A system log attack investigation method and system based on a graph convolutional neural network

Abstract

The application provides a kind of system log attack investigation method and system based on graph convolutional neural network, belong to computer network security field, by obtaining terminal side system log;System log node is generated according to time sequence, system call relationship origin graph;Train the vector representation of system log node;According to the given candidate system log node, the origin subgraph of the candidate system log node is generated;According to the similarity between the system log nodes contained in the origin subgraph, the redundant nodes are pruned;Balanced training data set is calculated based on graph kernel algorithm and the vector similarity of system log node;The type and direction matrix vector representation of origin subgraph is trained based on attention mechanism;Learn attack behavior mode characteristics of origin subgraph based on graph convolutional neural network, identify potential attack nodes.The application does not need to introduce expert knowledge, can automatically learn attack behavior mode characteristics, improve analysis investigation speed, effectively identify attack activities including new attack.

Description

Technical Field

[0001] This invention belongs to the field of computer network security, and in particular relates to a system and method for investigating system log attacks based on graph convolutional neural networks. Background Technology

[0002] Traditional threat detection tools (IDS, etc.) struggle to cope with new zero-day attacks. A large number of unfiltered alerts prevent security analysts from identifying genuine attacks. Moreover, this rule-based detection method may introduce more false negatives in real-world applications because it is insufficient to cover all attack patterns.

[0003] Recently, system logs have been widely adopted in enterprise security due to their ability to support causal analysis. The core of this approach is to construct a provenance graph by analyzing the timing and causal dependencies of system events described in the logs for attack investigation. System logs can be used for backward tracing to reveal attack entry points and forward tracing to investigate subsequent impacts. Dependency analysis can detect other attack footprints that were previously ignored by detection rules.

[0004] However, detecting attack activity from massive amounts of system logs is like finding a needle in a haystack, slowing down security analysts' attack investigations. Although some research has focused on log data compression, the workload of analysis is not significantly reduced. Studies have shown that attack-related logs account for less than 0.001% of all system logs. Therefore, the imbalance between attack and non-attack samples makes models prone to overfitting.

[0005] In summary, using system logs for attack investigations currently faces the following four challenges:

[0006] 1) How to automatically identify attack entities, or even new types of attacks, without introducing expert knowledge;

[0007] 2) How to effectively reduce the number of alarms and improve alarm quality;

[0008] 3) How to reduce the amount of system logs to speed up analysis and investigation;

[0009] 4) How to balance positive and negative sample datasets to reduce overfitting. Summary of the Invention

[0010] This invention provides a system and method for investigating system log attacks based on graph convolutional neural networks, which solves the problems of heavy reliance on detection rules, massive alarms, difficulty in detecting new attacks, and imbalanced training datasets in existing technical solutions, thereby achieving the goal of efficient and accurate attack investigation of system logs.

[0011] The technical solution adopted in this invention is as follows:

[0012] In a first aspect, the present invention provides a method for investigating system log attacks based on graph convolutional neural networks, comprising the following steps:

[0013] 1) Obtain system logs on the terminal side;

[0014] 2) Perform causal analysis on the system logs and generate an origin graph based on the time sequence and system call relationships of the system log nodes;

[0015] 3) Train vector representations of system log nodes based on the contextual semantics and topological features of the origin graph;

[0016] 4) Based on the given candidate system log nodes, perform forward and backward searches in the origin graph to generate an origin subgraph of the candidate system log nodes;

[0017] 5) Based on the vector similarity and edit distance between the system log nodes contained in the origin subgraph, prune redundant nodes in the origin subgraph;

[0018] 6) Calculate the vector similarity between the graph kernel algorithm and system log nodes to balance the dataset;

[0019] 7) Training the type and direction matrix vector representation of the system call relationship in the origin subgraph based on the attention mechanism;

[0020] 8) Based on graph convolutional neural networks, learn the attack behavior pattern features of the origin subgraph to identify potential attack nodes.

[0021] Furthermore, the terminal-side system log obtained in step 1) includes system events and their occurrence time t. The system event consists of the system log header node, tail node, and system call relationship, represented as a triple <header node, system call, tail node>.

[0022] Furthermore, the system log header and tail nodes include system log node types for processes, files, and sockets, and each system log node has its unique system log node label; system call relationships include read, write, and execute types.

[0023] Furthermore, step 2) involves performing causal analysis on the system logs, generating an origin graph based on the time sequence and system call relationships of the system log nodes, including the following steps:

[0024] 1) Generate an origin graph in chronological order based on the data flow and control flow relationships between system log nodes. This origin graph is normalized by G = (E, V, T), where E represents the set of system call relationships, V is the set of system log nodes, and T is the set of timestamps for a series of events.

[0025] 2) Delete duplicate and redundant system call relationships between system log nodes, and only retain the system call relationship that occurred earliest.

[0026] Furthermore, in step 3), the contextual semantics and topological features of the origin graph are captured based on the graph embedding algorithm struc2vec, and the vector representation of the system log node is calculated.

[0027] Furthermore, step 4) involves performing forward and backward searches in the origin graph, including searching based on forward and backward system call relationships and limiting the depth of the path search.

[0028] Further, in step 5), redundant nodes in the origin subgraph are pruned based on the vector similarity and edit distance between the system log nodes contained in the origin subgraph, including the following steps:

[0029] The similarity between system log node labels is measured based on edit distance, and the similarity between vector representations of system log nodes is measured based on cosine similarity. Redundant nodes are pruned when system log node types are the same.

[0030] Furthermore, step 6) involves calculating the vector similarity between the graph kernel algorithm and the system log nodes to balance the dataset, including the following steps:

[0031] 1) Undersample the origin subgraphs generated by non-attack system log nodes: Based on the graph kernel algorithm, measure the similarity between origin subgraphs generated by non-attack system log nodes, delete similar non-attack origin subgraphs, and preserve the topological diversity of non-attack origin subgraphs;

[0032] 2) Oversampling of the origin subgraph generated by the attack system log nodes: Based on cosine similarity, benign system log nodes in the origin subgraph generated by the attack system log nodes are randomly mutated, preserving the attack behavior pattern characteristics of the origin subgraph generated by the attack system log nodes.

[0033] Furthermore, step 7) involves training the type and direction matrix vector representation of the system call relationship of the origin subgraph based on the attention mechanism, including the following steps:

[0034] 1) Based on the origin subgraph of the given candidate system log nodes, transform it into an adjacency matrix A = (a i,j ) n×n Where n represents the number of nodes in the origin subgraph, if system log node v i and node v j If there is a system call relationship between them, then a i,j It is 1 if it is true, otherwise it is 0;

[0035] 2) Introduce the type and direction characteristics of system call relationships, and reconstruct the adjacency matrix A into a type and direction matrix K. Specifically, if there are two or more system call relationship types between two system log nodes in the same direction, they are connected to form a new system call relationship type, and the direction of the system call is indicated.

[0036] Further, step 8) involves learning the attack behavior pattern features of the origin subgraph based on a graph convolutional neural network to identify potential attack nodes, including the following steps:

[0037] 1) The temporal relationship between system log nodes in the origin subgraph is learned based on BiLSTM neural network, and the hidden layer vector H is output as the feature vector representation of the origin subgraph;

[0038] 2) Train the type and direction matrix K based on the attention mechanism, and represent K as a vector B of system call relationship type and direction matrix, where B is the attention weight matrix;

[0039] 3) Input the trained system call relationship type and direction matrix vector B and hidden layer vector H into the graph convolutional neural network model to learn the attack behavior pattern features of the origin subgraph, and use the binary cross-entropy loss function to identify potential attack nodes.

[0040] Secondly, the present invention also provides a system log attack investigation system based on graph convolutional neural networks, comprising:

[0041] The terminal-side system log acquisition module is used to acquire terminal-side system log data;

[0042] The origin graph generation module is used to perform causal analysis on system logs and generate an origin graph based on the time sequence and system call relationships of system log nodes.

[0043] The node vector representation module is used to train the vector representation of system log nodes based on the contextual semantics and topological features of the origin graph;

[0044] The origin subgraph extraction module is used to perform forward and backward searches in the origin graph based on given candidate system log nodes, and generate the origin subgraph of the candidate system log nodes.

[0045] The subgraph optimization module is used to prune redundant nodes in the origin subgraph based on the vector similarity and edit distance between the system log nodes contained in the origin subgraph.

[0046] The sample sampling module is used to balance the dataset by calculating the vector similarity between the graph kernel algorithm and the system log nodes.

[0047] The type and direction matrix vector training module is used to train the type and direction matrix vector representation of the system call relationship of the origin subgraph based on the attention mechanism.

[0048] The attack investigation module is used to learn the attack behavior pattern features of the origin subgraph based on graph convolutional neural networks and identify potential attack nodes.

[0049] Thirdly, the present invention also provides a storage medium in which the computer program, when executed by a processor, implements the steps of the above-described method.

[0050] Fourthly, the present invention also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the above-described method.

[0051] This invention provides a system log attack investigation method and system based on graph convolutional neural networks. By establishing a system log origin graph, the number of massive log nodes is reduced. Furthermore, based on the convolutional neural network, the attack behavior pattern characteristics contained in the origin subgraph generated by a given system attack node are fully learned for attack investigation. Compared with existing technologies, it has the following positive effects:

[0052] 1) Automatically learn attack behavior patterns and characteristics without introducing expert knowledge, and identify attack activities, including new types of attacks;

[0053] 2) Without compromising the semantic context, node similarity can be used to effectively reduce the number of logs and improve the speed of analysis and investigation;

[0054] 3) While balancing attack and non-attack samples, the model retains the behavioral pattern characteristics of attack samples and the topological diversity of non-attack samples, effectively improving the generalization performance of the model. Attached Figure Description

[0055] Figure 1 This is a flowchart illustrating the system log attack investigation method based on graph convolutional neural networks provided in this invention.

[0056] Figure 2 This is a schematic diagram of the origin subgraph generation provided by the present invention;

[0057] Figure 3 This is a schematic diagram of the optimization of the origin subgraph provided by the present invention;

[0058] Figure 4 This is a structural block diagram of the system log attack investigation system based on graph convolutional neural networks provided in this invention. Detailed Implementation

[0059] To ensure a clear and explicit description of the technical solutions of this invention, enabling those skilled in the art to understand them, and to make the objectives, technical methods, and advantages of this invention more apparent, the technical solutions proposed by this invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, embodiments of this invention, and are used merely to explain the invention and are not intended to limit it. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0060] This invention provides a method for investigating system log attacks based on graph convolutional neural networks, such as... Figure 1 As shown, it includes the following steps:

[0061] Step S1: Obtain system logs on the terminal side;

[0062] Step S2: Perform causal analysis on the system logs and generate an origin graph based on the time sequence and system call relationships of the system log nodes;

[0063] Step S3: Train the vector representation of the system log node based on the contextual semantics and topological features of the origin graph;

[0064] Step S4: Based on the given candidate system log nodes, perform forward and backward searches in the origin graph to generate an origin subgraph of the candidate system log nodes;

[0065] Step S5: Based on the vector similarity and edit distance between the system log nodes contained in the origin subgraph, prune redundant nodes in the origin subgraph;

[0066] Step S6: Calculate the vector similarity between the graph kernel algorithm and the system log nodes to balance the dataset;

[0067] Step S7: Train the type and direction matrix vector representation of the system call relationship of the origin subgraph based on the attention mechanism;

[0068] Step S8: Based on the graph convolutional neural network, fully learn the attack behavior pattern characteristics of the origin subgraph and identify potential attack nodes.

[0069] In step S1, system logs are collected using terminal-side system log collection tools such as Auditd and ETW. The acquired log data can reconstruct the system events that occurred in chronological order, represented as a triple of <head node, system call, tail node>. Both the head node and tail node are system log nodes, as shown in Table 1. The collection process needs to record system log node types such as processes, files, and sockets, and also collect the unique tags of the system log nodes, such as absolute paths, IP addresses, and port numbers. System calls are actions initiated by the head node and executed at the tail node, such as read and write operations. In addition, the start and end times of system events also need to be recorded.

[0070] Table 1 System Log Node Information

[0071]

[0072] In step S2, causal analysis is performed on the acquired system logs. Based on the data flow and control flow relationships between system log nodes, they are connected in chronological order to generate an origin graph G = (E, V, T), where E represents the set of system call relationships, V is the set of system log nodes, and T is the set of timestamps for a series of events.

[0073] Furthermore, operating systems often improve execution efficiency by distributing commands, which can lead to many redundant events. For example, to speed up read and write operations, multiple system calls may exist in parallel. These parallel call relationships are equivalent, so during the generation of the origin graph, duplicate and redundant call relationships between system log nodes are removed, and only the earliest system calls are retained.

[0074] In step S3, fully learning the contextual dependency information of a given system log node is beneficial for downstream attack investigation tasks. struc2vec can capture the topological characteristics of a network, allowing two similar nodes to be independent of their node labels or locations, considering only local structural features (i.e., the contextual dependency information of system entities). Therefore, this embodiment uses struc2vec to learn the contextual semantics and topological features of nodes in the system log set to train the vector representation of the system log nodes.

[0075] In step S4, given an arbitrary system log node, an origin subgraph is generated based on forward and backward searches of the origin graph. To mitigate the dependency explosion problem, this embodiment employs a heuristic method to constrain dependency paths. Due to the limitation of attack cost, attackers need to achieve their goals in a very small number of attack steps. Moreover, the fewer the attack steps, the less likely it is to trigger system alerts. Therefore, the search depth is limited to l during the construction of the origin subgraph.

[0076] Figure 2describes that Firefox receives network data stream from the malicious server IP_1, and then writes the malicious payload file profile. Note that at this time, the system call time t1<t2, and the direction of the edge represents the information flow or control flow between system nodes. Taking the profile file node as an example, both the forward and backward search depths are 2. In the figure, recv represents receiving a network data stream, write represents a write operation, exec represents an execution operation, read represents a read operation, send represents sending a network data stream, and connect represents a network connection.

[0077] In step S5, in order to alleviate the problem of high fan-out or high fan-in that occurs when system log nodes such as Firefox and Nginx perform breadth-first search, the embodiments of the present invention prune similar redundant neighbor nodes in the provenance subgraph. Specifically, in step S3, the trained vector representation of the system log node introduces its spatial topology, so the similarity of nodes can be determined through the vector representation and the label (for example, the absolute file path). The embodiments of the present invention use cosine similarity to measure the similarity of vectors between system log nodes, and use edit distance to obtain the similarity between node labels, and then merge neighbor nodes that meet the above conditions (retaining the event call with the earliest timestamp). As shown in Figure 3 , the neighbor nodes f1-f3 of the program p1 have similar embedding representations (that is, the same ancestor and descendant nodes and in-out edges) and similar label names (for example, many file names starting with .bash_history*). Therefore, they are merged into f 123 , and the system call that occurs earliest is retained.

[0078] Since the attack nodes in the system log are only a tiny minority, the number of attack and non-attack provenance subgraphs is significantly unbalanced. Therefore, in step S6, the following strategies are adopted to alleviate this problem:

[0079] 1) Perform undersampling on the provenance subgraphs generated by non-attack system log nodes: the undersampling of non-attack samples needs to maintain the topological diversity of the provenance subgraphs of non-attack nodes in the entire dataset. Here, the Weisfeiler-Lehman (WL) graph kernel algorithm is adopted, which provides an efficient way to compare subtree graphs for graph isomorphism testing and is widely used in graph similarity measurement. Therefore, based on the graph kernel algorithm, the similarity between the provenance subgraphs generated by non-attack system log nodes is measured, and similar non-attack provenance subgraphs are deleted;

[0080] 2) Oversampling the origin subgraph generated by the attack system log nodes: Oversampling the origin subgraph generated by the attack nodes cannot change the attack behavior pattern characteristics in the origin subgraph. Therefore, based on cosine similarity, non-attack nodes in the origin subgraph of the attack nodes are randomly mutated into other benign nodes with similar vector representations.

[0081] In step S7, after obtaining the origin subgraph of a given node, it is transformed into an adjacency matrix A = (a i,j ) n×n Where n represents the number of nodes in the origin subgraph, a i,j It is the element in the i-th row and j-th column of matrix A, representing node v. i and node v j Does a system call relationship exist between them? The adjacency matrix A represents the connectivity between nodes, such as node v i and node v j If there is a connection, then a i,j If the value is 1, then it is 0 otherwise. Furthermore, the type and direction of the system call are crucial for inferring attack investigations. Therefore, this embodiment of the invention introduces the type and direction characteristics of the edge (i.e., the type and direction matrix), denoted as K = (k i,j ) n×n Specifically, if two system log nodes have two or more system call relationship types in the same direction, they can be connected with "_" to form a new system call relationship type, indicating the direction of the system call. For example, chmod_write_out or chmpd_write_in, where out or in indicates the direction.

[0082] In step S8, the system log nodes are sorted according to the chronological order of their events, and a sequence vector X = {x1, x2, x3, ..., x...} is formed based on the node vector representation trained in step S3. n The BiLSTM neural network encodes the input sequence X, learns the temporal features between system log nodes in the origin subgraph, and outputs a hidden layer vector H as the feature vector representation of the origin subgraph, where h... i This represents the hidden layer vector of the i-th node.

[0083] Furthermore, in the origin subgraph, different system call types have varying degrees of importance for attack investigations. Figure 2 Taking the malicious payload profile as an example, its forward write edge and backward execution edge contribute more significantly to the attack investigation. Therefore, based on the type and direction matrix K generated in step S6, the direction and type features are relearned based on the attention mechanism to assign different importance weights to different system call types. The attention weight matrix is ​​represented as B = (β... i,j )n×n ,β i,j The formula representing the association weight between two nodes is shown below:

[0084]

[0085] Among them, g i,j It is an intermediate vector, which has learned the hidden layer vector h. j The temporal characteristics further introduce the type and direction matrix k. i,j Word embedding representation r i,j .

[0086] g i,j =(h i ⊕r i,j )·(h j ⊕r i,j (2)

[0087] Generally, the convolutional neural network of layer l uses weight adjustment β. i,j Hidden layer vectors Furthermore, type and direction features r were introduced. i,j .

[0088]

[0089]

[0090] Where W, W T Both b and are trainable parameters.

[0091] Finally, the model uses the binary cross-entropy loss function to evaluate candidate nodes v. i Classify them.

[0092] Loss(θ) = -∑logP(type(v) i )|[H,MaxPooling(h i )];θ) (5)

[0093] Where θ is the parameter set, [H,MaxPooling(h i )] is the concatenation of the time series representation H with the max-pooled representation of the i-th candidate node, with a base of e in logarithm.

[0094] This invention also provides a system log attack investigation system based on graph convolutional neural networks, such as... Figure 4 As shown, it includes:

[0095] Terminal-side system log acquisition module 41 is used to acquire terminal-side system log data;

[0096] Origin graph generation module 42 is used to perform causal analysis on system logs and generate an origin graph based on the time sequence and system call relationships of system log nodes.

[0097] The node vector representation module 43 is used to train the vector representation of the system log nodes based on the contextual semantics and topological features of the origin graph;

[0098] The origin subgraph extraction module 44 is used to perform forward and backward searches in the origin graph based on the given candidate system log nodes to generate the origin subgraph of the candidate system log nodes.

[0099] Subgraph optimization module 45 is used to prune redundant nodes in the origin subgraph based on the vector similarity and edit distance between the system log nodes contained in the origin subgraph.

[0100] The sample sampling module 46 is used to calculate the vector similarity between the graph kernel algorithm and the system log nodes to balance the dataset;

[0101] Type and direction matrix vector training module 47 is used to train the type and direction matrix vector representation of the system call relationship of the origin subgraph based on the attention mechanism;

[0102] The attack investigation module 48 is used to identify potential attack nodes by fully learning the attack behavior pattern features of the origin subgraph based on the graph convolutional neural network.

[0103] To demonstrate in more detail the system log attack investigation method and system based on graph convolutional neural networks proposed in this invention, the effectiveness and advancement of this invention are evaluated using the DARPA TC attack case dataset. The specific details are as follows:

[0104] 1) Experimental Dataset

[0105] Due to the cost of attacks, attack samples constitute a very small percentage of the entire system log dataset, possibly less than 0.001%. Therefore, this embodiment of the invention employs a conservative approach to select candidate system log nodes—setting the number of occurrences to exceed 0.01% of all events to select candidate system log nodes. Generally, candidate nodes include all attack nodes. Note that even when selecting 0.01% of system event occurrences, a large number of non-attack nodes still exist. Table 2 shows the statistics of the dataset. The first column represents different attack cases, where C, T, CS, and F represent the dataset names Cadets, Theia, ClearScope, and Fivedirections, respectively. "Origin Graph (#V)" indicates the number of nodes in the origin graph of each attack case generated after performing causal analysis. "Candidate Nodes (Unsampled)" is the number of attack nodes and non-attack nodes in each attack case dataset. "Candidate Nodes (Sampled)" lists the number of sampled attack and non-attack candidate nodes, which subsequently generate origin subgraphs with at least two system call relationships. It can be seen that after replacing similar benign nodes, the number of attack origin subgraphs increases, while after filtering out non-attack origin subgraphs with structural similarity, the number of non-attack samples decreases.

[0106] Table 2 Statistical information of the experimental dataset

[0107]

[0108] 2) Experimental setup

[0109] The experiments used the NetworkX tool to represent the generated origin graph. The vector representation of system log nodes was set to 128 dimensions. The model was optimized using Adam. The batch and epoch were set to 32 and 100, respectively, with a learning rate of 0.001 and a dropout of 0.1. The graph convolutional neural network model was set to two layers. The dataset was split into training and test sets in a 7:3 ratio. Note that oversampling and undersampling only applied to the training set. The experiments were evaluated using precision, recall, and F1 score.

[0110] 3) Experimental Analysis

[0111] The experimental results of the attack investigation are shown in Table 3. The model performed much better after sampling, with an F1 score of 95.48%. "Non-samp." indicates the results without oversampling or undersampling of the training set, resulting in a lower F1 score (94.84%). Error analysis revealed that the model trained without an oversampled training set incorrectly classified three attack nodes as normal nodes. In contrast, the model using the sampled training set had one less false negative. This demonstrates that oversampling can effectively prevent the model from favoring benign nodes. Furthermore, this embodiment of the invention was compared with existing technologies, including GCN which only focuses on graph node connectivity and Convolutional Neural Networks (CNNs) which focus on temporal features. Experiments verified that these two methods cannot effectively combine the structural features of audit logs with the temporal features of system calls. Further, the AUC (Area Under Curve) of the model in this embodiment of the invention is 99.6%, while the other two technologies are 97.2% and 94%, respectively.

[0112] Table 3 Experimental Results

[0113]

[0114] This invention analyzes the effectiveness of each module by replacing other solutions. First, it compares two different embedding methods, Node2Vec and DeepWalk. These two graph node embedding methods cannot capture the structural characteristics of non-adjacent nodes, and therefore their performance is slightly lower than struc2vec (see Table 3). Furthermore, the model's performance decreases when the BiLSTM module or the Type & Direction module is removed. This demonstrates the importance of BiLSTM in learning the temporal features between nodes and the necessity of introducing the type and direction of node relationships.

[0115] In summary, the system log attack investigation method and system based on graph convolutional neural networks provided by this invention first obtains system log data from the system terminal and establishes a system log origin graph; then, without destroying the contextual semantics, it effectively reduces the number of logs by utilizing node similarity, thereby improving the speed of analysis and investigation; when preparing the experimental dataset, it balances attack and non-attack sample data while preserving the behavioral pattern characteristics of attack samples and the topological diversity of non-attack samples, effectively preventing model overfitting; finally, without introducing expert knowledge, it introduces a graph convolutional neural network to automatically learn the attack behavior pattern characteristics contained in the origin subgraph generated by a given system attack node, effectively identifying attack activities, including novel attacks.

[0116] The embodiments described above are merely illustrative of the technical solutions of the present invention, and while the descriptions are detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention.

Claims

1. A method for investigating system log attacks based on graph convolutional neural networks, characterized in that, Includes the following steps: 1) Obtain system logs on the terminal side; 2) Perform causal analysis on the system logs and generate an origin graph based on the time sequence and system call relationships of the system log nodes; 3) Train vector representations of system log nodes based on the contextual semantics and topological features of the origin graph; 4) Based on the given candidate system log nodes, perform forward and backward searches in the origin graph to generate an origin subgraph of the candidate system log nodes; 5) Based on the vector similarity and edit distance between the system log nodes contained in the origin subgraph, prune redundant nodes in the origin subgraph; 6) Calculate the vector similarity between the graph kernel algorithm and system log nodes to balance the dataset; 7) Train the type and direction matrix of system call relationships in the origin subgraph based on the attention mechanism, and obtain the vector representation of the type and direction matrix. This includes the following steps: After considering the origin subgraph of a given candidate system log node, transform it into an adjacency matrix. ， in This represents the number of nodes in the origin subgraph. If the system log node... and nodes If there is a system call relationship, then The value is 1 if the system call relationship is true and 0 otherwise; the adjacency matrix is ​​reconstructed by introducing the type and direction characteristics of system call relationships. Type and direction matrix Specifically, if two system log nodes have two or more system call relationship types in the same direction, they are connected to form a new system call relationship type, and the direction of the system call is indicated. 8) Identify potential attack nodes by learning attack behavior patterns from the origin subgraph using graph convolutional neural networks, including the following steps: learning the temporal relationships between system log nodes in the origin subgraph using BiLSTM neural networks, and outputting hidden layer vectors. As the feature vector representation of the origin subgraph; training type and orientation matrices based on attention mechanism. and will Represented as system call relationship type and direction matrix vector , It is the attention weight matrix; it combines the trained system call relationship type with the direction matrix vector. With hidden layer vectors The input is fed into a graph convolutional neural network model to learn the attack behavior pattern features of the originating subgraph, and a binary cross-entropy loss function is used to identify potential attack nodes.

2. The method as described in claim 1, characterized in that, The terminal-side system logs obtained in step 1) include system events and their occurrence times. System events consist of a system log header node, a system log tail node, and system call relationships, represented as a triple <header node, system call, tail node>. The system log header node and tail node include system log node types for processes, files, and sockets, and each system log node has its unique system log node label. System call relationships include read, write, and execute types.

3. The method as described in claim 1, characterized in that, Step 2) involves performing causal analysis on the system logs, generating an origin graph based on the time sequence and system call relationships of the system log nodes. This includes the following steps: 1) Based on the data flow and control flow relationships between system log nodes, generate an origin graph in chronological order. This origin graph is generated by... To normalize the representation, where Represents a set of system call relationships. It is a collection of system log nodes. It is a collection of timestamps for a series of events; 2) Delete duplicate and redundant system call relationships between system log nodes, and only retain the system call relationship that occurred earliest.

4. The method as described in claim 1, characterized in that, In step 3), the contextual semantics and topological features of the origin graph are captured based on the graph embedding algorithm struc2vec, and the vector representation of the system log node is calculated.

5. The method as described in claim 1, characterized in that, Step 4) involves performing forward and backward searches in the origin graph, including searching based on forward and backward system call relationships and limiting the depth of path searches.

6. The method as described in claim 1, characterized in that, Step 5) involves pruning redundant nodes in the origin subgraph based on the vector similarity and edit distance between the system log nodes contained in the origin subgraph. This includes the following steps: The similarity between system log node labels is measured based on edit distance, and the similarity between vector representations of system log nodes is measured based on cosine similarity. Redundant nodes are pruned when system log node types are the same.

7. The method as described in claim 1, characterized in that, Step 6) involves calculating the vector similarity between the graph kernel algorithm and the system log nodes to balance the dataset, including the following steps: 1) Undersample the origin subgraphs generated by non-attack system log nodes: Based on the graph kernel algorithm, measure the similarity between origin subgraphs generated by non-attack system log nodes, delete similar non-attack origin subgraphs, and preserve the topological diversity of non-attack origin subgraphs; 2) Oversampling of the origin subgraph generated by the attack system log nodes: Based on cosine similarity, benign system log nodes in the origin subgraph generated by the attack system log nodes are randomly mutated, preserving the attack behavior pattern characteristics of the origin subgraph generated by the attack system log nodes.

8. A system log attack investigation system based on graph convolutional neural networks, used to implement the method described in any one of claims 1-7, characterized in that, include: The terminal-side system log acquisition module is used to acquire terminal-side system log data; The origin graph generation module is used to perform causal analysis on system logs and generate an origin graph based on the time sequence and system call relationships of system log nodes. The node vector representation module is used to train the vector representation of system log nodes based on the contextual semantics and topological features of the origin graph; The origin subgraph extraction module is used to perform forward and backward searches in the origin graph based on given candidate system log nodes, and generate the origin subgraph of the candidate system log nodes. The subgraph optimization module is used to prune redundant nodes in the origin subgraph based on the vector similarity and edit distance between the system log nodes contained in the origin subgraph. The sample sampling module is used to balance the dataset by calculating the vector similarity between the graph kernel algorithm and the system log nodes. The type and direction matrix vector training module is used to train the type and direction matrix vector representation of the system call relationship of the origin subgraph based on the attention mechanism. The attack investigation module is used to learn the attack behavior pattern features of the origin subgraph based on graph convolutional neural networks and identify potential attack nodes.

Images