An APT detection method based on semantic enhancement and attention mechanism

Abstract

The present invention belongs to the security research field of advanced persistent threat detection, and specifically relates to an APT detection method based on semantic enhancement and attention mechanism. The present invention includes collecting and parsing system logs, constructing a traceability graph according to the parsed system logs; obtaining a summary sentence of each node according to the attributes of the nodes and the types of the edges of the traceability graph, inputting the summary sentence into the BERT model, and extracting the attribute semantic feature vector representation of the nodes in the traceability graph; generating a subgraph of each node according to the nodes in the traceability graph, and extracting the feature matrix of each subgraph using a self-attention graph convolutional network as the node feature vector representation of each subgraph; inputting the node feature vector representation of the node to be detected into a lightweight classifier for anomaly detection. The present invention deeply mines and understands the semantic information of the log, deeply mines the encoding structure and causal information of the traceability graph, and improves the accuracy and efficiency of APT attack detection.

Description

Technical Field

[0001] The present invention belongs to the security research field of advanced persistent threat detection, and specifically relates to an APT detection method based on semantic enhancement and attention mechanism. Background Art

[0002] In recent years, there has been a significant increase in advanced persistent threats (APTs), and the means of such attacks have become increasingly complex and covert, bringing great challenges and pressure to network security. The high variability and covertness of APT attacks make their detection and defense particularly difficult. Most current studies on APT detection and investigation have adopted a provenance graph-based approach, using a provenance graph to describe the interactions between entities in a system. A provenance graph is a directed graph obtained from audit log analysis that represents the causal relationships between entities. The entities in the provenance graph include each unique and representative interaction subject and object in the audit log. By interconnecting isolated system events, it helps to identify causal relationships and track data lineage, thereby providing rich context for identifying the nature of system events. At the same time, advanced graph algorithms can also be applied in audit log analysis.

[0003] However, in the modern network security field facing advanced persistent threat (APT) attack detection, traditional provenance graph-based detection systems face many challenges. High false positive rate. Existing APT detection ignores system time and causal ordering when processing system logs and audit records with complex semantic information, such as important semantic information such as process names and command line parameters, and cannot fully explore and understand deep semantic relationships. High false negative rate. When processing large-scale graphs, many APT detections identify malicious subgraphs rather than single malicious nodes, and have limitations in capturing complex relationships between nodes and dynamic weight assignments. Low efficiency. In many existing methods, GNN (graph neural network) is used to extract structural information from the provenance graph to improve detection by capturing the relationship between neighboring nodes. However, the high computational requirements of GNN may hinder the detection performance of the system. Summary of the invention

[0004] The purpose of the present invention is to solve the problems of high false alarm rate, high missed alarm rate and low efficiency in current APT detection, and propose an APT detection method based on semantic enhancement and attention mechanism, which deeply mines and understands the semantic information of logs, deeply mines the coding structure and causal information of traceability graphs, and improves the accuracy and efficiency of APT attack detection.

[0005] In order to achieve the above object, the technical solution provided by the present invention is:

[0006] An APT detection method based on semantic enhancement and attention mechanism, comprising:

[0007] Collect and parse system logs, and build a traceability graph based on the parsed system logs;

[0008] Prune and optimize the traceability graph according to the traceability graph optimization rules;

[0009] Generate attribute semantic feature vector representation of nodes in the traceability graph through a BERT model, wherein the BERT model is a BERT model pre-trained using summary sentences on a benign system;

[0010] Generate a subgraph of each node according to the nodes in the traceability graph, and extract the feature matrix of each subgraph using the self-attention graph convolutional network according to the attribute semantic feature vector representation of the node as the node feature vector representation of each node;

[0011] The node feature vector representation of the node to be detected is input into the lightweight classifier to obtain the probability value of the node being an abnormal node. If the probability value is greater than a preset threshold, the current node is an abnormal node, otherwise, the current node is a benign node.

[0012] Furthermore, it also includes:

[0013] Construct a key-value database, where the key is a persistent node identifier and the value includes the node feature vector representation output by the self-attention graph convolutional network and the set of neighbor nodes associated with the corresponding node;

[0014] If the node attribute of the node to be detected is consistent with the persistent node identifier stored in the key-value database, and the Dice coefficient of the neighbor node set corresponding to the persistent node identifier stored in the key-value database and the current neighbor node set of the node to be detected is 1, then the node feature vector representation stored in the key-value database is assigned to the node to be detected, and the node feature vector representation stored in the key-value database is input into the lightweight classifier. Otherwise, the node feature vector representation obtained by the self-attention graph convolutional network is input into the lightweight classifier to classify the node to be detected, where the calculation formula of the Dice coefficient is as follows:

[0015] ;

[0016] in, represents the Dice coefficient, Represents a set of neighbor nodes in a key-value database, Represents the current neighbor node set of the node to be detected, Representing a collection and The number of elements in the intersection of and Respectively represent sets and collection The number of elements.

[0017] Furthermore, collecting and parsing system logs, and constructing a traceability graph according to the parsed system logs, includes:

[0018] Collect system logs;

[0019] Set the batch size P, where P is the number of system events in each log batch, and parse each log batch in chronological order;

[0020] The parsed system log is converted into a traceability graph, wherein the traceability graph includes nodes and edges, wherein the nodes include process nodes and object nodes, and the edges have attribute labels.

[0021] Furthermore, the pruning optimization of the traceability graph according to the traceability graph optimization rule includes:

[0022] Ignore user IDs for process nodes and file nodes, and merge similar behaviors among multiple users;

[0023] If there are multiple identical edges between two nodes, the multiple identical edges are merged into one edge, and the number of identical edges is used as the attribute label of the merged edge;

[0024] Delete the edges between files that are temporarily created by process nodes and do not interact with other process nodes;

[0025] If a process node points to itself, delete the edge pointing to the current process node.

[0026] Furthermore, the attribute semantic feature vector representation of the node in the traceability graph is generated by the BERT model, and the BERT model is a BERT model pre-trained using summary sentences on a benign system, including:

[0027] Generate summary sentences by combining the attributes and causal events between nodes and their one-hop neighbors;

[0028] On benign system logs, the BERT model is pre-trained by using summary sentences;

[0029] The BERT model is used to encode the attributes of the node into a fixed-length attribute semantic feature vector representation.

[0030] Furthermore, the subgraph of each node is generated according to the nodes in the traceability graph, and the feature matrix of each subgraph is extracted by using the self-attention graph convolutional network as the node feature vector representation of each subgraph, including:

[0031] The attribute semantic feature vector representation is used as the initial feature vector of the node;

[0032] Generate a subgraph for each node in the traceability graph ,in, Representation Node and Node The set of K-hop neighboring nodes of represents a set of edges;

[0033] Initialize the initial feature vector of each node in the provenance graph, generate the subgraph matrix of each node according to the provenance graph, and use the self-attention graph convolutional network to extract the feature matrix of each subgraph as the node feature vector representation of each subgraph.

[0034] Furthermore, the method of extracting a feature matrix of each subgraph using a self-attention graph convolutional network as a node feature vector representation of each subgraph includes:

[0035] The node subgraph matrix is ​​transformed linearly to obtain the Query matrix, Key matrix and Value matrix;

[0036] The self-attention score matrix is ​​calculated based on the Query matrix, Key matrix and Value matrix. The calculation formula is as follows:

[0037] ;

[0038] in, represents the self-attention score matrix, represents the dimension of the Key matrix, represents the Query matrix, Represents the transpose of the Key matrix;

[0039] The subgraph matrix of the node is used as the original adjacency matrix, and the original adjacency matrix is ​​aggregated to construct an enhanced adjacency matrix, which is expressed as follows:

[0040] ;

[0041] in, Represents the first node obtained by aggregating the node features of the subgraph based on the original adjacency matrix Layer node feature vector representation, is the initial eigenvector of the node, is the regularized original adjacency matrix, represents the original adjacency matrix, is the degree matrix, Indicates The node feature vector representation of the layer based on the original adjacency matrix, It is The weight matrix to be learned of the layer, represents the number of feature aggregations, ReLU activation function.

[0042] By selecting the first r maximum values ​​of the self-attention score matrix or exceeding the threshold The elements of construct a sparse enhanced adjacency matrix, which is expressed as follows:

[0043] ;

[0044] in, represents the i-th row and j-th column of the sparse enhanced adjacency matrix, represents the i-th row and j-th column of the self-attention score matrix;

[0045] The sparse enhanced adjacency matrix is ​​symmetric and expressed as follows:

[0046] ;

[0047] in, represents the j-th row and i-th column of the sparse enhanced adjacency matrix;

[0048] Aggregating the sparse enhanced adjacency matrix to obtain the node feature vector representation based on the enhanced adjacency matrix;

[0049] ;

[0050] in, represents the first node obtained by aggregating the node features of the subgraph based on the enhanced adjacency matrix Layer node feature vector representation, is the initial eigenvector of the node, represents the regularized enhanced adjacency matrix, represents the enhanced adjacency matrix, is the degree matrix, Indicates The node feature vector representation of the layer based on the enhanced adjacency matrix, Represents the weight matrix to be enhanced and learned in the mth layer;

[0051] The node feature vector representation of the subgraph obtained by aggregating the node features of the subgraph based on the original adjacency matrix and the enhanced adjacency matrix is ​​fused to obtain the node feature vector representation of the subgraph.

[0052] Compared with the prior art, the present invention has the following significant advantages: 1. It proposes an APT attack detection framework based on a provenance graph, which combines the model learning technology of semantics and attention mechanism to help security analysts quickly detect attacks from audit logs. 2. The BERT semantic encoder is introduced to capture the semantic information of node attributes. The BERT model is used to deeply understand the semantic information in the system log, so that the nodes in the provenance graph have rich semantic attributes, which helps to identify complex APT attack patterns. 3. A context encoder based on a self-attention graph convolutional network and a persistent database design are adopted. The interactions between nodes are effectively encoded through the self-attention graph convolutional network, and a persistent database is designed to quickly access key information, thereby improving the accuracy and efficiency of APT attack detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 This is a flow chart of an APT detection method based on semantic enhancement and attention mechanism of the present invention. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0055] like Figure 1 As shown, the present invention provides an APT detection method based on semantic enhancement and attention mechanism, comprising the following steps:

[0056] (1) Parsing logs, building and optimizing traceability graphs: Parse system logs such as Windows event logs or Linux audit logs, define the entities and behaviors involved, and build a traceability graph representing the system behavior on this basis. Implement multi-dimensional traceability graph optimization rules while preserving semantics.

[0057] (1-1) Parsing log:

[0058] Parse system logs, such as Windows event logs or Linux audit logs. These logs include host event records, such as process execution, file operations, network connections, and modules. System logs are semi-structured data that need to be converted into structured data through parsing operations to extract useful information. Use batch system logs to manage real-time log collection, and the batch size P is set to the number of system events per batch. Then perform sequential operations on each log batch and convert it into a traceability graph for subsequent analysis. Set the batch size P to control how much data is processed at a time, thereby controlling the size of the traceability graph formed.

[0059] (1-2) Constructing a traceability graph:

[0060] Construct a data traceability diagram based on the parsed data ,in represents the set of nodes in the graph, Represents a set of edges. The graph is mainly composed of two types of nodes: process nodes and object nodes. Object nodes cover files, network flows, modules, and other system objects. The edges between these nodes are labeled, indicating the event type (such as system calls), showing the causal relationship between nodes and the timestamp of the event. These attributes provide more context and detailed information. Connect process nodes and object nodes to generate a traceability graph, with the direction from process nodes to object nodes. Table 1 is a summary of the nodes and edges in the traceability graph, where Subject represents the subject, including Process; Object represents the object, including: process, file, socket, module; Attributes represents attributes, including: name, command line, file path, src / dest ip; Relations represents relationships, including: fork / clone, read, write, execute, recv, send, connect.

[0061] Table 1 Summary of nodes and edges in the provenance graph

[0062]

[0063] (1-3) Graph optimization:

[0064] On the basis of preserving semantics, the traceability graph is pruned and optimized. The specific rules are as follows:

[0065] ① Entity merging: Ignore user IDs for process nodes and file nodes, and merge similar behaviors between multiple users. Specifically, nodes or edges with different user-specific attributes are considered the same. For example, the file path / Users / Tim / .sh can be abstracted into / Users / * / .sh. This not only reduces the number of nodes in the graph, but also reduces the complexity of analysis. For example, for process instances that execute the same command multiple times, they can be merged into a representative process node.

[0066] ② Edge simplification: Analyze the importance and influence of edges, and remove or merge unimportant or low-influence edges in the graph. Specifically, if there are multiple edges between two nodes representing the same relationship, these edges can be merged into one edge, and the frequency of this relationship is recorded in the attributes of the edge. There are also deletion events for files that are temporarily created by a process and have never interacted with other processes, as well as exit events represented by self-loops of process nodes.

[0067] (2) Node feature extraction: The BERT model receives the provenance graph, extracts the attribute semantic feature vector representation of the nodes in the provenance graph, generates a subgraph for each node on this basis, and extracts the subgraph structure feature vector representation as the final node feature vector representation.

[0068] (2-1) Extract the attribute semantic feature vector representation of the nodes in the traceability graph:

[0069] System logs contain rich attributes related to various system entities. These attributes, such as process names and file paths, first need to be encoded into vector space so that the model can utilize them.

[0070] This embodiment will consider the following node attributes of each node type: process name and command line parameters of process nodes, file path of file nodes, network IP address and port of socket nodes, module name of module nodes. A summary sentence is formed for each node by combining the attributes and causal event (system call, i.e., Relations in Table 1) types between the node and its one-hop neighbor. System events are sorted by timestamp to maintain chronological order. Then, each summary sentence is pre-trained on a benign system log using the BERT model. The BERT model is used to encode the node attributes in the provenance graph into a fixed-length vector.

[0071] Example scenario:

[0072] For example, assume that this embodiment includes a system log that describes the following events:

[0073] 1. Process A (named / usr / bin / python) executed a command python script.py.

[0074] 2. Process A reads a file File1 (path is / home / user / data.txt).

[0075] 3. Process A writes a file File2 (path is / home / user / output.log).

[0076] 4. Process A sent data through socket Socket1 (IP address 192.168.1.2, port 8080).

[0077] Tracing graph construction:

[0078] Node V1: Process A ( / usr / bin / python).

[0079] Node V2: File File1 ( / home / user / data.txt).

[0080] Node V3: File File2 ( / home / user / output.log).

[0081] Node V4: Socket Socket1 (192.168.1.2:8080).

[0082] Neighbor Relations and Causal Events:

[0083] V1 -> V2: Process A reads File1 (system call: read).

[0084] V1 -> V3: Process A writes to File2 (system call: write).

[0085] V1 -> V4: Process A sends data through Socket1 (system call: send).

[0086] Concluding Sentence Formation:

[0087] For node V1 (process A), the summary sentence can be formed by combining the attributes and event types of V1 and its 1-hop neighbors (V2, V3, V4):

[0088] "Process ' / usr / bin / python' with command 'python script.py' reads file ' / home / user / data.txt', writes to file ' / home / user / output.log', and sends datathrough socket '192.168.1.2:8080'.".

[0089] This summary sentence includes the attributes of node V1 (process name and command line parameters), as well as the attributes of its 1-hop neighbor nodes V2, V3, and V4 (file path and IP address), and describes the causal event types (read, write, send) between them.

[0090] (2-2) Extract subgraph structure feature vector representation:

[0091] In order to effectively identify the stealth attack nodes in the traceability graph, it is necessary to encode the K-hop neighbor nodes around each node. This embodiment proposes a new self-attention graph convolutional network to capture the structural information between nodes. The node attribute vector generated from the previous BERT model (i.e., the attribute semantic feature vector representation extracted in step (2-1)) is used as the initial feature vector of the node.

[0092] 1. Subgraph Representation Node and its K-hop neighborhood subgraph, containing the node set and edge set .

[0093] 2. Initialize node feature vector representation . Assume that each node in the traceability graph The initial eigenvector of , d represents the dimension of the node feature vector, and the node feature vector of the entire traceability graph is represented as ,in, Indicates the number of nodes in the traceability graph. , the corresponding node feature vector is expressed as ,Right now: .in, From the source map The node feature vector representation of The sub-graph extracted from The eigenvectors of the midpoints, Indicates the number of nodes in the subgraph.

[0094] 3. Self-Attention Enhanced Adjacency Matrix Utilize the self-attention mechanism and make full use of the feature information of the nodes to enhance the representation ability of the adjacency matrix.

[0095] Initialize node feature vector representation The Query, Key and Value matrices are obtained through linear transformation:

[0096] ;

[0097] ;

[0098] ;

[0099] in, , , are the Query matrix, Key matrix and Value matrix, Represents the weight matrix of the Query matrix to be learned, Represents the weight matrix of the Key matrix to be learned, Represents the weight matrix of the Value matrix to be learned.

[0100] Calculate the self-attention score matrix :

[0101] ;

[0102] in, is the dimension of the Key matrix, used for scaling to maintain numerical stability.

[0103] Constructing the enhanced adjacency matrix , by selecting the first r maximum values ​​or exceeding the threshold Elements of , construct a sparse enhanced adjacency matrix:

[0104] ;

[0105] in, represents the i-th row and j-th column of the sparse enhanced adjacency matrix, represents the i-th row and j-th column of the self-attention score matrix.

[0106] To ensure the symmetry of the matrix, the processing is as follows:

[0107] ;

[0108] in, represents the j-th row and i-th column of the sparse augmented adjacency matrix.

[0109] 4. Feature aggregation and update:

[0110] The node features of the subgraph are aggregated using the self-attention graph convolutional network to obtain a new node feature vector representation and update it. Here we consider two adjacency matrices: the original adjacency matrix and the enhanced adjacency matrix .

[0111] Aggregation using the original adjacency matrix:

[0112] ;

[0113] in: Represents the first node obtained by aggregating the node features of the subgraph based on the original adjacency matrix Layer node feature vector representation, is the initial eigenvector of the node, is the regularized original adjacency matrix, represents the original adjacency matrix, is the degree matrix, Indicates The node feature vector representation of the layer based on the original adjacency matrix, It is The weight matrix to be learned of the layer, Indicates the number of feature aggregations.

[0114] Aggregation using the augmented adjacency matrix:

[0115] ;

[0116] Likewise, represents the first node obtained by aggregating the node features of the subgraph based on the enhanced adjacency matrix Layer node feature vector representation, is the initial eigenvector of the node, and is obtained by Perform regularized aggregation, represents the regularized enhanced adjacency matrix, represents the enhanced adjacency matrix, is the degree matrix, Indicates The node feature vector representation of the layer based on the enhanced adjacency matrix, Represents the weight matrix to be enhanced and learned in the mth layer.

[0117] 5. Fusion of node representations at different levels:

[0118] Finally, the final representation of the subgraph is obtained by fusing the node representations at different levels. :

[0119] ;

[0120] in, Node representation using the original adjacency matrix and the enhanced adjacency matrix are included.

[0121] (3) Design of a persistent database: A dedicated key-value storage system was designed, which used attribute abstraction technology to remove specific information such as users and executions to generate generalized embeddings and applied the database to improve efficiency.

[0122] (3-1) Key-value database storage rules:

[0123] In order to efficiently retrieve and store the self-attention graph convolutional network output vectors during threat detection, a dedicated key-value database is constructed. The keys are designed as persistent node identifiers (PNIs) bound to node attributes that remain unchanged across different system executions. These attributes include process name, file path, module path, and network flow IP address. The corresponding values ​​encapsulate the node feature vector representation derived by the self-attention graph convolutional network, as well as the set of neighbor nodes associated with this specific node. Specific nodes are nodes with process file name, file path, module path, and network flow IP address.

[0124] To derive the PNI, we abstract the attributes to remove user and execution specific information, ensuring that the stored node feature vector representation is generalizable and can adapt to the data provenance graph on different hosts within the enterprise. To facilitate the abstraction process, we group the data provenance node types into different abstraction schemes:

[0125] 1. For process and file node types, user abstraction is performed to omit the user ID in the process name and file path, achieving a high degree of generalization. For example, the file path / Users / Mary / .txt is abstracted to / Users / * / .txt. This abstraction mechanism enables the system to leverage the embedding of similar behaviors across multiple users, significantly improving the ability to detect abnormal patterns.

[0126] 2. For the socket node type, network connection abstraction is performed to eliminate the start and end time, enhance the generalization ability of execution across different systems, and help the system focus on the structure and behavior of the node. For example, a socket node with the attributes IP:192.168.1.1, Port:22, Start:10:00:00, End:12:00:00 is abstracted to IP:192.168.1.1, Port:22, which only encapsulates the key connection information.

[0127] 3. For module nodes, module nodes have path and base address attributes. When the base address changes, the path remains unchanged in different executions. This mode only retains the module path, ensuring a consistent and generalizable representation of module nodes.

[0128] (3-2) Database application to optimize the performance of anomaly detection and reduce computational overhead.

[0129] By pre-calculating and storing node feature vector representations of nodes with stable subgraphs, the stored node feature vector representations can be quickly assigned to nodes with matching neighbor nodes during the detection phase, improving the performance and scalability of the detection process.

[0130] In order to determine whether the subgraph structure of the node in the detection phase matches the structure observed in the benign phase, this embodiment adopts the neighborhood set method. If it matches, the node is immediately assigned a stored node feature vector representation from the database. Conversely, if there is a difference in the neighboring nodes, the model will default to using BERT features for anomaly detection.

[0131] This embodiment uses the Dice coefficient to compare the storage and current neighborhood of a node. Before allocating the pre-stored node feature vector representation, the Dice coefficient index is defined as:

[0132] ;

[0133] in, Represents a set of neighbor nodes in a key-value database, Represents the current neighbor node set of the node to be detected, Representing a collection and The number of elements in the intersection of and Respectively represent sets and collection The number of elements, and It is calculated The coefficient has a value between 0 and 1.

[0134] In the detection phase, the node to be detected must meet the following two conditions to be assigned its stored node feature vector representation:

[0135] 1. The PNI of the node to be detected must exist as a key in the key-value database;

[0136] 2. The Dice coefficient between the stored neighborhood set corresponding to this PNI in the key-value database and the current neighborhood set of the node to be detected must be 1.

[0137] If the node to be detected meets the above conditions, it will be assigned a stored node feature vector representation; otherwise, this method relies on the BERT model and the self-attention graph convolutional network to generate the node feature vector representation, and uses a lightweight classifier to classify the node to be detected.

[0138] (4) Anomaly detection using lightweight classifier: The node feature vector in step (2) is sent to the lightweight classifier to detect abnormal nodes by comparing the predicted and actual node types. A threshold parameter is introduced to control the generation of alerts. This parameter limits the classification probability of the predicted category, reflecting the model's confidence in its prediction.

[0139] The node feature vector representation of the subgraph and the attribute semantic feature vector representation are merged and input into a lightweight classifier, and the probability of the node being an outlier is output.

[0140] This embodiment introduces a threshold parameter T to control the generation of an alarm. When the probability that a node is an abnormal value exceeds the threshold parameter T, the node issues an alarm, and it is considered that the node may be abnormal.

[0141] This scheme considers both neighbor nodes and node attributes to learn benign features related to various node types. Malicious entities often exhibit neighborhood structures and attributes that deviate from benign patterns. When the model encounters outliers during runtime, the malicious entity does not fit the learned node distribution and is marked as an abnormal node.

[0142] The present invention effectively solves key problems such as high false alarm rate, high missed alarm rate and low efficiency in APT attack detection, improves the depth of semantic understanding, accurately identifies complex attack patterns, and enhances detection efficiency and response capabilities.

[0143] The above-mentioned embodiments only express several implementation methods of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. An APT detection method based on semantic enhancement and attention mechanism, characterized in that: The APT detection method based on semantic enhancement and attention mechanism includes: Collect and parse system logs, and build a traceability graph based on the parsed system logs; Prune and optimize the traceability graph according to the traceability graph optimization rules; Generate attribute semantic feature vector representation of nodes in the traceability graph through a BERT model, wherein the BERT model is a BERT model pre-trained using summary sentences on a benign system; Generate a subgraph of each node according to the nodes in the traceability graph, and extract the feature matrix of each subgraph using the self-attention graph convolutional network according to the attribute semantic feature vector representation of the node as the node feature vector representation of each node; The node feature vector representation of the node to be detected is input into the lightweight classifier to obtain the probability value of the node being an abnormal node. If the probability value is greater than a preset threshold, the current node is an abnormal node, otherwise, the current node is a benign node.

2. The APT detection method based on semantic enhancement and attention mechanism according to claim 1 is characterized in that: Also includes: Construct a key-value database, where the key is a persistent node identifier and the value includes the node feature vector representation output by the self-attention graph convolutional network and the set of neighbor nodes associated with the corresponding node; If the node attribute of the node to be detected is consistent with the persistent node identifier stored in the key-value database, and the Dice coefficient of the neighbor node set corresponding to the persistent node identifier stored in the key-value database and the current neighbor node set of the node to be detected is 1, then the node feature vector representation stored in the key-value database is assigned to the node to be detected, and the node feature vector representation stored in the key-value database is input into the lightweight classifier. Otherwise, the node feature vector representation obtained by the self-attention graph convolutional network is input into the lightweight classifier to classify the node to be detected, where the calculation formula of the Dice coefficient is as follows: ； in, represents the Dice coefficient, Represents a set of neighbor nodes in a key-value database, Represents the current neighbor node set of the node to be detected, Representing a collection and The number of elements in the intersection of and Respectively represent sets and collection The number of elements.

3. The APT detection method based on semantic enhancement and attention mechanism according to claim 1 is characterized in that: The collecting and parsing of system logs, and constructing a traceability graph according to the parsed system logs, includes: Collect system logs; Set the batch size P, where P is the number of system events in each log batch, and parse each log batch in chronological order; The parsed system log is converted into a traceability graph, wherein the traceability graph includes nodes and edges, wherein the nodes include process nodes and object nodes, and the edges have attribute labels.

4. The APT detection method based on semantic enhancement and attention mechanism according to claim 3 is characterized in that: The pruning optimization of the traceability graph according to the traceability graph optimization rule includes: Ignore user IDs for process nodes and file nodes, and merge similar behaviors among multiple users; If there are multiple identical edges between two nodes, the multiple identical edges are merged into one edge, and the number of identical edges is used as the attribute label of the merged edge; Delete the edges between files that are temporarily created by process nodes and do not interact with other process nodes; If a process node points to itself, delete the edge pointing to the current process node.

5. The APT detection method based on semantic enhancement and attention mechanism according to claim 1 is characterized in that: The method generates a semantic feature vector representation of an attribute of a node in a traceability graph by using a BERT model, wherein the BERT model is a BERT model pre-trained using summary sentences on a benign system, and includes: Generate summary sentences by combining the attributes and causal events between nodes and their one-hop neighbors; On benign system logs, the BERT model is pre-trained by using summary sentences; The BERT model is used to encode the attributes of the node into a fixed-length attribute semantic feature vector representation.

6. The APT detection method based on semantic enhancement and attention mechanism according to claim 3 is characterized in that: The method generates a subgraph of each node according to the nodes in the traceability graph, and extracts a feature matrix of each subgraph using a self-attention graph convolutional network according to the attribute semantic feature vector representation of the node as the node feature vector representation of each node, including: The attribute semantic feature vector representation is used as the initial feature vector of the node; Generate a subgraph for each node in the traceability graph ,in, Representation Node and Node The set of K-hop neighboring nodes of represents a set of edges; Initialize the initial feature vector of each node in the provenance graph, generate the subgraph matrix of each node according to the provenance graph, and use the self-attention graph convolutional network to extract the feature matrix of each subgraph as the node feature vector representation of each subgraph.

7. The APT detection method based on semantic enhancement and attention mechanism according to claim 6 is characterized in that: The method of extracting a feature matrix of each subgraph using a self-attention graph convolutional network as a node feature vector representation of each subgraph includes: The node subgraph matrix is ​​transformed linearly to obtain the Query matrix, Key matrix and Value matrix; The self-attention score matrix is ​​calculated based on the Query matrix, Key matrix and Value matrix. The calculation formula is as follows: ； in, represents the self-attention score matrix, represents the dimension of the Key matrix, represents the Query matrix, Represents the transpose of the Key matrix; The subgraph matrix of the node is used as the original adjacency matrix, and the original adjacency matrix is ​​aggregated to construct an enhanced adjacency matrix, which is expressed as follows: ； in, Represents the first node obtained by aggregating the node features of the subgraph based on the original adjacency matrix Layer node feature vector representation, is the initial eigenvector of the node, is the regularized original adjacency matrix, represents the original adjacency matrix, is the degree matrix, Indicates The node feature vector representation of the layer based on the original adjacency matrix, It is The weight matrix to be learned of the layer, represents the number of feature aggregations, ReLU activation function. By selecting the first r maximum values ​​of the self-attention score matrix or exceeding the threshold The elements of construct a sparse enhanced adjacency matrix, which is expressed as follows: ； in, represents the i-th row and j-th column of the sparse enhanced adjacency matrix, represents the i-th row and j-th column of the self-attention score matrix; The sparse enhanced adjacency matrix is ​​symmetric and expressed as follows: ； in, represents the j-th row and i-th column of the sparse enhanced adjacency matrix; Aggregating the sparse enhanced adjacency matrix to obtain the node feature vector representation based on the enhanced adjacency matrix; ； in, represents the first node obtained by aggregating the node features of the subgraph based on the enhanced adjacency matrix Layer node feature vector representation, is the initial eigenvector of the node, represents the regularized enhanced adjacency matrix, represents the enhanced adjacency matrix, is the degree matrix, Indicates The node feature vector representation of the layer based on the enhanced adjacency matrix, Represents the weight matrix to be enhanced and learned in the mth layer; The node feature vector representation of the subgraph obtained by aggregating the node features of the subgraph based on the original adjacency matrix and the enhanced adjacency matrix is ​​fused to obtain the node feature vector representation of the subgraph.

Images