Attack Scene Detection Method Based on Graph Convolutional Neural Network

Abstract

This invention relates to the field of network security, and more particularly to an attack scenario detection method based on graph convolutional neural networks. With the increasing complexity and diversity of network attacks, the detection of network attack scenarios has become extremely challenging. Typically, administrators deploy monitoring devices, such as intrusion detection systems (IDS), in network nodes. IDS generate a large number of alert messages to reflect potential attack behaviors in the underlying network. Analyzing these intrusion alert messages can reveal corresponding attack scenarios. A common approach is to group similar network security alert messages together using alert message association, thereby discovering similar attack scenarios. This alert message association provides network administrators with an abstract, higher-level view of the network. This patent proposes an attack scenario detection method based on graph convolutional neural networks to discover attack scenarios in network alert messages. By utilizing graph convolutional neural networks, the detection of attack scenarios is transformed into a multi-classification problem of nodes on the alert message graph, achieving relatively accurate detection results.

Description

Technical Field

[0001] This invention belongs to the field of network security, and in particular relates to an attack scenario detection method based on graph convolutional neural networks. Background Technology

[0002] As cyberattacks become increasingly complex and diverse, detecting cyberattack scenarios has become extremely challenging. Typically, administrators deploy monitoring devices, such as intrusion detection systems (IDS), on network nodes. IDS generate a large number of alerts reflecting potential attack behaviors within the underlying network. Analyzing these intrusion alerts can reveal corresponding attack scenarios. A common practice is to group similar cybersecurity alerts together using alert correlation, thereby identifying similar attack scenarios. This alert correlation provides network administrators with an abstract, higher-level view of the network.

[0003] To address this, the present invention proposes an attack scenario detection method based on graph convolutional neural networks, which is used to discover attack scenarios in network alert messages. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings of the prior art and provide an attack scene detection technology based on graph convolutional neural networks.

[0005] This network attack scenario detection technology includes the following steps:

[0006] S1. Potential attack signals generated by the intrusion detection system are defined as alarm information, and the alarm information is encoded according to classification attributes and numerical attributes.

[0007] S102. Determine the classification and numerical attributes of the alarm message, and use the idea of ​​discretization to map the numerical attributes to discrete categories;

[0008] S104. Use one-hot coding to encode the mixed data of the alarm message into a feature vector;

[0009] S2. Create an alarm message graph, where the vertices are alarm information graphs and the edges of the graph are determined by the similarity between alarm messages. Calculate the adjacency matrix based on the alarm message similarity.

[0010] S202. Calculate the adjacency matrix based on the similarity of alarm messages, and store the adjacency matrix of the graph using a sparse matrix.

[0011] S204. For a single attribute, multiply it by the corresponding preset attribute weight to obtain the similarity of the alarm information, and adjust the adjacency matrix value according to the preset attribute weight.

[0012] S3. Design a graph convolutional neural network structure, input the detected alarm information graph into the graph neural network for classification, and realize the attack scenario detection of alarm information;

[0013] S302, Design a graph convolutional neural network to learn graph node features from adjacent nodes;

[0014] S304. Information propagation is achieved by using the eigenvalue decomposition of the graph Laplacian matrix, which propagates from a minority of nodes in the graph to generate composite nodes.

[0015] S306. Use the edge generator to generate a new set of nodes and connect the edges.

[0016] S308. The extended alarm information graph is input into a graph convolutional neural network for classification training. The label of the alarm message attack category and the predicted probability value are compared using the cross-entropy loss function. When the cross-entropy loss function converges, the training of the graph convolutional neural network is completed. Further, the alarm information encoding method described in S102 includes:

[0017] The classification attributes of alert messages are determined based on the following criteria. Each alert message contains multiple attributes, divided into categorical and numerical attributes. Common categorical attributes include source / destination IP address, source / destination port, and protocol type, while numerical attributes include TTL and IP packet length. Existing literature only considers some categorical attributes when constructing the graph, while this method extracts mixed data containing eight categorical attributes and three numerical attributes, specifically including: the part that generated the alert message, version number, alert message type, source IP address, source port number, destination IP address, destination port number, packet time-to-live (TTL), alert message ID, datagram length, and IP packet length.

[0018] Furthermore, the hybrid data encoding method described in S104 includes:

[0019] One-hot encoding was used to encode the mixed data of alarm messages. Considering the skewed distribution of numerical attributes in alarm messages, instead of the common Max-Min normalization method, a discretization approach was adopted to map the values ​​to discrete categories (bins). Based on the data distribution intervals, continuous attributes were divided into several classes, and one-hot encoding was used to encode the mixed data into a feature vector x. v ∈R M Where v is a node and M is the dimension of the feature vector.

[0020] Furthermore, the method for calculating the adjacency matrix based on the similarity of alarm messages described in S202 includes:

[0021] The adjacency matrix is ​​calculated based on the similarity of alert messages. The edges of the graph are determined by the similarity between alert messages. To reduce computational complexity and memory consumption, the adjacency matrix is ​​stored as a sparse matrix. An edge exists between two alert messages if their similarity exceeds a threshold. Given two distinct alert messages a... i and a j The similarity can be calculated using the following formula:

[0022]

[0023] Where n is the number of basic attributes used to calculate similarity in the alarm message. w represents the similarity between two alert messages on the k-th basic attribute. k This represents the weight of the k-th basic attribute. The similarity calculation methods differ for different attributes.

[0024] Furthermore, the method for adjusting the adjacency matrix based on attribute weights described in S204 includes:

[0025] For a single attribute, it needs to be multiplied by its corresponding weight to calculate the similarity of the entire alert message. During the creation of the alert message graph, the weight allocation of different attributes determines the creation of the graph. Not all basic attributes have the same importance in identifying attacks. Among them, the attributes IP packet length (iplen), total datagram length (dgmlen), IP address, and port have a more significant distinguishing effect; therefore, these more discriminative basic attributes need to be assigned higher weights. Thus, a weight vector with different values ​​is introduced to calculate the similarity of different alert messages.

[0026] Furthermore, the graph node feature extraction method described in S302 includes:

[0027] GraphSage is used as the backbone model structure because it can effectively learn various types of local topologies and generalizes well to new structures. It has been observed that overly deep GNNs often lead to suboptimal performance due to oversmoothing and overfitting. Therefore, only one GraphSage block is used as the feature extractor.

[0028]

[0029] F represents the input node attribute matrix, and F[v,:] represents the attributes of node v. A[:,v] is the v-th column in the adjacency matrix. For the embedding of node v, W 1 σ represents the weight parameters, and σ is the ReLU activation function.

[0030] Furthermore, the method for generating the synthetic node described in S304 includes:

[0031] We attempt to generate desired representations of new samples from the minority class. In this work, to perform oversampling, we employ a widely used attack algorithm that enhances ordinary oversampling by altering the repetition to interpolation, interpolating samples of the target minority class with their nearest neighbors in the embedding space that belong to the same class.

[0032] set up The few nodes that are labeled are marked as Y. u The first step is to find... The nearest labeled node in the same class, i.e.

[0033]

[0034] nn(v) refers to the nearest neighbor of v in the same class, measured using Euclidean distance in the embedding space. For the nearest neighbor, we can generate a synthetic node as follows:

[0035]

[0036] Here, δ is a random variable that is uniformly distributed in the range [0,1].

[0037] Furthermore, the method for generating node connection edges described in S306 includes:

[0038] An edge generator is introduced to model the existence of edges between nodes. Since GNNs need to learn how to simultaneously extract and propagate features, this edge generator can provide relational information for these synthesized samples, thereby facilitating the training of GNN-based classifiers. A weighted approach is employed.

[0039]

[0040] E {v,u} S represents the predicted relationship information between nodes v and u, and S is the parameter matrix that captures the interactions between nodes.

[0041] Furthermore, the method for inputting the extended alarm information graph into the GNN classifier as described in S308 includes:

[0042] Based on the generated composite nodes and connecting edges, an extended alarm information graph is obtained. Another graphical block is used, and a linear layer is added to the graph for node classification.

[0043]

[0044]

[0045] Where H 2W is the node representation matrix for the second illustrated block. 2 and W c P represents the weighting parameter. v It is the probability distribution of node v on the class label.

[0046] This patent proposes a network framework called Alert-GCN for detecting attack scenarios in network alert messages. By using graph convolutional neural networks, the detection of attack scenarios is transformed into a multi-classification problem of nodes on the alert message graph, achieving a relatively accurate detection effect. Attached Figure Description

[0047] To more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0048] Figure 1 This is a schematic diagram of the entire process in an embodiment of the present invention;

[0049] Figure 2 This is a flowchart illustrating the encoding process for alarm messages in an embodiment of the present invention;

[0050] Figure 3 This is a flowchart for creating an alarm message graph in an embodiment of the present invention;

[0051] Figure 4 This is a flowchart illustrating the training process of a graph neural network in an embodiment of the present invention. Detailed Implementation

[0052] To further illustrate the technical means and effects adopted by the present invention to achieve its intended purpose, the following, in conjunction with the accompanying drawings and preferred embodiments, details the specific implementation, structure, features, and effects of an attack scene detection method based on a graph convolutional neural network proposed according to the present invention. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics in one or more embodiments can be combined in any suitable form.

[0053] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0054] The following description, in conjunction with the accompanying drawings, details a specific scheme for an attack scene detection method based on graph convolutional neural networks provided by this invention.

[0055] The attack scene detection method proposed in this embodiment is used to discover attack scenes in network alarm messages. By using graph convolutional neural networks, the detection of attack scenes is transformed into a multi-classification problem of nodes on the alarm message graph, which achieves a relatively accurate detection effect.

[0056] Please see Figure 1 The diagram illustrates a flowchart of an attack scene detection method based on a graph convolutional neural network according to an embodiment of the present invention. The method includes the following steps:

[0057] Step S1: Encode the alarm information based on the classification attribute and the numerical attribute.

[0058] S102. Determine the classification attributes of alert messages. Each alert message contains multiple attributes, divided into classification attributes and numerical attributes. Common classification attributes include source / destination IP address, source / destination port, protocol type, etc., while numerical attributes include TTL, IP packet length, etc. Existing literature only considers some classification attributes when constructing the graph, while this method extracts mixed data containing eight classification attributes and three numerical attributes, specifically including: the part that generated the alert message (sig generator), version number (sig rev), alert message type (msg), source IP address (src), source port number (srcport), destination IP address (dst), destination port number (dstport), packet time to live (TTL), alert message ID (id), datagram length (dgmlen), and IP packet length (iplen).

[0059] S104. Encode the mixed data of alarm messages using one-hot coding. Considering the skewed distribution of numerical attributes in alarm messages, instead of using common numerical attribute processing methods like Max-min normalization, a discretization approach is adopted to map the numerical values ​​to discrete categories (bins). Based on the data distribution intervals, continuous attributes are divided into several categories, and one-hot coding is used to encode the mixed data into a feature vector x. v ∈R M Where v is a node and M is the dimension of the feature vector.

[0060] Step S2: Create an alarm message graph and calculate the adjacency matrix based on the similarity of alarm messages.

[0061] S202. Calculate the adjacency matrix based on the similarity of alarm messages. The edges of the graph are determined by the similarity between alarm messages. To reduce computational complexity and memory consumption, the adjacency matrix is ​​stored as a sparse matrix. When the similarity between two alarm messages exceeds a threshold, an edge exists between the two alarm messages. Given two distinct alarm messages a... i and a jThe similarity can be calculated using the following formula:

[0062]

[0063] Where n is the number of basic attributes used to calculate similarity in the alarm message. w represents the similarity between two alert messages on the k-th basic attribute. k This represents the weight of the k-th basic attribute. The similarity calculation methods differ for different attributes.

[0064] S204. For a single attribute, it needs to be multiplied by its corresponding weight to calculate the similarity of the entire alert message. During the creation of the alert message graph, the weight allocation of different attributes determines the graph's structure. Not all basic attributes have the same importance in identifying attacks. Among them, the attributes IP packet length (iplen), total datagram length (dgmlen), IP address, and port have a more significant distinguishing effect; therefore, these more discriminative basic attributes need to be assigned higher weights. Therefore, a weight vector with different values ​​is introduced to calculate the similarity of different alert messages.

[0065] Step S3: Input the alarm information graph into the graph neural network for classification training.

[0066] S302. GraphSage is used as the backbone model structure because it can effectively learn various types of local topologies and generalize well to new structures. It has been observed that overly deep GNNs often lead to suboptimal performance due to oversmoothing and overfitting. Therefore, only one GraphSage block is used as the feature extractor.

[0067]

[0068] F represents the input node attribute matrix, and F[v,:] represents the attributes of node v. A[:,v] is the v-th column in the adjacency matrix. For the embedding of node v, W 1 σ represents the weight parameters, and σ is the ReLU activation function.

[0069] S304. An expected representation of new samples from the minority class is attempted. In this work, to perform oversampling, we employ a widely used attack algorithm that enhances ordinary oversampling by changing the repetition to interpolation, interpolating the samples of the target minority class with their nearest neighbors in the embedding space.

[0070] set up The few nodes that are labeled are marked as Y. u The first step is to find... The nearest labeled node in the same class, i.e.

[0071]

[0072] nn(v) refers to the nearest neighbor of v in the same class, measured using Euclidean distance in the embedding space. For the nearest neighbor, we can generate a synthetic node as follows:

[0073]

[0074] Here, δ is a random variable that is uniformly distributed in the range [0,1].

[0075] S306 introduces an edge generator to model the existence of edges between nodes. Since GNNs need to learn how to simultaneously extract and propagate features, this edge generator can provide relational information for these synthesized samples, thereby facilitating the training of GNN-based classifiers. A weighted approach is used:

[0076]

[0077] E {v,u} S represents the predicted relationship information between nodes v and u, and S is the parameter matrix that captures the interactions between nodes.

[0078] S308. Based on the generated composite nodes and connecting edges, an extended alarm information graph is obtained. Another graphical block is used to add a linear layer to the graph for node classification.

[0079]

[0080]

[0081] Where H 2 W is the node representation matrix for the second illustrated block. 2 and W c P represents the weighting parameter. v It is the probability distribution of node v on the class label.

Claims

1. A method for attack scenario detection based on graph convolutional neural network, characterized in that, The method comprises the following steps: S1, the possible potential attack signal generated by the intrusion detection system is defined as alarm information, and the alarm information is encoded according to the classification attribute and the numerical attribute; S102, the classification attribute and the numerical attribute of the alarm message are determined, and the numerical attribute is mapped to a discrete category by using the idea of discretization; S104, the alarm message mixed data is encoded into a feature vector by using one-hot encoding; S2, an alarm message graph is created, the graph vertex is an alarm information graph, and the edges of the graph are determined by the similarity between the alarm messages; S202, the adjacency matrix is calculated according to the similarity of the alarm messages, and the adjacency matrix of the graph is stored in a sparse matrix; S204, for a single attribute, the similarity of the alarm information is obtained by multiplying the corresponding preset attribute weight, and the value of the adjacency matrix is adjusted according to the preset attribute weight; S3, a graph convolutional neural network structure is designed, the alarm information graph output by detection is input into the graph neural network for classification, and the attack scene detection of the alarm information is realized; S302, the graph convolutional neural network learns the graph node features from the adjacency points; S304, the feature decomposition of the graph Laplacian matrix is used to realize information propagation, and a synthetic node is generated by propagating from a few nodes of the graph; S306, a new node set connection edge is generated by using an edge generator; S308, the expanded alarm information graph is input into the graph convolutional neural network for classification training, the label and the predicted probability value of the alarm message attack category are compared through a cross-entropy loss function, and the training of the graph convolutional neural network is completed when the cross-entropy loss function converges.

2. The attack scenario detection method based on graph convolutional neural network according to claim 1, wherein, The classification attribute data encoding method of the alarm message in S1 comprises: The alarm information is encoded, the classification attribute of the alarm message is determined, each alarm message contains multiple attributes, which are divided into classification attributes and numerical attributes, the mixed data containing eight classification attributes and three numerical attributes are extracted, the alarm message mixed data is encoded by using one-hot encoding, the numerical attribute is mapped to a discrete category by using the idea of discretization, the continuous attribute is divided into several categories according to the interval of data distribution, and the mixed data is encoded into a feature vector by using one-hot encoding. 3.The attack scenario detection method based on graph convolutional neural network according to claim 1, wherein, The alarm information graph creation method in S2 comprises: The alarm message graph is created, the adjacency matrix is calculated according to the similarity of the alarm messages, the edges of the graph are determined by the similarity between the alarm messages, in order to reduce the calculation complexity and the memory consumption, the adjacency matrix of the graph is stored in a sparse matrix, the adjacency matrix is adjusted according to the attribute weight, and for a single attribute, the weight of the corresponding attribute needs to be multiplied to obtain the similarity of the whole alarm message. 4.The attack scenario detection method based on graph convolutional neural network according to claim 1, wherein, The graph neural network model training method in S3 comprises: The graph neural network is trained, the cross-entropy loss function is set, the Softmax classifier is used in the output layer, the output is the probability distribution of different attack scene categories, the alarm message graph is input into the neural network for training, the constructed alarm message graph is input into the graph convolutional neural network for training, the label and the predicted probability value of the alarm message attack category are compared through the cross-entropy loss function, and the training of the graph convolutional neural network is completed when the cross-entropy loss function converges.

Images