A traceability graph-oriented host intrusion detection method and system, and a storage medium

Abstract

This invention discloses a host intrusion detection method, system, and storage medium based on a source graph, belonging to the field of network security. It includes: S1, collecting source data of the host under test to construct a source graph representing user behavior; S2, mapping nodes in the source graph to roles, constructing a node feature matrix with feature vectors to characterize the attribute features, structural features, and interaction relationships between nodes in the source graph, and mapping nodes with similar feature vectors to the same role; S3, performing attention-based attribute temporal random walks, comprehensively considering the attributes of nodes in the source graph, the temporal relationships between edges, and the attention parameters between different roles; S4, converting the obtained attribute temporal random walk sequence into embedding vectors to extract features from the source graph and performing intrusion anomaly detection. This invention can now perform deep representation learning on source data, reducing the training workload of detection models and improving the accuracy and efficiency of intrusion detection.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, and more specifically, relates to a host intrusion detection method, system, and storage medium based on source tracing graphs. Background Technology

[0002] Intrusion detection technology is one of the core technologies in the field of network security. This technology analyzes and utilizes information collected from computer systems and networks (such as network traffic and host logs) to determine whether there are abnormal behaviors that violate security policies or whether the system or network has been attacked. As a proactive protection technology, intrusion detection is of great significance for the security protection of networks and systems.

[0003] Traditional host intrusion detection methods typically use system calls or logs as data sources to analyze and identify host intrusions. However, these methods are easily bypassed by attackers due to inherent flaws in their data sources (system calls / logs), resulting in low detection accuracy. Source-based host intrusion detection uses source data as its data source. This source data describes system data objects (processes, files, sockets, pipes) and the complex dependencies between them, providing a complete structured view of events occurring on the system or network. This view is presented as a directed acyclic graph (source graph), fundamentally enhancing the accuracy and robustness of detection.

[0004] Traditional source tracing-based host intrusion detection methods use general graph embedding models (such as DeepWalk, Node2Vec, GraphSAGE) or graph kernel algorithms (such as Weisfeiler-Lehma) to perform representation learning on the source tracing graph data to obtain embedding vectors. Intrusion detection is then performed based on the data features represented by these embedding vectors. However, this method can only perform shallow representation learning on source tracing, resulting in limited data features. As user behavior becomes increasingly diverse and attacker methods become more complex, the embedding vectors obtained based on general models or algorithms provide a relatively simplistic representation of source tracing data features. This shallow representation learning also fails to consider the specific application scenarios and data characteristics required for intrusion detection, leading to poor representation learning performance. When applied to intrusion detection, this method results in low detection efficiency and requires significant manpower and time to adjust and train the detection model. Summary of the Invention

[0005] To address the shortcomings and improvement needs of existing technologies, this invention provides a host intrusion detection method, system, and storage medium based on source graphs, with the aim of improving the accuracy and efficiency of intrusion detection based on source graph data.

[0006] To achieve the above objectives, according to a first aspect of the present invention, a host intrusion detection method based on a source graph is provided, comprising:

[0007] S1. Collect source data of the host under test to construct a source graph representing user behavior;

[0008] S2. Map the nodes in the source map to roles, construct a node feature matrix with feature vectors to characterize the attribute features, structural features and interaction relationships between nodes in the source map, and map nodes with similar feature vectors in the node feature matrix to the same role.

[0009] S3. Perform an attention-based temporal random walk of attributes to generate a sequence of nodes starting with the current node v. i Starting from a value of L, a sequence of attribute-based temporal random walks of length L: x i It is node v i The eigenvectors; φ(x) represents the function that maps nodes to roles; where, and For nodes With the next node The edges connecting them; E T The edge in the source graph is t; t is the sequence number in the walk sequence. Represents a node The edge between them was created earlier than the node. The creation time of the edges between them;

[0010] Furthermore, the current node will move to neighbor nodes corresponding to different roles with different probabilities; the probabilities are attention parameters between the roles, used to reflect the importance between the roles;

[0011] S4. Convert the attribute time-series random walk sequence into an embedding vector to extract the source map features and perform intrusion anomaly detection.

[0012] Furthermore, in S3, the attention parameters between the characters are represented by a character attention matrix M, and the character attention matrix M is obtained in the following ways:

[0013] S301. Set equal transition probabilities as the current role attention matrix M;

[0014] S302. Perform an attribute-based temporal random walk with attention using the current role attention matrix M to obtain the current node v. i Embedded vector e i and the embedding vector e corresponding to all neighboring nodes of the current node. N ;

[0015] S303, Using the embedded vector e i and eN Update the current role attention matrix M:

[0016]

[0017]

[0018] Where softmax represents the normalization operator; W i Indicates the current node v i The corresponding role, w j Indicates the current node v i The elements in the role set corresponding to all neighboring nodes; δ(w j ,w i ) indicates w j Character vs. w i The importance of the role; e i It is the current node v i The corresponding embedding vector; N wj This indicates that the neighboring node belongs to the role w. j The set of nodes, the mean function is used to aggregate the embedding vectors corresponding to the same type of role in the sequence;

[0019] S304. Repeat S302 and S303 until the character attention matrix M tends to stabilize, thus obtaining the desired character attention matrix M.

[0020] Furthermore, in S304, the distance between the two character attention matrices obtained from two adjacent iterations is calculated to obtain the number of times the character's transition probability changes exceed a set first threshold. If the number is less than a set second threshold, then the character attention matrix M tends to stabilize.

[0021] Furthermore, in S4, the attribute temporal random walk sequence is input into the SkipGram model to calculate the embedding vector for each node.

[0022] Furthermore, in S4, the embedded vector is fed into a pre-trained intrusion detection model for intrusion anomaly detection.

[0023] Furthermore, the function φ(x) that maps nodes to roles is a binary operator or a k-means clustering function.

[0024] Furthermore, in S1, after collecting the source data of the host under test, the following steps are also included: filtering source data that is not related to the intrusion behavior, and removing nodes with the same attribute characteristics.

[0025] Furthermore, the nodes in the source graph are used to represent the data objects of the host under test, including processes, files, sockets, and pipes.

[0026] According to another aspect of the present invention, a host intrusion detection system oriented towards a source graph is provided for performing the method as described in any one of the first aspects, the system comprising:

[0027] The source graph construction module is used to collect source data from the host under test in order to construct a source graph representing user behavior.

[0028] The role mapping module is used to map nodes in the source graph to roles, construct a node feature matrix with feature vectors to characterize the attribute features, structural features and interaction relationships between nodes in the source graph, and map nodes with similar feature vectors in the node feature matrix to the same role.

[0029] The random walk module is used to perform attention-based temporal random walks of attributes, generating results with the current node v as the starting point. i Starting from a value of L, a sequence of attribute-based temporal random walks of length L: x i It is node v i The eigenvectors; φ(x) represents the function that maps nodes to roles; where, and For nodes With the next node The edges connecting them; E T The edge in the source graph is t; t is the sequence number in the walk sequence. Represents a node The edge between them was created earlier than the node. The creation time of the edges between them;

[0030] Furthermore, the current node will move to neighbor nodes corresponding to different roles with different probabilities; the probabilities are attention parameters between the roles, used to reflect the importance between the roles;

[0031] An anomaly detection module is used to convert the attribute time-series random walk sequence into an embedding vector to extract the source map features and perform intrusion anomaly detection.

[0032] According to another aspect of the present invention, a computer-readable storage medium is provided, including a stored computer program; when the computer program is executed by a processor, it controls the device where the computer-readable storage medium is located to perform the host intrusion detection method oriented towards a source map as described in any one aspect.

[0033] In summary, the above-described technical solutions conceived in this invention can achieve the following beneficial effects:

[0034] (1) The host intrusion detection method for source tracing graph of the present invention, in the process of performing attention-based attribute temporal random walk, takes into account the temporal nature of the data in the source tracing intrusion detection scenario, that is, the relationship and behavior between nodes occur in chronological order. The constructed walk strategy can capture the temporal evolution relationship between nodes by considering the temporal characteristics of the edge of the source tracing graph, so that the obtained embedding vector can represent the dynamic characteristics of intrusion behavior. At the same time, nodes with different roles have different behaviors and characteristics in the source tracing graph. In the process of random walk, considering the influence of the neighbor nodes of different roles on the embedding, the interaction patterns and information transmission between nodes can be better captured, which can improve the perception and understanding of the behavioral characteristics of different roles, thereby more accurately distinguishing normal behavior and potential intrusion behavior. The resulting embedding vector can provide more accurate features for tasks such as node classification, node clustering, and node similarity calculation, realizing a deep representation of source tracing data, thereby improving the accuracy of intrusion detection.

[0035] The method of this invention maps nodes with similar attribute features, structural features and interaction relationships in the node feature matrix to the same role. Through role mapping, a large number of nodes can be summarized into a group of roles with similar features and behavioral patterns, reducing the complexity of information, thereby simplifying the intrusion detection process, reducing the number of nodes that need to be analyzed, and improving the efficiency of intrusion detection.

[0036] (2) The method of the present invention, after role mapping, can better identify the behavior patterns between nodes in the source data, making it easier to discover abnormal behavior and unusual interaction patterns. By utilizing the behavioral characteristics and interaction methods of the roles, nodes with similar features and behavior patterns will have similar embedding vectors even if they are far apart in the source graph. When performing intrusion detection, it can fully explore the correlation between node features, realize the effective extraction of node features in the source graph for intrusion behavior, and also provide more accurate features for subsequent tasks such as node classification, node clustering, and node similarity calculation, thereby further improving the accuracy and efficiency of intrusion detection.

[0037] (3) As a preferred option, effective source tracing information can be extracted through preprocessing such as filtering and compression, which can further improve the efficiency of intrusion detection.

[0038] In summary, this invention effectively solves the problem that existing source tracing intrusion detection technologies struggle to perform deep representation learning on increasingly complex and growing source tracing data, reducing the workload of training detection models and improving the accuracy and efficiency of intrusion detection. Attached Figure Description

[0039] Figure 1 This is a flowchart of the host intrusion detection method based on the source graph of the present invention.

[0040] Figure 2 This is a schematic diagram of constructing a node feature matrix based on a source graph, provided in an embodiment of the present invention.

[0041] Figure 3 This is a schematic diagram of the role attention matrix update steps provided in an embodiment of the present invention.

[0042] Figure 4 This is a schematic diagram of the node embedding vector process based on attention-based attribute temporal random walk provided in an embodiment of the present invention; wherein, Figure 4 In the diagram, (a)-(d) represent different stages of the attention-based temporal random walk on the node. Detailed Implementation

[0043] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0044] In this invention, the terms "first," "second," etc., used in the invention and accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0045] like Figure 1 As shown, the host intrusion detection method based on the source map of the present invention mainly includes:

[0046] S1. Collect the source data of the host under test, and use the source data to construct a source graph representing user behavior.

[0047] S2. Construct a node feature matrix based on the attribute features, structural features, and interaction relationships between nodes in the source graph; and map all nodes to roles through a role mapping function, and map nodes with similar attribute features, structural features, and interaction relationships between nodes in the node feature matrix to the same role; wherein, nodes in the source graph are used to represent data objects such as processes, files, sockets, and pipes; the structural features of nodes are used to represent the position information of the node in the graph, and the interaction relationships between nodes are the behavior patterns of the nodes, used to represent the interaction relationships between the current node and other nodes.

[0048] S3. Perform an attention-based temporal random walk of attributes to generate a sequence of nodes starting with the current node v. i Starting from a value of L, a sequence of attribute-based temporal random walks of length L: x i It is node v iThe k-dimensional feature vector is used to represent the attribute features, structural features, and interaction relationships between the node and its neighboring nodes; φ(x) represents the function that maps the node with feature vector x to a role, φ:x→w, where x represents the k-dimensional feature vector corresponding to the node, and w represents the role corresponding to the node;

[0049] in, and Represents nodes in the source graph With its next node The edges connecting them; E T This represents all edges in the source graph; t represents the sequence number in the walk sequence; T() represents the time it takes for an edge to be established between two nodes; Represents a node The edge between them was created earlier than the node. The creation time of the edges between them; and, during a random walk, the probability that the current node will walk to a neighbor node corresponding to a different role is determined by the attention parameters between the roles.

[0050] S4. Convert the obtained attribute time-series random walk sequence into an embedding vector to extract features from the source map for intrusion detection.

[0051] Specifically, in S1, the source collection system intercepts system calls of the host under test and generates source data that records user behavior. By describing system data objects (processes, files, sockets, pipes, etc.) and the complex dependencies between data objects, the source data can provide a complete structured view of events that occur on the system, presented as a directed acyclic graph (source graph).

[0052] In this embodiment of the invention, systems such as SPADE and Camflow are used to collect and record traceability information about the system kernel, file formats, and applications that record user behavior.

[0053] Preferably, step S1 further includes: preprocessing the collected source tracing data to filter out source tracing information unrelated to intrusion behavior, remove nodes with identical attribute information, and filter redundant information such as temporary files and environment variables that are unrelated to intrusion detection. Valid source tracing information is extracted through filtering, compression, and other preprocessing to improve detection efficiency.

[0054] Specifically, such as Figure 2 As shown in S2, the attribute features of a node include its own attribute features such as type, ID, timestamp, and version. Each row or column of the node feature matrix contains a k-dimensional feature vector corresponding to the node, including its attribute features, structural features, and the interaction relationships between nodes.

[0055] In this embodiment of the invention, taking a source graph with five nodes A, B, C, D, and E as an example, the node feature matrix X after transformation is as follows: Figure 2 As shown.

[0056] In S2, the role mapping function φ can be obtained by learning or by manual definition. In this embodiment of the invention, the role mapping function φ is defined as a binary operator; in other embodiments, the role mapping function φ can also be defined as a k-means clustering function.

[0057] Meanwhile, features and behavioral patterns that are identical within a set error range are considered to have similar features and behavioral patterns. In this embodiment of the invention, all source graph nodes are mapped to n roles.

[0058] Specifically, such as Figure 3 As shown in S3, the attention parameters between characters are represented by the character attention matrix, which represents the importance of different characters. The character attention matrix learns the optimal adaptive attention parameters between characters through iterative training and updating, including:

[0059] S301. Set equal transition probabilities as the current role attention matrix M;

[0060] S302. Perform an attribute-based temporal random walk with attention using the current role attention matrix M to obtain the result with the current node v i Starting with a sequence of attribute-based random walks of length L with attention, the sequence is input into the SkipGram model to calculate the current node v. i Embedded vector e i and the embedding vector e corresponding to all neighboring nodes of the current node. N Where N represents node v i The set consisting of all neighboring nodes; S303, using the embedding vector e i and e N Update the character attention matrix M;

[0061] S304. Repeat S302 and S303 until the character attention matrix M tends to stabilize, thus obtaining the required character attention matrix M.

[0062] Specifically, in S303, the embedding vector e is used. i and e N The character attention matrix M is updated as follows:

[0063]

[0064]

[0065] Where softmax represents the normalization operator; W i Indicates the current node v i The corresponding role, w j Indicates the current node v i The set of roles R corresponding to all neighboring nodes i w in j Element; δ(w) j ,w i ) indicates w j Character vs. w i The importance of the role; e i It is the current node v i The corresponding embedding vector, e N It is the embedding vector corresponding to all neighboring nodes of the current node; This indicates that the neighboring node belongs to the role w. j The set of nodes, the mean aggregator function is used to aggregate the embedding vectors corresponding to the same type of role in the time-series random walk sequence of attributes with attention.

[0066] M ij The values ​​range from [0,1], where each element represents the role w. i The current node v i Wander to the role of w j The probability of neighboring nodes.

[0067] Specifically, in S304, the change in node transition probability is obtained by recording the distance between the two role attention matrices obtained after two adjacent iterations (calculating the difference), and the number of node transition probability changes greater than a set first threshold is recorded. If the number is less than a set second threshold, it indicates that the role attention matrix M tends to stabilize, the iteration update stops, and the desired role attention matrix M is obtained. In this embodiment of the invention, the first threshold is set to 0.05, and the second threshold is the proportion of node change, which is set to 10%.

[0068] Specifically, after completing the role mapping in S2 and the attention matrix update in S3, an attention-based attribute temporal random walk is performed on all nodes to obtain the role sequence of the walking nodes, and then the final embedding vector is obtained through the SkipGram model. In this embodiment of the invention, node v1 is used as an example to illustrate the process of obtaining the embedding vector of node v1 based on attention-based attribute temporal random walk. Figure 4 As shown in (a), firstly, all nodes in the source graph are mapped to four role types (role 1 to role 4) through role mapping; then, the temporal relationship between node edges and the attention parameters between different roles are comprehensively considered, such as... Figure 4As shown in (b), t represents the time when the edge is generated, and α represents the attention parameter. Then, a random walk is performed starting from node v1. The set of roles corresponding to the neighboring nodes of node v1 is N = {role 2, role 1}, where the attention parameter between role 2 (belonging to node v1) and its neighboring role 2 is 0.25, and the attention parameter between role 2 and its neighboring role 1 is 0.75. By setting the random walk length to 3 and the number of walks to 4, ideally, node v1 will walk to the neighboring node corresponding to role 1 3 times and to the neighboring node corresponding to role 2 1 time. The resulting random walk sequence is as follows: Figure 4 As shown in (c); finally, the embedding vector is obtained through the SkipGram model, as shown in (c). Figure 4 As shown in (d) in the figure.

[0069] Specifically, in S4, the obtained embedding vector is input into the pre-trained intrusion detection model for intrusion anomaly detection.

[0070] The embedding vector is used to reflect the current node v. i The similarity between a corresponding role and the roles of its neighboring nodes is a key factor. Higher similarity indicates that the role of the neighboring node is more relevant to the current node v. i The more important it is.

[0071] The host intrusion detection method based on the source graph of the present invention, by using the current node v i Starting from the first point, during the attention-based attribute temporal random walk, considering the temporal nature of the data in the source tracing intrusion detection scenario, that is, the relationships and behaviors between nodes occur in chronological order, the constructed walk strategy can capture the temporal evolution relationship between nodes by considering the temporal order of the source tracing graph edges, so that the resulting embedding vector can represent the dynamic characteristics of intrusion behavior.

[0072] Meanwhile, the constructed walking strategy takes into account the influence of role neighbor nodes on the current node's walking. Nodes with different roles have different behaviors and characteristics in the source graph. Considering the influence of neighbor nodes of different roles on the embedding, the interaction patterns and information transmission between nodes can be captured better, which can improve the perception and understanding of the behavioral characteristics of different roles, thereby more accurately distinguishing normal behavior from potential intrusion behavior, so as to improve the efficiency of intrusion detection based on source graph data.

[0073] In other words, the method of this invention simultaneously considers the temporal sequence of the source graph edges and the influence of neighboring nodes with different roles on the embedding, thereby better capturing the temporal characteristics of intrusion behavior and improving the ability to perceive temporal correlation. Modeling neighboring nodes with different roles enhances the ability to perceive and understand the behavioral characteristics of different roles. The resulting embedding vector can provide more accurate features for tasks such as node classification, node clustering, and node similarity calculation, thereby improving the accuracy of the intrusion detection system.

[0074] The method of this invention maps nodes with similar attribute features, structural features and interaction relationships in the node feature matrix to the same role. Through role mapping, a large number of nodes can be summarized into a group of roles with similar features and behavioral patterns, reducing the complexity of information, thereby simplifying the intrusion detection process and reducing the number of nodes that need to be analyzed.

[0075] The source data after role mapping can better identify the behavioral patterns between nodes, making it easier to discover abnormal behaviors and unusual interaction patterns. By utilizing the behavioral characteristics and interaction methods of roles, nodes with similar features and behavioral patterns will have similar embedding vectors even if they are far apart in the source graph. When performing intrusion detection, it can fully explore the correlation between node features, realize the effective extraction of node features in the source graph for intrusion behavior, and provide more accurate features for subsequent tasks such as node classification, node clustering, and node similarity calculation, thereby further improving the accuracy and efficiency of intrusion detection.

[0076] Mapping to roles can provide an understanding of the structural characteristics of a node's location in the graph, facilitating the analysis of how node behavior and interactions are integrated into the overall graph structure. This helps detect abnormal graph structures and node locations, improving the ability to detect intrusion behavior.

[0077] Furthermore, role mapping makes intrusion detection results easier to understand and interpret. Different roles represent different behaviors and characteristics, which can provide more intuitive intrusion detection output compared to node information. It also facilitates the visualization of the behavior and relationships of different roles in the source tracing diagram, helping analysts to better understand and assess potential intrusion behaviors.

[0078] In summary, mapping attribution information to a role simplifies complexity, improves pattern recognition capabilities, aids in context modeling, and enhances interpretability and visualization. These improvements contribute to increasing the accuracy, efficiency, and understandability of intrusion detection, thereby enabling more effective detection and response to potential intrusions.

[0079] According to another aspect of the present invention, a host intrusion detection system oriented towards source graphs is provided, for performing the steps corresponding to the host intrusion detection method oriented towards source graphs in the above embodiments, the system comprising:

[0080] The source graph construction module is used to collect source data from the host under test in order to construct a source graph representing user behavior.

[0081] The role mapping module is used to map nodes in the source graph to roles, construct a node feature matrix with feature vectors to represent the attribute features, structural features and interaction relationships between nodes in the source graph, and map nodes with similar feature vectors in the node feature matrix to the same role.

[0082] The random walk module is used to perform attention-based temporal random walks of attributes, generating results with the current node v as the starting point. i Starting from a value of L, a sequence of attribute-based temporal random walks of length L: x i It is node v i The eigenvectors; φ(x) represents the function that maps nodes to roles; where, and For nodes With the next node The edges connecting them; E T The edge in the source graph is t; t is the sequence number in the walk sequence. Represents a node The edge between them was created earlier than the node. The creation time of the edges between them; and the probability that the current node will walk to the neighbor nodes corresponding to different roles; the probability is the attention parameter between roles, which is used to reflect the importance between roles;

[0083] The anomaly detection module is used to convert the attribute time-series random walk sequence into an embedding vector to extract source map features and perform intrusion anomaly detection.

[0084] According to another aspect of the present invention, a computer-readable storage medium is provided, including a stored computer program; when the computer program is executed by a processor, it controls the device where the computer-readable storage medium is located to execute the host intrusion detection method oriented towards the source map in the above embodiments.

[0085] The attention-based attribute-temporal random walk strategy of this invention is a random walk proposed for the source tracing intrusion detection scenario. It comprehensively mines the attributes, temporal relationships, and weights of the roles of the current node when it walks to its neighboring nodes in the source tracing graph. The resulting embedding vector can provide more accurate features for tasks such as node classification, node clustering, and node similarity calculation, thereby achieving a deep representation of source tracing data and improving the accuracy of the intrusion detection system. At the same time, it also avoids the need to adjust and train the intrusion detection model during intrusion detection.

[0086] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A host intrusion detection method based on source graphs, characterized in that, include: S1. Collect source data of the host under test to construct a source graph representing user behavior; S2. Map the nodes in the source map to roles, construct a node feature matrix with feature vectors to characterize the attribute features, structural features and interaction relationships between nodes in the source map, and map nodes with similar feature vectors in the node feature matrix to the same role. S3. Perform an attention-based temporal random walk of attributes to generate a sequence of nodes starting from the current node. v i Starting from a value of L, a sequence of attribute-based temporal random walks of length L: , x i It is a node v i eigenvectors; This represents a function that maps nodes to roles; where, and , For nodes With the next node The edges connecting them; For all edges in the source graph; The sequence number is the number in the walk sequence; Represents a node The edge between them was created earlier than the node. The creation time of the edges between them; Furthermore, the current node will move to neighbor nodes corresponding to different roles with different probabilities; the probabilities are attention parameters between the roles, used to reflect the importance between the roles; S4. Convert the attribute time-series random walk sequence into an embedding vector to extract the source map features and perform intrusion anomaly detection.

2. The method according to claim 1, characterized in that, In S3, through the role attention matrix M The character attention matrix represents the attention parameters between the characters. M The methods of obtaining it include: S301. Set equal transition probabilities as the current role attention matrix. M ; S302, Adopt the current role attention matrix M Perform an attention-based temporal random walk to obtain the current node. v i Embedded vector and the embedding vectors of all neighboring nodes of the current node. ; S303, Using the embedding vector and Attention matrix for the current role M Update: = softmax( ) = = mean({e j , e j And v j }) Where softmax represents the normalization operator; Indicates the current node v i The corresponding role, w j Indicates the current node v i The elements in the set of roles corresponding to all neighboring nodes; express w j Characters The importance of the role; The current node v i The corresponding embedding vector; Indicates the role among neighboring nodes. w j The set of nodes, the mean function is used to aggregate the embedding vectors corresponding to the same type of role in the sequence; Indicates the current node v i The set of roles corresponding to all neighboring nodes; S304, Repeat S302 and S303 until the role attention matrix is ​​obtained. M The system tends to stabilize, thus obtaining the required character attention matrix. M .

3. The method according to claim 2, characterized in that, In S304, the distance between two character attention matrices obtained from two adjacent iterations is calculated to determine the number of character transition probability changes exceeding a set first threshold. If the number is less than a set second threshold, then the character attention matrix... M It is trending towards stability.

4. The method according to any one of claims 1-3, characterized in that, In S4, the attribute time-series random walk sequence is input into the SkipGram model to calculate the embedding vector for each node.

5. The method according to claim 4, characterized in that, In S4, the embedded vector is input into a pre-trained intrusion detection model for intrusion anomaly detection.

6. The method according to any one of claims 1-3, characterized in that, The function that maps nodes to roles This can be a binary operator or a k-means clustering function.

7. The method according to claim 1, characterized in that, In S1, after collecting the source data of the host under test, the following steps are also taken: filtering source data that is not related to the intrusion behavior, and removing nodes with the same attribute characteristics.

8. The method according to claim 1, characterized in that, The nodes in the source graph are used to represent the data objects of the host under test, including processes, files, sockets, and pipes.

9. A host intrusion detection system based on source mapping, characterized in that, The system for performing the method as described in any one of claims 1-8 includes: The source graph construction module is used to collect source data from the host under test in order to construct a source graph representing user behavior. The role mapping module is used to map nodes in the source graph to roles, construct a node feature matrix with feature vectors to characterize the attribute features, structural features and interaction relationships between nodes in the source graph, and map nodes with similar feature vectors in the node feature matrix to the same role. The random walk module is used to perform attention-based temporal random walks of attributes, generating results based on the current node. v i Starting from a value of L, a sequence of attribute-based temporal random walks of length L: , x i It is a node v i eigenvectors; This represents a function that maps nodes to roles; where, and , For nodes With the next node The edges connecting them; For all edges in the source graph; The sequence number is the number in the walk sequence; Represents a node The edge between them was created earlier than the node. The creation time of the edges between them; Furthermore, the current node will move to neighbor nodes corresponding to different roles with different probabilities; the probabilities are attention parameters between the roles, used to reflect the importance between the roles; An anomaly detection module is used to convert the attribute time-series random walk sequence into an embedding vector to extract the source map features and perform intrusion anomaly detection.

10. A computer-readable storage medium, characterized in that, The computer program includes a stored computer program; when executed by a processor, the computer program controls the device containing the computer-readable storage medium to perform the host intrusion detection method based on the source map as described in any one of claims 1-8.

Images