A method for identifying APT attack behaviors based on overlapping community discovery

Abstract

The present invention belongs to the technical field of network security, and specifically relates to a method for identifying APT attack behaviors based on overlapping community discovery. The present invention includes collecting log data and constructing an origin graph, denoising and compressing the origin graph; obtaining a seed node set through feature initialization, feature learning and seed node detection; calculating weights for each edge and each node in the origin graph, and reconstructing the origin graph into a weighted heterogeneous graph; detecting overlapping communities based on the seed node set and the weighted heterogeneous graph to obtain the natural community of each seed node, and obtaining multiple subgraphs of the origin graph at the same time; inputting the subgraph features of the subgraph to be detected into a trained classifier, and if the subgraph features of the subgraph to be detected are greatly offset from the benign subgraph features, malicious behaviors exist in the subgraph to be detected. The present invention performs overlapping community detection after denoising the origin graph to divide the attack community and identify the attack behaviors.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a method for identifying APT attack behaviors based on overlapping community discovery. Background Art

[0002] APT attacks (Advanced Persistent Threat) refer to persistent and effective attacks launched by certain organizations against specific targets. Such attacks are highly concealed and targeted, and usually use various infected media, supply chains, social engineering and other means to implement advanced, persistent and effective threats and attacks.

[0003] APT attacks are considered a highly dangerous network security threat because they have a long latency period and are difficult to detect by existing security defense systems. They are also difficult to trace even after the attack. APT attacks have become the main security threat faced by all types of networks, so various APT detection methods have emerged one after another. Currently, a very popular approach is to collect host logs and build a provenance graph to reflect the interaction between entities in the system. Logs build a provenance graph through <subject, operation, object> triples. The data structure type of ordinary graphs can only consider the behavior of neighboring points but cannot consider the correlation of distant points.

[0004] Community detection is also often used to aggregate and classify attack behaviors. It relies on the influence of nodes on neighboring nodes and aggregates communities through modularity optimization. However, such unsupervised methods are prone to cause the correlation and coupling between normal behaviors and attack behaviors. Aggregated communities are prone to aggregate a large number of benign behaviors and cause dependency explosion problems, making attack behaviors in attack communities unclear and increasing false positives. Summary of the invention

[0005] The purpose of the present invention is to solve the problems of the prior art and propose an APT attack behavior identification method based on overlapping community discovery, which uses the collected logs to build an origin graph, compresses the origin graph and then performs overlapping community detection to divide the attack community and identify the attack behavior.

[0006] In order to achieve the above object, the technical solution provided by the present invention is:

[0007] A method for identifying APT attack behaviors based on overlapping community discovery, including:

[0008] Collect log data and build a provenance graph, and compress the provenance graph;

[0009] The seed node set is obtained through feature initialization, feature learning and seed node detection;

[0010] Calculate the weight for each edge and each node in the origin graph, and reconstruct the origin graph into a weighted heterogeneous graph;

[0011] Based on the seed node set and the weighted heterogeneous graph, the overlapping communities are detected to obtain the natural community of each seed node, and the origin graph is divided into multiple subgraphs based on the natural community.

[0012] The subgraph is characterized to obtain subgraph features, and a classifier is trained using benign subgraph features. The subgraph features of the subgraph to be detected are input into the trained classifier. If there is an offset between the output of the classifier for the subgraph features of the subgraph to be detected and the benign subgraph features, the subgraph features of the subgraph to be detected are malicious, that is, there is malicious behavior in the subgraph to be detected. Otherwise, the subgraph features of the subgraph to be detected are benign, and there is no malicious behavior in the subgraph to be detected.

[0013] Furthermore, compressing the provenance graph includes:

[0014] The provenance graph is composed of multiple triples, wherein the triple (subject, operator, object) represents an event, wherein subject represents the subject node that initiates the operation, object represents the object node that is operated, and operator represents the operation behavior, i.e., edge;

[0015] Delete irrelevant edges according to preset rules;

[0016] When a subject node visits the same object node multiple times to perform repeated operations, the edges representing the operations are merged, and the type and number of operations are stored as the weight of the edge;

[0017] When a subject node performs multiple reads and writes to an object node under a path, the object nodes under the path are merged into an abstract node.

[0018] Furthermore, the seed node set is obtained through feature initialization, feature learning and seed node detection, including:

[0019] The feature initialization includes:

[0020] According to the types of nodes and edges of the provenance graph, the types of nodes include processes, files, registries, and sockets, creating an initial feature matrix for each node;

[0021] The feature learning includes:

[0022] Construct a graph neural network, which is expressed by the following formula:

[0023] ;

[0024] in, Indicates The node feature matrix of the layer, t ∈ [1,T] , Represents the total number of GNN layers, represents a graph neural network, G is the topological structure of the origin graph, is the initial parameter matrix to be trained, For the The parameter matrix to be trained for the layer, is the initial feature matrix, For the The node feature matrix of the layer;

[0025] The first The node feature matrix of the layer is input to In the classifier, node type classification is performed according to the following formula:

[0026] ;

[0027] in, is the probability distribution of node types, For the classifier The parameter matrix of the layer, is the final node feature matrix;

[0028] Use the gradient descent method to train the graph neural network, and input the initial feature matrix of each node into the trained graph neural network to obtain the final feature matrix;

[0029] The seed node detection includes:

[0030] According to the final feature matrix of each node, an outlier mining algorithm is used to detect outliers of all process nodes in the provenance graph, and nodes with outliers greater than a preset threshold are taken as seed nodes to obtain a seed node set.

[0031] Furthermore, the step of calculating a weight for each edge and each node in the origin graph and reconstructing the origin graph into a weighted heterogeneous graph includes:

[0032] Calculate the weight of each node in the origin graph according to the initial feature matrix of each node to obtain a node weight set;

[0033] Calculate the weight of each edge in the origin graph according to the preset rules to obtain an edge weight set;

[0034] According to the node weight set and edge weight set, weight attributes are added to each node and each edge in the origin graph to form a weighted heterogeneous graph.

[0035] Furthermore, the detection of overlapping communities based on the seed node set and the weighted heterogeneous graph to obtain the natural community of each seed node includes:

[0036] Randomly select a seed node from the seed node set;

[0037] Detect the natural community of the selected seed nodes and delete the selected seed nodes from the seed node set;

[0038] Repeat the process of selecting, testing, and deleting seed nodes until the seed node set is empty.

[0039] Furthermore, the detecting of the natural community of the selected seed nodes includes:

[0040] Take the selected seed node as a community, set the internal fitness and external fitness of the community to 0, and extract the neighbor node set of the community;

[0041] Select any neighbor node from the neighbor node set to join the community, and calculate the current internal fitness and external fitness of the community;

[0042] The community quality of the community is calculated based on the current internal fitness and external fitness of the community. If the value of the community quality increases, the neighbor node is retained in the community and removed from the neighbor node set. Otherwise, the neighbor node is deleted from the community and removed from the neighbor node set.

[0043] When the neighbor node set is not empty, repeatedly select a neighbor node and operate the current neighbor node, and calculate the community quality. When the neighbor node set is empty, obtain the expanded community and the final community quality of the expanded community.

[0044] When the final community quality is equal to the community quality, the algorithm ends. When the final community quality is not equal to the community quality, the neighbor node set of the expanded community is extracted, and neighbor nodes are repeatedly selected from the neighbor node set, the current neighbor nodes are operated on and the community is expanded until the final community quality is equal to the community quality or the neighbor node set of the expanded community is empty, the algorithm ends.

[0045] After the algorithm ends, the natural community of the selected seed nodes is obtained.

[0046] Furthermore, the calculation formulas for the current internal fitness and external fitness of the community are:

[0047] The internal fitness formula is:

[0048] ;

[0049] in, Indicates joining a neighbor node j Former Community C The internal fitness of Indicates joining a neighbor node j Future Community C The internal fitness of Represents neighbor nodes j In the community C The fitness within is calculated as follows:

[0050] ;

[0051] in, i Representing the community C Internal nodes, Represents a connected node i With neighbor nodes j The weight of the edge between Represents neighbor nodes j The weight of

[0052] The external fitness formula is:

[0053] ;

[0054] in, Indicates joining a neighbor node j Former Community C The external fitness of Indicates joining a neighbor node j Future Community C The external fitness of Represents neighbor nodes j In the community C The fitness within Represents neighbor nodes j Not in the community C The fitness within is calculated as follows:

[0055] ;

[0056] in, u Representing the community C External nodes, Represents a connected node u With neighbor nodes j The weight of the edge between Representation Node u The weight of .

[0057] Furthermore, the calculation formula of the community quality is:

[0058] ;

[0059] in, For community quality, Indicates joining a neighbor node j Future Community C The internal fitness of Indicates joining a neighbor node j Future Community C The external adaptability, is a positive real-valued parameter.

[0060] Compared with the prior art, the present invention has the following significant advantages: 1. For the random selection of nodes in LFM (Local Fitness Maximization), nodes are selected by anomaly detection, which reduces the randomness of the community. 2. The community aggregation method is improved, the characteristics of community aggregation are enhanced, and a more obvious community is obtained. 3. The overlapping community method is used to ensure that there may be multiple community attributes for some nodes in the origin graph of APT behavior, thereby increasing the robustness and adaptability of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 This is a flow chart of an APT attack behavior identification method based on overlapping community discovery according to the present invention;

[0062] Figure 2 This is an example diagram of the origin diagram of the present invention;

[0063] Figure 3 This is an example diagram of the origin graph compression of the present invention. DETAILED DESCRIPTION

[0064] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0065] like Figure 1 As shown, a method for identifying APT attack behaviors based on overlapping community discovery includes:

[0066] Step 1. Collect log data and build a provenance graph: Use a published log collection tool (such as the log collection tool in the invention patent with patent number 2022110610516) to collect logs in the system, and build a provenance graph based on the collected logs. The nodes represent process, file or socket entities, and the edges represent the operation relationship between two nodes, such as read, write, download, send, etc. The timestamp is used as the attribute of the edge to indicate the time when the event occurred. The provenance graph is composed of multiple triplets and stored. One of the triples (subject, operator, object) represents an event, where subject represents the main node that initiates the operation, object represents the object node being operated, and operator represents the operation behavior, that is, the edge. The subject and object may overlap. Figure 2 For example, (powershell, launch, unknownprocess) is a triple, where powershell is the subject, launch is the operator, and unknownprocess is the object. This triple means that powershell launched an unknown process. Figure 2 As shown in the figure, chrome, PDFreader, and powershell are all software names, x.pdf refers to a PDF file, unknown Dlls refers to multiple unknown dll files, and unknown remote IP refers to an unknown remote IP address.

[0067] Step 2: compress the provenance graph according to the rules. The specific steps include:

[0068] Step 2-1: Delete irrelevant edges. In the origin graph, there is a lot of information generated by the process. There are some behaviors (irrelevant edges) that can be determined as absolutely safe operations according to preset rules during script execution, such as accessing a non-malicious dll file or a non-malicious folder. Delete such operations.

[0069] Step 2-2, merge repeated edges. A process may access the same file multiple times and perform repeated operations on a file more than once (such as multiple reads or writes). This type of edge is compressed and merged, and the type and number of operations are retained as the weight of the edge, expressed as operation:n, where operation is the operation type and n is the number of read operations. If a process p1 performs two read operations on the same file file1, there will be two edges in the origin graph with the same subject and object except for the timestamp, and the operation is both read. The denoising operation is: merge the two read edges into one, and the weight of the merged edge is expressed as read:2, such as Figure 3 As shown in part a of FIG.

[0070] Step 2-3, abstract the type nodes. The process will frequently read and write files under a certain path, resulting in the existence of multiple edges representing the process's file reading behavior. The nodes containing the same path are abstracted to form the same abstract node, and the node attributes represent the files under the path. If there is a process P1 that reads files F1, F2, and F3 under C:\Windows\System32, and a process P2 reads file F5 under C:\Windows\System32, then there are three read edges from P1 to F1, F2, and F3 respectively, and one edge from P2 to F5 in the provenance graph. The denoising operation is: merge the four edges into one read edge, merge the four file nodes into one Fa node as an abstract node to represent all files under C:\Windows\System32, and change the filepath in the Fa node attribute to the folder path, that is, C:\Windows\System32, such as Figure 3 As shown in part b.

[0071] Step 3: Using the improved LFM algorithm to detect overlapping communities, specifically including: improving the LFM algorithm that can be used to detect overlapping communities so that it can overcome the inherent defects of the LFM algorithm. The improved LFM algorithm is divided into two parts: seed node selection and community expansion. The specific steps include:

[0072] Step 3-1, select seed nodes. The LFM algorithm first selects seed nodes as the initial nodes for community division. The seed nodes of the traditional LFM algorithm are randomly selected, which will directly affect the quality of community division. Therefore, a seed node detection model is designed to quickly discover potential malicious nodes in the origin graph as seed nodes. The model is divided into three parts: feature initialization, feature learning and seed node detection. The specific steps include:

[0073] (1) Feature initialization: Extract the initial value of the feature for each node. The feature of the node should reflect its behavior pattern in the origin graph. Compared with benign nodes, malicious nodes usually have different interaction patterns with neighboring nodes. Therefore, the features of each node are extracted. The specific steps include:

[0074] The nodes in the provenance graph are divided into four types (process, file, registry, and socket). The interactions between different types of nodes can form 21 types of edges, as shown in Table 1:

[0075] Table 1 Types of nodes and edges in the provenance graph

[0076]

[0077] For each node in the provenance graph , creating a 42-dimensional vector e i =[ a 1 , a 2 ,⋯, a 21 , a 22 , a 23 ,⋯, a 42 ] for The initial feature matrix of for No. p The number of edges in the type, for No. The number of edges of the type.

[0078] (2) Feature learning: Use GNN (graph neural network) to aggregate information from the ancestor nodes of each node to learn node features. Use the node type as a supervisory signal and classify the nodes as processes, files, registries, or sockets to train GNN. The training formula is as follows:

[0079] ;

[0080] GNN can be trained through multiple layers. t Layer, update the node feature matrix according to formula 1 ,in, G is the topological structure of the origin graph (usually represented by an adjacency matrix), is the initial parameter matrix to be trained, is the parameter matrix to be trained, t ∈ [1,T] , Represents the total number of GNN layers, is the initial feature matrix, For the The node feature matrix of the layer.

[0081] In the origin diagram G Overlay T GNN layers to learn the final node feature matrix , and then enter it into In the classifier, node type classification is performed according to the following formula:

[0082] ;

[0083] Where P is the probability distribution of node type, For the classifier The parameter matrix of the layer. For the final node feature matrix, use the gradient descent method to train .

[0084] Given the initial feature matrix of each node in the origin graph ,Will Input to the trained encoder The encoder will output the final feature matrix for each node .

[0085] (3) Seed node detection: After obtaining the final feature matrix of each node in the provenance graph, seed node detection is regarded as an outlier mining problem. Specifically, the outlier mining algorithm Isolation forest is used to detect outliers in all process nodes in the provenance graph, and these abnormal outlier nodes are selected as seed nodes, and finally a seed node set is obtained.

[0086] Step 3-2: Construct a weighted heterogeneous graph. Calculate the weights for each edge and each node in the origin graph, and reconstruct the origin graph into a weighted heterogeneous graph. The specific steps are as follows:

[0087] (1) Calculate node weights: Calculate the weights for each node in the origin graph. In the feature initialization step in step 3-1, a 42-dimensional initial feature vector is initialized for each node. The weight corresponding to a node is the sum of the values ​​of all bits of the initial feature vector corresponding to the node. The weights of all nodes are calculated to obtain a node weight set.

[0088] (2) Calculate the edge weight: Assign a 21-dimensional feature vector as shown in Table 2 to each edge. All attributes in this vector are 0 or 1:

[0089] Table 2

[0090]

[0091] For two vertices connected by an edge u and v :

[0092] is 1 if and only if u and v When the time difference between them is less than the threshold t, the user can customize the threshold t.

[0093] is 1 if and only if u and v When there is the same process id.

[0094] is 1 if and only if u and v When the destination IP address is the same when making an outbound connection request.

[0095] is 1 if and only if u and v When the port is the same as when making an outbound connection request.

[0096] arrive 1 if and only if the HTTP log is captured u and v The source or host is the same.

[0097] arrive is 1 if and only if u and v It is a brother process, v yes u The parent process of u yes v When the parent process.

[0098] is 1 if and only if u and v When accessing the same object.

[0099] is 1 if and only if u and v When there are the same process names.

[0100] and is 1 if and only if the model is outbound ( ) / Inbound ( ) When the network request is related to a DNS query.

[0101] arrive It is 1 if and only if the DNS query behavior is related to the web browsing behavior, such as when the request domain name is equal to the host domain name, the source domain name is equal to the domain name, and the resource address is equal to the domain name.

[0102] The weight of each edge is calculated according to the above rules, that is, all values ​​in the feature vector are added as weights to obtain an edge weight set.

[0103] (3) Constructing a weighted heterogeneous graph: After obtaining the node weight set and edge weight set, the origin graph is reconstructed by adding weight attributes to each node and each edge to form the corresponding weighted heterogeneous graph.

[0104] Step 3-3, community expansion: Based on the weighted heterogeneous graph obtained in step 3-2, the improved LFM algorithm is used to detect overlapping communities. The specific steps are as follows:

[0105] 1. Randomly select seed node a from the seed node set obtained in step 3-1.

[0106] 2. Detect the natural community of seed node a (see below for the specific algorithm) and remove a from the seed node set.

[0107] 3. Repeat steps 1 and 2. When the seed node set is empty, the algorithm stops.

[0108] If a seed node a is selected as a community C , at this time the community C Internal fitness External fitness All are 0, extract community C The steps to detect the natural community of seed node a are as follows:

[0109] A. In the community C Select any neighbor node from the neighbor node set j (excluding communities C Nodes in the community) C and calculate the community at this time C Internal fitness and external fitness , the internal fitness formula is:

[0110] ;

[0111] in, Indicates joining a neighbor node j Former Community CThe internal fitness of is 0; Indicates joining a neighbor node j Future Community C Internal fitness; Represents neighbor nodes j In the community C The fitness within is calculated as follows:

[0112] ;

[0113] in, i Representing the community C Internal nodes, Represents a connected node i With neighbor nodes j The weight of the edge between Represents neighbor nodes j The formula represents the weight of all neighboring nodes in the community. j The weight of the connected edges and the neighbor nodes j The sum of the products of the weights.

[0114] The external fitness formula is:

[0115] ;

[0116] in, Indicates joining a neighbor node j Former Community C The external fitness of is 0; Indicates joining a neighbor node j Future Community C External adaptability; Represents neighbor nodes j In the community C The fitness within Represents neighbor nodes j Not in the community C The fitness within is calculated as follows:

[0117] ;

[0118] in, u Representing the community C External nodes, Represents a connected node u With neighbor nodes j The weight of the edge between Representation Node u The formula represents the weight of all neighboring nodes outside the community. jThe sum of the products of the weights of the connected points and the corresponding edge weights.

[0119] B. Use Evaluate the quality of the community. As the value of increases, the neighbor nodes j Stay in the community C and will j From the community C The neighbor nodes of j From the community C Delete and remove j from the community C The neighbor nodes of are removed centrally. The calculation formula is as follows:

[0120] ;

[0121] in, For community quality, is a positive real-valued parameter representing the community resolution, where Take 1.

[0122] C. If the community C When the neighbor node set of is not empty, repeat steps ① and ②. Otherwise, get the C Expand the community its neighbors get and the community Final community quality .

[0123] D. If the community Final community quality With the community C The communities are of equal quality, that is, no community C Neighbor nodes are added to the community C Otherwise, the community As a community C , re-extract the community C The set of neighbor nodes of the community If the neighbor node set of is empty, the algorithm ends.

[0124] After the above algorithm is completed, an expanded community is obtained G C , called the natural community of seed node a.

[0125] Step 4: After performing community detection using the above steps, each natural community forms a subgraph, and the original origin graph will be divided into subgraphs based on the natural community. . Use the GAT (Graph Attention Network) algorithm to characterize these subgraphs and obtain the subgraph feature set , where each element corresponds to a subgraph after community detection. Then, a classifier is trained using the benign subgraph features. If the result obtained by inputting a subgraph feature into the classifier deviates from the result obtained by the benign subgraph feature through the classifier, the subgraph feature is considered to be malicious, that is, there is malicious behavior in the subgraph, so as to identify APT attack behavior.

[0126] The above-mentioned embodiments only express several implementation methods of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A method for identifying APT attack behaviors based on overlapping community discovery, characterized in that: The APT attack behavior identification method based on overlapping community discovery includes: Collect log data and build a provenance graph, and compress the provenance graph; The seed node set is obtained through feature initialization, feature learning and seed node detection; Calculate the weight for each edge and each node in the origin graph, and reconstruct the origin graph into a weighted heterogeneous graph; Based on the seed node set and the weighted heterogeneous graph, the overlapping communities are detected to obtain the natural community of each seed node, and the origin graph is divided into multiple subgraphs based on the natural community. Characterize the subgraph to obtain subgraph features, use the benign subgraph features to train a classifier, input the subgraph features of the subgraph to be detected into the trained classifier, if the output of the classifier for the subgraph features of the subgraph to be detected and the benign subgraph features is offset, then the subgraph features of the subgraph to be detected are malicious, that is, there is malicious behavior in the subgraph to be detected, otherwise, the subgraph features of the subgraph to be detected are benign, and there is no malicious behavior in the subgraph to be detected; in, The seed node set is obtained through feature initialization, feature learning and seed node detection, including: The feature initialization includes: According to the types of nodes and edges of the provenance graph, the types of nodes include processes, files, registries, and sockets, creating an initial feature matrix for each node; The feature learning includes: Construct a graph neural network, which is expressed by the following formula: ； in, Indicates The node feature matrix of the layer, , Represents the total number of GNN layers, represents a graph neural network, G is the topological structure of the origin graph, is the initial parameter matrix to be trained, For the The parameter matrix to be trained for the layer, is the initial feature matrix, For the The node feature matrix of the layer; The first The node feature matrix of the layer is input to In the classifier, node type classification is performed according to the following formula: ； in, is the probability distribution of node types, For the classifier The parameter matrix of the layer, is the final node feature matrix; Use the gradient descent method to train the graph neural network, and input the initial feature matrix of each node into the trained graph neural network to obtain the final feature matrix; The seed node detection includes: According to the final feature matrix of each node, the outlier mining algorithm is used to detect the outliers of all process nodes in the provenance graph, and the nodes with outliers greater than a preset threshold are taken as seed nodes to obtain a seed node set; in, The detection of overlapping communities based on the seed node set and the weighted heterogeneous graph obtains the natural community of each seed node, including: Randomly select a seed node from the seed node set; Detect the natural community of the selected seed nodes and delete the selected seed nodes from the seed node set; Repeatedly select, detect and delete seed nodes until the seed node set is empty; in, The detecting of the natural community of the selected seed nodes includes: Take the selected seed node as a community, set the internal fitness and external fitness of the community to 0, and extract the neighbor node set of the community; Select any neighbor node from the neighbor node set to join the community, and calculate the current internal fitness and external fitness of the community; The community quality of the community is calculated based on the current internal fitness and external fitness of the community. If the value of the community quality increases, the neighbor node is retained in the community and removed from the neighbor node set. Otherwise, the neighbor node is deleted from the community and removed from the neighbor node set. When the neighbor node set is not empty, repeatedly select a neighbor node and operate the current neighbor node, and calculate the community quality. When the neighbor node set is empty, obtain the expanded community and the final community quality of the expanded community. When the final community quality is equal to the community quality, the algorithm ends. When the final community quality is not equal to the community quality, the neighbor node set of the expanded community is extracted, and neighbor nodes are repeatedly selected from the neighbor node set, the current neighbor nodes are operated on and the community is expanded until the final community quality is equal to the community quality or the neighbor node set of the expanded community is empty, the algorithm ends. After the algorithm ends, the natural community of the selected seed nodes is obtained.

2. The APT attack behavior identification method based on overlapping community discovery according to claim 1 is characterized in that: The compressing the origin graph includes: The provenance graph is composed of multiple triples, wherein the triple (subject, operator, object) represents an event, wherein subject represents the subject node that initiates the operation, object represents the object node that is operated, and operator represents the operation behavior, i.e., edge; Delete irrelevant edges according to preset rules; When a subject node visits the same object node multiple times to perform repeated operations, the edges representing the operations are merged, and the type and number of operations are stored as the weight of the edge; When a subject node performs multiple reads and writes to an object node under a path, the object nodes under the path are merged into an abstract node.

3. The APT attack behavior identification method based on overlapping community discovery according to claim 1 is characterized in that: The method calculates a weight for each edge and each node in the origin graph and reconstructs the origin graph into a weighted heterogeneous graph, including: Calculate the weight of each node in the origin graph according to the initial feature matrix of each node to obtain a node weight set; Calculate the weight of each edge in the origin graph according to the preset rules to obtain an edge weight set; According to the node weight set and edge weight set, weight attributes are added to each node and each edge in the origin graph to form a weighted heterogeneous graph.

4. The APT attack behavior identification method based on overlapping community discovery according to claim 1 is characterized in that: The calculation formulas for the current internal fitness and external fitness of the community are: The internal fitness formula is: ； in, Indicates joining a neighbor node j Former Community C The internal fitness of Indicates joining a neighbor node j Future Community C The internal fitness of Represents neighbor nodes j In the community C The fitness within is calculated as follows: ； in, i Representing the community C Internal nodes, Represents a connected node i With neighbor nodes j The weight of the edge between Represents neighbor nodes j The weight of The external fitness formula is: ； in, Indicates joining a neighbor node j Former Community C The external fitness of Indicates joining a neighbor node j Future Community C The external fitness of Represents neighbor nodes j In the community C The fitness within Represents neighbor nodes j Not in the community C The fitness within is calculated as follows: ； in, u Representing the community C External nodes, Represents a connected node u With neighbor nodes j The weight of the edge between Representation Node u The weight of .

5. The APT attack behavior identification method based on overlapping community discovery according to claim 1 is characterized in that: The calculation formula of the community quality is: ； in, For community quality, Indicates joining a neighbor node j Future Community C The internal fitness of Indicates joining a neighbor node j Future Community C The external fitness of is a positive real-valued parameter.

Images