A method and system for detecting lateral movement attacks based on heterogeneous graph networks

Abstract

This invention relates to a method and system for detecting lateral movement attacks based on heterogeneous graph networks. The method first constructs a directed heterogeneous user-entity interaction graph based on multi-source network logs. This graph model encompasses two types of nodes and five types of interaction edges. Next, the graph embedding method LINE is used to learn the features of this graph, enriching the representation of each node. Finally, a two-stage semi-supervised learning method is used to detect anomalous nodes in lateral movement attacks. In the first stage, an autoencoder is constructed using a relational graph convolutional network (RGCN), and this autoencoder is used to learn the network structure of the user-entity interaction graph unsupervised. In the second stage, the autoencoder trained in the first stage is used with a small number of labels for supervised training to adapt it to the target lateral movement attack detection task. This invention can effectively predict anomalous users and hosts in lateral movement attacks.

Description

Technical Field

[0001] This invention proposes a method and system for detecting lateral movement attacks based on heterogeneous graph networks, applicable to internal threat detection. The method and system introduce a novel heterogeneous graph modeling approach, encompassing two types of nodes and five types of edges, and can combine graph neural network methods to detect abnormal hosts during lateral movement. This invention belongs to the field of computer network security. Background Technology

[0002] In the current new normal of widespread working from home, organizations and businesses are more vulnerable to insider threats. According to the 2021 Insider Threat Report, 59% of organizations experienced one or more insider attacks in 2021. How to effectively detect insider threats has become a pressing issue for cybersecurity professionals.

[0003] A significant portion of current insider threats relate to lateral movement. Lateral movement is a crucial process for attackers to launch attacks after gaining access to the internal network, allowing threat actors to evade detection and retain access. Once attackers breach the security perimeter and enter an organization's internal network, they can remotely access desktop login systems, servers, and switches, collect domain credentials, and secretly execute programs, ultimately gaining control of the entire network to achieve goals such as disrupting target networks or infrastructure, stealing confidential data, or core intellectual property. Attackers use various methods to laterally infiltrate other hosts on the internal network, such as script hosts (49%), file storage (46%), PowerShell (45%), business communication platforms (41%), and .NET (39%). As attackers penetrate deeper into the network, their actions become increasingly difficult to detect.

[0004] Existing detection techniques for lateral movement attacks have certain limitations. Previous studies detected anomalies by matching login path patterns, but this behavior-based approach is ill-suited to complex intranet scenarios. Other studies use traditional supervised learning methods to detect anomalies by learning large amounts of data labels. However, these labels are often difficult to obtain in real-world network environments and cannot be practically used in production. With the rise of neural networks, researchers began using deep learning methods to detect lateral movement attacks. However, their models are limited by manually extracted features and cannot fully and adequately represent interactions within the intranet, resulting in high false positive rates. Currently, graph-based lateral movement detection methods have become mainstream. These methods attempt to represent the interactions between people and devices within the intranet using graph models (e.g., host-to-host communication graphs or user-to-host interaction graphs), performing anomaly detection on the graph in an unsupervised or semi-supervised manner. Graph-based detection methods have achieved some success, but existing research often constructs graph models with limited forms. Even when heterogeneous nodes are constructed based on the actual intranet conditions, the edge construction does not consider multiple types of interactions, weakening the graph's representational power and leading to high false positive rates. Furthermore, since lateral movement attacks involve multiple dimensions of behavior such as authentication, remote command execution, and network interaction, research using logs from a single source is unlikely to obtain comprehensive information, which also affects the performance of detection methods.

[0005] In summary, the high degree of stealth of lateral movement attacks makes them difficult to detect, and current research on the detection of lateral movement attacks is still insufficient and needs further optimization and improvement. Summary of the Invention

[0006] To address the aforementioned problems, this invention proposes a method and system for detecting lateral movement attacks based on heterogeneous graph networks.

[0007] This invention first constructs a directed heterogeneous user-entity interaction graph based on multi-source network logs (emails, authentication logs, network traffic logs, system logs, and DNS records). This graph model encompasses two types of nodes and five types of interaction edges. Next, the graph embedding method LINE is used to learn the features of this graph, enriching the representation of each node. Finally, this invention employs a two-stage semi-supervised learning method to detect anomalous nodes in lateral movement attacks. In the first stage, an autoencoder is constructed using a relational graph convolution network (RGCN), and this autoencoder is used to learn the network structure of the user-entity interaction graph unsupervised. In the second stage, the encoder trained in the first stage is used, with a small number of labels added, for supervised training to adapt it to the target lateral movement attack detection task.

[0008] To achieve the above objectives, the specific technical solution adopted by the present invention is as follows:

[0009] A method for detecting lateral movement attacks based on heterogeneous graph networks includes the following steps:

[0010] Obtain multi-source network logs;

[0011] Constructing a directed heterogeneous user-entity interaction graph based on multi-source network logs;

[0012] The graph embedding method is used to learn the features of the user-entity interaction graph and obtain the node embedding representation;

[0013] By utilizing node embedding representations, a semi-supervised learning method is employed to detect anomalous nodes in lateral movement attacks.

[0014] Furthermore, the acquisition of multi-source network logs includes the collection and processing of multi-source logs, i.e., preprocessing. To more comprehensively describe the interaction behavior between users and entities within the intranet, it is necessary to utilize logs from multiple sources and perspectives, including user email logs, authentication logs, system logs, DNS logs, network flow logs, etc., covering user-user, user-entity, and entity-entity aspects. In practice, the collected multi-source logs are often redundant and complex, with different sources containing different attributes and characteristic descriptions. Therefore, this step requires unifying element attributes to ensure consistency in the description of the same attribute in the logs. In addition, data cleaning is required to remove missing and erroneous data from the logs. To uniquely identify users and entities within the intranet, a unique ID is generated for each user and entity at the end of the data preprocessing.

[0015] Furthermore, the graph construction in this invention includes two parts: constructing a user-entity interaction graph and embedding nodes.

[0016] Furthermore, the user-entity interaction graph is a directed heterogeneous graph that summarizes the interaction behaviors within the intranet. Define graph G = (V, E), where V represents a node in the graph and E represents an edge. V contains two types of nodes. u and V e V u V represents users within the intranet. u They can communicate with each other, and also with V. e To communicate; V e The representative entity is the host and router devices within the internal network, V e They can communicate with each other. Each type of node has a corresponding attribute, which will be explained in the node embedding section. The edge set E in the user-entity interaction graph contains five types of edges. email E auth E proc E dnsand E flow These represent different interactive behaviors between nodes. For user-to-user email communication, E is used. email Side to two V u The nodes are connected. For user-entity interactions, if it's an authentication action, an E connection is established from the user node to the entity node. auth Similarly, if a user performs a system operation on the target entity, then E is connected in the same way. proc Edge. For entity-entity interactions, use E based on DNS records and network flow logs respectively. dns and E flow Connect the corresponding source and destination nodes. The edge attributes in the user-entity interaction graph depend on the edge type. For edges of type email and DNS (i.e., E...),... emails Side and E dns Edges are not assigned attributes; only edge weights are considered. For edges of type auth (i.e., E...),... auth For edges of type proc (i.e., E), consider four attributes: authentication type (auth_type), login type (logon_type), authentication source (auth_orient), and authentication result (result). proc For edges (i.e., E), consider the process name (process_name) and operation status (status) of the user operation. flow For edges, consider the source port (src_port), destination port (dst_port), and network flow protocol (proto) in the network flow. For edges with the same source, destination nodes, and attributes, set their repetition count as the edge weight to represent the strength of the interaction.

[0017] Furthermore, in the node embedding part, node attributes are generated by the LINE graph embedding method. In this step, the user-entity interaction graph described above is temporarily treated as a homogeneous graph, and only structural features on the graph are learned. The LINE graph embedding method is based on two similarity calculations: first-order similarity and second-order similarity. First-order similarity is used to describe the local similarity between pairs of vertices in the graph. If there is a direct edge between two nodes u and v, then the weight w of that edge... uv First-order similarity is the similarity between two vertices; if there is no direct edge connecting them, the first-order similarity is 0. Second-order similarity describes the similarity between the neighbors of two nodes. Let p u =(w u,1 ,…,w u,|V| Let p represent the first-order similarity between vertex u and all other vertices. Then the second-order similarity between u and v can be expressed by p. u and p vThe similarity is represented by the first-order and second-order similarities of the nodes in the graph. If u and v do not have any common neighboring vertices, the second-order similarity is 0. The LINE algorithm obtains the optimal node embedding representation by making the first-order and second-order similarities of the node representations in the graph as similar as possible to the node relationships in the original graph. According to this method, a 128-dimensional node embedding is generated for each node in the graph as a node attribute.

[0018] Furthermore, the method employs semi-supervised learning to detect anomalous nodes in lateral movement attacks, and uses an RGCN-based anomaly detection model to detect anomalous nodes in lateral movement attacks. This part consists of two stages: an RGCN autoencoder model and a lateral movement anomaly detection model.

[0019] The first stage uses an RGCN autoencoder model to unsupervisedly learn representations on the user-entity interaction graph. RGCN is a neural network method for processing multi-relation graph data, capable of aggregating data features of multiple relationships by weighted summation of nodes from different relationships. By using an encoder and linear decoder built with two layers of RGCN, it can fully learn heterogeneous relationships on the user-entity interaction graph, independent of any labels. In this stage, the MSE loss function is used, and ReLU and dropout layers are added to each layer of the RGCN encoder to avoid gradient vanishing and overfitting. To prevent gradient explosion, L2 norm normalization is used in each iteration, i.e., for each dimension x1, x2, ..., xn of vector X... n Divide all by ||x|| 2 A new vector X' is obtained.

[0020] The second stage uses the RGCN encoder trained in the previous stage, coupled with a linear binary classifier to output anomaly probabilities. To adapt it for the lateral movement detection task, a small number of labels are introduced for fine-tuning. This stage uses cross-entropy as the loss function. Similar to the previous stage, ReLU and dropout layers are used to avoid gradient vanishing and overfitting. Finally, the finely tuned model outputs anomaly scores on the input graphical model to identify anomalous nodes in lateral movement.

[0021] To avoid unpredictable memory consumption, instead of using the complete neighborhood set of a node during training, a fixed-size set of neighbors is uniformly sampled to keep the computational footprint consistent for each batch of data. Specifically, for node v... i In each iteration, from its neighbor set N i r Different uniform samples N(i) are drawn from the sample.

[0022] A lateral movement attack detection system based on heterogeneous graph networks, comprising:

[0023] The data preprocessing module is used to acquire and preprocess multi-source network logs.

[0024] The graph construction module is used to construct a directed heterogeneous user-entity interaction graph based on multi-source network logs, and to learn the features of the user-entity interaction graph using a graph embedding method to obtain node embedding representations.

[0025] The anomaly detection module is used to detect anomalous nodes in lateral movement attacks by utilizing node embedding representations and employing a semi-supervised learning method.

[0026] The beneficial effects of this invention are as follows:

[0027] This invention constructs a directed heterogeneous user-entity interaction graph based on multi-source network logs, covering two types of nodes and five types of interaction edges, which can more completely describe the interaction behavior between users and entities in the intranet.

[0028] This invention uses a two-stage semi-supervised learning method to detect anomalous nodes in lateral movement attacks. The model trained in these two stages can effectively predict anomalous users and hosts in lateral movement attacks, achieving an AUC of 0.92 and an FPR as low as 1.5% on the public dataset LANL, and obtaining an F1 score of 80.47%. Attached Figure Description

[0029] Figure 1 This is the overall flowchart of the present invention.

[0030] Figure 2 This is a schematic diagram of the working mechanism of the RGCN layer in this invention.

[0031] Figure 3 This is a schematic diagram of the first stage of the anomaly detection model based on RGCN of this invention.

[0032] Figure 4 This is a schematic diagram of the second stage of the anomaly detection model based on RGCN of the present invention.

[0033] Figure 5 This is a graph showing the experimental results under different ratios of positive and negative samples.

[0034] Figure 6 This is a graph showing the experimental results under different label ratios.

[0035] Figure 7 These are experimental results graphs showing the results of experiments conducted using different graph embedding methods. Detailed Implementation

[0036] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, and to make the objectives, features and advantages of the present invention more apparent and understandable, the core technology of the present invention will be further described in detail below with reference to the accompanying drawings and examples.

[0037] In one embodiment of the present invention, a method for detecting lateral movement attacks based on heterogeneous graph networks is disclosed, such as... Figure 1 As shown, this method mainly consists of three parts: data preprocessing, graph construction, and an anomaly detection model based on RGCN. The main steps are as follows:

[0038] Step 100 involves data collection and preprocessing, which means collecting multi-source log data from the intranet over a period of time, including user email logs, system logs, login authentication logs, DNS logs, network flow logs, etc., and then cleaning and standardizing the data format.

[0039] Step 200 involves graph construction, which mainly includes the construction of the user-entity interaction graph and node embedding.

[0040] Step 210: Generate heterogeneous nodes in the user-entity interaction graph based on the log information in the intranet. User nodes represent users within the intranet, and entity nodes represent physical devices such as hosts and routers within the intranet.

[0041] Step 220: Further generate heterogeneous edges in the user-entity interaction graph based on the log information. For example... Figure 1 As shown, for logs describing user-user behavior interactions (such as user email logs), an edge of type email is generated by treating the message sender as the source node and the receiver as the destination node, i.e., E. emails Edges. For logs describing user-entity behavioral interactions (such as authentication logs and system logs), edges of type auth or proc are generated with the user as the source node and the entity being operated on as the destination node. auth Side and E proc Edges. For logs describing entity-entity behavioral interactions (such as DNS logs and network traffic logs), edges of type DNS or flow are generated from the source entity to the destination entity, i.e., E. dns Side and E flow Finally, count the number of repeated edges and assign the number of repetitions as the edge weight to the edge, ensuring that the number of identical edges between nodes in the graph is no greater than 1.

[0042] The edge attributes in a user-entity interaction graph depend on the edge type. For E emails Side and E dns Edges are not assigned attributes; only edge weights are considered. For E authConsider four attributes: authentication type (auth_type), login type (logon_type), authentication source (auth_orient), and authentication result (result). For E proc Consider the process name (process_name) and operation status (status) of the user operation. For E flow Consider the source port src_port, destination port dst_port, and network flow protocol proto in the network flow.

[0043] Step 230: For the generated user-entity interaction graph, temporarily treat it as a homogeneous graph and initialize the representation of each node as a 128-dimensional vector.

[0044] Step 240: Calculate the first-order and second-order similarity between nodes from their vectors, and then calculate the difference between these similarities and the actual first-order and second-order similarities of the nodes in the graph. Optimize the node vector representation to minimize this difference. Finally, obtain the node representation that best fits the graph structure.

[0045] The LINE algorithm is used to learn the graph structure by calculating first-order and second-order similarity, and obtains a 128-dimensional embedding vector for each node as a node attribute.

[0046] Step 300 involves a two-stage semi-supervised anomaly detection. The first stage uses an RGCN autoencoder to unsupervisedly learn the network structure of the user-entity heterogeneous graph. The second stage uses a small number of labels to adjust the RGCN encoder trained in the first stage for lateral movement attack detection, ultimately achieving anomaly detection. The principle of the RGCN layer is as follows: Figure 2 As shown, in represents the embedding vector of the incoming edge of the target node, and out represents the embedding vector of the outgoing edge of the target node.

[0047] The network structure learned by the unsupervised RGCN autoencoder is as follows: Figure 3 As shown, the first stage includes the following steps:

[0048] Step 310, for each node's neighborhood set N i r Sample a fixed-size set of neighbors N(i).

[0049] Step 320: Input x, i.e., the representation of each node and its relationship with its neighbor N(i), into the RGCN encoder. The RGCN layer aggregates the edges with different relationships by performing in-degree and out-degree operations respectively, generating a hidden vector representation.

[0050] Step 330: Input the hidden vector representation into the linear decoding layer of the decoder to obtain the self-encoded node representation x'.

[0051] Step 340: Calculate the MSE loss between the self-encoded node representation and the original node representation, and optimize the parameters to minimize the MSE loss between the two.

[0052] Supervised lateral movement detection tasks with a small number of labels, such as Figure 4 As shown, the second stage includes the following steps:

[0053] Step 350: Based on the RGCN encoder trained in the first stage, a small number of labels are input, and after passing through the RGCN encoder, a linear binary classifier outputs the classification result y. Figure 4 p normal p represents the probability that the target node is predicted as a positive sample. abnormal This represents the probability that the target node is predicted as a negative sample.

[0054] Step 360: In each iteration, calculate the cross-entropy loss between the classification result and the original label, and optimize the parameters to minimize the cross-entropy loss between the two.

[0055] The resulting trained model can then detect anomalous nodes in lateral movement attacks.

[0056] To verify the effectiveness of this invention, the LANL multi-source dataset was used as the original data. This dataset contains 58 consecutive days of de-identified event data collected from five sources within the Los Alamos National Laboratory intranet. It includes Windows-based authentication events from personal computers and a centralized Active Directory domain controller server, startup and shutdown events from individual Windows computers, Domain Name Service (DNS) queries collected from an internal DNS server, network traffic data collected from several key router locations, and a set of well-defined red team events exhibiting misbehavior over the 58 days. The dataset totals approximately 12GB and provides a total of 1,648,275,307 events for 12,425 users, 17,684 computers, and 62,974 processes. In experiments, accuracy, precision, recall, F1 score, and false positive rate (FPR) were used as metrics for comparison with existing methods to evaluate the effectiveness and stability of this invention.

[0057] Specifically, the experiment of this invention is divided into four parts: 1) performance comparison with other lateral movement detection baseline methods; 2) the influence of the positive and negative sample ratio on the performance of this invention; 3) the influence of the label ratio on the performance of this invention; and 4) the influence of the graph embedding method on the performance of this invention.

[0058] 1) Comparison with other baseline methods

[0059] This invention selects two machine learning methods, two heterogeneous graph-based methods, and one graph neural network method as baselines among existing lateral movement detection technologies to demonstrate the effectiveness of the invention. The comparison results are shown in Table 1, where AUMDAIMLM and ADITUE are abbreviations of the article titles to which these two methods belong. The results show that the method of this invention has the highest accuracy and F1 score, the lowest false positive rate, and an excellent AUC score.

[0060] Table 1. Results of baseline comparison experiment

[0061] method accuracy F1 score False positive rate AUC Log2vec 81.17％ / 19.28％ 0.91 AUMDAIMLM 88.70％ / 14.06％ 0.89 NestedGNN 85.00％ 79.00％ / / ADITUE / / / 0.91 LMTracker 91.00％ 47.00％ 8.00％ 0.95 This invention 92.55％ 80.47％ 1.50％ 0.92

[0062] 2) The impact of the positive and negative sample ratio on the performance of this invention

[0063] To evaluate the impact of the positive-to-negative sample ratio on the method of this invention, experiments were conducted at different positive-to-negative sample ratios. The experimental results are as follows: Figure 5 As shown, the results indicate that as the ratio of positive to negative samples gradually increases, the model of this method can predict more positive samples, but the accuracy and F1 score decrease accordingly. Overall, when negative samples account for 1 / 2 to 1 / 5 of the total sample, the model of this invention achieves better results, with an average accuracy of 80.57% and an average F1 score of 77.00%.

[0064] 3) The impact of label ratio on the performance of this invention

[0065] To evaluate the impact of the proportion of labeled data on the method of this invention, experiments were conducted under different label proportions while keeping other conditions the same. The experimental results are as follows: Figure 6 As shown in the table, the results indicate that the model achieves higher accuracy and F1 score as the proportion of labeled data increases, while maintaining excellent performance even with a small number of labels. Table 2 compares the performance of different graph neural network methods under different label proportions. It can be seen that compared to other graph neural network methods, the method of this invention achieves a higher F1 score and better stability. This demonstrates the effectiveness and superiority of this invention.

[0066] Table 2. Comparison of F1 scores for various graph neural network algorithms under different label proportions.

[0067] Tag percentage 1:10 2:10 3:10 4:10 5:10 6:10 7:10 8:10 9:10 GCMC 36.95％ 48.80％ 51.19％ 55.08％ 61.33％ 61.83％ 64.57％ 66.67％ 70.42％ RGAT 46.90％ 55.23％ 57.64％ 62.20％ 61.09％ 59.56％ 60.00％ 71.94％ 70.37％ HAN 48.72％ 47.57％ 45.29％ 55.77％ 57.79％ 54.46％ 63.29％ 57.50％ 69.09％ KGCN 53.45％ 53.04％ 57.38％ 58.28％ 62.64％ 58.82％ 57.48％ 61.41％ 61.90％ NGCF 20.19％ 35.82％ 44.01％ 50.31％ 50.66％ 52.26％ 50.88％ 45.23％ 31.90％ This invention 59.03％ 60.40％ 61.82％ 65.42％ 67.45％ 67.98％ 68.55％ 80.67％ 80.47％

[0068] 4) The impact of graph embedding method on the performance of the present invention

[0069] The graph embedding method used in this invention is the LINE algorithm. In this experiment, the LINE algorithm was replaced with other graph embedding algorithms to study the impact of graph embedding methods on the performance of this invention. The experimental results are as follows. Figure 7 As shown, the LINE method outperforms other methods.

[0070] The above four experiments all demonstrate that the method of the present invention can effectively detect lateral movement attacks with a small number of labels, and the experimental results meet the standards for practical application.

[0071] Another embodiment of the present invention provides a lateral movement attack detection system based on heterogeneous graph networks, comprising:

[0072] The data preprocessing module is used to acquire and preprocess multi-source network logs.

[0073] The graph construction module is used to construct a directed heterogeneous user-entity interaction graph based on multi-source network logs, and to learn the features of the user-entity interaction graph using a graph embedding method to obtain node embedding representations.

[0074] The anomaly detection module is used to detect anomalous nodes in lateral movement attacks by utilizing node embedding representations and employing a semi-supervised learning method.

[0075] For the specific implementation process of each module, please refer to the description of the method of the present invention above.

[0076] Based on the same inventive concept, another embodiment of the present invention provides a computer device (computer, server, smartphone, etc.) including a memory and a processor, wherein the memory stores a computer program configured to be executed by the processor, and the computer program includes instructions for performing the steps of the method of the present invention.

[0077] Based on the same inventive concept, another embodiment of the present invention provides a computer-readable storage medium (such as ROM / RAM, disk, optical disk), which stores a computer program that, when executed by a computer, implements the various steps of the method of the present invention.

[0078] The embodiments described above are merely illustrative of implementation methods of the present invention, and while the descriptions are detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

Claims

1. A method for detecting lateral movement attacks based on heterogeneous graph networks, characterized in that, Includes the following steps: Obtain multi-source network logs; Constructing a directed heterogeneous user-entity interaction graph based on multi-source network logs; The graph embedding method is used to learn the features of the user-entity interaction graph and obtain the node embedding representation; By utilizing node embedding representations and employing a semi-supervised learning method, anomalous nodes in lateral movement attacks are detected. The user-entity interaction graph is a directed heterogeneous graph, defined as graph G = (V, E), where V represents the nodes in the graph and E represents the edges in the graph, where: V contains two types of nodes. u and V e V u V represents users within the intranet. u They can communicate with each other and also with V. e To communicate; V e Represents the entity, V e They can communicate with each other; each type of node has a corresponding node attribute. E contains five types of edges. email E auth E proc E dns and E flow This represents different interaction behaviors between nodes; for user-to-user email communication, E is used. email Side to two V u The nodes are connected; For user-entity interactions, if it is an authentication action, then the connection from the user node to the entity node is E. auth If a user performs a system operation on the target entity, then the connection is E. proc Edges; for entity-to-entity interactions, use E based on DNS records and network flow logs respectively. dns and E flow Connect the corresponding source and destination nodes; the edge attributes in the user-entity interaction graph depend on the edge type, for E emails Side and E dns Edges are not assigned attributes; only edge weights are considered. For E... auth Edges, whose attributes include authentication type (auth_type), login type (logon_type), authentication source (auth_orient), and authentication result (result); for E proc Edges, whose attributes include the process name (process_name) and operation status (status) of the user operation; for E flow Edges, whose attributes include the source port src_port, destination port dst_port, and network flow protocol proto in the network flow; for edges with the same source, destination nodes, and attributes, the number of times they are repeated is set as the edge weight, representing the strength of the interaction; The node attributes are generated by the LINE graph embedding method. The LINE graph embedding method is based on two similarity calculations: first-order similarity and second-order similarity. The first-order similarity is used to describe the local similarity between pairs of vertices in the graph, and the second-order similarity describes the similarity between the neighbors of two nodes. By making the first-order similarity and second-order similarity of the node representation in the graph as similar as possible to the node relationships in the original graph, the optimal node embedding representation is finally obtained.

2. The method according to claim 1, characterized in that, The acquisition of multi-source network logs includes: Collect logs from multiple sources and from multiple perspectives, including user email logs, authentication logs, system logs, DNS logs, and network flow logs, covering three aspects: user-user, user-entity, and entity-entity. The system unifies the element attributes of the collected logs to ensure consistent descriptions of the same attribute in the logs. It also cleans up missing and erroneous data in the logs and generates a unique ID for each user and entity to uniquely identify them.

3. The method according to claim 1, characterized in that, The method of detecting anomalous nodes in lateral movement attacks using a semi-supervised learning approach comprises two stages: the first stage uses a relational graph convolutional network (RGCN) to construct an autoencoder, and uses this autoencoder to learn the network structure of the user-entity interaction graph in an unsupervised manner. The second stage uses the autoencoder trained in the first stage and connects it to a linear binary classifier to output the anomaly probability.

4. The method according to claim 3, characterized in that, The first stage of training uses the MSE loss function and adds ReLU and dropout layers in each RGCN layer of the encoder to avoid gradient vanishing and overfitting, and uses L2 norm normalization in each iteration to prevent gradient explosion; the second stage of training uses the cross-entropy loss function and uses ReLU and dropout layers to avoid gradient vanishing and overfitting.

5. The method according to claim 4, characterized in that, In the training of the autoencoder, instead of using the complete neighborhood set of a node, a fixed-size set of neighbors is uniformly sampled to keep the computational footprint of each batch of data constant, thereby avoiding unpredictable memory consumption.

6. A lateral movement attack detection system based on heterogeneous graph networks according to any one of claims 1 to 5, characterized in that, include: The data preprocessing module is used to acquire and preprocess multi-source network logs. The graph construction module is used to construct a directed heterogeneous user-entity interaction graph based on multi-source network logs, and to learn the features of the user-entity interaction graph using a graph embedding method to obtain node embedding representations. The anomaly detection module is used to detect anomalous nodes in lateral movement attacks by utilizing node embedding representations and employing a semi-supervised learning method.

7. A computer device, characterized in that, It includes a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the method of any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a computer, implements the method according to any one of claims 1 to 5.

Images