Terminal anomaly detection method and related device

Abstract

The embodiment of the invention discloses a terminal anomaly detection method and a related device, which are used for carrying out anomaly detection on a detection object. The method comprises the steps that a terminal behavior graph of a terminal set is generated according to alarm data, each node in the terminal behavior graph represents one terminal, each edge represents the behavior between the terminals, and each node corresponds to an initial node feature; inputting the terminal behavior graph and the initial node feature of each node in the terminal behavior graph into a pre-trained anomaly detection model, and updating the initial node feature of each node by a graph attention network in the anomaly detection model to obtain an updated node feature of each node; according to the updated node features of each node, object features of a detection object are determined, and the detection object comprises at least one of nodes, edges and subgraphs of the terminal behavior graph; and obtaining a detection result of whether the detection object is abnormal according to the object features of the detection object.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of data detection, and in particular to a terminal anomaly detection method and related devices for performing anomaly detection on a detection object. Background Art

[0002] With the continuous development of science and technology, people have become more and more dependent on the Internet. However, some hackers, for illegal purposes, will disrupt the operation of user terminal systems, invade other people's computer systems, steal terminal system confidential information, and destroy the data of target terminal systems through the Internet, causing great losses to people. Therefore, in the field of network security, anomaly detection is crucial to defend against complex network attacks.

[0003] However, in existing solutions, detection methods are usually based on the practical experience of network security personnel, which leads to poor anomaly detection and recognition effects and low detection efficiency, bringing certain inconveniences to the detection work of network security personnel. Summary of the invention

[0004] The embodiments of the present application provide a terminal anomaly detection method and related devices for performing anomaly detection on a detection object.

[0005] A first aspect of an embodiment of the present application provides a terminal abnormality detection method, including:

[0006] Generate a terminal behavior graph of the terminal set according to the alarm data of each terminal in the terminal set, wherein each node in the terminal behavior graph represents one of the terminals, each edge represents the behavior between the terminals, and each of the nodes corresponds to an initial node feature, and the initial node feature is obtained from the alarm data of the terminal represented by the node;

[0007] Inputting the terminal behavior graph and the initial node features of each node in the terminal behavior graph into a pre-trained anomaly detection model, and using a graph attention network in the anomaly detection model to update the initial node features of each node according to the terminal behavior graph to obtain updated node features of each node;

[0008] Determine the object features of the detection object according to the updated node features of each of the nodes, the detection object including the nodes, edges and sub-nodes of the terminal behavior graph Figure 3 At least one of the following;

[0009] A detection result of whether the detection object is abnormal is obtained according to the object characteristics of the detection object.

[0010] Optionally, obtaining a detection result of whether the detection object is abnormal according to the object feature of the detection object includes:

[0011] The object features of the detection object are input into the classifier of the anomaly detection model to obtain a detection result of whether the detection object is abnormal.

[0012] Optionally, the graph attention network includes at least one graph attention layer, and the graph attention network in the anomaly detection model updates the initial node feature of each of the nodes according to the terminal behavior graph to obtain the updated node feature of each of the nodes, including:

[0013] The current graph attention layer calculates the normalized attention coefficients between the node and each adjacent node in the terminal behavior graph according to the input node features of the node in the current graph attention layer; based on the input node features corresponding to the node and the normalized attention coefficients, the aggregate node features of the node are obtained;

[0014] Nonlinearly process the aggregated node features of each of the nodes obtained by the last graph attention layer to obtain updated node features of each of the nodes;

[0015] Among them, if the current graph attention layer is the first graph attention layer, the input node features of the node are the initial node features of the node; if the current graph attention layer is not the first graph attention layer, the input node features of the node are the aggregated node features of the node obtained by the previous graph attention layer.

[0016] Optionally, the calculating, according to the input node feature of the node in the current graph attention layer, the normalized attention coefficient between the node and each adjacent node in the terminal behavior graph, includes:

[0017] For a target node and a target adjacent node of the target node, the current graph attention layer calculates the product of the input node feature of the target node in the current graph attention layer and the representation conversion matrix of the current graph attention layer to obtain a first result, and calculates the product of the input node feature of the target adjacent node in the current graph attention layer and the representation conversion matrix of the current graph attention layer to obtain a second result;

[0018] The first result and the second result are concatenated and then an inner product operation is performed with the attention vector of the current graph attention layer, and the inner product operation result is normalized to obtain a normalized attention coefficient between the target node and the target adjacent node;

[0019] The target node is any node in the terminal behavior graph, and the target adjacent node is any adjacent node of the target node in the terminal behavior graph.

[0020] Optionally, obtaining the aggregate node feature of the node based on the input node feature corresponding to the node and the normalized attention coefficient includes:

[0021] Perform a weighted average operation using the input node features of all neighboring nodes of the node and the corresponding normalized attention coefficients to obtain an aggregated node feature of the node at the current graph attention layer;

[0022] or,

[0023] The input node features of all nodes in all adjacent nodes of the node whose normalized attention coefficients are greater than a preset coefficient threshold are concatenated or weighted averaged based on the normalized attention coefficients to obtain the aggregated node features of the node in the current graph attention layer.

[0024] Optionally, the detection object includes a node of the terminal behavior graph; and determining the object feature of the detection object according to the updated node feature of each of the nodes includes:

[0025] The updated node features corresponding to each of the nodes are respectively determined as object features of each of the nodes.

[0026] Optionally, the detection object includes an edge of the terminal behavior graph, and determining the object feature of the detection object according to the updated node feature of each of the nodes includes:

[0027] The updated node features of two nodes that are adjacent to each other in the terminal behavior graph are concatenated or weighted averaged to obtain the object features of each edge of the terminal behavior graph.

[0028] Optionally, the detection object includes a subgraph of the terminal behavior graph, and determining the object feature of the detection object according to the updated node feature of each of the nodes includes:

[0029] Inputting the terminal behavior graph and the updated node features of each of the nodes into the pooling layer of the anomaly detection model to perform a graph clustering operation to obtain at least one terminal behavior subgraph;

[0030] The pooling layer performs maximum pooling or average pooling processing on the updated node features of the nodes in each of the terminal behavior subgraphs to obtain the object features of each of the terminal behavior subgraphs.

[0031] A second aspect of an embodiment of the present application provides a terminal abnormality detection device, including:

[0032] A generating unit, configured to generate a terminal behavior graph of the terminal set according to the alarm data of each terminal in the terminal set, wherein each node in the terminal behavior graph represents one of the terminals, each edge represents the behavior between the terminals, and each of the nodes corresponds to an initial node feature, and the initial node feature is obtained from the alarm data of the terminal represented by the node;

[0033] A processing unit, configured to input the terminal behavior graph and the initial node feature of each node in the terminal behavior graph into a pre-trained anomaly detection model, and update the initial node feature of each node according to the terminal behavior graph by a graph attention network in the anomaly detection model to obtain an updated node feature of each node;

[0034] A determination unit, configured to determine object features of a detection object according to the updated node features of each of the nodes, wherein the detection object includes nodes, edges, and sub-nodes of the terminal behavior graph. Figure 3 At least one of the following;

[0035] The processing unit is further used to obtain a detection result of whether the detection object is abnormal according to the object characteristics of the detection object.

[0036] A third aspect of an embodiment of the present application provides a terminal abnormality detection device, including:

[0037] CPU, memory and input / output interface;

[0038] The memory is a short-term storage memory or a persistent storage memory;

[0039] The central processing unit is configured to communicate with the memory and execute instructions in the memory to perform the aforementioned method.

[0040] A fourth aspect of an embodiment of the present application provides a computer-readable storage medium, comprising instructions, which, when executed on a computer, enable the computer to execute the aforementioned method.

[0041] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages:

[0042] First, based on the alarm data of each terminal in the terminal set, a terminal behavior graph of the terminal set is generated. Then, the terminal behavior graph and the initial node features of each node in the terminal behavior graph are input into the pre-trained anomaly detection model. The graph attention network in the anomaly detection model updates the initial node features of each node according to the terminal behavior graph to obtain the updated node features of each node. Then, based on the updated node features of each node, the object features of the detection object are determined. Finally, based on the object features of the detection object, the detection result of whether the detection object is abnormal is obtained. By using the pre-trained anomaly detection model including the graph attention network for detection, the relationship between the terminals can be used for detection, and the detection efficiency is high, which brings convenience to network security personnel. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 A schematic diagram of an embodiment of a terminal anomaly detection method disclosed in the present application;

[0044] Figure 2 A schematic diagram of another embodiment of a terminal anomaly detection method disclosed in the present application;

[0045] Figure 3 A schematic diagram of another embodiment of a terminal anomaly detection method disclosed in the present application;

[0046] Figure 4 A schematic diagram of an embodiment of a terminal abnormality detection device disclosed in the present application;

[0047] Figure 5 A schematic diagram of another embodiment of a terminal abnormality detection device disclosed in the present application;

[0048] Figure 6 A schematic diagram of another embodiment of a terminal anomaly detection device disclosed in the present application. DETAILED DESCRIPTION

[0049] The present application is further described in detail below in conjunction with the accompanying drawings.

[0050] The embodiments of the present application provide a terminal anomaly detection method and related devices for performing anomaly detection on a detection object.

[0051] Network security refers to the protection of the hardware, software and data in the network system and the system, and it will not be destroyed, changed or leaked due to accidental or malicious reasons. The system can run continuously and reliably, and the network service is not interrupted. In order to ensure network security, it is necessary to defend against complex network attacks. Among them, the abnormal detection means of the terminal can achieve network security. In the existing scheme, the detection is based on the practical experience of network security personnel. However, this will lead to poor recognition effect of abnormal detection and low detection efficiency, and ignore the complex relationship between terminals, resulting in limited detection ability when facing diversified attack methods. In order to solve the above problems, the present application provides a terminal anomaly detection method and a terminal anomaly detection device, which are based on the graph attention network in the pre-trained anomaly detection model for detection, can use the relative importance between terminals for detection, have excellent generalization, and can effectively identify unknown attack patterns, including zero-day attacks, greatly improve the accuracy of detection, and have high detection efficiency, which brings great convenience to network security personnel.

[0052] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0053] The terms "first", "second", "third", "fourth", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0054] The following describes a terminal anomaly detection method of the present application. Figure 1 , an embodiment of a terminal anomaly detection method of the present application includes:

[0055] 101. Generate a terminal behavior graph of the terminal set according to the alarm data of each terminal in the terminal set;

[0056] According to the alarm data of each terminal in the terminal set, a terminal behavior graph of the terminal set is generated, wherein the terminal behavior graph is a graph structure representing the behavior generated on the terminal in the local area network, and has multiple types of nodes and edges, which can describe the complex interactive relationship of the terminal, and is a typical heterogeneous graph. Each node in the terminal behavior graph represents a terminal, and each edge represents the behavior between the terminals, such as creation, reading, modification, access, etc., and each node corresponds to an initial node feature, which is obtained by the alarm data of the terminal represented by the node. Specifically, in a local area network that needs to perform anomaly detection, there are multiple terminals constituting a terminal set. When an alarm occurs, the terminal will generate its own corresponding alarm data, and the alarm data can be directly reported to the terminal anomaly detection device of the present application, or first sent to the security alarm database for temporary storage, and then pulled from the security alarm database by the terminal anomaly detection device. There can be other ways to obtain the alarm data, which are not limited here. Then, the terminal involved in the alarm data is mapped to a node, and the behavior between the terminal and the terminal is mapped to the corresponding edge, and the node and edge constitute the terminal behavior graph. In addition, based on the preset generation rules, the attribute information about the terminal in the alarm data is used to generate the initial node feature of the corresponding node to represent the characteristics of the node. Before generating the terminal behavior graph, the alarm data can also be preprocessed.

[0057] 102. Input the terminal behavior graph and the initial node features of each node in the terminal behavior graph into the pre-trained anomaly detection model, and use the graph attention network in the anomaly detection model to update the initial node features of each node according to the terminal behavior graph to obtain updated node features of each node;

[0058] The terminal behavior graph and the initial node features of each node in the terminal behavior graph are input into the pre-trained anomaly detection model, and the graph attention network in the anomaly detection model updates the initial node features of each node according to the terminal behavior graph to obtain the updated node features of each node. Specifically, the anomaly detection model needs to be trained first, and then applied after training. The historical alarm data is obtained from the historical alarm database, and after preprocessing the historical alarm data, the required detection objects are labeled for training. After the training is completed, the parameters of the anomaly detection model are fixed and can be used for detection. The anomaly detection model includes a graph attention network, which can update the initial node features to obtain updated node features. The graph attention network is a neural network architecture for processing graph structured data. The attention mechanism gives the importance of different adjacent nodes of each node in the terminal behavior graph relative to the node, and uses this importance to update, thereby improving the expression ability of the anomaly detection model.

[0059] 103. Determine the object feature of the detection object according to the updated node feature of each node;

[0060] According to the updated node features of each node, the object features of the detection object are determined, wherein the detection object includes the nodes, edges and sub-nodes of the terminal behavior graph. Figure 3 At least one of the above. Since the anomaly detection model can determine the subsequent steps, the detection object of the anomaly detection model and the steps related to the detection object have been determined during training. For example, if the detection object only includes the nodes of the terminal behavior graph, the relevant nodes will be labeled during training, and the relevant steps will be performed on the updated node features of the nodes to obtain the object features of the nodes, and the subsequent detection will be performed to obtain the detection results. Specifically, nodes, edges, and sub- Figure 3 The steps involved are different, please refer to the following embodiments for details.

[0061] 104. Obtain a detection result of whether the detection object is abnormal according to the object characteristics of the detection object.

[0062] According to the object characteristics of the detection object, the detection result of whether the detection object is abnormal is obtained. Specifically, a classifier can be used for detection: the classifier has trained classifier parameters, and the object characteristics of the detection object are calculated with the classifier parameters to obtain the corresponding score value, and then determine whether the score value is greater than or equal to the preset score threshold. If so, the detection object corresponding to the score value is abnormal, otherwise, it means that the detection object corresponding to the score value is normal. Alternatively, after calculating the score value, determine whether the score value is in a specific interval to detect whether the detection object is abnormal. It is understandable that other methods other than classifiers can also be used for detection, for example, preset features for comparison can be pre-set, and then the object features are compared with the preset features. If the similarity is lower than the preset similarity value, it indicates an abnormality, and if the similarity is higher than the preset similarity value, it indicates normal. There are other detection methods, which are not specifically limited here.

[0063] In the embodiment of the present application, a terminal behavior graph of the terminal set is first generated based on the alarm data of each terminal in the terminal set, and then the terminal behavior graph and the initial node features of each node in the terminal behavior graph are input into a pre-trained anomaly detection model, and the graph attention network in the anomaly detection model updates the initial node features of each node according to the terminal behavior graph to obtain the updated node features of each node, and then determines the object features of the detection object according to the updated node features of each node, and finally obtains the detection result of whether the detection object is abnormal according to the object features of the detection object. By performing detection through a pre-trained anomaly detection model including a graph attention network, it is possible to use the relationship between terminals to assign relative importance, and the detection efficiency is high, which brings convenience to network security personnel.

[0064] See also Figure 2 Another embodiment of a terminal anomaly detection method of the present application includes:

[0065] 201. Generate a terminal behavior graph of the terminal set according to the alarm data of each terminal in the terminal set;

[0066] According to the alarm data of each terminal in the terminal set, a terminal behavior graph of the terminal set is generated, wherein the terminal behavior graph is a graph structure representing the behavior generated on the terminal in the local area network, and has multiple types of nodes and edges, which can describe the complex interactive relationship between the terminals. It is a typical heterogeneous graph. Each node in the terminal behavior graph represents a terminal, and each edge represents the behavior between the terminals, such as creation, reading, modification, access, etc., and each node corresponds to an initial node feature, which is obtained from the alarm data of the terminal represented by the node.

[0067] 202. Input the terminal behavior graph and the initial node features of each node in the terminal behavior graph into the pre-trained anomaly detection model, and update the initial node features of each node according to the terminal behavior graph by the graph attention network in the anomaly detection model to obtain the updated node features of each node;

[0068] The terminal behavior graph and the initial node features of each node in the terminal behavior graph are input into the pre-trained anomaly detection model, and the graph attention network in the anomaly detection model updates the initial node features of each node according to the terminal behavior graph to obtain the updated node features of each node. Specifically, after the initial node features of each node are input into the anomaly detection model, the current graph attention layer calculates the normalized attention coefficients between the node and each adjacent node in the terminal behavior graph according to the input node features of the node in the current graph attention layer, and then obtains the aggregate node features of the node based on the input node features and the normalized attention coefficients corresponding to the node. Finally, the aggregate node features of each node obtained by the last graph attention layer are nonlinearly processed to obtain the updated node features of each node, wherein, if the current graph attention layer is the first graph attention layer, the input node features of the node are the initial node features of the node, and if the current graph attention layer is not the first graph attention layer, the input node features of the node are the aggregate node features of the node obtained by the previous graph attention layer. Simply put, each node in the terminal behavior graph needs to go through a set of processing steps to obtain the corresponding updated node features: the initial node features of the node are input into the first-layer graph attention layer as the input node features of the first-layer attention layer. Each layer of the graph attention layer will calculate the corresponding normalized attention coefficient based on the input node features, and then calculate the output corresponding aggregate node features. When the graph attention network has only one layer of graph attention layer, the output of the first layer is the updated node feature. When the graph attention network has two or more layers of graph attention layers, the output of the previous layer is used as the input of the next layer, and the operation continues to be executed, and the output of the last layer of graph attention layer is used as the updated node feature of the node.

[0069] 203. Determine the object feature of the detection object according to the updated node feature of each node;

[0070] According to the updated node features of each node, the object features of the detection object are determined, wherein the detection object includes the nodes, edges and sub-nodes of the terminal behavior graph. Figure 3 Since the anomaly detection model can determine the subsequent steps, the detection object of the anomaly detection model and the steps related to the detection object have been determined during training.

[0071] 204. Obtain a detection result of whether the detection object is abnormal according to the object characteristics of the detection object.

[0072] According to the object characteristics of the detected object, a detection result of whether the detected object is abnormal is obtained. Specifically, the detection can be performed using a classifier, or the detection can be performed without using a classifier, and the comparison can be performed based on a preset standard. There are other detection methods, which are not specifically limited here.

[0073] In this embodiment, a terminal behavior graph of the terminal set is first generated based on the alarm data of each terminal in the terminal set, and then the terminal behavior graph and the initial node features of each node in the terminal behavior graph are input into a pre-trained anomaly detection model. The graph attention network in the anomaly detection model updates the initial node features of each node based on the terminal behavior graph to obtain the updated node features of each node, and then determines the object features of the detection object based on the updated node features of each node. Finally, based on the object features of the detection object, a detection result of whether the detection object is abnormal is obtained. By performing detection using a pre-trained anomaly detection model including a graph attention network, the relationship between terminals can be used to assign relative importance, and the detection efficiency is high, which brings convenience to network security personnel.

[0074] See also Figure 3 Another embodiment of a terminal anomaly detection method of the present application includes:

[0075] 301. Generate a terminal behavior graph of the terminal set according to the alarm data of each terminal in the terminal set;

[0076] According to the alarm data of each terminal in the terminal set, a terminal behavior graph of the terminal set is generated, wherein the terminal behavior graph has multiple types of nodes and edges, each node in the terminal behavior graph represents a terminal, each edge represents the behavior between the terminals, such as creation, reading, modification, access, etc., and each node corresponds to an initial node feature, and the initial node feature is obtained by the alarm data of the terminal represented by the node. Specifically, in a local area network that needs to perform anomaly detection, there are multiple terminals (which can be a host, a network card or a hard disk, etc.) that constitute a terminal set. When an alarm occurs, the terminal will generate its own corresponding alarm data, wherein the alarm data includes the identification of the current device, the time when the alarm is generated, the cause of the alarm (such as hitting a security rule or an abnormal behavior, etc.) and the specific content of the abnormality (such as an input instruction, etc.). The terminal can directly report the alarm data to the terminal abnormality detection device of this application, or first send it to the security alarm database for temporary storage, and then the terminal abnormality detection device pulls it from the security alarm database. There can also be other ways to obtain the alarm data, which are not limited here. Then, the terminal involved in the alarm data is mapped to a node, and the behavior between the terminals is mapped to the corresponding edge. The nodes and edges constitute the terminal behavior graph. In addition, based on the preset generation rules, the attribute information about the terminal in the alarm data is used to generate the initial node features of the corresponding node to correspond to the characteristics of the node. Before generating the terminal behavior graph, the alarm data can also be preprocessed (such as redundant data cleaning, data standardization or data format conversion, etc.) to improve the efficiency of detection.

[0077] 302. Input the terminal behavior graph and the initial node features of each node in the terminal behavior graph into the pre-trained anomaly detection model, and use the graph attention network in the anomaly detection model to update the initial node features of each node according to the terminal behavior graph to obtain updated node features of each node;

[0078] The terminal behavior graph and the initial node features of each node in the terminal behavior graph are input into the pre-trained anomaly detection model, and the graph attention network in the anomaly detection model updates the initial node features of each node according to the terminal behavior graph to obtain the updated node features of each node. The graph attention network includes at least one graph attention layer and an output layer, all graph attention layers are connected in series, the input of the first graph attention layer is external data, the last graph attention layer is connected to the output layer, and the output data of the last layer is input to the output layer. For example, if there are three layers of graph attention layers, the input of the first graph attention layer is the terminal behavior graph and the initial node features, the output of the first graph attention layer is the input data of the second graph attention layer, the output data of the second graph attention layer is the input of the last graph attention layer, the last graph attention layer outputs data to the output layer, and the output layer outputs the corresponding updated node features.

[0079] There are many specific implementation methods and corresponding algorithms, which are not limited here. In one implementation method, the current graph attention layer determines at least one adjacent node of the node according to the terminal behavior graph, and calculates the attention coefficient between the node and each adjacent node according to the input node features of the node in the current graph attention layer. Then, the attention coefficient between the node and each adjacent node is normalized to obtain the normalized attention coefficient between the node and each adjacent node. Then, based on the input node features of each adjacent node of the node in the current graph attention layer and the normalized attention coefficient between the node and each adjacent node, the aggregate node features of the node are obtained. Finally, the aggregate node features of each node obtained by the last layer of graph attention layer are input into the output layer for nonlinear processing to obtain the updated node features of each node. Among them, the current graph attention layer can be any graph attention layer, and the execution steps of each graph attention layer are the same. The difference is that if the current graph attention layer is the first graph attention layer, the input node features of the node are the initial node features of the node. If the current graph attention layer is not the first graph attention layer, the input node features of the node are the aggregated node features of the node obtained by the previous graph attention layer, and the output of the last graph attention layer is the input data of the output layer.

[0080] In the above implementation, there are also multiple implementations for the step of "calculating the attention coefficients between the node and each adjacent node based on the input node features of the node in the current graph attention layer". The specific implementation is not limited here. Here, one implementation is used for explanation: first, for the target node and the target adjacent node of the target node, the current graph attention layer calculates the product of the input node features of the target node in the current graph attention layer and the representation conversion matrix of the current graph attention layer to obtain the first result, and calculates the product of the input node features of the target adjacent node in the current graph attention layer and the representation conversion matrix of the current graph attention layer to obtain the second result. Finally, the first result and the second result are concatenated and then inner product operation is performed with the attention vector of the current graph attention layer to obtain the attention coefficient between the target node and the target adjacent node. Among them, the target node is any node in the terminal behavior graph, the target adjacent node is any adjacent node of the target node in the terminal behavior graph, the representation conversion matrix and the attention vector are parameters of the graph attention layer, and the representation conversion matrix and attention vector of each layer of the graph attention layer are different. Specifically, this implementation can be calculated by the following formula:

[0081] e ij =a([Wh i ||Wh j ]);

[0082] Among them, e ijrepresents the attention coefficient of the jth node relative to the ith node (two nodes are adjacent nodes to each other), a is the attention vector of the current graph attention layer, W is the representation conversion matrix of the current graph attention layer, and h i is the input node feature of the i-th node in the current graph attention layer, h j is the input node feature of the jth node in the current graph attention layer, Wh i is the first result related to the i-th node, Wh j is the first result related to the jth node. i and Wh j The calculation result is two vectors, and the two vertical lines represent the concatenation of the two vectors.

[0083] In the above implementation, there are also multiple implementations for the step of "normalizing the attention coefficient between the node and each adjacent node to obtain the normalized attention coefficient between the node and each adjacent node", which is not limited here, and is described here with the following formula:

[0084]

[0085] Among them, α ij is the normalized attention coefficient, k represents any node in the set N of neighboring nodes of the i-th node, e ij represents the attention coefficient of the jth node relative to the i-th node, e ik Represents the attention coefficient of the kth node relative to the i-th node.

[0086] In the above implementation, there are also multiple implementations for the step of "obtaining the aggregate node features of the node based on the input node features of each adjacent node of the node in the current graph attention layer and the normalized attention coefficients between the node and each adjacent node", which are not limited here. Here, two implementations are described: The first is to use the input node features of all adjacent nodes of the node and the corresponding normalized attention coefficients to perform a weighted average operation to obtain the aggregate node features of the node in the current graph attention layer. For example, if a node has only two adjacent nodes, the input node features are a and b, the normalized attention coefficients are c and d respectively, then the aggregate node feature of the node is (a*c+b*d) / (c+d); the second is to concatenate the input node features of all nodes whose normalized attention coefficients are greater than the preset coefficient threshold among all adjacent nodes of the node or to perform weighted averaging based on the normalized attention coefficient to obtain the aggregate node feature of the node in the current graph attention layer. For example, if a node has three adjacent nodes, their normalized attention coefficients are 0.2, 0.7 and 0.8 respectively. If the preset coefficient threshold is 0.5, the first adjacent node does not participate in the weighted average calculation.

[0087] 303. Determine the object feature of the detection object according to the updated node feature of each node;

[0088] According to the updated node features of each node, the object features of the detection object are determined, wherein the detection object includes the nodes, edges and sub-nodes of the terminal behavior graph. Figure 3 At least one of the above. The specific steps are determined by the type of the current anomaly detection model. If the current anomaly detection model is a model trained on labeled nodes, and the detection objects include nodes in the terminal behavior graph, then the implementation method of this step is: determine the updated node features corresponding to each node as the object features of each node, that is, directly determine the updated node features as object features. If the current anomaly detection model is a model trained on labeled edges, and the detection objects include edges in the terminal behavior graph, then the implementation method of this step is: concatenate or weighted average the updated node features of two adjacent nodes in the terminal behavior graph to obtain the object features of each edge of the terminal behavior graph. If the current anomaly detection model is a model trained on labeled subgraphs, the detection object includes a subgraph of the terminal behavior graph, and the anomaly detection model also includes a pooling layer, then the implementation method of this step is: first input the terminal behavior graph and the updated node features of each node into the pooling layer of the anomaly detection model for graph clustering operation to obtain at least one terminal behavior subgraph, and then the pooling layer performs maximum pooling or average pooling on the updated node features of the nodes in each terminal behavior subgraph to obtain the object features of each terminal behavior subgraph. Among them, the pooling layer is used to summarize the node information to extract the coarse-grained features of the graph, which helps to capture the overall structural information of the graph. This process is similar to the pooling operation in the convolutional neural network to form at least one subgraph. There are many graph clustering methods for the pooling layer, which can be selected according to actual needs, and the specific ones are not limited here. Maximum pooling is to determine the maximum value of the node features of the nodes in the subgraph as the object feature of the subgraph, and average pooling is to use the node features of the nodes in the subgraph and the preset pooling parameters for weighted averaging, and the result is the object feature of the subgraph. If the detection object includes nodes, edges and subgraphs, all the above-mentioned implementation methods must be executed.

[0089] 304. Inputting the object features of the detection object into the classifier of the anomaly detection model to obtain a detection result of whether the detection object is abnormal;

[0090] The object features of the detection object are input into the classifier of the anomaly detection model to obtain the detection result of whether the detection object is abnormal. Specifically, the classifier has trained classifier parameters, and the object features of the detection object are calculated with the classifier parameters to obtain the corresponding score value, and then determine whether the score value is greater than or equal to the preset score threshold. If so, the detection object corresponding to the score value is abnormal, otherwise, it means that the detection object corresponding to the score value is normal. Alternatively, after calculating the score value, determine whether the score value is in a specific interval to detect whether the detection object is abnormal. There are other detection methods, which are not limited here.

[0091] In addition, the training process of the anomaly detection model is explained. First, historical alarm data is obtained from the historical alarm database, and redundant data is cleaned (that is, duplicate alarm data with the same content but different timestamps are deleted, leaving only one copy) and data standardization (alarms with consistent field semantics but inconsistent field value ranges are standardized. For example, system A uses 0-5 points to represent the degree of risk, and system B uses 0-100 points to represent the degree of risk, but 5 points in A and 100 points in B have the same meaning. Therefore, during preprocessing, the scores of A and B are uniformly scaled to 0-10 points), and then the historical alarm data is mapped to a training graph, and the training graph and the initial node features of the nodes in the training graph are input into the graph of the untrained model. In the force network, in the graph attention network, at least one graph attention layer and an output layer are included, and all graph attention layers are connected in series. The last graph attention layer is connected to the output layer. The initial attention vector and the initial representation feature matrix of the graph attention layer are randomly generated at the beginning. After the combination is operated, the output data of the output layer is obtained, that is, the updated node features. If it is necessary to detect the node, the relevant nodes need to be labeled and relevant steps need to be designed. The updated node features are directly input into the classifier to obtain the corresponding training results. The training results are compared with the labels to update the initial attention vector, the initial representation conversion matrix and the weight of the classifier until the training result is completed when the difference between the training result and the label is less than a certain value. Similarly, if it is necessary to detect the edge, the relevant nodes need to be labeled and relevant steps need to be designed for training. After the edge features are obtained according to the updated node features, they are input into the classifier for training. If it is necessary to detect the subgraph, the relevant subgraph needs to be labeled and relevant steps need to be designed for training. After the subgraph features are obtained according to the updated node features, they are input into the classifier for training. The training steps are similar and will not be repeated here.

[0092] 305. Sampling the detection results to update the anomaly detection model using the erroneous detection samples in the sampling results.

[0093] The test results are sampled to update the anomaly detection model using the error detection samples in the sampled results. Specifically, the test results are sampled and then judged whether they are accurate. If the test results are inaccurate, the error detection samples are input into the anomaly detection model to update the parameters in the anomaly detection model to ensure the accuracy of the anomaly detection model detection.

[0094] In this embodiment, a terminal behavior graph of the terminal set is first generated according to the alarm data of each terminal in the terminal set, and then the terminal behavior graph and the initial node features of each node in the terminal behavior graph are input into the pre-trained anomaly detection model, and the graph attention network in the anomaly detection model updates the initial node features of each node according to the terminal behavior graph to obtain the updated node features of each node, and then the object features of the detection object are determined according to the updated node features of each node, and then the object features of the detection object are input into the classifier of the anomaly detection model to obtain the detection result of whether the detection object is abnormal, and finally sampling is performed to update the anomaly detection model using the error detection samples in the sampling results. . By using a pre-trained anomaly detection model including a graph attention network for detection, the relationship between the terminals can be used to assign relative importance, and the detection efficiency is high, which brings convenience to network security personnel. The accuracy of the anomaly detection model is ensured by sampling and retraining, and the accuracy is improved.

[0095] A terminal abnormality detection method in an embodiment of the present application is described above, and a terminal abnormality detection device in an embodiment of the present application is described below. Figure 4 , an embodiment of a terminal abnormality detection device in an embodiment of the present application includes:

[0096] A generating unit 401 is configured to generate a terminal behavior graph of the terminal set according to the alarm data of each terminal in the terminal set, wherein each node in the terminal behavior graph represents one of the terminals, each edge represents the behavior between the terminals, and each of the nodes corresponds to an initial node feature, and the initial node feature is obtained from the alarm data of the terminal represented by the node;

[0097] A processing unit 402 is used to input the terminal behavior graph and the initial node feature of each node in the terminal behavior graph into a pre-trained anomaly detection model, and the graph attention network in the anomaly detection model updates the initial node feature of each node according to the terminal behavior graph to obtain an updated node feature of each node;

[0098] The determination unit 403 is used to determine the object features of the detection object according to the updated node features of each node, and the detection object includes the nodes, edges and sub-nodes of the terminal behavior graph. Figure 3At least one of the following;

[0099] The processing unit 402 is further configured to obtain a detection result of whether the detection object is abnormal according to the object characteristics of the detection object.

[0100] In the embodiment of the present application, the generating unit 401 first generates a terminal behavior graph of the terminal set according to the alarm data of each terminal in the terminal set, and then the processing unit 402 inputs the terminal behavior graph and the initial node features of each node in the terminal behavior graph into the pre-trained anomaly detection model, and the graph attention network in the anomaly detection model updates the initial node features of each node according to the terminal behavior graph to obtain the updated node features of each node, and the determining unit 403 determines the object features of the detection object according to the updated node features of each node, and finally obtains the detection result of whether the detection object is abnormal according to the object features of the detection object. By performing detection through a pre-trained anomaly detection model including a graph attention network, it is possible to use the relationship between terminals to assign relative importance, and the detection efficiency is high, which brings convenience to network security personnel.

[0101] The following is a detailed description of a terminal abnormality detection device in an embodiment of the present application. Figure 5 Another embodiment of a terminal abnormality detection device according to an embodiment of the present application includes:

[0102] A generating unit 501 is configured to generate a terminal behavior graph of the terminal set according to the alarm data of each terminal in the terminal set, wherein each node in the terminal behavior graph represents one of the terminals, each edge represents the behavior between the terminals, and each of the nodes corresponds to an initial node feature, and the initial node feature is obtained from the alarm data of the terminal represented by the node;

[0103] A processing unit 502 is used to input the terminal behavior graph and the initial node feature of each node in the terminal behavior graph into a pre-trained anomaly detection model, and the graph attention network in the anomaly detection model updates the initial node feature of each node according to the terminal behavior graph to obtain an updated node feature of each node;

[0104] The determination unit 503 is used to determine the object features of the detection object according to the updated node features of each node, and the detection object includes the nodes, edges and sub-nodes of the terminal behavior graph. Figure 3 At least one of the following;

[0105] The processing unit 502 is further configured to input the object features of the detection object into the classifier of the anomaly detection model to obtain a detection result of whether the detection object is abnormal.

[0106] The processing unit 502 is specifically used for:

[0107] The current graph attention layer determines, for each of the nodes: at least one adjacent node of the node is determined according to the terminal behavior graph, and the attention coefficients between the node and each adjacent node are calculated according to the input node features of the node in the current graph attention layer; the attention coefficients between the node and each adjacent node are normalized to obtain the normalized attention coefficients between the node and each adjacent node; based on the input node features of each adjacent node of the node in the current graph attention layer and the normalized attention coefficients between the node and each adjacent node, the aggregate node features of the node are obtained;

[0108] Inputting the aggregated node features of each of the nodes obtained by the last graph attention layer into the output layer for nonlinear processing to obtain updated node features of each of the nodes;

[0109] Among them, if the current graph attention layer is the first graph attention layer, the input node feature of the node is the initial node feature of the node; if the current graph attention layer is not the first graph attention layer, the input node feature of the node is the aggregated node feature of the node obtained by the previous graph attention layer.

[0110] The processing unit 502 is specifically used for:

[0111] For a target node and a target adjacent node of the target node, the current graph attention layer calculates the product of the input node feature of the target node in the current graph attention layer and the representation conversion matrix of the current graph attention layer to obtain a first result, and calculates the product of the input node feature of the target adjacent node in the current graph attention layer and the representation conversion matrix of the current graph attention layer to obtain a second result;

[0112] The first result and the second result are concatenated and then an inner product operation is performed with the attention vector of the current graph attention layer to obtain an attention coefficient between the target node and the target adjacent node;

[0113] The target node is any node in the terminal behavior graph, and the target adjacent node is any adjacent node of the target node in the terminal behavior graph.

[0114] The processing unit 502 is specifically used for:

[0115] Perform a weighted average operation using the input node features of all neighboring nodes of the node and the corresponding normalized attention coefficients to obtain an aggregated node feature of the node at the current graph attention layer;

[0116] or,

[0117] The input node features of all nodes in all adjacent nodes of the node whose normalized attention coefficients are greater than a preset coefficient threshold are concatenated or weighted averaged based on the normalized attention coefficients to obtain the aggregated node features of the node in the current graph attention layer.

[0118] The determining unit 503 is specifically used for:

[0119] The updated node features corresponding to each of the nodes are respectively determined as object features of each of the nodes.

[0120] The determining unit 503 is specifically used for:

[0121] The updated node features of two nodes that are adjacent to each other in the terminal behavior graph are concatenated or weighted averaged to obtain the object features of each edge of the terminal behavior graph.

[0122] The determining unit 503 is specifically used for:

[0123] Inputting the terminal behavior graph and the updated node features of each of the nodes into the pooling layer of the anomaly detection model to perform a graph clustering operation to obtain at least one terminal behavior subgraph;

[0124] The pooling layer performs maximum pooling or average pooling processing on the updated node features of the nodes in each of the terminal behavior subgraphs to obtain the object features of each of the terminal behavior subgraphs.

[0125] The functions and processes performed by each unit in the terminal abnormality detection device of this embodiment are similar to those of the aforementioned Figures 1 to 3 The functions and processes performed by the terminal anomaly detection device are similar and will not be repeated here.

[0126] Figure 6 It is a schematic diagram of the structure of a terminal anomaly detection device provided in an embodiment of the present application. The terminal anomaly detection device 600 may include one or more central processing units (CPU) 601 and a memory 605. The memory 605 stores one or more application programs or data.

[0127] The memory 605 may be a volatile storage or a persistent storage. The program stored in the memory 605 may include one or more modules, each of which may include a series of instruction operations in the terminal abnormality detection device 600. Furthermore, the central processor 601 may be configured to communicate with the memory 605 and execute a series of instruction operations in the memory 605 on the terminal abnormality detection device 600.

[0128] The terminal anomaly detection device 600 may also include one or more power supplies 602, one or more wired or wireless network interfaces 603, one or more input and output interfaces 604, and / or one or more operating systems, such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, etc.

[0129] The CPU 601 can execute the aforementioned Figures 1 to 3 The operations performed by the terminal anomaly detection device in the illustrated embodiment will not be described in detail here.

[0130] An embodiment of the present application also provides a computer-readable storage medium, including instructions, which, when executed on a computer, enable the computer to execute the method in the aforementioned embodiment.

[0131] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0132] It should be noted that, although the steps in the flowcharts involved in the embodiments are drawn in sequence according to the instructions of the arrows, unless otherwise clearly stated in this document, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0133] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0134] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0135] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0136] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), disk or optical disk and other media that can store program code.

Claims

1. A terminal anomaly detection method, characterized in that: include: Generate a terminal behavior graph of the terminal set according to the alarm data of each terminal in the terminal set, wherein each node in the terminal behavior graph represents one of the terminals, each edge represents the behavior between the terminals, and each of the nodes corresponds to an initial node feature, and the initial node feature is obtained from the alarm data of the terminal represented by the node; Inputting the terminal behavior graph and the initial node features of each node in the terminal behavior graph into a pre-trained anomaly detection model, and using a graph attention network in the anomaly detection model to update the initial node features of each node according to the terminal behavior graph to obtain updated node features of each node; Determine, according to the updated node feature of each of the nodes, an object feature of a detection object, wherein the detection object includes at least one of a node, an edge, and a subgraph of the terminal behavior graph; A detection result of whether the detection object is abnormal is obtained according to the object characteristics of the detection object.

2. The terminal anomaly detection method according to claim 1, characterized in that: The step of obtaining a detection result of whether the detection object is abnormal according to the object feature of the detection object includes: The object features of the detection object are input into the classifier of the anomaly detection model to obtain a detection result of whether the detection object is abnormal.

3. The terminal anomaly detection method according to claim 1, characterized in that: The graph attention network includes at least one graph attention layer, and the graph attention network in the anomaly detection model updates the initial node feature of each of the nodes according to the terminal behavior graph to obtain the updated node feature of each of the nodes, including: The current graph attention layer calculates the normalized attention coefficients between the node and each adjacent node in the terminal behavior graph according to the input node features of the node in the current graph attention layer; based on the input node features corresponding to the node and the normalized attention coefficients, the aggregate node features of the node are obtained; Nonlinearly process the aggregated node features of each of the nodes obtained by the last graph attention layer to obtain updated node features of each of the nodes; Among them, if the current graph attention layer is the first graph attention layer, the input node features of the node are the initial node features of the node; if the current graph attention layer is not the first graph attention layer, the input node features of the node are the aggregated node features of the node obtained by the previous graph attention layer.

4. The terminal anomaly detection method according to claim 3, characterized in that: The calculating, according to the input node feature of the node in the current graph attention layer, the normalized attention coefficient between the node and each adjacent node in the terminal behavior graph, includes: For a target node and a target adjacent node of the target node, the current graph attention layer calculates the product of the input node feature of the target node in the current graph attention layer and the representation conversion matrix of the current graph attention layer to obtain a first result, and calculates the product of the input node feature of the target adjacent node in the current graph attention layer and the representation conversion matrix of the current graph attention layer to obtain a second result; The first result and the second result are concatenated and then an inner product operation is performed with the attention vector of the current graph attention layer, and the inner product operation result is normalized to obtain a normalized attention coefficient between the target node and the target adjacent node; The target node is any node in the terminal behavior graph, and the target adjacent node is any adjacent node of the target node in the terminal behavior graph.

5. The terminal anomaly detection method according to claim 3, characterized in that: The obtaining, based on the input node feature corresponding to the node and the normalized attention coefficient, an aggregate node feature of the node includes: Perform a weighted average operation using the input node features of all neighboring nodes of the node and the corresponding normalized attention coefficients to obtain an aggregated node feature of the node at the current graph attention layer; or, The input node features of all nodes in all adjacent nodes of the node whose normalized attention coefficients are greater than a preset coefficient threshold are concatenated or weighted averaged based on the normalized attention coefficients to obtain the aggregated node features of the node in the current graph attention layer.

6. The terminal anomaly detection method according to claim 1, characterized in that: The detection object includes nodes of the terminal behavior graph; and determining the object feature of the detection object according to the updated node feature of each of the nodes includes: The updated node features corresponding to each of the nodes are respectively determined as object features of each of the nodes.

7. The terminal anomaly detection method according to claim 1, characterized in that: The detection object includes an edge of the terminal behavior graph, and determining the object feature of the detection object according to the updated node feature of each of the nodes includes: The updated node features of two nodes that are adjacent to each other in the terminal behavior graph are concatenated or weighted averaged to obtain the object features of each edge of the terminal behavior graph.

8. The terminal anomaly detection method according to claim 1, characterized in that: The detection object includes a subgraph of the terminal behavior graph, and determining the object feature of the detection object according to the updated node feature of each of the nodes includes: Inputting the terminal behavior graph and the updated node features of each of the nodes into the pooling layer of the anomaly detection model to perform a graph clustering operation to obtain at least one terminal behavior subgraph; The pooling layer performs maximum pooling or average pooling processing on the updated node features of the nodes in each of the terminal behavior subgraphs to obtain the object features of each of the terminal behavior subgraphs.

9. A terminal abnormality detection device, characterized in that: include: A generating unit, configured to generate a terminal behavior graph of the terminal set according to the alarm data of each terminal in the terminal set, wherein each node in the terminal behavior graph represents one of the terminals, each edge represents the behavior between the terminals, and each of the nodes corresponds to an initial node feature, and the initial node feature is obtained from the alarm data of the terminal represented by the node; A processing unit, configured to input the terminal behavior graph and the initial node feature of each node in the terminal behavior graph into a pre-trained anomaly detection model, and update the initial node feature of each node according to the terminal behavior graph by a graph attention network in the anomaly detection model to obtain an updated node feature of each node; a determining unit, configured to determine an object feature of a detection object according to the updated node feature of each of the nodes, wherein the detection object includes at least one of a node, an edge, and a subgraph of the terminal behavior graph; The processing unit is further used to obtain a detection result of whether the detection object is abnormal according to the object characteristics of the detection object.

10. A terminal abnormality detection device, characterized in that: include: CPU, memory and input / output interface; The memory is a short-term storage memory or a persistent storage memory; The central processing unit is configured to communicate with the memory and execute instructions in the memory to perform the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The method comprises instructions, which, when executed on a computer, cause the computer to execute the method according to any one of claims 1 to 8.

Images