Host intrusion detection method and device, storage medium and electronic device

Abstract

The present application discloses a host intrusion detection method and device, a storage medium and an electronic device. The detection method includes obtaining the host audit log of the target computer and constructing a directed traceability graph, wherein the nodes of the directed traceability graph are used to represent entities in the host audit log, and the edges of the directed traceability graph are used to represent system calls between the nodes; the traceability graph data of the directed traceability graph is input into a pre-trained graph encoder to obtain a graph-level embedding; the graph-level embedding is input into a pre-trained dual autoencoder to calculate the predicted label to realize intrusion detection, wherein the dual autoencoder includes an encoder, a benign decoder and a malicious decoder. The detection method of the present application utilizes a competition mechanism so that the decision threshold in anomaly detection can be automatically learned during training without the need for manual setting by security personnel, thereby reducing the workload of security analysts and improving its application and promotion capabilities in new scenarios.

Description

Technical Field

[0001] The present application relates to the technical field of host anomaly detection, and in particular to a host intrusion detection method and device, a storage medium and an electronic device. Background Art

[0002] With the continuous development of technology, the emergence of advanced persistent threat (APT) attacks has brought new challenges to network security. APT attacks are a highly complex and organized attack method. Attackers quietly obtain sensitive information or destroy target systems through long-term persistent intrusions. This attack method not only poses a threat to the privacy and property security of individuals and organizations, but also has a serious impact on national security and global economic stability. Due to its high complexity and persistence, APT attacks have attracted the attention of more and more researchers, and studying defense methods against APT attacks has become a focus of security personnel.

[0003] The system's audit log is an excellent data source for APT intrusion detection. The audit log comprehensively records various activities and events that occur in the system, including user logins, file accesses, system configuration changes, etc. These records are arranged in chronological order, providing comprehensive information and event sequences that can track and restore the attacker's behavior path. However, audit logs are usually large and complex in data volume, and security professionals are in urgent need of a better tool to describe and model attacks to enhance defense capabilities. The provenance graph is an optimal threat modeling method because of its powerful semantic expression and ability to associate attack history. At present, detection methods based on the provenance graph can be roughly divided into the following two types: rule-based detection and anomaly-based detection.

[0004] Rule-based detection is a common security detection method that detects potential security threats or abnormal behaviors based on predefined rules or rule sets. These rules are usually formulated by security experts or security teams to describe the differences between normal behaviors and potential malicious behaviors. Rule-based detection monitors and analyzes system activities and events in real time and matches them with predefined rules to identify possible security issues. However, due to the high concealment, variability, zero-day attacks and advanced technology of APT attacks, traditional rule-based detection methods are difficult to capture unknown attack patterns and malicious behaviors, and are easily circumvented and bypassed by attackers.

[0005] The anomaly-based APT attack detection method is a method that detects abnormal behaviors or patterns in the system by building a normal behavior model. It does not rely on predefined rules, but identifies abnormal behaviors that do not conform to the normal behavior model by analyzing the activities and events of the system. The core idea of ​​this method is to regard normal behavior as the benchmark of the system, and to discover abnormal behaviors that are inconsistent with the normal behavior model by monitoring and analyzing the behavior of the system. However, in actual deployment, it often has some unrealistic assumptions, such as assuming that all training data are uncontaminated data, and the threshold of anomaly detection needs to be set manually, which greatly reduces its practicality.

[0006] The information disclosed in this background technology section is only intended to increase the understanding of the overall background of the application and should not be regarded as an admission or any form of suggestion that the information constitutes the prior art already known to a person skilled in the art. Summary of the invention

[0007] The purpose of the present application is to provide a host intrusion detection method and device, a storage medium and an electronic device to solve the technical problem that the anomaly-based APT attack detection method in the prior art often has some unrealistic assumptions in actual deployment, and the threshold of anomaly detection needs to be set manually, which greatly reduces the practicality.

[0008] To achieve the above purpose, a technical solution adopted in this application is:

[0009] A host intrusion detection method is provided, comprising:

[0010] Obtaining a host audit log of a target computer and constructing a directed traceability graph, wherein nodes of the directed traceability graph are used to represent entities in the host audit log, and edges of the directed traceability graph are used to represent system calls between the nodes;

[0011] Inputting the traceability graph data of the directed traceability graph into a pre-trained graph encoder to obtain a graph-level embedding;

[0012] The graph level embedding is input into a pre-trained dual autoencoder to calculate a predicted label to achieve intrusion detection. The dual autoencoder includes an encoder, a benign decoder, and a malicious decoder.

[0013] In one or more embodiments, the training process of the graph encoder includes:

[0014] Constructing a graph neural network, performing unsupervised training on the graph neural network based on the traceability graph data of the directed traceability graph, and obtaining graph neural network parameters;

[0015] The graph neural network parameters are loaded to obtain a graph encoder.

[0016] In one or more embodiments, the graph neural network is a graph convolutional neural network, which is expressed as:

[0017]

[0018] In the formula, GE( ) represents graph convolutional neural network; represents an adjacency matrix with self-loops; H (l) represents the embedding vector matrix of the node at the lth layer iteration of the graph convolutional neural network. When l = 0, H (l) Represents the initial feature vector of the node in the traceability graph; W (l) represents the weight matrix of the lth layer.

[0019] In one or more embodiments, the pretext task of the unsupervised training is to maximize local information, and the loss function is:

[0020]

[0021] In the formula, Represents the positive sample pairs in training; Represents the negative sample pairs in training; represents the graph embedding of the current graph; h i Represents the embedding of a node in the graph; represents the embedded representation of the node after negative sampling; D represents the discriminator, and the expression is The expression of the erosion function used for negative sampling is C = R N×F ×R N×N →R M×F ×R M×M , where N and M represent the dimensions before and after corrosion, respectively.

[0022] In one or more embodiments, the training process of the dual autoencoder includes:

[0023] Inputting the provenance graph data of the directed provenance graph into the pre-trained graph encoder to obtain an embedding representation of the nodes of the directed provenance graph, and obtaining a graph-level embedding through a readout function, wherein the graph-level embedding includes a benign labeled graph embedding and an unlabeled graph embedding;

[0024] Constructing a dual autoencoder including an encoder, a benign decoder and a malicious decoder, embedding the benign labeled image into the encoder for encoding and inputting it into the benign decoder, embedding the unlabeled image into the encoder for encoding and inputting it into the benign decoder and the malicious decoder respectively, and calculating the reconstruction errors of the benign decoder and the malicious decoder;

[0025] Based on the reconstruction errors of the benign decoder and the malicious decoder, the predicted label of the unlabeled graph embedding is calculated, and the mutual information is introduced to construct a loss function;

[0026] Based on the loss function, the weights of the dual autoencoder are updated along the direction of gradient descent until the loss function converges and the training is completed.

[0027] In one or more embodiments, the readout function is average pooling;

[0028] The calculation formula of the reconstruction error of the benign decoder is as follows:

[0029]

[0030] In the formula, represents the benign labeled graph embedding, D benigh represents the output of the benign decoder;

[0031] The calculation formula of the reconstruction error of the malicious decoder is as follows:

[0032]

[0033] In the formula, represents the unlabeled graph embedding, D attack Represents the output of the malicious decoder.

[0034] In one or more embodiments, in the step of calculating the predicted label of the unlabeled graph embedding based on the reconstruction error of the benign decoder and the malicious decoder, and introducing mutual information to construct the loss function,

[0035] The calculation formula for the predicted label of the unlabeled graph embedding is:

[0036]

[0037] When i = 1, the unlabeled graph is embedded and detected as an attack graph. i =0, the unlabeled graph is embedded and detected as a regular graph;

[0038] The calculation formula of the loss function is as follows:

[0039] Loss=LOSS benigh +Loss unlabeled -λLoss MI ;

[0040] Where λ is an adjustable hyperparameter;

[0041] Loss unlabeledrepresents the loss function for training the unlabeled graph embedding, and is expressed as follows:

[0042]

[0043] Loss MI Represents the loss function of the mutual information training, and the expression is as follows:

[0044]

[0045] Among them, Disc represents the discriminator used to maximize mutual information, E(z attack ) represents the embedded vector representation obtained by averaging the dimensions of the latent vector detected as an attack graph.

[0046] In one or more embodiments, in the step of embedding the graph level into a pre-trained dual autoencoder to calculate the predicted label and implement intrusion detection,

[0047] The calculation formula of the predicted label is as follows:

[0048]

[0049] In the formula, represents the graph-level embedding of the input, D benigh represents the output of the benign decoder, D attack represents the output of the malicious decoder;

[0050] When i = attack, the input graph level embedding is detected as an attack graph. i =normal, the input graph-level embedding is detected as a normal graph.

[0051] To achieve the above purpose, another technical solution adopted by this application is:

[0052] Provided is a host intrusion detection device, comprising:

[0053] A traceability graph construction module is used to obtain the host audit log of the target computer and construct a directed traceability graph, wherein the nodes of the directed traceability graph are used to represent entities in the host audit log, and the edges of the directed traceability graph are used to represent system calls between the nodes;

[0054] A graph encoding module, used for inputting the traceability graph data of the directed traceability graph into a pre-trained graph encoder to obtain a graph-level embedding;

[0055] The prediction module is used to embed the graph level into a pre-trained dual autoencoder to calculate the predicted label and realize intrusion detection. The dual autoencoder includes an encoder, a benign decoder and a malicious decoder.

[0056] To achieve the above purpose, another technical solution adopted by this application is:

[0057] An electronic device is provided, comprising:

[0058] at least one processor; and

[0059] A memory storing instructions, which, when executed by the at least one processor, enables the at least one processor to execute the host intrusion detection method according to any one of claims 1 to 8.

[0060] To achieve the above purpose, another technical solution adopted by this application is:

[0061] A machine-readable storage medium is provided, which stores executable instructions, and when the instructions are executed, the machine executes the host intrusion detection method according to any one of claims 1 to 8.

[0062] Different from the prior art, the beneficial effects of this application are:

[0063] The detection method of the present application utilizes a traceability graph to model host logs, allowing analysts to more intuitively understand and analyze activities and events in the system, which helps to determine the intent and purpose of the attacker.

[0064] The detection method of this application targets the characteristics of tracing graphs and APT attacks, and proposes a self-supervised learning method to train a graph encoder based on a graph neural network, making full use of the graph to discriminate between abnormal and benign behaviors through a graph representation learning method, preserving rich semantic information in the vector space, and improving the accuracy of anomaly detection.

[0065] The detection method of the present application introduces mutual information maximization. In anomaly detection, the most discriminative feature subset is selected through mutual information maximization, and the difference between normal samples and abnormal samples is captured, so as to better distinguish them, thereby improving the accuracy and robustness of anomaly detection.

[0066] The detection method of the present application utilizes a special dual encoder mechanism. By setting up an encoder and two decoders, it is possible to train the anomaly detection model normally even when the data is contaminated. Security analysts only need to mark a part of the data to start the weakly supervised training model, which greatly reduces the manpower and time costs required for actual operation deployment.

[0067] The detection method of the present application utilizes a competition mechanism so that the decision threshold in anomaly detection can be automatically learned during training without the need for manual setting by security personnel, thereby reducing the workload of security analysts and improving its application and promotion capabilities in new scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 It is a flowchart of an implementation method of a host intrusion detection method of the present application;

[0069] Figure 2 It is a flowchart of an implementation method of a training method of a graph encoder of the present application;

[0070] Figure 3 It is a flowchart of an implementation method of a dual autoencoder training method of the present application;

[0071] Figure 4 It is a structural schematic diagram of an implementation scheme of a host intrusion detection device of the present application;

[0072] Figure 5 It is a schematic structural diagram of an embodiment of an electronic device of the present application. DETAILED DESCRIPTION

[0073] Intrusion detection methods based on traceability graphs can include: rule-based detection and anomaly-based detection. Among them, rule-based detection is difficult to capture unknown attack patterns and malicious behaviors, and is easily circumvented and bypassed by attackers.

[0074] Anomaly-based detection does not rely on predefined rules, but instead identifies abnormal behaviors that are inconsistent with the normal behavior model by analyzing the system's activities and events. The core idea of ​​this method is to regard normal behavior as the system's benchmark and to discover abnormal behaviors that are inconsistent with the normal behavior model by monitoring and analyzing the system's behavior. However, in actual deployment, there are often some unrealistic assumptions, such as assuming that all training data is uncontaminated data, and the threshold for anomaly detection needs to be set manually, which greatly reduces its practicality.

[0075] In order to solve the problems existing in the current anomaly-based intrusion detection methods, the applicant has developed a new host intrusion detection method. The anomaly detection threshold of this method can be automatically learned during training without the need for manual setting by security personnel, thereby reducing the workload of security analysts and improving its application and promotion capabilities in new scenarios.

[0076] The specific implementation methods of the present application are described in detail below in conjunction with the accompanying drawings, but it should be understood that the protection scope of the present application is not limited by the specific implementation methods.

[0077] Unless explicitly stated otherwise, throughout the specification and claims, the term “comprise” or variations such as “include” or “comprising”, etc., will be understood to include the stated elements or components but not to exclude other elements or components.

[0078] See also Figure 1 , Figure 1 It is a flow chart of an implementation method of a host intrusion detection method of the present application.

[0079] like Figure 1 As shown, the detection method includes:

[0080] S100, obtaining the host audit log of the target computer and constructing a directed traceability graph.

[0081] The host audit log may include, but is not limited to, information about various activities and events occurring on the host. For example, the host audit log may use a log collection framework built into the operating system, such as the Linux audit subsystem, Windows Event Tracing (ETW), and FreeBSD's DTrace.

[0082] By obtaining the host audit log of the target computer, a directed traceability graph can be constructed. The nodes in the directed traceability graph can represent the entities in the host audit log, and the edges connecting the nodes can be used to represent the system calls between the nodes. Therefore, the information of various activities and events on the host can be represented by the directed traceability graph.

[0083] Modeling host logs with traceability graphs allows analysts to more intuitively understand and analyze activities and events in the system, helping to determine the attacker's intentions and goals.

[0084] In one embodiment, the provenance graph data of the directed provenance graph may be represented and stored in the form of a four-tuple <source node, system call operation, target node, timestamp>.

[0085] S200: Input the traceability graph data of the directed traceability graph into a pre-trained graph encoder to obtain graph-level embedding.

[0086] Based on the directed provenance graph, the provenance graph data can be input into the graph encoder. The graph encoder is pre-trained and can learn the features and representations of the graph data, thereby mapping the input graph data to a low-dimensional vector for graph clustering and obtaining graph-level embedding.

[0087] In one embodiment, see Figure 2 , Figure 2 It is a flowchart of an implementation method of a training method for a diagram encoder of the present application.

[0088] like Figure 2As shown, the training method of the graph encoder may include:

[0089] S201. Construct a graph neural network, perform unsupervised training on the graph neural network based on the traceability graph data of the directed traceability graph, and obtain graph neural network parameters.

[0090] Among them, the graph neural network can be a graph convolutional neural network, and its expression is:

[0091]

[0092] In the formula, GE() represents graph convolutional neural network; represents an adjacency matrix with self-loops; H (l) represents the embedding vector matrix of the node at the lth layer iteration of the graph convolutional neural network. When l = 0, H (l) Represents the initial feature vector of the node in the traceability graph; W (l) represents the weight matrix of the lth layer.

[0093] Based on the traceability graph data, the graph neural network can be trained unsupervisedly and the parameters of the graph neural network can be updated to obtain good graph neural network parameters.

[0094] In one embodiment, the pretext task of unsupervised training may be to maximize local information, and its loss function may be:

[0095]

[0096] In the formula, Represents the positive sample pairs in training; Represents the negative sample pairs in training; represents the graph embedding of the current graph; h i Represents the embedding of a node in the graph; represents the embedded representation of the node after negative sampling; D represents the discriminator, and the expression is The expression of the erosion function used for negative sampling is C = R N×F ×R N×N →R M×F ×R M×M , where N and M represent the dimensions before and after corrosion, respectively.

[0097] By updating the parameters of the graph neural network along the gradient descent method in unsupervised training until the above loss function converges, the trained graph neural network parameters can be obtained.

[0098] S202. Load graph neural network parameters to obtain a graph encoder.

[0099] After obtaining the graph neural network parameters through training, the graph neural network parameters can be loaded to obtain the graph encoder, thereby realizing the training of the graph encoder.

[0100] It can be understood that the graph encoder trained by the unsupervised training learning method can make full use of the graph to discriminate between abnormal and benign behaviors through the graph representation learning method, preserve rich semantic information in the vector space, and improve the accuracy of anomaly detection.

[0101] S300, embed the graph level into the pre-trained dual autoencoder, calculate the predicted label, and realize intrusion detection.

[0102] Among them, the dual autoencoder includes an encoder, a benign decoder and a malicious decoder. After pre-training, it can remove noise and redundant information in the input data, so as to learn the potential characteristics of the data and can still train the anomaly detection model normally when the data is contaminated.

[0103] Specifically, see Figure 3 , Figure 3 It is a flowchart of an implementation method of a dual autoencoder training method of the present application.

[0104] like Figure 3 As shown, the training method of the dual autoencoder may include:

[0105] S301, inputting the traceability graph data of the directed traceability graph into a pre-trained graph encoder to obtain an embedding representation of the nodes of the directed traceability graph, and obtaining a graph-level embedding through a readout function.

[0106] First, based on the trained graph encoder, the graph encoder can extract features from the traceability graph data, obtain the embedded representation of the nodes, and obtain the graph-level embedding through the readout function.

[0107] The readout function may be average pooling.

[0108] Among them, the traceability graph data may include a small amount of manually labeled benign data, so that the graph-level embedding obtained after passing through the graph encoder may include benign labeled graph embedding and unlabeled graph embedding.

[0109] Among them, benign labeled graph embedding is the graph-level embedding output by the graph encoder based on manually labeled benign traceability graph data; unlabeled graph embedding is the graph-level embedding output by the graph encoder based on unlabeled traceability graph data.

[0110] S302, constructing a dual autoencoder including an encoder, a benign decoder and a malicious decoder, embedding the benign labeled image into the benign decoder, embedding the unlabeled image into the benign decoder and the malicious decoder, respectively, and calculating the reconstruction errors of the benign decoder and the malicious decoder.

[0111] After obtaining the graph-level embedding, the graph-level embedding can first be encoded by the encoder of the dual autoencoder, and then the output content of the encoder for the graph-level embedding is input into the benign decoder, and the benign decoder output data is compared with the benign labeled graph embedding, so as to calculate the reconstruction error of the benign decoder;

[0112] The output content of the encoder for the unlabeled graph embedding is input into the benign decoder and the malicious decoder respectively, and the malicious decoder output data is compared with the unlabeled graph embedding to calculate the reconstruction error of the malicious decoder.

[0113] Specifically, the calculation formula of the reconstruction error of the benign decoder is as follows:

[0114]

[0115] In the formula, represents the benign labeled graph embedding, D benigh represents the output of the benign decoder;

[0116] The calculation formula of the reconstruction error of the malicious decoder is as follows:

[0117]

[0118] In the formula, represents the unlabeled graph embedding, D attack Represents the output of the malicious decoder.

[0119] S303. Based on the reconstruction errors of the benign decoder and the malicious decoder, the predicted labels of the unlabeled graph embedding are calculated, and the mutual information is introduced to construct a loss function.

[0120] Based on the reconstruction error, the predicted label is calculated to predict the embedding classification of the unlabeled graph and whether it is an intrusion attack graph.

[0121] Specifically, the calculation formula for the predicted label is as follows:

[0122]

[0123] When i = 1, the unlabeled graph is embedded and detected as an attack graph. i When =0, the unlabeled graph is embedded and detected as a regular graph.

[0124] After embedding the unlabeled graph into classification, a loss function related to the reconstruction error of the benign decoder and the malicious decoder, as well as the mutual information, can be introduced to train the two decoders in a competitive manner and optimize the accuracy of the model classification through mutual information.

[0125] Specifically, the calculation formula of the loss function can be as follows:

[0126] Loss=LOSS benigh +Loss unlabeled -λLoss MI ;

[0127] Where λ is an adjustable hyperparameter, which can be preset based on actual working conditions to adjust the weight of mutual information;

[0128] Loss unlabeled represents the loss function for training unlabeled graph embeddings, expressed as follows:

[0129]

[0130] Loss MI Represents the loss function of mutual information training, and the expression is as follows:

[0131]

[0132] Among them, Disc represents the discriminator used to maximize mutual information, E(z attack ) represents the embedded vector representation obtained by averaging the dimensions of the latent vector detected as an attack graph.

[0133] By introducing mutual information maximization, in anomaly detection, the most discriminative feature subset is selected through mutual information maximization, which captures the difference between normal samples and abnormal samples, so as to better distinguish them, thereby improving the accuracy and robustness of anomaly detection.

[0134] At the same time, by using a special dual encoder mechanism, by setting up an encoder and two decoders, it is possible to train the anomaly detection model normally even when the data is contaminated. Security analysts only need to mark a part of the data to start the weakly supervised training model, which greatly reduces the manpower and time costs required for actual operation deployment.

[0135] By utilizing the competition mechanism, the decision threshold in anomaly detection can be automatically learned during training without the need for manual setting by security personnel, thereby reducing the workload of security analysts and improving its application and promotion capabilities in new scenarios.

[0136] S304: Based on the loss function, update the weights of the dual autoencoder in the direction of gradient descent until the loss function converges and the training is completed.

[0137] Based on the loss function constructed in step S303, the dual autoencoder can be trained to obtain an optimized dual autoencoder.

[0138] By embedding the graph level output by the graph encoder based on the input traceability graph data into the trained dual autoencoder, the reconstruction error of the benign decoder and the malicious decoder in the dual autoencoder for the graph level embedding can be obtained. Based on the reconstruction error of the two decoders, the predicted label for the traceability graph data can be calculated, thereby realizing intrusion detection.

[0139] Specifically, the calculation formula for the predicted label can be as follows:

[0140]

[0141] In the formula, represents the graph-level embedding of the input, D benigh represents the output of the benign decoder, D attack represents the output of the malicious decoder;

[0142] When i = attack, the input graph level embedding is detected as an attack graph. i =normal, the input graph-level embedding is detected as a normal graph.

[0143] Therefore, based on the above prediction tags, host intrusion detection can be achieved.

[0144] This application also provides a host intrusion detection device, see Figure 4 , Figure 4 It is a structural diagram of an implementation scheme of a host intrusion detection device of the present application.

[0145] like Figure 4 As shown, the host intrusion detection device includes a traceability graph construction module 21, a graph encoding module 22 and a prediction module 23.

[0146] The traceability graph construction module 21 is used to obtain the host audit log of the target computer and construct a directed traceability graph, the nodes of the directed traceability graph are used to represent entities in the host audit log, and the edges of the directed traceability graph are used to represent system calls between nodes;

[0147] The graph encoding module 22 is used to input the traceability graph data of the directed traceability graph into a pre-trained graph encoder to obtain graph-level embedding;

[0148] The prediction module 23 is used to embed the graph level into the pre-trained dual autoencoder, calculate the predicted label, and realize intrusion detection. The dual autoencoder includes an encoder, a benign decoder and a malicious decoder.

[0149] In one embodiment, the host intrusion detection device further includes a graph encoder training module 24, which is used to construct a graph neural network, perform unsupervised training on the graph neural network based on the traceability graph data of the directed traceability graph, and obtain graph neural network parameters;

[0150] The graph encoder training module 24 is also used to load graph neural network parameters to obtain a graph encoder.

[0151] In one embodiment, the host intrusion detection device further includes a dual autoencoder training module 25, which is used to input the traceability graph data of the directed traceability graph into a pre-trained graph encoder to obtain an embedding representation of the nodes of the directed traceability graph, and obtain a graph-level embedding by reading out a function, wherein the graph-level embedding includes a benign labeled graph embedding and an unlabeled graph embedding;

[0152] The dual autoencoder training module 25 is also used to construct a dual autoencoder including an encoder, a benign decoder and a malicious decoder, embed the benign labeled image into the benign decoder after being encoded by the encoder, embed the unlabeled image into the benign decoder and the malicious decoder after being encoded by the encoder, and calculate the reconstruction errors of the benign decoder and the malicious decoder;

[0153] The dual autoencoder training module 25 is also used to calculate the predicted label of the unlabeled graph embedding based on the reconstruction error of the benign decoder and the malicious decoder, and introduce mutual information to construct a loss function;

[0154] The dual autoencoder training module 25 is also used to update the weights of the dual autoencoder based on the loss function along the direction of gradient descent until the loss function converges and the training is completed.

[0155] As above Figures 1 to 4 , a host intrusion detection method according to an embodiment of this specification is described. The details mentioned in the above description of the method embodiment are also applicable to the host intrusion detection device of the embodiment of this specification. The above host intrusion detection device can be implemented by hardware, or by software, or a combination of hardware and software.

[0156] This application also provides an electronic device, see Figure 5 , Figure 5 It is a schematic structural diagram of an embodiment of an electronic device of the present application.

[0157] like Figure 5As shown, the electronic device 30 may include at least one processor 31, a memory 32 (e.g., a non-volatile memory), a memory 33, and a communication interface 34, and the at least one processor 31, the memory 32, the memory 33, and the communication interface 34 are connected together via a bus 35. At least one processor 31 executes at least one computer-readable instruction stored or encoded in the memory 32.

[0158] It should be understood that the computer executable instructions stored in the memory 32, when executed, cause at least one processor 31 to perform the above combined operations in various embodiments of the present specification. Figure 1-Figure 3 Describes the various operations and functions.

[0159] In the embodiments of the present specification, the electronic device 30 may include, but is not limited to, personal computers, server computers, workstations, desktop computers, laptop computers, notebook computers, mobile electronic devices, smart phones, tablet computers, cellular phones, personal digital assistants (PDAs), handheld devices, messaging devices, wearable electronic devices, consumer electronic devices, and the like.

[0160] According to one embodiment, a program product such as a machine-readable medium is provided. The machine-readable medium may have instructions (i.e., the above-mentioned elements implemented in the form of software), which, when executed by a machine, causes the machine to perform the above-mentioned combination of various embodiments of this specification. Figure 1-Figure 5 Specifically, a system or device equipped with a readable storage medium may be provided, on which a software program code implementing the functions of any of the above-mentioned embodiments is stored, and a computer or processor of the system or device reads and executes the instructions stored in the readable storage medium.

[0161] In this case, the program code itself read from the machine-readable medium can realize the function of any one of the above embodiments, and thus the machine-readable code and the machine-readable storage medium storing the machine-readable code constitute part of this specification.

[0162] Examples of readable storage media include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD-RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, the program code may be downloaded from a server computer or a cloud via a communication network.

[0163] Those skilled in the art should understand that the various embodiments disclosed above can be modified and altered in various ways without departing from the essence of the invention. Therefore, the protection scope of this specification should be defined by the appended claims.

[0164] It should be noted that not all steps and units in the above-mentioned processes and system structure diagrams are necessary, and some steps or units can be ignored according to actual needs. The execution order of each step is not fixed and can be determined as needed. The device structure described in the above-mentioned embodiments can be a physical structure or a logical structure, that is, some units may be implemented by the same physical client, or some units may be implemented by multiple physical clients, or some components in multiple independent devices may be implemented together.

[0165] In the above embodiments, the hardware unit or module can be realized by mechanical or electrical means. For example, a hardware unit, module or processor can include permanent dedicated circuit or logic (such as special processor, FPGA or ASIC) to complete the corresponding operation. The hardware unit or processor can also include programmable logic or circuit (such as general-purpose processor or other programmable processor), which can be temporarily set by software to complete the corresponding operation. Specific implementation (mechanical method or dedicated permanent circuit or temporary circuit) can be determined based on cost and time consideration.

[0166] The specific embodiments described above in conjunction with the accompanying drawings describe exemplary embodiments, but do not represent all embodiments that can be implemented or fall within the scope of protection of the claims. The term "exemplary" used throughout this specification means "used as an example, instance or illustration" and does not mean "preferred" or "having advantages" over other embodiments. For the purpose of providing an understanding of the described technology, the specific embodiments include specific details. However, these technologies can be implemented without these specific details. In some instances, in order to avoid making the concepts of the described embodiments difficult to understand, well-known structures and devices are shown in block diagram form.

[0167] The above description of the present disclosure is provided to enable any person of ordinary skill in the art to implement or use the present disclosure. Various modifications to the present disclosure will be apparent to those of ordinary skill in the art, and the general principles corresponding to the present disclosure may be applied to other variations without departing from the scope of protection of the present disclosure. Therefore, the present disclosure is not limited to the examples and designs described herein, but is consistent with the widest range of principles and novel features disclosed herein.

Claims

1. A host intrusion detection method, characterized in that: include: Obtaining a host audit log of a target computer and constructing a directed traceability graph, wherein nodes of the directed traceability graph are used to represent entities in the host audit log, and edges of the directed traceability graph are used to represent system calls between the nodes; Inputting the traceability graph data of the directed traceability graph into a pre-trained graph encoder to obtain a graph-level embedding; The graph level embedding is input into a pre-trained dual autoencoder to calculate a predicted label to implement intrusion detection, wherein the dual autoencoder includes an encoder, a benign decoder, and a malicious decoder; The training process of the dual autoencoder includes: Inputting the provenance graph data of the directed provenance graph into the pre-trained graph encoder to obtain an embedding representation of the nodes of the directed provenance graph, and obtaining a graph-level embedding through a readout function, wherein the graph-level embedding includes a benign labeled graph embedding and an unlabeled graph embedding; Constructing a dual autoencoder including an encoder, a benign decoder and a malicious decoder, embedding the benign labeled image into the encoder for encoding and inputting it into the benign decoder, embedding the unlabeled image into the encoder for encoding and inputting it into the benign decoder and the malicious decoder respectively, and calculating the reconstruction errors of the benign decoder and the malicious decoder; Based on the reconstruction errors of the benign decoder and the malicious decoder, the predicted label of the unlabeled graph embedding is calculated, and the mutual information is introduced to construct a loss function; Based on the loss function, updating the weights of the dual autoencoder along the direction of gradient descent until the loss function converges and the training is completed; The readout function is average pooling, and the calculation formula of the reconstruction error of the benign decoder is as follows: In the formula, represents the benign labeled graph embedding, D benigh represents the output of the benign decoder, GE() represents the graph convolutional neural network; The calculation formula of the reconstruction error of the malicious decoder is as follows: In the formula, represents the unlabeled graph embedding, D attack represents the output of the malicious decoder; The calculation formula for the predicted label of the unlabeled graph embedding is: When i = 1, the unlabeled graph is embedded and detected as an attack graph. i =0, the unlabeled graph is embedded and detected as a regular graph; The calculation formula of the loss function is as follows: Loss=LOSS benigh +Loss unlabeled -λLoss MI ; Where λ is an adjustable hyperparameter; Loss unlabeled represents the loss function for training the unlabeled graph embedding, and is expressed as follows: Loss MI Represents the loss function of mutual information training, and the expression is as follows: Among them, Ep is the expectation of the attack graph, Ep' is the expectation of the regular graph, is the unlabeled graph embedding vector, Disc represents the discriminator used to maximize mutual information, and z attack The embedding vector representation obtained by averaging the dimensions of the latent vector detected as an attack graph, N and M are the number of samples of benign labeled graph embedding and unlabeled graph embedding respectively; The calculation formula of the predicted label is as follows: Where D benigh represents the output of the benign decoder, D attack represents the output of the malicious decoder; When i = attack, the input graph level embedding is detected as an attack graph. i =normal, the input graph-level embedding is detected as a normal graph.

2. The host intrusion detection method according to claim 1, characterized in that: The training process of the graph encoder includes: Constructing a graph neural network, performing unsupervised training on the graph neural network based on the traceability graph data of the directed traceability graph, and obtaining graph neural network parameters; The graph neural network parameters are loaded to obtain a graph encoder.

3. The host intrusion detection method according to claim 2, characterized in that: The graph neural network is a graph convolutional neural network, and its expression is: In the formula, GE( ) represents graph convolutional neural network; A is the adjacency matrix; represents an adjacency matrix with self-loops; D is The degree matrix of H; σ is the nonlinear activation function; H (l) represents the embedding vector matrix of the node at the lth layer iteration of the graph convolutional neural network. When l = 0, H( l ) represents the initial feature vector of the node in the traceability graph; W( l ) represents the weight matrix of the lth layer.

4. The host intrusion detection method according to claim 2, characterized in that: The pretext task of the unsupervised training is to maximize local information, and the loss function is: In the formula, E (X,A) is the expectation of the regular graph, is the expectation of the attack graph, Represents the positive sample pairs in training; Represents the negative sample pairs in training; represents the graph embedding of the current graph; h i Represents the embedding of a node in the graph; represents the embedded representation of the node after negative sampling; D represents the discriminator, and the expression is Among them, h i ∈R F′ , Represents the probability score of the sample pair; the expression of the erosion function used for negative sampling is C = R N×F ×R N×N →R M ×F ×R M×M , where N and M represent the dimensions before and after corrosion, respectively.

5. A host intrusion detection device, characterized in that: include: A traceability graph construction module is used to obtain the host audit log of the target computer and construct a directed traceability graph, wherein the nodes of the directed traceability graph are used to represent entities in the host audit log, and the edges of the directed traceability graph are used to represent system calls between the nodes; A graph encoding module, used for inputting the traceability graph data of the directed traceability graph into a pre-trained graph encoder to obtain a graph-level embedding; A prediction module, used for inputting the graph level embedding into a pre-trained dual autoencoder to calculate the predicted label and implement intrusion detection, wherein the dual autoencoder includes an encoder, a benign decoder and a malicious decoder; The training process of the dual autoencoder includes: Inputting the provenance graph data of the directed provenance graph into the pre-trained graph encoder to obtain an embedding representation of the nodes of the directed provenance graph, and obtaining a graph-level embedding through a readout function, wherein the graph-level embedding includes a benign labeled graph embedding and an unlabeled graph embedding; Constructing a dual autoencoder including an encoder, a benign decoder and a malicious decoder, embedding the benign labeled image into the encoder for encoding and inputting it into the benign decoder, embedding the unlabeled image into the encoder for encoding and inputting it into the benign decoder and the malicious decoder respectively, and calculating the reconstruction errors of the benign decoder and the malicious decoder; Based on the reconstruction errors of the benign decoder and the malicious decoder, the predicted label of the unlabeled graph embedding is calculated, and the mutual information is introduced to construct a loss function; Based on the loss function, updating the weights of the dual autoencoder along the direction of gradient descent until the loss function converges and the training is completed; The readout function is average pooling, and the calculation formula of the reconstruction error of the benign decoder is as follows: In the formula, represents the benign labeled graph embedding, D benigh represents the output of the benign decoder, GE() represents the graph convolutional neural network; The calculation formula of the reconstruction error of the malicious decoder is as follows: In the formula, represents the unlabeled graph embedding, D attack represents the output of the malicious decoder; The calculation formula for the predicted label of the unlabeled graph embedding is: When i = 1, the unlabeled graph is embedded and detected as an attack graph. i =0, the unlabeled graph is embedded and detected as a regular graph; The calculation formula of the loss function is as follows: Loss=LOSS benigh +Loss unlabeled -λLoss MI ; Where λ is an adjustable hyperparameter; Loss unlabeled represents the loss function for training the unlabeled graph embedding, and is expressed as follows: Loss MI Represents the loss function of mutual information training, and the expression is as follows: Among them, Ep is the expectation of the attack graph, Ep' is the expectation of the regular graph, is the unlabeled graph embedding vector, Disc represents the discriminator used to maximize mutual information, and z attack The embedding vector representation obtained by averaging the dimensions of the latent vector detected as an attack graph, N and M are the number of samples of benign labeled graph embedding and unlabeled graph embedding respectively; The calculation formula of the predicted label is as follows: Where D benigh represents the output of the benign decoder, D attack represents the output of the malicious decoder; When i = attack, the input graph level embedding is detected as an attack graph. i =normal, the input graph-level embedding is detected as a normal graph.

6. An electronic device comprising: at least one processor; as well as A memory storing instructions, which, when executed by the at least one processor, enables the at least one processor to execute the host intrusion detection method according to any one of claims 1 to 4.

7. A machine-readable storage medium storing executable instructions, wherein when the instructions are executed, the machine executes the host intrusion detection method according to any one of claims 1 to 4.

Images