

[0030] Furthermore, the analyzing the target node based on the node representation of the target node includes:

[0031] Determining a threat risk coefficient of the target node based on the node characterization of the target node, where the threat risk coefficient is used to characterize the risk level of the target node;

[0032] When it is determined that the threat risk coefficient of the target node is greater than a preset coefficient value, the node data of the target node is stored in a fall identification map database, or an alarm is issued to the target node, or the node data of the target node and the node data of the associated nodes of the target node are displayed.

[0033] Furthermore, the analyzing the target node based on the node representation of the target node includes:

[0034] Compare and analyze the node representation of the target node with the node representations of other nodes to determine nodes similar to the target node.

[0035] In a second aspect, an embodiment of the present invention further provides a node analysis device based on a threat analysis graph, comprising:

[0036] A first extraction unit is configured to extract target data from the source data and use the target data as a seed node; the target data is data with security risks;

[0037] A second extraction unit is configured to extract target subgraph data associated with the seed node from the threat analysis graph stored in the graph database;

[0038] A determining unit, configured to determine a node representation of a target node in the target subgraph data; the node representation of the target node includes node data of the target node and node data of neighboring nodes of the target node;

[0039] An analyzing unit is configured to analyze the target node based on the node representation of the target node.

[0040] In a third aspect, an embodiment of the present invention further provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the node analysis method based on the threat analysis graph as described in the first aspect are implemented.

[0041] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the node analysis method based on the threat analysis graph as described in the first aspect.

[0042] In a fifth aspect, an embodiment of the present invention further provides a computer program product having executable instructions stored thereon, which, when executed by a processor, enables the processor to implement the steps of the node analysis method based on the threat analysis graph described in the first aspect.

[0043] The node analysis method and device based on the threat analysis graph provided by the embodiments of the present invention use target data with security risks extracted from source data as seed nodes, extract target subgraph data associated with the seed nodes from the threat analysis graph, determine the node representation of the target node in the target subgraph data, and the node representation includes the node data of the target node and the node data of the target node's neighbor nodes. Finally, based on the node representation of the target node, a correlation analysis is performed on the target node. It can be seen that the present invention only determines the node representation of the target node in the target subgraph data associated with the seed node, eliminating the need to calculate and analyze all graph data in the threat analysis graph, thereby improving the efficiency of data analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0045] Figure 1 This is one of the flow diagrams of the node analysis method based on the threat analysis graph provided by an embodiment of the present invention;

[0046] Figure 2 is a schematic diagram of target subgraph data extraction provided by an embodiment of the present invention;

[0047] Figure 3 This is the second flow chart of the node analysis method based on the threat analysis graph provided by an embodiment of the present invention;

[0048] Figure 4 Schematic diagram of the structure of the initial autoencoder model provided by an embodiment of the present invention;

[0049] Figure 5 Schematic diagram of converting target subgraph data into a node representation of a target node according to an embodiment of the present invention;

[0050] Figure 6Schematic diagram of the structure of a node analysis system based on a threat analysis graph provided by an embodiment of the present invention;

[0051] Figure 7 Schematic diagram of the structure of a node analysis device based on a threat analysis graph provided by an embodiment of the present invention;

[0052] Figure 8 It is a schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0053] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0054] Figure 1 This is one of the flow charts of the node analysis method based on the threat analysis graph provided by the embodiment of the present invention, such as Figure 1 As shown, the node analysis method based on the threat analysis graph includes the following steps:

[0055] Step 101: extract target data from source data and use the target data as a seed node; the target data is data with security risks.

[0056] The source data can be sandbox data, crawler data, or Indicator of Compromise (IOC) data. An IOC is a type of threat intelligence, which refers to intelligence about the remote command and control server used by attackers to control the victim host. IOCs typically include domain names, Internet Protocol (IP), Uniform Resource Locator (URL), Secure Sockets Layer (SSL) certificates, and hashes.

[0057] For example, in cyberspace, massive amounts of data are generated every day, including but not limited to network behavior data generated by malicious samples running in sandboxes, Internet threat risk data crawled by web crawlers, threat intelligence data in open source security reports, etc. Multiple source data are collected regularly, and target data with security risks such as domains, URLs, and IPs are extracted from the source data as seed nodes.

[0058] Step 102: Extract target subgraph data associated with the seed node from the threat analysis graph stored in the graph database.

[0059] The graph database can be NebulaGraph, a distributed graph database that stores a threat analysis graph with tens of billions of instances. The threat analysis graph consists of multiple nodes and edges, where a node represents an entity and an edge represents the relationship between two entities. Based on the graph data types (node type, edge type) and the relationships between graph data, an undirected data association graph is generated. Based on this, the threat analysis graph is constructed by combining the data association directions of the relationships between graph data. This threat analysis graph can then be put into practical application. The relationship network is highly flexible and can present heterogeneous information in a unified view. NebulaGraph provides built-in services that enable querying graph data and the relationships between graph data based on various rules. Node types include, but are not limited to, V(IP), V(domain), and V(URL), where V represents a node. Edge types include, but are not limited to, E(connect), E(release), E(download), and E(delivery), where E represents an edge. When data initiates a network connection, it may connect to an IP, domain name, or URL; this type of relationship is called a connection. Data may be used to release files, creating a release relationship. Data may be used to download files, creating a download relationship. An IP, domain name, or URL may also be used to distribute malicious files, creating a delivery relationship. All of these data types and relationships can be derived based on threat intelligence within a specific network environment, allowing the threat analysis graph to be directly incorporated into the threat intelligence analysis process. Furthermore, because the threat analysis graph is tailored to the user's network environment, it is easier and more convenient to obtain threat intelligence tailored to the user's network environment based on the threat analysis graph.

[0060] For example, analyzing node associations in cyberspace data doesn't require full-graph analysis. Extracting associations within a few hops of a seed node provides sufficient information. The subgraph extraction module leverages NebulaGraph's vertex and edge query services to flexibly extract target subgraphs of varying sizes associated with seed nodes. The extracted target subgraph data is saved as vertex and edge data in JSON format.

[0061] The main fields used in vertex data include, but are not limited to, fields used to identify the node data content, fields indicating the node type, and fields indicating the node's unique identifier in the graph data. For example, the node data can be: {"name":"b**du.com","label":"domain","vertexId":"0005d1b1f7fde4c98455d29ece315570"}, where the field name stores the node data, the field label indicates that the node type is a domain name, and the field vertexId indicates that the node's hash value is 0005d1b1f7fde4c98455d29ece315570.

[0062] The main fields used in edge data include, but are not limited to, fields that uniquely identify the node in the graph and fields that indicate the node type. For example, edge data can be: {"srcId":"2c238667ca0068cead9c529e06b8675d","dstId":"d878b8a1a12e3920a6a713f12a3d18e2","label":"contain"}. The srcId field indicates that the hash value of node 1 is 2c238667ca0068cead9c529e06b8675d, the dstId field indicates that the hash value of node 2 is d878b8a1a12e3920a6a713f12a3d18e2, and the label field indicates that the edge type is contain. The direction of the edge is from the node represented by the srcId field to the node represented by the dstId field.

[0063] Step 103: Determine a node representation of a target node in the target subgraph data; the node representation of the target node includes the node data of the target node and the node data of neighboring nodes of the target node.

[0064] For example, when the target subgraph data is extracted, for the target node, the neighbor nodes of the target node are determined in the target subgraph data, and the node data of the target node and the node data of the neighbor nodes of the target node are aggregated to obtain the node representation of the target node; in addition, the target node can be one or more, and the specific number of target nodes can be determined based on actual needs.

[0065] Step 104: Analyze the target node based on the node representation of the target node.

[0066] For example, when the node representation of each target node is obtained, threat analysis, similarity analysis, etc. can be performed based on the node representation of each target node.

[0067] The node analysis method based on the threat analysis graph provided by an embodiment of the present invention uses target data with security risks extracted from source data as a seed node, extracts target subgraph data associated with the seed node from the threat analysis graph, determines the node representation of the target node in the target subgraph data, and includes the node data of the target node and the node data of the target node's neighbor nodes. Finally, a correlation analysis is performed on the target node based on the node representation of the target node. It can be seen that the present invention only determines the node representation of the target node in the target subgraph data associated with the seed node, eliminating the need to calculate and analyze all graph data in the threat analysis graph, thereby improving the efficiency of data analysis.

[0068] In one embodiment, the above step 102 may be implemented in the following manner:

[0069] Searching for target association data of a preset number of hops associated with the seed node in the threat analysis graph; the target association data includes node data and edge data;

[0070] The node data of the seed node and the target associated data are combined to obtain the target subgraph data.

[0071] The preset number of hops may be 1 hop, 2 hops, or 3 hops, etc., and may be set based on specific needs.

[0072] For example, the point and edge query service provided by the graph database NebulaGraph can be used to extract node data and edge data of different scales associated with seed nodes from NebulaGraph, and then the node data of the seed node, the node data associated with the seed node, and the edge data can be combined to obtain the target subgraph data; the specific size of the target subgraph data is determined based on the preset number of hops. Figure 2 is a schematic diagram of target subgraph data extraction provided by an embodiment of the present invention, such as Figure 2 As shown, a seed node 202 is extracted from the source data 201, and a subgraph extraction module 203 extracts target subgraph data 205 from the threat analysis graph of the graph database 204 based on the seed node 202. Figure 2 In the example, the source data 201 may be sandbox data, crawler data, or trap identification data, and the seed nodes 202 may be nodes A, B, C, E, and F, for example.

[0073] The node analysis method based on the threat analysis graph provided by the embodiment of the present invention is based on the point and edge query services provided by the graph database NebulaGraph, and the target subgraph data associated with the seed node is extracted, which is convenient for extraction.

[0074] In one embodiment, Figure 3This is a second flow chart of a node analysis method based on a threat analysis graph provided by an embodiment of the present invention. Figure 3 As shown, the above step 103 can be specifically implemented by the following steps:

[0075] Step 1031: Determine the graph embedding vector of each node in the target subgraph data.

[0076] Optionally, determining the graph embedding vector of each node in the target subgraph data may be specifically implemented in the following manner:

[0077] Get the current business scenario;

[0078] When the current business scenario includes a business scenario of searching for structurally similar nodes, determining a graph embedding vector of each node in the target subgraph data based on a structural similarity algorithm;

[0079] When the current business scenario includes a business scenario of searching for content-similar nodes, a graph embedding vector of each node in the target subgraph data is determined based on a content similarity algorithm.

[0080] For example, the target subgraph data consists of edge data and node data. The network relationships within the target subgraph data are non-Euclidean, making them inconvenient to process and compute directly. Euclidean space, on the other hand, is a vector space with a richer set of methods and tools. Graph embedding maps graph data into low-dimensional dense vectors, addressing the difficulty of efficiently inputting graph data into machine learning algorithms and enabling computations in Euclidean space. Graph embedding is more practical than adjacency matrices because it packages node attributes into a smaller-dimensional vector. Furthermore, vector operations are simpler and faster than operations on graphs. The goal of graph embedding is to represent nodes and edges using vectors. Specifically, graph embedding converts the node data for each node in the target subgraph data into a corresponding graph embedding vector. Graph embedding captures the topological structure of the target subgraph data, and embedding more attributes can yield better results in future tasks. Specifically, the appropriate algorithm can be selected based on the specific business scenario. For example, when searching for structurally similar nodes, a structurally similar algorithm can be used to determine the graph embedding vector for each node in the target subgraph data. When searching for content-similar nodes, a content-similar algorithm can be used to determine the graph embedding vector for each node in the target subgraph data.

[0081] Content similarity algorithms, including but not limited to the TransE algorithm, are used to represent graph embeddings of nodes and relationships in graph structures. They can be widely applied to various subsequent graph-based tasks. A piece of content can be represented as a triple (srcId, label, dstId). For example, a triple can be represented as: {"srcId":"2c238667ca0068cead9c529e06b8675d","dstId":"d878b8a1a12e3920a6a713f12a3d18e2","label":"contain"}. In this triple, the srcId and dstId fields are both nodes, represented by the hash values (MD5) of the nodes in the target subgraph data. The "contain" field is a relation, represented by an edge in the target subgraph data. The dimension of the graph embedding vector typically ranges from 64 to 512, and the specific dimension can be flexibly selected based on the actual performance of downstream tasks and business needs.

[0082] The structural similarity algorithm specifically takes the edge type statistics corresponding to each node in the target subgraph data and inputs them into the target autoencoder model, obtaining the graph embedding vector for each node output by the target autoencoder model. The target autoencoder model is trained based on the edge type statistics sample information corresponding to each node in the graph structure sample.

[0083] Specifically, the training process for the target autoencoder model is as follows: a large number of graph structure samples are obtained, and the edge type statistical sample information corresponding to each node in each graph structure sample is determined. The edge type statistical sample information corresponding to each node in the graph structure sample is then input into a pre-created initial autoencoder model. The initial autoencoder model then performs feature analysis on the edge type statistical sample information corresponding to each node to obtain edge type statistical prediction information output by the initial autoencoder model. A loss function is then constructed based on the edge type statistical prediction information and the edge type statistical sample information. The model parameters of the initial autoencoder model are optimized based on the loss function until convergence conditions are met, completing model training. This means that the trained model is obtained through the above-mentioned inductive learning training method. At this point, the trained model, from the input layer to the intermediate hidden layer, is extracted from the trained model as the target autoencoder model. Figure 4 Schematic diagram of the structure of the initial autoencoder model provided by the embodiment of the present invention. Figure 4 As shown in the figure, the layer numbered 1 is the input layer, the layer numbered 2 is the middle hidden layer, and the layer numbered 3 is the output layer. The input layer numbered 1 and the middle hidden layer numbered 2 are used as the target autoencoder model, that is, the part in the dotted box is used as the target autoencoder model.

[0084] It should be noted that the initial autoencoding model can be a three-layer deep neural network (DNN), the number of layers of the deep neural network can be increased, and other network structures can be used; vector dimensionality reduction (such as PCA) or other encoding technologies can also be used, and the present invention does not limit this.

[0085] It should be noted that when there is too much edge type statistical information corresponding to each node in the target subgraph data, the target autoencoder model can be input in batches for prediction calculation. After the prediction calculation, each node in the target subgraph data corresponds to a graph embedding vector, and the dimension of the graph embedding vector is the encoding layer dimension of the target autoencoder model or other encoding structure.

[0086] Step 1032: Determine a node representation of the target node based on the graph embedding vector of each node.

[0087] Optionally, the graph embedding vector of each of the nodes is input into the target graph neural network model to obtain the node representation of the target node output by the target graph neural network model.

[0088] The target graph neural network model is obtained by training based on graph embedding vector samples of multiple nodes.

[0089] For example, many real-world data are presented in the form of graphs. The graph neural network model is a new family of machine learning models. The graph neural network model has been proven to fully utilize the structural information of graph data. Machine learning models have promoted practical solutions to many practical problems, such as node classification, similarity detection of malicious samples, malware detection, fraud detection, etc. The message passing paradigm is a paradigm that aggregates adjacent node information to update central node information. It generalizes the convolution operator to the field of irregular data and realizes the connection between graphs and neural networks. The message passing paradigm is widely used because of its simplicity and powerful characteristics. The present invention determines the node representation of the target node based on the graph embedding vector of each node and the target graph neural network model.

[0090] In one embodiment, the target graph neural network model includes an acquisition module and an aggregation module; the graph embedding vector of each node is input into the target graph neural network model to obtain a node representation of the target node output by the target graph neural network model, which can be specifically achieved by the following method:

[0091] Inputting the graph embedding vector of each node into the acquisition module, collecting the node data of each neighbor node of the target node from the graph embedding vector of each node through the acquisition module, and sending the node data of each neighbor node and the node data of the target node to the aggregation module;

[0092] Aggregating the node data of each neighbor node and the node data of the target node through the aggregation module to obtain node aggregation information;

[0093] The node aggregation information is determined as the node representation of the target node.

[0094] Among them, the target graph neural network model can have built-in multiple mainstream graph neural network algorithms to meet the usage requirements of different security scenarios, including but not limited to the GraphSAGE algorithm. The GraphSAGE algorithm is taken as an example below.

[0095] GraphSAGE is a graph neural network algorithm that addresses the limitations of graph convolutional neural networks (GCNs). GCN training requires the adjacency matrix of the entire graph, which relies on the specific graph structure and is generally only applicable to transductive learning. GraphSAGE uses multiple layers of aggregation functions, each of which aggregates information about a node and its neighbors to produce the feature vectors of the next layer. GraphSAGE leverages node neighborhood information and does not rely on the global graph structure. GraphSAGE includes a sampling module and an aggregation module. It first samples neighboring nodes using connectivity information between nodes. Then, it continuously aggregates information from adjacent nodes through multiple layers of aggregation functions to obtain node aggregate information, which is used as the node representation of the target node. The aggregation function can be any of the following: mean aggregator, graph convolutional network aggregator (GCN aggregator), long short-term memory network aggregator (LSTM aggregator), or pooling aggregator.

[0096] Figure 5 Schematic diagram of converting target subgraph data into node representation of target node according to an embodiment of the present invention, such as Figure 5 As shown, the target subgraph data 501 includes node A, node B, node C, node D, node E and node F. The specific connection relationship between the six nodes is as follows: Figure 5 As shown, Figure 5Figure 2 shows the process of transferring node information from neighboring nodes to the target node. Node B's neighboring nodes include nodes A and C. Node A's and C's node data are linearly transformed and aggregated to node B. Node B's node data, the linearly transformed node data of node A, and the node data of node C are linearly transformed to obtain node B's aggregated node information. Node C's neighboring nodes include nodes A, B, E, and F. Node A's, B's, E's, and F's node data are linearly transformed and aggregated to node C. Node C's, A's, B's, E's, and F's node data are linearly transformed to obtain node C's aggregated node information. Node D's neighboring nodes include node A. Node A's node data is linearly transformed and aggregated to node D. Node D's node data and A's linearly transformed node data are linearly transformed to obtain node D's aggregated node information.

[0097] This process of transmitting neighbor node information to the target node occurs multiple times. Node A's neighbor nodes B, C, and D all have their node information updated once. After linear transformation, aggregation, and further linear transformation, the aggregated node information for node A is generated. This aggregated node information is used as the node representation for node A.

[0098] It should be noted that the training process of the target graph neural network model can be: inputting graph embedding vector samples of multiple nodes into the initial graph neural network model, the algorithm adopted by the initial graph neural network model can be the GraphSAGE algorithm, the initial graph neural network model collects the node data of the neighboring nodes of the sample node, and aggregates the node data of the sample node and the node data of the neighboring nodes of the sample node based on the aggregation function to obtain the node representation of the sample node; constructing a loss function based on the node representation of the sample node and the graph embedding vector of the sample node, optimizing the initial graph neural network model based on the loss function until the convergence condition is reached, and finally obtaining the target graph neural network model.

[0099] The node analysis method based on the threat analysis graph provided by an embodiment of the present invention determines the node representation of the target node based on the graph embedding vector of each node and the target graph neural network model, and adds the node information of the neighboring nodes of the target node to the target node, so that the node representation of the target node contains more information. In this way, when the target node is subsequently analyzed based on the node representation of the target node, the accuracy of the analysis can be improved.

[0100] In one embodiment, the above step 104 may be implemented in the following manner:

[0101] Determining a threat risk coefficient of the target node based on the node characterization of the target node, where the threat risk coefficient is used to characterize the risk level of the target node;

[0102] When it is determined that the threat risk coefficient of the target node is greater than a preset coefficient value, the node data of the target node is stored in a fall identification map database, or an alarm is issued to the target node, or the node data of the target node and the node data of the associated nodes of the target node are displayed.

[0103] For example, in order to build a highly automated platform and tool chain, a unified model that can handle massive amounts of heterogeneous multi-source data is constructed, and a target graph neural network model is used to detect, analyze, and track threat events. When the node representation of the target node output by the target graph neural network model is obtained, the graph neural network is used to analyze the node representation of the target node to obtain the threat risk coefficient of the target node, and then the threat risk coefficient of the target node is compared with the preset coefficient value. When it is determined that the threat risk coefficient of the target node is greater than the preset coefficient value, it means that the target node is a risk node. At this time, the node data of the target node can be determined as fall identification data, and the node data of the target node can be stored in the fall identification graph database, so that security experts can view the node data of the target node in the graph database; or, when it is determined that the threat risk coefficient of the target node is greater than the preset coefficient value, the target node can also be alerted to achieve early warning of the risk node; in addition, the node data of the target node and the node data of the neighboring nodes of the target node can be displayed in a visual manner to assist security experts in operation, analysis and confrontation.

[0104] It should be noted that when it is determined that the threat risk coefficient of the target node is greater than the preset coefficient value, the target node can be further manually judged and analyzed. When the target node is manually determined to be a high-risk node, the node data of the target node is stored in the collapse identification map database.

[0105] The node analysis method based on the threat analysis graph provided by the embodiment of the present invention can use the target graph neural network model to continuously monitor the massive data generated daily, realize the prediction of unknown risk nodes and the early warning of risk nodes. In addition, it can also display the node data of the target node and the node data of the neighboring nodes of the target node, which can assist security experts in operation, analysis and confrontation.

[0106] In one embodiment, the above step 104 may be implemented in the following manner:

[0107] Compare and analyze the node representation of the target node with the node representations of other nodes to determine nodes similar to the target node.

[0108] For example, node representations of multiple nodes can be obtained, and the node representation of the target node can be compared with the node representations of other nodes for similarity, thereby determining nodes similar to the target node. In this way, if the target node is determined to be a risk node, nodes similar to the target node are also risk nodes.

[0109] The node analysis method based on the threat analysis graph provided by the embodiment of the present invention can use the target graph neural network model to continuously monitor the massive data generated daily, and realize the search for similar nodes.

[0110] Figure 6 Schematic diagram of the structure of the node analysis system based on the threat analysis map provided by the embodiment of the present invention. The node analysis system based on the threat analysis map can be deployed on the server side, such as Figure 6 As shown, the node analysis system based on the threat analysis graph includes a graph data storage module 601, a subgraph extraction module 602, a graph embedding module 603, a graph calculation module 604, a data post-processing module 605 and a data acquisition module 606; wherein, the data acquisition module is used to collect source data; the graph data storage module 601 is used to store the threat analysis graph and provide query services; the subgraph extraction module 602 is used to extract target subgraph data in the threat analysis graph based on the seed node; the graph embedding module 603 is used to determine the graph embedding vector of each node in the target subgraph data; the graph calculation module 604 is used to determine the node representation of the target node based on the target graph neural network model and the graph embedding vector of each node; the data post-processing module 605 is used to perform threat analysis on the target node based on the node representation of the target node, and is also used to determine nodes similar to the target node based on the node representation of the target node and the node representations of other nodes, and is also used to display the node data of the target node and the node data of the associated nodes of the target node when the target node is determined to be a risk node.

[0111] The node analysis method based on the threat analysis graph provided by the embodiment of the present invention is based on the threat analysis graph and combined with the basic network facilities used by the APT organization to perform correlation analysis on massive heterogeneous multi-source data to realize the calculation of unknown risk nodes, early warning of risk nodes and search for similar nodes.

[0112] Figure 7 FIG is a schematic diagram of the structure of a node analysis device based on a threat analysis graph provided by an embodiment of the present invention. Figure 7 As shown, the node analysis device 700 based on the threat analysis graph includes a first extraction unit 701, a second extraction unit 702, a determination unit 703 and an analysis unit 704; wherein:

[0113] The first extraction unit 701 is used to extract target data from the source data and use the target data as a seed node; the target data is data with security risks;

[0114] A second extraction unit 702 is configured to extract target subgraph data associated with the seed node from the threat analysis graph stored in the graph database;

[0115] A determining unit 703 is configured to determine a node representation of a target node in the target subgraph data; the node representation of the target node includes node data of the target node and node data of neighboring nodes of the target node;

[0116] The analyzing unit 704 is configured to analyze the target node based on the node representation of the target node.

[0117] The node analysis device based on the threat analysis graph provided by an embodiment of the present invention uses target data with security risks extracted from source data as a seed node, extracts target subgraph data associated with the seed node from the threat analysis graph, determines the node representation of the target node in the target subgraph data, and includes the node data of the target node and the node data of the target node's neighboring nodes. Finally, a correlation analysis is performed on the target node based on the node representation of the target node. It can be seen that the present invention only determines the node representation of the target node in the target subgraph data associated with the seed node, eliminating the need to calculate and analyze all graph data in the threat analysis graph, thereby improving the efficiency of data analysis.

[0118] Based on any of the foregoing embodiments, the first extraction unit 702 is specifically configured to:

[0119] Searching for target association data of a preset number of hops associated with the seed node in the threat analysis graph; the target association data includes node data and edge data;

[0120] The node data of the seed node and the target associated data are combined to obtain the target subgraph data.

[0121] Based on any of the foregoing embodiments, the determining unit 703 is specifically configured to:

[0122] Determining a graph embedding vector for each node in the target subgraph data;

[0123] The node representation of the target node is determined based on the graph embedding vector of each node.

[0124] Based on any of the foregoing embodiments, the determining unit 703 is further specifically configured to:

[0125] Get the current business scenario;

[0126] When the current business scenario includes a business scenario of searching for structurally similar nodes, determining a graph embedding vector of each node in the target subgraph data based on a structural similarity algorithm;

[0127] When the current business scenario includes a business scenario of searching for content-similar nodes, a graph embedding vector of each node in the target subgraph data is determined based on a content similarity algorithm.

[0128] Based on any of the foregoing embodiments, the determining unit 703 is further specifically configured to:

[0129] Inputting the graph embedding vector of each of the nodes into the target graph neural network model to obtain a node representation of the target node output by the target graph neural network model;

[0130] The target graph neural network model is obtained by training based on graph embedding vector samples of multiple nodes.

[0131] Based on any of the above embodiments, the target graph neural network model includes an acquisition module and an aggregation module;

[0132] The determining unit 703 is further specifically configured to:

[0133] Inputting the graph embedding vector of each node into the acquisition module, collecting the node data of each neighbor node of the target node from the graph embedding vector of each node through the acquisition module, and sending the node data of each neighbor node and the node data of the target node to the aggregation module;

[0134] Aggregating the node data of each neighbor node and the node data of the target node through the aggregation module to obtain node aggregation information;

[0135] The node aggregation information is determined as the node representation of the target node.

[0136] Based on any of the above embodiments, the analyzing unit 704 is specifically configured to:

[0137] Determining a threat risk coefficient of the target node based on the node characterization of the target node, where the threat risk coefficient is used to characterize the risk level of the target node;

[0138] When it is determined that the threat risk coefficient of the target node is greater than a preset coefficient value, the node data of the target node is stored in a fall identification map database, or an alarm is issued to the target node, or the node data of the target node and the node data of the associated nodes of the target node are displayed.

[0139] Based on any of the above embodiments, the analyzing unit 704 is specifically configured to:

[0140] Compare and analyze the node representation of the target node with the node representations of other nodes to determine nodes similar to the target node.

[0141] Figure 8 FIG is a schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention, such as Figure 8 As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830, and a communication bus 840, wherein the processor 810, the communication interface 820, and the memory 830 communicate with each other via the communication bus 840. The processor 810 may call the logic instructions in the memory 830 to execute the following method: extracting target data from the source data and using the target data as a seed node; the target data is data with security risks;

[0142] Extracting target subgraph data associated with the seed node from the threat analysis graph stored in the graph database;

[0143] Determine a node representation of a target node in the target subgraph data; the node representation of the target node includes node data of the target node and node data of neighboring nodes of the target node;

[0144] The target node is analyzed based on the node representation of the target node.

[0145] In addition, the logic instructions in the above-mentioned memory 830 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0146] On the other hand, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method for analyzing nodes based on a threat analysis graph provided in the above embodiments is implemented, for example, including: extracting target data from source data and using the target data as a seed node; the target data is data with security risks;

[0147] Extracting target subgraph data associated with the seed node from the threat analysis graph stored in the graph database;

[0148] Determine a node representation of a target node in the target subgraph data; the node representation of the target node includes node data of the target node and node data of neighboring nodes of the target node;

[0149] The target node is analyzed based on the node representation of the target node.

[0150] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method for performing the node analysis method based on the threat analysis graph provided by the above methods is implemented, the method comprising: extracting target data from source data and using the target data as a seed node; the target data is data with security risks;

[0151] Extracting target subgraph data associated with the seed node from the threat analysis graph stored in the graph database;

[0152] Determine a node representation of a target node in the target subgraph data; the node representation of the target node includes node data of the target node and node data of neighboring nodes of the target node;

[0153] The target node is analyzed based on the node representation of the target node.

[0154] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0155] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0156] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A node analysis method based on threat analysis graph, characterized in that: include: Extract target data from source data and use the target data as a seed node; The target data is data with security risks; Extracting target subgraph data associated with the seed node from the threat analysis graph stored in the graph database; Determining a node representation of a target node in the target subgraph data; The node representation of the target node includes node data of the target node and node data of neighboring nodes of the target node; Analyzing the target node based on the node representation of the target node; The determining of the node representation of the target node in the target subgraph data includes: Determining a graph embedding vector for each node in the target subgraph data; Inputting the graph embedding vector of each node into the acquisition module of the target graph neural network model, collecting the node data of each neighbor node of the target node in the graph embedding vector of each node through the acquisition module, and sending the node data of each neighbor node and the node data of the target node to the aggregation module of the target graph neural network model; Aggregating the node data of each neighbor node and the node data of the target node through the aggregation module to obtain node aggregation information; Determining the node aggregation information as a node representation of the target node, wherein the target graph neural network model is trained based on graph embedding vector samples of multiple nodes; The aggregating the node data of each neighbor node and the node data of the target node by the aggregation module to obtain node aggregation information includes: The node data of each of the neighboring nodes are linearly transformed and then aggregated to the target node through the aggregation module, and the node data of the target node and the node data of each linearly transformed neighboring node are linearly transformed again to obtain the node aggregation information of the target node.

2. The node analysis method based on threat analysis graph according to claim 1 is characterized in that: Extracting target subgraph data associated with the seed node from the threat analysis graph stored in the graph database includes: Searching for target association data of a preset number of hops associated with the seed node in the threat analysis graph; the target association data includes node data and edge data; The node data of the seed node and the target associated data are combined to obtain the target subgraph data.

3. The node analysis method based on threat analysis graph according to claim 1 is characterized in that: Determining a graph embedding vector for each node in the target subgraph data includes: Get the current business scenario; When the current business scenario includes a business scenario of searching for structurally similar nodes, determining a graph embedding vector of each node in the target subgraph data based on a structural similarity algorithm; When the current business scenario includes a business scenario of searching for content-similar nodes, a graph embedding vector of each node in the target subgraph data is determined based on a content similarity algorithm.

4. The node analysis method based on the threat analysis graph according to any one of claims 1 to 3, characterized in that: The analyzing the target node based on the node representation of the target node includes: Determining a threat risk coefficient of the target node based on the node characterization of the target node, where the threat risk coefficient is used to characterize the risk level of the target node; When it is determined that the threat risk coefficient of the target node is greater than a preset coefficient value, the node data of the target node is stored in a fall identification map database, or an alarm is issued to the target node, or the node data of the target node and the node data of the associated nodes of the target node are displayed.

5. The node analysis method based on the threat analysis graph according to any one of claims 1 to 3, characterized in that: The analyzing the target node based on the node representation of the target node includes: Compare and analyze the node representation of the target node with the node representations of other nodes to determine nodes similar to the target node.

6. A node analysis device based on threat analysis graph, characterized in that: include: A first extraction unit is used to extract target data from the source data and use the target data as a seed node; The target data is data with security risks; A second extraction unit is configured to extract target subgraph data associated with the seed node from the threat analysis graph stored in the graph database; a determining unit, configured to determine a node representation of a target node in the target subgraph data; The node representation of the target node includes node data of the target node and node data of neighboring nodes of the target node; an analyzing unit, configured to analyze the target node based on the node representation of the target node; The determining unit is specifically configured to: Determining a graph embedding vector for each node in the target subgraph data; Inputting the graph embedding vector of each node into the acquisition module of the target graph neural network model, collecting the node data of each neighbor node of the target node in the graph embedding vector of each node through the acquisition module, and sending the node data of each neighbor node and the node data of the target node to the aggregation module of the target graph neural network model; Aggregating the node data of each neighbor node and the node data of the target node through the aggregation module to obtain node aggregation information; Determining the node aggregation information as a node representation of the target node, wherein the target graph neural network model is trained based on graph embedding vector samples of multiple nodes; The determining unit is further specifically configured to: The node data of each of the neighboring nodes are linearly transformed and then aggregated to the target node through the aggregation module, and the node data of the target node and the node data of each linearly transformed neighboring node are linearly transformed again to obtain the node aggregation information of the target node.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the node analysis method based on the threat analysis graph as described in any one of claims 1 to 5 is implemented.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the node analysis method based on the threat analysis graph as described in any one of claims 1 to 5 is implemented.

9. A computer program product having executable instructions stored thereon, characterized in that: When the instruction is executed by the processor, the processor implements the node analysis method based on the threat analysis graph as described in any one of claims 1 to 5.

Images