Attack group portrait analysis method, device, equipment and storage medium

Abstract

This application discloses an attack group portrait analysis method, device, equipment, and storage medium, relating to the field of network security, including: performing log fusion based on multiple logs to be processed collected from data sources; after performing vector conversion on the nodes and edge labels in the constructed target heterogeneous attack behavior graph, performing key node enumeration, subgraph construction, and feature extraction based on the obtained vector information to obtain target vector features; learning key node attack behavior patterns based on the Graph SAGE graph neural network and target vector features, and inputting the obtained full-scale node behavior feature vectors into the K-means model for distance clustering to complete training; and in the process of performing portrait analysis on the saved key node behavior subgraph based on the target attack group identification model obtained after training, classifying the attack group behavior patterns using a preset discriminant formula and the target probability matrix of the saved model output results. This improves analysis accuracy.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a method, device, equipment and storage medium for analyzing an attack group portrait. Background Art

[0002] Attack group profiling can help security professionals better understand the behavior patterns, attack methods, targets, and motivations of specific attack groups, helping to develop more effective defense strategies and countermeasures. Currently, many deep learning-based network traffic anomaly detection methods are available.

[0003] However, in real-world application scenarios, the first approach proposes a data flow tagging and tracing system called RTAG (Real-Time Active Gateway). However, due to the system's poor ability to identify attack groups based on the different attack types employed by different groups and its limited ability to interpret attack behavior patterns, the RTAG system is less applicable to alarm log data. Furthermore, the second approach simply uses graph neural networks to construct attack behavior graphs and uses timestamps to filter different attack behavior patterns. This relies heavily on empirical knowledge to define timestamps and fails to comprehensively analyze the overall behavior of attack groups. The third approach constructs attribution graphs and heterogeneous graphs, but this neural network-based approach is highly data-dependent. Furthermore, in real-world scenarios, the quality of log data generated by different security devices varies greatly, which affects the accuracy of the information used to construct attribution graphs or attack heterogeneous graphs, resulting in poor identification of attack groups and incomplete attack patterns within them. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide an attack group profiling analysis method, apparatus, device, and storage medium that can effectively improve the accuracy, comprehensiveness, and interpretability of analysis results, thereby reducing the manpower investment in enterprise security operations. The specific solution is as follows:

[0005] In a first aspect, this application provides a method for analyzing an attack group profile, including:

[0006] Logs are collected based on a preset data source, and log fusion and heterogeneous attack behavior graphs are sequentially performed based on the collected multiple logs to be processed and preset data processing rules to obtain a corresponding target heterogeneous attack behavior graph; wherein the target heterogeneous attack behavior graph is an attack behavior graph arranged in chronological order;

[0007] After performing vector conversion on the nodes and edge labels in the target heterogeneous attack behavior graph, key node enumeration, subgraph construction, and feature extraction are performed based on the obtained vector information and preset key node behavior subgraph vector feature extraction rules to obtain corresponding target vector features; wherein the key nodes are entities in the target heterogeneous attack behavior graph used for training or detection;

[0008] Based on the Graph SAGE graph neural network and the target vector features, key node attack behavior patterns are learned, and the obtained full node behavior feature vectors are input into the K-means model for distance clustering to complete the corresponding model training operation and obtain the target attack group identification model;

[0009] In the process of performing attack group portrait analysis on the saved key node behavior subgraph based on the target attack group identification model, the attack group behavior pattern is classified using the preset discriminant formula and the target probability matrix of the saved model output result to obtain the corresponding attack group portrait analysis result.

[0010] Optionally, the log collection is performed based on a preset data source, and log fusion and heterogeneous attack behavior graph construction are performed in sequence based on the collected multiple logs to be processed and preset data processing rules to obtain a corresponding target heterogeneous attack behavior graph, including:

[0011] Log collection is performed based on network intrusion detection systems, full-flow detection, and network application protection systems, as well as corresponding user behavior logs to obtain a variety of logs to be processed;

[0012] Based on the preset data processing tools and the multiple logs to be processed, data extraction, data conversion and data storage are performed to complete the corresponding log fusion operation and obtain the corresponding fused information;

[0013] A corresponding heterogeneous attack behavior graph is constructed using a preset simulation tool and the fused information to obtain a target heterogeneous attack behavior graph; wherein the target heterogeneous attack behavior graph includes entities as nodes and attack behaviors as edges, and the entities include files, IP addresses, memories, and processes.

[0014] Optionally, the using a preset simulation tool and the fused information to construct a corresponding heterogeneous attack behavior graph to obtain a target heterogeneous attack behavior graph includes:

[0015] In the process of constructing a target heterogeneous attack behavior graph using a preset simulation tool and the fused information, the process name or file name is mapped to the corresponding node ID based on fast hashing technology and directional indexing technology.

[0016] Optionally, the key node enumeration, subgraph construction, and feature extraction are performed based on the obtained vector information and preset key node behavior subgraph vector feature extraction rules to obtain corresponding target vector features, including:

[0017] Enumerate key nodes in the target heterogeneous attack behavior graph based on the obtained vector information, and determine neighbor nodes corresponding to each key node; wherein the neighbor nodes are nodes interconnected with the corresponding key node within 2 hops;

[0018] The target heterogeneous attack behavior graph is divided based on each of the key nodes and the corresponding neighbor nodes to obtain a plurality of corresponding key node behavior subgraphs; wherein the key node behavior subgraphs include corresponding key nodes, corresponding neighbor nodes, and edges between nodes;

[0019] By labeling the key nodes and the neighboring nodes in each key node behavior subgraph, and performing vector conversion and subgraph vector feature aggregation based on the obtained label information, the feature extraction operation is completed and the corresponding target vector feature is obtained.

[0020] Optionally, the Graph SAGE graph neural network and the target vector features are used to learn the attack behavior patterns of key nodes, and the obtained full node behavior feature vectors are input into a K-means model for distance clustering to complete the corresponding model training operation, including:

[0021] In the process of learning attack behavior patterns for the target vector features corresponding to each of the key node behavior subgraphs based on the Graph SAGE graph neural network, node ancestor information of the key nodes from the key node behavior subgraphs is aggregated based on a plurality of pre-configured hidden layers and a forward propagation algorithm in the Graph SAGE graph neural network to complete the corresponding attack behavior pattern learning operation;

[0022] Evaluate the effects of different numbers of clusters based on a preset formula to determine the target number of clusters, and determine the corresponding K-means model based on the target number of clusters;

[0023] The full node behavior feature vectors corresponding to each of the key node behavior subgraphs output by the Graph SAGE graph neural network are obtained, and the full node behavior feature vectors are input into the K-means model for distance clustering to complete the corresponding model training operation and obtain the target attack group identification model.

[0024] Optionally, in the process of performing attack group portrait analysis on the saved key node behavior subgraph based on the target attack group identification model, attack group behavior pattern classification is performed using a preset discriminant formula and a target probability matrix of the saved model output result, including:

[0025] In the process of dynamically performing attack group profiling analysis based on the target attack group identification model in the flow execution mode, the obtained model output results are recorded using a probability matrix to obtain a corresponding target probability matrix; wherein the model output results include attack group behavior pattern identification results corresponding to the key nodes in each of the key node behavior subgraphs that have been saved locally and the corresponding probabilities;

[0026] For each of the key nodes, the preset discriminant formula and the corresponding target probability matrix are used to classify the attack group behavior pattern to obtain the corresponding attack group portrait analysis results.

[0027] Optionally, for each of the key nodes, using a preset discriminant formula and the corresponding target probability matrix to classify the attack group behavior pattern includes:

[0028] For each of the key nodes, using the corresponding target probability matrix to obtain the corresponding maximum probability value and the second maximum probability value;

[0029] Obtaining a corresponding preset threshold, and substituting the maximum probability value, the second maximum probability value, and the preset threshold into the preset discrimination formula to obtain a corresponding discrimination result;

[0030] Based on the discrimination results, the target attack group behavior pattern and the corresponding target pattern category corresponding to each key node are determined to obtain the attack group portrait analysis result.

[0031] In a second aspect, the present application provides an attack group profile analysis device, comprising:

[0032] A behavior graph construction module is used to collect logs based on a preset data source, and to perform log fusion and heterogeneous attack behavior graph construction based on the collected multiple logs to be processed and preset data processing rules, so as to obtain a corresponding target heterogeneous attack behavior graph; wherein the target heterogeneous attack behavior graph is an attack behavior graph arranged in chronological order;

[0033] A feature extraction module is configured to, after performing vector conversion on the nodes and edge labels in the target heterogeneous attack behavior graph, perform key node enumeration, subgraph construction, and feature extraction based on the obtained vector information and preset key node behavior subgraph vector feature extraction rules to obtain corresponding target vector features; wherein the key nodes are entities in the target heterogeneous attack behavior graph used for training or detection;

[0034] A model training module is used to learn key node attack behavior patterns based on the Graph SAGE graph neural network and the target vector features, and input the obtained full node behavior feature vectors into the K-means model for distance clustering to complete the corresponding model training operation and obtain a target attack group identification model;

[0035] The analysis result acquisition module is used to classify the attack group behavior patterns using a preset discriminant formula and a target probability matrix that saves the model output results during the attack group portrait analysis of the saved key node behavior subgraph based on the target attack group identification model, so as to obtain the corresponding attack group portrait analysis results.

[0036] In a third aspect, the present application provides an electronic device, comprising:

[0037] Memory, used to store computer programs;

[0038] A processor is used to execute the computer program to implement the steps of the aforementioned attack group portrait analysis method.

[0039] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, which, when executed by a processor, implements the steps of the aforementioned attack group portrait analysis method.

[0040] It can be seen that in this application, log collection is performed based on a preset data source, and log fusion and heterogeneous attack behavior graph construction are performed in sequence based on the collected multiple logs to be processed and the preset data processing rules to obtain the corresponding target heterogeneous attack behavior graph; wherein, the target heterogeneous attack behavior graph is an attack behavior graph arranged in chronological order; after vector conversion of the nodes and edge labels in the target heterogeneous attack behavior graph, key node enumeration, subgraph construction, and feature extraction are performed based on the obtained vector information and the preset key node behavior subgraph vector feature extraction rules to obtain the corresponding target vector features; wherein, the key node is the entity used for training or detection in the target heterogeneous attack behavior graph; based on Graph The SAGE graph neural network and the target vector features are used to learn attack behavior patterns at key nodes. The resulting full set of node behavior feature vectors are then input into a K-means model for distance clustering to complete the corresponding model training operation and obtain a target attack group identification model. During attack group profiling analysis of the saved key node behavior subgraph based on the target attack group identification model, the attack group behavior patterns are classified using a preset discriminant formula and a target probability matrix containing the model output results to obtain the corresponding attack group profiling analysis results. In other words, in this embodiment, the corresponding heterogeneous attack behavior graph is constructed by collecting and fusing logs from various data sources. Then, the target vector features corresponding to the constructed target heterogeneous attack behavior graph are used to learn attack behavior patterns using a graph neural network and distance clustering to obtain a target attack group identification model. Subsequently, during analysis using the target attack group identification model, the attack group profiling analysis results are determined based on the probability matrix and the preset discriminant formula. This effectively improves the accuracy, comprehensiveness, and interpretability of the analysis results, thereby reducing the manpower investment in enterprise security operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0042] Figure 1 A flowchart of an attack group profiling method provided in this application;

[0043] Figure 2 A flowchart of a specific attack group profiling method provided for this application;

[0044] Figure 3A schematic diagram of a key node subgraph behavior pattern vector representation provided in this application;

[0045] Figure 4 A flowchart of a key node attack behavior pattern learning provided by this application;

[0046] Figure 5 A training flow chart of an attack group identification model provided in this application;

[0047] Figure 6 A schematic diagram of the structure of an attack group portrait analysis device provided in this application;

[0048] Figure 7 This is a structural diagram of an electronic device provided in this application. DETAILED DESCRIPTION

[0049] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0050] In real-world application scenarios, the first method proposes a data stream tagging and tracking system called RTAG. However, due to the poor group recognition capabilities of the RTAG system for different attack types used by different attack groups, and its limited ability to interpret attack behavior patterns, the applicability of the RTAG system to alarm log data is low. In addition, the second method simply uses a graph neural network to construct an attack behavior graph and uses timestamps for judgment to screen different attack behavior patterns. It relies heavily on empirical awareness to define timestamps and cannot fully analyze the overall situation of the attack group's behavior. The third method constructs a traceability graph and a heterogeneous graph, but its neural network-based method is highly dependent on data. In addition, since the quality of log data generated by different security devices in real scenarios is uneven, this will affect the accuracy of the information used to construct the traceability graph or attack heterogeneous graph, resulting in poor attack group identification and incomplete attack patterns in the attack group. To this end, the present application provides an attack group portrait analysis solution that can effectively improve the accuracy, comprehensiveness, and interpretability of the analysis results, thereby reducing the manpower investment in enterprise security operations.

[0051] See also Figure 1 As shown, the embodiment of the present invention discloses a method for analyzing an attack group profile, including:

[0052] Step S11: Log collection is performed based on a preset data source, and log fusion and heterogeneous attack behavior graph construction are performed in sequence based on the collected multiple logs to be processed and preset data processing rules to obtain a corresponding target heterogeneous attack behavior graph; wherein the target heterogeneous attack behavior graph is an attack behavior graph arranged in chronological order.

[0053] Combine Figure 2 As shown, in this embodiment, logs are first collected from multiple data sources and a heterogeneous attack behavior graph is constructed, that is, log collection is performed based on a preset data source, and log fusion and heterogeneous attack behavior graph construction are performed in sequence based on the collected multiple logs to be processed and preset data processing rules to obtain a corresponding target heterogeneous attack behavior graph, including: log collection based on a network intrusion detection system (IDS / IPS, Intrusion Detection System / Intrusion Prevention System, also known as an intrusion detection system / intrusion prevention system), full-flow detection and a network application protection system (Web Application Firewall, i.e., WAF), and corresponding user behavior logs are collected to obtain multiple logs to be processed; data extraction, data conversion and data storage are performed based on a preset data processing tool and the multiple logs to be processed to complete the corresponding log fusion operation and obtain corresponding fused information; a corresponding heterogeneous attack behavior graph is constructed using a preset simulation tool and the fused information to obtain a target heterogeneous attack behavior graph; wherein the target heterogeneous attack behavior graph includes entities as nodes and attack behaviors as edges, and the entities include files, IP (Internet Protocol, Internet Interconnection Protocol), memory and processes. It is understandable that the logs to be processed to be collected in this embodiment include but are not limited to traffic detection logs containing traffic log information, intrusion detection logs containing intrusion information, and user behavior logs containing user behavior information.

[0054] It's important to note that in this embodiment, to achieve data integration based on log fusion, an ETL (Extract, Transform, and Load) tool is used. This tool extracts, transforms, and loads log data from various pre-defined data sources into a unified data warehouse. Furthermore, during the data conversion process, operations such as data format standardization, field mapping, and data cleansing are also required to ensure data consistency and accuracy.

[0055] Afterwards, an external tool, Camflow, is used to construct a chronologically arranged heterogeneous attack behavior graph. In the constructed target heterogeneous attack behavior graph, nodes include system entities such as processes, files, IP addresses, and memory (the system is the attack group profiling analysis system corresponding to this embodiment), while edges include attack actions such as compatible system calls. The edges represent the direction of information flow and the causal relationship between nodes. In order to achieve efficient search on the graph, fast hashing technology and reverse indexing methods can be used to map process / file names to unique node IDs (Identity documents), thereby improving search efficiency and ensuring accuracy. That is, the use of the preset simulation tool and the fused information to construct the corresponding heterogeneous attack behavior graph to obtain the target heterogeneous attack behavior graph includes: in the process of constructing the target heterogeneous attack behavior graph using the preset simulation tool and the fused information, the process name or file name is mapped to the corresponding node ID based on the fast hashing technology and the directional indexing technology.

[0056] Furthermore, when storing the target heterogeneous attack behavior graph in memory, this embodiment maintains it as a key node behavior subgraph. A key node behavior subgraph consists of key nodes, neighbor nodes, and the edges between them. Key nodes are entities in the graph used for training or detection. Nodes that can connect to a key node within two hops are called neighbor nodes, and neighbor nodes contain historical information used for training or detection.

[0057] Step S12: After performing vector conversion on the nodes and edge labels in the target heterogeneous attack behavior graph, key node enumeration, subgraph construction, and feature extraction are performed based on the obtained vector information and the preset key node behavior subgraph vector feature extraction rules to obtain the corresponding target vector features; wherein the key nodes are entities in the target heterogeneous attack behavior graph used for training or detection.

[0058] In this embodiment, traditional attack group profiling tasks typically use alarm log data to train supervised attack group analysis models. This results in the lack of benign user data behavior patterns during the training phase, making it impossible to accurately distinguish between attack group behavior patterns and benign user behavior patterns. To address this issue, this embodiment customizes a method for extracting key node attack behavior pattern features and assigning labels, and uses a supervised training model to learn the local structural information of each node.

[0059] It should be understood that in this embodiment, the node label is set as the node type, and the distribution of the number of different edge types associated with it is extracted as the feature of the node. Then, by using labeled data for supervised training, the Graph SAGE model (Graph SAmple Aggre GatE, a graph neural network model) can learn the different behavior patterns of the nodes. In other words, the Graph SAGE model uses the extracted features to learn the hidden distribution of different nodes. In this way, if a node is misclassified by the trained Graph SAGE model during the execution phase, it means that its underlying distribution is different from the behavior pattern of other nodes learned during the training phase, which means that it may be an abnormal node with an attack behavior pattern different from other nodes.

[0060] Specifically, in this embodiment, regarding feature extraction, the key node enumeration, subgraph construction, and feature extraction are performed based on the obtained vector information and the preset key node behavior subgraph vector feature extraction rules to obtain the corresponding target vector features, including: enumerating the key nodes in the target heterogeneous attack behavior graph based on the obtained vector information, and determining the neighbor nodes corresponding to each key node; wherein the neighbor nodes are nodes interconnected with the corresponding key node within 2 hops; dividing the target heterogeneous attack behavior graph based on each key node and the corresponding neighbor node to obtain corresponding multiple key node behavior subgraphs; wherein the key node behavior subgraph includes corresponding key nodes, corresponding neighbor nodes, and edges between nodes; by labeling the key nodes and the neighbor nodes in each key node behavior subgraph, and performing vector conversion and subgraph vector feature aggregation based on the obtained label information, the feature extraction operation is completed and the corresponding target vector features are obtained. In other words, in order to better perform attack group profiling analysis later, it is necessary to vectorize the node and edge labels in the target heterogeneous attack behavior graph. Since the behavior of a node is usually reflected in the system call operations represented by its related edges, we can extract these features to learn the distribution of behavioral characteristics of different nodes, thereby better understanding the attacker's behavior pattern. Secondly, it is necessary to enumerate the key nodes in the entire target heterogeneous attack behavior graph and label these key nodes and their neighboring nodes (within 2 hops). The key node behavior subgraph formed in this way can be used as a training vector feature to learn the local behavior of each subgraph. The specific details are as follows Figure 3 shown. Figure 3 The label, type, and edge in represent label, type, and edge respectively.

[0061] This allows for more precise identification of attack groups and understanding of their attack strategies, targets, and timing, enabling better prediction and prevention of future attacks. This will help us better understand attacker behavior patterns, thereby improving the accuracy and robustness of the model.

[0062] Step S13: Based on the Graph SAGE neural network and the target vector features, key node attack behavior patterns are learned, and the obtained full node behavior feature vectors are input into the K-means model for distance clustering to complete the corresponding model training operation and obtain the target attack group identification model.

[0063] Combine Figure 2 It can be seen that in this embodiment, after obtaining the features, it is necessary to use the extracted features to use the GraphSAGE graph neural network to learn the key node subgraph behavior patterns, and use the clustering method to characterize the local details of the attack behavior model. That is, the attack behavior pattern of key nodes is learned based on the Graph SAGE graph neural network and the target vector features, and the obtained full node behavior feature vectors are input into the K-means model for distance clustering to complete the corresponding model training operation, including: in the process of learning the attack behavior pattern of the target vector features corresponding to each of the key node behavior subgraphs based on the Graph SAGE graph neural network, the node ancestor information of the key nodes from the key node behavior subgraph is aggregated based on several hidden layers pre-configured in the Graph SAGE graph neural network and the forward propagation algorithm to complete the corresponding attack behavior pattern learning operation; based on a preset formula, the effect of different clustering numbers is evaluated to determine the target cluster number, and the corresponding K-means model is determined according to the target cluster number; the full node behavior feature vectors corresponding to each of the key node behavior subgraphs output by the Graph SAGE graph neural network are obtained, and the full node behavior feature vectors are input into the K-means model for distance clustering to complete the corresponding model training operation and obtain a target attack group identification model. It's important to understand that during the training phase, the entire training graph (i.e., the target heterogeneous attack behavior graph) is divided into multiple key node behavior subgraphs, and each subgraph (i.e., the key node behavior subgraph) is trained sequentially (possibly in chronological order). This has the advantage of only requiring a limited number of subgraphs to be stored in memory, thus ensuring scalability.

[0064] Combine Figure 4As shown, specifically, in each subgraph, a set of random active nodes and related nodes are selected and the edges between them are considered, where the active node sets of each subgraph are disjoint. Then, the information from the node ancestors is aggregated by the forward propagation algorithm. In the Graph SAGE graph neural network, K-1 hidden layers are set, where the first aggregation occurs from the input layer to the hidden layer, and the second aggregation occurs from the hidden layer to the output layer. Through the iterative process, the cross entropy loss between the true value and the predicted value is calculated, and the weight matrix W is adjusted. k , where W k ∈{1,…,K}, where K is the number of hops. In this way, Graph SAGE graph neural network can learn the attack behavior patterns of different categories of nodes and explore their characteristics and local structures.

[0065] It's important to note that the choice of batch size (batch_size) affects runtime overhead, while the number of hops K represents the size of the ancestry from which each node aggregates information. To balance representation capability and runtime overhead, this example sets K to 2, which is why relevant nodes are defined as active nodes that can be reached within two hops. Through the forward propagation and tuning of the Graph SAGE graph neural network model, we can better understand the behavioral patterns of attack groups and identify attack behaviors of different node categories. This modeling approach can help improve our ability to profile attack groups, thereby strengthening information security protection.

[0066] Furthermore, regarding the K-means model, clustering methods are used to better characterize the local details of the attack behavior pattern, thereby detecting potential intrusion behaviors. Specifically, the K-means algorithm is an unsupervised learning algorithm that can divide a data set into K clusters, each cluster containing the data points closest to its centroid. In this embodiment, the K-means algorithm is used to cluster the full node feature vectors output by the Graph SAGE graph neural network to detect the behavior pattern of the attack group. It should be noted that before enabling the K-means algorithm, an appropriate number of clusters k needs to be selected. The clustering effect under different numbers of clusters can be evaluated by heuristic methods (Elbow Method (EM) or Silhouette Coefficient (AC)) and the optimal k value can be selected. The elbow method can be obtained as formula (1), and the silhouette coefficient can be obtained as formula (2). The relevant details of formulas (1) and (2) are shown in Tables 1 and 2, respectively.

[0067] (1);

[0068] (2);

[0069] Table 1

[0070] Related parameters definition J Clustering coefficient <![CDATA[u k ]]> Cluster center location k Number of cluster categories

[0071] Table 2

[0072] Silhouette coefficient definition 1 It indicates that the samples are clustered reasonably, the distance within the cluster is small and the distance between clusters is large. 0 Indicates sample cluster overlap -1 Indicates that the sample is incorrectly assigned to an adjacent cluster.

[0073] In formula (2), a represents the average distance between a sample and other samples in its cluster, reflecting the cohesion of the cluster; b represents the average distance between a sample and all samples in its nearest neighbor cluster, reflecting the separation between clusters.

[0074] It's understandable that in this embodiment, after selecting an appropriate number of clusters, k, k centroids are randomly initialized, and each data point is assigned to the cluster with the nearest centroid. Then, for each cluster, its centroid is recalculated, and the above steps are repeated until convergence. Ultimately, the resulting clustering results can help us understand the behavioral patterns of attack groups and identify potential intrusions.

[0075] In this way, combining the Graph SAGE graph neural network and the K-means clustering algorithm allows for modeling and analyzing attack behavior from both a global and local perspective, resulting in a target attack group identification model. This improves the ability to profile attack groups and thus better identify potential network security threats. Furthermore, this target attack group identification model needs to be continuously optimized to improve its accuracy and robustness, thereby further protecting information security.

[0076] Step S14: In the process of performing attack group portrait analysis on the saved key node behavior subgraph based on the target attack group identification model, the attack group behavior pattern is classified using the preset discriminant formula and the target probability matrix of the saved model output result to obtain the corresponding attack group portrait analysis result.

[0077] Combine Figure 2As shown, in this embodiment, a method based on the probability matrix discriminant method is proposed, which is combined with the output of the target attack group identification model to classify the attack group behavior pattern. That is, in the process of performing attack group portrait analysis on the saved key node behavior subgraph based on the target attack group identification model, the attack group behavior pattern classification is performed using a preset discriminant formula and a target probability matrix that stores the model output results, including: in the process of dynamically performing attack group portrait analysis based on the target attack group identification model through the flow execution mode, the obtained model output results are recorded using a probability matrix to obtain a corresponding target probability matrix; wherein the model output results include the attack group behavior pattern recognition results and corresponding probabilities corresponding to the key nodes in each key node behavior subgraph that has been saved locally; for each key node, the attack group behavior pattern classification is performed using a preset discriminant formula and the corresponding target probability matrix to obtain the corresponding attack group portrait analysis result.

[0078] It is further important to understand that in this embodiment, a key node behavior subgraph G is maintained in memory. Graph G is initially empty, and newly arrived nodes and edges are continuously added. The edges and points connected to the incoming and outgoing edges and their 2-hop descendants are defined as active nodes. Descendants and related nodes are obtained from the entire target heterogeneous attack behavior graph on disk. Specifically, a parameter called the subgraph size can be set. When the number of newly arrived edges in graph G reaches SS, graph G is used for detection, and a new subgraph is started to be built in memory. Note that SS is not the number of edges in graph G, because some additional edges from other subgraphs are added. Through the stream execution mode, the attack behavior pattern of the current node can be dynamically detected and long-term scalability can be guaranteed.

[0079] At the same time, in order to achieve accurate attack group classification, this embodiment also proposes a probability-based method in the category discrimination stage. For unidentified nodes v, iterative detection is performed in the sub-model corresponding to the target attack group identification model, and the probability list Mv given by each sub-model is obtained, which is the model output result. The nodes v with the largest and second largest probabilities are then marked as C respectively. v and Since nodes with similar but different attack behavior patterns may not be classified into any category with high probability in each sub-model, there is a risk of correctly classifying them into the dominant label L(v) of a sub-model, which is undesirable because it is not desirable to correctly classify abnormal nodes. Therefore, in the execution phase, a threshold R is also used, and the node is considered to be correctly classified only when the following conditions are met. The discriminant formula is shown in (3).

[0080] (3);

[0081] Specifically, for each key node, attack group behavior pattern classification is performed using a preset discriminant formula and the corresponding target probability matrix. This includes: obtaining the corresponding maximum and second-largest probability values ​​for each key node using the corresponding target probability matrix; obtaining a corresponding preset threshold value and substituting the maximum, second-largest, and preset threshold values ​​into the preset discriminant formula to obtain a corresponding discrimination result; and determining the target attack group behavior pattern and the corresponding target pattern category corresponding to each key node based on the discrimination result to obtain the attack group profile analysis result. This allows for more accurate identification of different attack group behavior patterns and their categories, thereby improving the practicality and effectiveness of attack group profile identification. This optimization method plays a crucial role in the model training and testing phases. The probability matrix discriminant method records the instances in which nodes may be identified as different attack groups and classifies them based on the relationship between the maximum and second-largest values. The feature outputs of the Graph SAGE and K-means models provide richer information for distinguishing different attack group behavior patterns. By combining these methods, we are able to more accurately classify and identify attack groups, enhancing the accuracy and reliability of the model.

[0082] In summary, this application proposes an attack group portrait analysis method and system based on SAGE graph neural network and distance clustering, which analyzes the portraits of different attacker groups. In view of the fact that existing attack detection equipment lacks the ability to analyze the correlation of log alarm events, which leads to a high false alarm problem, and secondly, the alarm logs generated by the detection equipment are usually low-level and isolated. To this end, an attack group portrait analysis method based on graph neural network and distance clustering is proposed. A heterogeneous attack behavior graph is constructed through the collected logs or device alarms. In order to focus on the node behavior pattern, fine-grained feature extraction of nodes and edges and aggregation of key node subgraph features are selected, and then the SAGE graph neural network model is combined to learn the behavior pattern of the entire graph node; through the SAGE graph neural network, for different attacker group portraits, distance clustering is used to associate attack groups with similar behavior patterns in the heterogeneous attack graph, thereby portraying the portraits of different attacker groups. By extracting the attack behavior-related features of the attack group, constructing a graph describing the heterogeneous attack behavior, and associating different log information, richer security semantics can be obtained. Using representation learning methods to achieve attacker threat assessment provides security operations personnel with more accurate results, thereby reducing manpower investment in enterprise security operations.

[0083] It can be seen that in this application, log collection is performed based on a preset data source, and log fusion and heterogeneous attack behavior graph construction are performed in sequence based on the collected multiple logs to be processed and the preset data processing rules to obtain the corresponding target heterogeneous attack behavior graph; wherein, the target heterogeneous attack behavior graph is an attack behavior graph arranged in chronological order; after vector conversion of the nodes and edge labels in the target heterogeneous attack behavior graph, key node enumeration, subgraph construction, and feature extraction are performed based on the obtained vector information and the preset key node behavior subgraph vector feature extraction rules to obtain the corresponding target vector features; wherein, the key node is the entity used for training or detection in the target heterogeneous attack behavior graph; based on Graph The SAGE graph neural network and the target vector features are used to learn attack behavior patterns at key nodes. The resulting full set of node behavior feature vectors are then input into a K-means model for distance clustering to complete the corresponding model training operation and obtain a target attack group identification model. During attack group profiling analysis of the saved key node behavior subgraph based on the target attack group identification model, the attack group behavior patterns are classified using a preset discriminant formula and a target probability matrix containing the model output results to obtain the corresponding attack group profiling analysis results. In other words, in this embodiment, the corresponding heterogeneous attack behavior graph is constructed by collecting and fusing logs from various data sources. Then, the target vector features corresponding to the constructed target heterogeneous attack behavior graph are used to learn attack behavior patterns using a graph neural network and distance clustering to obtain a target attack group identification model. Subsequently, during analysis using the target attack group identification model, the attack group profiling analysis results are determined based on the probability matrix and the preset discriminant formula. This effectively improves the accuracy, comprehensiveness, and interpretability of the analysis results, thereby reducing the manpower investment in enterprise security operations.

[0084] See also Figure 5 As shown, the embodiment of the present invention discloses a method for analyzing an attack group profile, including:

[0085] Step S21: In the process of learning the attack behavior pattern of the target vector features corresponding to each of the key node behavior subgraphs based on the Graph SAGE graph neural network, the node ancestor information of the key nodes from the key node behavior subgraph is aggregated based on several hidden layers pre-configured in the Graph SAGE graph neural network and the forward propagation algorithm to complete the corresponding attack behavior pattern learning operation.

[0086] Step S22: Evaluate the effects of different numbers of clusters based on a preset formula to determine a target number of clusters, and determine a corresponding K-means model according to the target number of clusters.

[0087] Step S23: Obtain the full node behavior feature vectors corresponding to each of the key node behavior subgraphs output by the Graph SAGE graph neural network, and input the full node behavior feature vectors into the K-means model for distance clustering to complete the corresponding model training operation and obtain the target attack group identification model.

[0088] For the specific process of the above steps S21 to S23, reference may be made to the corresponding contents disclosed in the above embodiments, which will not be described again here.

[0089] As can be seen, in the embodiments of this application, the extracted features are used to learn the behavior patterns of key node subgraphs using the Graph SAGE neural network, and clustering methods are used to characterize the local details of the attack behavior model. In this way, the Graph SAGE neural network and the K-means clustering algorithm are combined to model and analyze attack behavior from both a global and local perspective, thereby improving the accuracy of the target attack group identification model.

[0090] See also Figure 6 As shown, the embodiment of the present application also discloses a device for analyzing an attack group portrait, including:

[0091] The behavior graph construction module 11 is configured to collect logs based on a preset data source, and to sequentially perform log fusion and heterogeneous attack behavior graph construction based on the collected multiple logs to be processed and preset data processing rules, so as to obtain a corresponding target heterogeneous attack behavior graph; wherein the target heterogeneous attack behavior graph is an attack behavior graph arranged in chronological order;

[0092] A feature extraction module 12 is configured to, after performing vector conversion on the nodes and edge labels in the target heterogeneous attack behavior graph, perform key node enumeration, subgraph construction, and feature extraction based on the obtained vector information and preset key node behavior subgraph vector feature extraction rules to obtain corresponding target vector features; wherein the key nodes are entities in the target heterogeneous attack behavior graph used for training or detection;

[0093] The model training module 13 is used to learn the attack behavior patterns of key nodes based on the Graph SAGE graph neural network and the target vector features, and input the obtained full node behavior feature vectors into the K-means model for distance clustering to complete the corresponding model training operation and obtain the target attack group identification model;

[0094] The analysis result acquisition module 14 is used to classify the attack group behavior pattern using a preset discriminant formula and a target probability matrix that saves the model output results during the attack group portrait analysis of the saved key node behavior subgraph based on the target attack group identification model, so as to obtain the corresponding attack group portrait analysis results.

[0095] Among them, for more specific working processes of the above modules, please refer to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0096] As can be seen, this application completes the construction of the corresponding heterogeneous attack behavior graph by collecting and fusing logs from various data sources. Then, through graph neural networks and distance clustering, the target vector features corresponding to the constructed target heterogeneous attack behavior graph are used to learn attack behavior patterns to obtain a target attack group identification model. Subsequently, during the analysis process using the target attack group identification model, the attack group profiling results are determined based on the probability matrix and a preset discriminant formula. This effectively improves the accuracy, comprehensiveness, and interpretability of the analysis results, thereby reducing the manpower investment in enterprise security operations.

[0097] In some specific embodiments, the behavior graph construction module 11 may specifically include:

[0098] The log collection unit is used to collect logs based on the network intrusion detection system, full flow detection and network application protection system, and collect corresponding user behavior logs to obtain a variety of logs to be processed;

[0099] A log fusion unit, configured to extract, convert, and save data based on a preset data processing tool and the plurality of logs to be processed, so as to complete corresponding log fusion operations and obtain corresponding fused information;

[0100] A heterogeneous attack behavior graph construction unit is used to use a preset simulation tool and the fused information to construct a corresponding heterogeneous attack behavior graph to obtain a target heterogeneous attack behavior graph; wherein the target heterogeneous attack behavior graph includes entities as nodes and attack behaviors as edges, and the entities include files, IPs, memories, and processes.

[0101] In some specific embodiments, the heterogeneous attack behavior graph construction unit may specifically include:

[0102] The name mapping subunit is used to map the process name or file name to the corresponding node ID based on the fast hashing technology and the direction indexing technology in the process of constructing the target heterogeneous attack behavior graph using the preset simulation tool and the fused information.

[0103] In some specific embodiments, the feature extraction module 12 may specifically include:

[0104] a key node enumeration unit, configured to enumerate key nodes in the target heterogeneous attack behavior graph based on the obtained vector information, and determine neighbor nodes corresponding to each key node; wherein the neighbor nodes are nodes interconnected with the corresponding key node within two hops;

[0105] a key node behavior subgraph acquisition unit, configured to partition the target heterogeneous attack behavior graph based on each key node and the corresponding neighboring node to obtain a plurality of corresponding key node behavior subgraphs; wherein the key node behavior subgraphs include corresponding key nodes, corresponding neighboring nodes, and edges between nodes;

[0106] The feature acquisition unit is used to label the key nodes and the neighbor nodes in each key node behavior subgraph, and perform vector conversion and subgraph vector feature aggregation based on the obtained label information to complete the feature extraction operation and obtain the corresponding target vector features.

[0107] In some specific embodiments, the model training module 13 may specifically include:

[0108] an information aggregation unit for aggregating node ancestor information of the key nodes from the key node behavior subgraphs based on a plurality of pre-configured hidden layers and a forward propagation algorithm in the Graph SAGE graph neural network during attack behavior pattern learning of the target vector features corresponding to each of the key node behavior subgraphs based on the Graph SAGE graph neural network, so as to complete the corresponding attack behavior pattern learning operation;

[0109] A model determination unit is used to evaluate the effects of different numbers of clusters based on a preset formula to determine a target number of clusters, and to determine a corresponding K-means model according to the target number of clusters;

[0110] The distance clustering unit is used to obtain the full node behavior feature vectors corresponding to each of the key node behavior subgraphs output by the Graph SAGE graph neural network, and input the full node behavior feature vectors into the K-means model for distance clustering to complete the corresponding model training operation and obtain the target attack group identification model.

[0111] In some specific embodiments, the analysis result acquisition module 14 may specifically include:

[0112] a target probability matrix acquisition unit, configured to record the obtained model output results using a probability matrix during the process of dynamically performing attack group profiling analysis based on the target attack group identification model in a flow execution mode, so as to obtain a corresponding target probability matrix; wherein the model output results include attack group behavior pattern recognition results corresponding to the key nodes in each of the key node behavior subgraphs that have been saved locally, and the corresponding probabilities;

[0113] The analysis result acquisition unit is used to classify the attack group behavior pattern for each key node using a preset discriminant formula and the corresponding target probability matrix to obtain a corresponding attack group portrait analysis result.

[0114] In some specific embodiments, the analysis result obtaining unit may specifically include:

[0115] A value acquisition subunit, configured to obtain, for each of the key nodes, a corresponding maximum probability value and a second maximum probability value using the corresponding target probability matrix;

[0116] a discrimination result acquisition subunit, configured to acquire a corresponding preset threshold value, and substitute the maximum probability value, the second maximum probability value, and the preset threshold value into the preset discrimination formula to obtain a corresponding discrimination result;

[0117] The pattern determination subunit is used to determine the target attack group behavior pattern and the corresponding target pattern category corresponding to each key node based on the discrimination result, so as to obtain the attack group portrait analysis result.

[0118] Furthermore, the embodiment of the present application also discloses an electronic device, Figure 7 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram should not be considered as any limitation to the scope of application of the present application.

[0119] Figure 7 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps of the attack group profiling analysis method disclosed in any of the aforementioned embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0120] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0121] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or CD, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0122] The operating system 221 is used to manage and control the hardware devices on the electronic device 20 and the computer program 222. It can be Windows Server, NetWare, Unix, Linux, etc. In addition to including computer programs capable of implementing the attack group profiling analysis method performed by the electronic device 20 as disclosed in any of the aforementioned embodiments, the computer program 222 can further include computer programs capable of performing other specific tasks.

[0123] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when executed by a processor, the computer program implements the aforementioned attack group profiling method. The specific steps of this method can be found in the corresponding content disclosed in the aforementioned embodiments and will not be repeated here.

[0124] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0125] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0126] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0127] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0128] The above is a detailed introduction to the technical solution provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the ideas of the present application, there may be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for analyzing attack group profiles, characterized in that: include: Logs are collected based on a preset data source, and log fusion and heterogeneous attack behavior graphs are sequentially performed based on the collected multiple logs to be processed and preset data processing rules to obtain a corresponding target heterogeneous attack behavior graph; wherein the target heterogeneous attack behavior graph is an attack behavior graph arranged in chronological order; After performing vector conversion on the nodes and edge labels in the target heterogeneous attack behavior graph, key node enumeration, subgraph construction, and feature extraction are performed based on the obtained vector information and preset key node behavior subgraph vector feature extraction rules to obtain corresponding target vector features; wherein the key nodes are entities in the target heterogeneous attack behavior graph used for training or detection; Based on the Graph SAGE graph neural network and the target vector features, key node attack behavior patterns are learned, and the obtained full node behavior feature vectors are input into the K-means model for distance clustering to complete the corresponding model training operation and obtain the target attack group identification model; In the process of performing attack group portrait analysis on the saved key node behavior subgraph based on the target attack group identification model, the attack group behavior pattern is classified using the preset discriminant formula and the target probability matrix of the saved model output result to obtain the corresponding attack group portrait analysis result.

2. The attack group profile analysis method according to claim 1, characterized in that: The log collection is performed based on a preset data source, and log fusion and heterogeneous attack behavior graph construction are performed in sequence based on the collected multiple logs to be processed and preset data processing rules to obtain the corresponding target heterogeneous attack behavior graph, including: Log collection is performed based on network intrusion detection systems, full-flow detection, and network application protection systems, as well as corresponding user behavior logs to obtain a variety of logs to be processed; Based on the preset data processing tools and the multiple logs to be processed, data extraction, data conversion and data storage are performed to complete the corresponding log fusion operation and obtain the corresponding fused information; A corresponding heterogeneous attack behavior graph is constructed using a preset simulation tool and the fused information to obtain a target heterogeneous attack behavior graph; wherein the target heterogeneous attack behavior graph includes entities as nodes and attack behaviors as edges, and the entities include files, IP addresses, memories, and processes.

3. The attack group profile analysis method according to claim 2, characterized in that: The use of a preset simulation tool and the fused information to construct a corresponding heterogeneous attack behavior graph to obtain a target heterogeneous attack behavior graph includes: In the process of constructing a target heterogeneous attack behavior graph using a preset simulation tool and the fused information, the process name or file name is mapped to the corresponding node ID based on fast hashing technology and directional indexing technology.

4. The attack group profile analysis method according to any one of claims 1 to 3, characterized in that: The key node enumeration, subgraph construction, and feature extraction are performed based on the obtained vector information and the preset key node behavior subgraph vector feature extraction rules to obtain the corresponding target vector features, including: Enumerate key nodes in the target heterogeneous attack behavior graph based on the obtained vector information, and determine neighbor nodes corresponding to each key node; wherein the neighbor nodes are nodes interconnected with the corresponding key node within 2 hops; The target heterogeneous attack behavior graph is divided based on each of the key nodes and the corresponding neighbor nodes to obtain a plurality of corresponding key node behavior subgraphs; wherein the key node behavior subgraphs include corresponding key nodes, corresponding neighbor nodes, and edges between nodes; By labeling the key nodes and the neighboring nodes in each key node behavior subgraph, and performing vector conversion and subgraph vector feature aggregation based on the obtained label information, the feature extraction operation is completed and the corresponding target vector feature is obtained.

5. The attack group profile analysis method according to claim 4 is characterized in that: The Graph SAGE graph neural network and the target vector features are used to learn the attack behavior patterns of key nodes, and the obtained full node behavior feature vectors are input into the K-means model for distance clustering to complete the corresponding model training operation, including: In the process of learning attack behavior patterns for the target vector features corresponding to each of the key node behavior subgraphs based on the Graph SAGE graph neural network, node ancestor information of the key nodes from the key node behavior subgraphs is aggregated based on a plurality of pre-configured hidden layers and a forward propagation algorithm in the Graph SAGE graph neural network to complete the corresponding attack behavior pattern learning operation; Evaluate the effects of different numbers of clusters based on a preset formula to determine the target number of clusters, and determine the corresponding K-means model based on the target number of clusters; The full node behavior feature vectors corresponding to each of the key node behavior subgraphs output by the Graph SAGE graph neural network are obtained, and the full node behavior feature vectors are input into the K-means model for distance clustering to complete the corresponding model training operation and obtain the target attack group identification model.

6. The attack group profile analysis method according to claim 4, characterized in that: In the process of performing attack group portrait analysis on the saved key node behavior subgraph based on the target attack group identification model, attack group behavior pattern classification is performed using a preset discriminant formula and a target probability matrix of the saved model output result, including: In the process of dynamically performing attack group profiling analysis based on the target attack group identification model in the flow execution mode, the obtained model output results are recorded using a probability matrix to obtain a corresponding target probability matrix; wherein the model output results include attack group behavior pattern identification results corresponding to the key nodes in each of the key node behavior subgraphs that have been saved locally and the corresponding probabilities; For each of the key nodes, the preset discriminant formula and the corresponding target probability matrix are used to classify the attack group behavior pattern to obtain the corresponding attack group portrait analysis results.

7. The attack group profile analysis method according to claim 6, characterized in that: For each of the key nodes, the attack group behavior pattern classification is performed using a preset discriminant formula and the corresponding target probability matrix, including: For each of the key nodes, using the corresponding target probability matrix to obtain the corresponding maximum probability value and the second maximum probability value; Obtaining a corresponding preset threshold, and substituting the maximum probability value, the second maximum probability value, and the preset threshold into the preset discrimination formula to obtain a corresponding discrimination result; Based on the discrimination results, the target attack group behavior pattern and the corresponding target pattern category corresponding to each key node are determined to obtain the attack group portrait analysis result.

8. A device for analyzing attack group portraits, characterized in that: include: A behavior graph construction module is used to collect logs based on a preset data source, and to perform log fusion and heterogeneous attack behavior graph construction based on the collected multiple logs to be processed and preset data processing rules, so as to obtain a corresponding target heterogeneous attack behavior graph; wherein the target heterogeneous attack behavior graph is an attack behavior graph arranged in chronological order; A feature extraction module is configured to, after performing vector conversion on the nodes and edge labels in the target heterogeneous attack behavior graph, perform key node enumeration, subgraph construction, and feature extraction based on the obtained vector information and preset key node behavior subgraph vector feature extraction rules to obtain corresponding target vector features; wherein the key nodes are entities in the target heterogeneous attack behavior graph used for training or detection; A model training module is used to learn key node attack behavior patterns based on the Graph SAGE graph neural network and the target vector features, and input the obtained full node behavior feature vectors into the K-means model for distance clustering to complete the corresponding model training operation and obtain a target attack group identification model; The analysis result acquisition module is used to classify the attack group behavior patterns using a preset discriminant formula and a target probability matrix that saves the model output results during the attack group portrait analysis of the saved key node behavior subgraph based on the target attack group identification model, so as to obtain the corresponding attack group portrait analysis results.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the attack group profile analysis method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that Used to store a computer program, which, when executed by a processor, implements the attack group portrait analysis method according to any one of claims 1 to 7.

Images