A network security incident detection method based on knowledge graph and incremental learning

Abstract

This invention discloses a network security incident detection method based on a knowledge graph and incremental learning. The method includes the following steps: using a network security incident knowledge graph as a training set to train a network security incident detection model; using incremental learning to allow the model to continuously learn new knowledge without retraining the entire model; and proposing a memory cache to store prior knowledge from the network security knowledge graph, thereby preventing the model from catastrophically forgetting previously learned knowledge. This invention addresses the low efficiency of traditional graph neural networks in the field of network security incident detection and, through incremental learning, enables the model to be tailored to different types of network security incidents.

Description

Technical Field

[0001] The present invention belongs to the field of network security incident detection based on network security knowledge graph. Background Art

[0002] With the rapid development of network technology, the cybersecurity environment is becoming increasingly complex. To ensure the secure, stable, and continuous operation of enterprise business systems, enterprises need to strengthen their cybersecurity protection capabilities and build cybersecurity incident response and command capabilities, moving the checkpoints forward and preventing risks before they occur. Furthermore, as cybersecurity confrontations continue to escalate, security emergency response technologies are also evolving, shifting from primarily passive incident response to proactive defense.

[0003] One of the goals of the cybersecurity incident detection phase is to determine whether the attack was successful or unsuccessful during detection, as well as the cause of the incident. This allows us to determine the nature and severity of the attack and analyze the appropriate response strategy.

[0004] Currently, network security event detection methods based on deep learning models have received widespread attention in the industry. However, such methods have the following drawbacks: (1) The trained model can only detect a single category of network security events (for example, only phishing emails); (2) Network attack methods are changing, becoming more diverse and structured, and the model cannot be trained on network security event data under all conditions; (3) Once the model is deployed, it cannot learn new network security knowledge graphs, and even if it is relearned, it will suffer from catastrophic forgetting (i.e., the accuracy of detecting network security events in the previous knowledge graph will decrease).

[0005] The cybersecurity knowledge graph is essentially a structured semantic knowledge base that models entities and their relationships in the real world in the form of triples (i.e., head entity, relationship, and tail entity). These triples are connected by shared entities or attributes, forming a network-like knowledge structure. Graph neural networks, due to their unique graph structure, have achieved beneficial results in the generation and reasoning of knowledge graphs. However, the scalability challenges brought about by data dependencies have made graph neural networks unpopular in actual industry deployments. This is because graph neural network reasoning relies on neighboring nodes, and obtaining these nodes places a burden on latency-constrained applications. Summary of the Invention

[0006] This invention proposes a network security incident detection method based on knowledge graph and incremental learning. The invention has the following objectives:

[0007] [1] In order to alleviate the low efficiency of traditional graph neural networks in the field of network security incident detection, the present invention trains the network security incident detection model by extracting features of auxiliary graph nodes.

[0008] [2] proposed a new incremental learning method that uses a task attention module to capture specific task information from the cybersecurity knowledge graph, enabling the model to target different types of cybersecurity events.

[0009] [3] proposed a memory cache to store prior knowledge in the previous network security knowledge graph, thereby preventing the model from catastrophically forgetting the previously learned knowledge.

[0010] Technical means

[0011] This paper uses the cybersecurity event knowledge graph as a training set to train a cybersecurity event detection model. This model can efficiently detect various types of cybersecurity events and can continuously learn new knowledge through incremental learning without having to retrain the entire model. The details are as follows:

[0012] S1: Use different cybersecurity event knowledge graphs as training sets and perform semantic clustering on each node in the knowledge graph;

[0013] S2: Through a kernel-guided Transformer network, we first find the most relevant clusters in each layer and generate auxiliary graphs, and then map the features of these auxiliary graphs to a common representation space;

[0014] S3: The task attention module captures information about specific cybersecurity events based on the type of knowledge graph and selects features that are important to the current cybersecurity event, thereby preventing interference from different events.

[0015] S4: Map the output features of the task attention module to the global workspace and detect the danger level of the current network security incident through a multi-classifier;

[0016] S5: Build a memory cache to store the feature distribution of previously learned cybersecurity events and use these features in subsequent training to achieve incremental learning and avoid catastrophic forgetting of previously learned knowledge.

[0017] As a preferred embodiment of the present invention, the S1 further comprises the following steps:

[0018] S101: The network security incident knowledge graph is recorded as D n , where n∈{1, 2, ...N}, N represents N different types of knowledge graphs. The node set of the first layer of the knowledge graph is denoted as Where p∈{1, 2, ..., P}, means that there are P nodes in the current knowledge graph;

[0019] S102: Calculate the semantic similarity between nodes in each layer and perform semantic clustering layer by layer, clustering nodes with higher similarity into one category, as follows:

[0020]

[0021] Where q∈{1, 2, ..., Q} indicates that there are Q classes in total, the upper limit of the sum is the number of nodes P in the knowledge graph, T represents the transposition operation, and θ represents feature extraction.

[0022] As a preferred embodiment of the present invention, S2 includes the following steps:

[0023] S201: For the clustering results of layer l, use the Transformer network guided by kernel Kernel[l] to find the most relevant clusters and generate the auxiliary graph A[l], as follows:

[0024]

[0025] Where K represents a two-dimensional Gaussian kernel function, and q represents each class

[0026]

[0027] in, is the kernel function value of the lth layer. The Transformer network is a multi-head self-attention network.

[0028] S202: Pass the bottleneck layer f δ Map the features of the auxiliary graph to a common representation space Com Space , as follows:

[0029]

[0030] in, Represents the sample characteristics of the nth network security incident.

[0031] As a preferred embodiment of the present invention, S3 includes the following steps:

[0032] S301: For features in the public representation space, the task attention module (TAM) is used to capture information related to the current network security event type. The details are as follows:

[0033]

[0034] TAM ξ Represents the output of the ξth task attention module. The task attention module consists of two parts: one is the feature extractor f e , a feature selector f s .fe It consists of a linear layer and a ReLU activation function to learn low-dimensional subspace features. s It consists of a global average pooling layer and a sigmoid activation function, which can inhibit the task attention module from reconstructing its own input and greatly reduce the number of parameters required by the model;

[0035] S302: In order to ensure that the task attention module can efficiently identify various types of network security events, we propose a difference loss maximization function Loss TAM It is used to constrain the output between each task attention module. The details are as follows:

[0036]

[0037] Where x is the output of the task attention module, It means x is compared with the public representation space Com Space The mathematical expectation of the features in . Softmax is a normalized exponential function. Stopgrad means not updating the gradient, which ensures that the previous attention value will not be overwritten. || ||1 refers to the 1-norm operation, ψ represents the number of task attention modules, TAM η and TAM ξ denote the outputs of the ηth and ξth task attention modules, respectively.

[0038] As a preferred embodiment of the present invention, S4 includes the steps of:

[0039] S401: Element-wise multiplication of the output of the task attention module with the features in the public representation space and input them into the global workspace Gobal Space , as follows:

[0040]

[0041] in, represents the nth feature in the public representation space, Represents element-wise product operation;

[0042] S402: Through a global multi-classifier g θ Used to detect the level of current network security incidents, as follows:

[0043] R = g θ (Gobal Space )

[0044] Where R is the danger level of the detected network security incident.

[0045] As a preferred embodiment of the present invention, S5 includes the following steps:

[0046] S501: Use the reservoir sampling algorithm to sample features of previously learned network security events Assign equal probabilities and save them in the memory buffer as follows:

[0047]

[0048] Where i=randomInteger(1, N), which means randomly generating a number between 1 and N. Represents the sample characteristics of the i-th network security incident;

[0049] S502: When training a new cybersecurity incident knowledge graph later, prevent previously learned knowledge from being forgotten. Train the new knowledge graph together with the features of previous cybersecurity incident samples in the memory cache. The new knowledge graph training performs the steps of semantic clustering and feature mapping. For the features of previous cybersecurity incident samples, we calculate the mean square error between them and the output of each task attention module and select the most appropriate task attention module. The details are as follows:

[0050]

[0051] Among them, num indicates that the numth task attention module is most suitable, and the argmin function is used to find the subscript of the minimum value. is the mean square error calculation formula, j∈{1, 2, ..., N}, which means traversing N task attention modules in sequence;

[0052] S503: Once the most appropriate task attention module is selected, apply cross entropy loss to the features of previous cybersecurity incident samples The details are as follows:

[0053]

[0054] Among them, i represents the characteristics of the previous network security incident samples, TAM num Represents the output of the num-th task attention module, and log represents the logarithmic operation.

[0055] Different from the existing technology, the above method has the following beneficial effects:

[0056] By extracting features from auxiliary graph nodes to train the network security incident detection model, the problem of low efficiency of traditional graph neural networks in the field of network security incident detection is solved; a new incremental learning method is proposed that uses a task attention module to capture specific task information from the network security knowledge graph, which enables the model to target different types of network security incidents. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 It is the overall flow chart of the present invention. DETAILED DESCRIPTION

[0058] In order to explain the technical content, structural features, achieved objectives and effects of the technical solution in detail, the following is a detailed description in conjunction with specific embodiments and accompanying drawings.

[0059] Please also refer to Figure 1 As shown in the figure, this embodiment provides a network security incident detection method based on knowledge graph and incremental learning, including the following steps:

[0060] S1: Use different cybersecurity event knowledge graphs as training sets and perform semantic clustering on each node in the knowledge graph;

[0061] S2: Through a kernel-guided Transformer network, we first find the most relevant clusters in each layer and generate auxiliary graphs, and then map the features of these auxiliary graphs to a common representation space;

[0062] S3: The task attention module captures information about specific cybersecurity events based on the type of knowledge graph and selects features that are important to the current cybersecurity event, thereby preventing interference from different events.

[0063] S4: Map the output features of the task attention module to the global workspace and detect the danger level of the current network security incident through a multi-classifier;

[0064] S5: Build a memory cache to store the feature distribution of previously learned cybersecurity events and use these features in subsequent training to achieve incremental learning and avoid catastrophic forgetting of previously learned knowledge.

[0065] In the above embodiment, S1 further includes the following steps:

[0066] S101: The network security incident knowledge graph is recorded as D n , where n∈{1, 2, ...N}, N represents N different types of knowledge graphs. The node set of the first layer of the knowledge graph is denoted as Where p∈{1, 2, ..., P}, means that there are P nodes in the current knowledge graph;

[0067] S102: Calculate the semantic similarity between nodes in each layer and perform semantic clustering layer by layer, clustering nodes with higher similarity into one category, as follows:

[0068]

[0069] Where q∈{1, 2, ..., Q} indicates that there are Q classes in total, the upper limit of the sum is the number of nodes P in the knowledge graph, T represents the transposition operation, and θ represents feature extraction.

[0070] In the above embodiment, S2 further includes the following steps:

[0071] S201: For the clustering results of layer l, use the Transformer network guided by kernel Kernel[l] to find the most relevant clusters and generate the auxiliary graph A[l], as follows:

[0072]

[0073] Where K represents a two-dimensional Gaussian kernel function, and q represents each class

[0074]

[0075] in, is the kernel function value of the lth layer. The Transformer network is a multi-head self-attention network.

[0076] S202: Pass the bottleneck layer f δ Map the features of the auxiliary graph to a common representation space Com Space , as follows:

[0077]

[0078] in, Represents the sample characteristics of the nth network security incident.

[0079] In the above embodiment, S3 further includes the following steps:

[0080] S301: For features in the public representation space, the task attention module (TAM) is used to capture information related to the current network security event type. The details are as follows:

[0081]

[0082] TAM ξ Represents the output of the ξth task attention module. The task attention module consists of two parts: one is the feature extractor f e , a feature selector f s .f e It consists of a linear layer and a ReLU activation function to learn low-dimensional subspace features. s It consists of a global average pooling layer and a sigmoid activation function, which can inhibit the task attention module from reconstructing its own input and greatly reduce the number of parameters required by the model;

[0083] S302: In order to ensure that the task attention module can efficiently identify various types of network security events, we propose a difference loss maximization function Loss TAM It is used to constrain the output between each task attention module. The details are as follows:

[0084]

[0085] Where x is the output of the task attention module, It means x is compared with the public representation space Com Space The mathematical expectation of the features in . Softmax is a normalized exponential function. Stopgrad means not updating the gradient, which ensures that the previous attention value will not be overwritten. || ||1 refers to the 1-norm operation, ψ represents the number of task attention modules, TAM ξ and TAMn denote the outputs of the ξ-th and η-th task attention modules, respectively.

[0086] In the above embodiment, S4 further includes the following steps:

[0087] S401: Element-wise multiplication of the output of the task attention module with the features in the public representation space and input them into the global workspace Gobal Space , as follows:

[0088]

[0089] in, represents the nth feature in the public representation space, Represents element-wise product operation;

[0090] S402: Through a global multi-classifier g θ Used to detect the level of current network security incidents, as follows:

[0091] R = g θ (Gobal Space )

[0092] Where R is the danger level of the detected network security incident.

[0093] In the above embodiment, S5 further includes the following steps:

[0094] S501: Use the reservoir sampling algorithm to sample features of previously learned network security events Assign equal probabilities and save them in the memory buffer as follows:

[0095]

[0096] Where i=randomInteger(1, N), which means randomly generating a number between 1 and N. Represents the sample characteristics of the i-th network security incident;

[0097] S502: When training a new cybersecurity incident knowledge graph later, prevent previously learned knowledge from being forgotten. Train the new knowledge graph together with the features of previous cybersecurity incident samples in the memory cache. The new knowledge graph training performs the steps of semantic clustering and feature mapping. For the features of previous cybersecurity incident samples, we calculate the mean square error between them and the output of each task attention module and select the most appropriate task attention module. The details are as follows:

[0098]

[0099] Among them, num indicates that the numth task attention module is most suitable, and the argmin function is used to find the subscript of the minimum value. is the mean square error calculation formula, j∈{1, 2, ..., N}, which means traversing N task attention modules in sequence;

[0100] S503: Once the most appropriate task attention module is selected, apply cross entropy loss to the features of previous cybersecurity incident samples The details are as follows:

[0101]

[0102] Among them, i represents the characteristics of the previous network security incident samples, TAM num Represents the output of the num-th task attention module, and log represents the logarithmic operation.

[0103] To demonstrate the effectiveness of the present invention, different datasets were used for verification. Specifically, they are: Malicious URLs (malicious URL dataset), MAWILab (network traffic anomaly dataset), AposematIoT-23 (network traffic dataset for IoT devices), and Malware Training Sets (malware training dataset). The Malicious URLs (malicious URL dataset) includes malicious URL examples from a large webmail provider, which provides 6,000-7,500 spam and phishing URL examples every day. MAWILab (network traffic anomaly dataset) is a network traffic anomaly detection dataset consisting of multiple sets of traffic anomaly labels. Aposemat IoT-23 (network traffic dataset for IoT devices) is a network traffic dataset from IoT devices.

[0104] The experimental results are as follows:

[0105] Table 1 Feature semantic similarity matching results of different datasets

[0106]

[0107] Experimental results show that the present invention can effectively detect network security incidents.

Claims

1. A network security incident detection method based on knowledge graph and incremental learning, characterized by: It includes the following steps: S1: Use different cybersecurity event knowledge graphs as training sets and perform semantic clustering on each node in the knowledge graph; S2: Through a kernel-guided Transformer network, we first find the most relevant clusters in each layer and generate auxiliary graphs, and then map the features of these auxiliary graphs to a common representation space; S3: The task attention module captures information about specific cybersecurity events based on the type of knowledge graph and selects features that are important to the current cybersecurity event, thereby preventing interference from different events. S4: Map the output features of the task attention module to the global workspace and detect the danger level of the current network security incident through a multi-classifier; S5: Build a memory cache to store the feature distribution of previously learned cybersecurity events and use these features in subsequent training to achieve incremental learning and avoid catastrophic forgetting of previously learned knowledge.

2. A network security incident detection method based on knowledge graph and incremental learning according to claim 1, characterized in that: S1 includes the following steps: S101: The network security incident knowledge graph is recorded as D n , where n∈{1, 2, ...N}, N represents N different types of knowledge graphs, and the node set of the first layer of the knowledge graph is recorded as Where p∈{1, 2, ..., P}, means that there are P nodes in the current knowledge graph; S102: Calculate the semantic similarity between nodes in each layer and perform semantic clustering layer by layer, clustering nodes with higher similarity into one category, as follows: Where q∈{1, 2, ..., Q} indicates that there are Q classes in total, the upper limit of the sum is the number of nodes P in the knowledge graph, T represents the transposition operation, and θ represents feature extraction.

3. A network security incident detection method based on knowledge graph and incremental learning according to claim 2, characterized in that: S2 includes the steps: S201: For the clustering results of layer l, use the Transformer network guided by kernel Kernel[l] to find the most relevant clusters and generate the auxiliary graph A[l], as follows: Where K represents a two-dimensional Gaussian kernel function, and q represents each class in, is the kernel function value of the lth layer. The Transformer network is a multi-head self-attention network. S202: Pass the bottleneck layer f δ Map the features of the auxiliary graph to a common representation space Com Space , as follows: in, Represents the sample characteristics of the nth network security incident.

4. A network security incident detection method based on knowledge graph and incremental learning according to claim 3, characterized in that: S3 includes the following steps: S301: For the features in the public representation space, the task attention module (TAM) is used to capture information related to the current network security event type, as follows: TAM ξ Represents the output of the ξth task attention module; the task attention module consists of two parts: one is the feature extractor f e , a feature selector f s ;f e It consists of a linear layer and a ReLU activation function to learn low-dimensional subspace features; f s It consists of a global average pooling layer and a sigmoid activation function, which can inhibit the task attention module from reconstructing its own input and greatly reduce the number of parameters required by the model; S302: In order to ensure that the task attention module can efficiently identify various types of network security events, we propose a difference loss maximization function Loss TAM Used to constrain the output between each task attention module, as follows: Where x is the output of the task attention module, It means x is compared with the public representation space Com Space The mathematical expectation of the features in , softmax is the normalized exponential function, stopgrad means not updating the gradient, which can ensure that the previous attention value will not be overwritten, || ||1 refers to the 1-norm operation, Ψ represents the number of task attention modules, TAM ξ and TAM η denote the outputs of the ξ-th and η-th task attention modules, respectively.

5. A network security incident detection method based on knowledge graph and incremental learning according to claim 4, characterized in that: S4 includes the following steps: S401: Element-wise multiplication of the output of the task attention module with the features in the public representation space and input them into the global workspace Gobal Space , as follows: in, represents the nth feature in the public representation space, Represents element-wise product operation; S402: Through a global multi-classifier g θ Used to detect the level of current network security incidents, as follows: R6 θ (Gobal Space ) Where R is the danger level of the detected network security incident.

6. A network security incident detection method based on knowledge graph and incremental learning according to claim 5, characterized in that: S5 includes the steps of: S501: Use the reservoir sampling algorithm to sample features of previously learned network security events Assign equal probabilities and save them in the memory buffer as follows: Where i=randomInteger(1, N), which means randomly generating a number between 1 and N. Represents the sample characteristics of the i-th network security incident; S502: When training a new cybersecurity incident knowledge graph later, prevent the previously learned knowledge from being forgotten; train the new knowledge graph together with the features of previous cybersecurity incident samples in the memory buffer; perform semantic clustering and feature mapping steps on the new knowledge graph training; for the features of previous cybersecurity incident samples, calculate the mean square error between them and the output of each task attention module and select the most appropriate task attention module, as follows: Among them, num indicates that the numth task attention module is most suitable, and the argmin function is used to find the subscript of the minimum value. is the mean square error calculation formula, j∈{1, 2, ..., N}, which means traversing N task attention modules in sequence; S503: Once the most appropriate task attention module is selected, apply cross entropy loss to the features of previous cybersecurity incident samples The details are as follows: Among them, i represents the characteristics of the previous network security incident samples, TAM num Represents the output of the num-th task attention module, and log represents the logarithmic operation.

Images