High-level security threat monitoring method and system based on graph neural network

Abstract

The invention discloses a high-level security threat monitoring method and system based on a graph neural network. The method comprises the following steps: constructing a power monitoring system network attack graph sample set; performing sample enhancement on the power monitoring system network attack graph sample set; and performing graph neural network training on the enhanced power monitoring system network attack graph sample to obtain a graph neural network model, and predicting and extracting a high-level network attack evolution path through the graph neural network model. According to the method, the graph neural network model is utilized, good adaptation performance is achieved for attack path network interpretation, the attention mechanism and mutual information are applied to the graph neural network, key information of the attack path network can be better extracted, and therefore a good effect can be achieved.

Description

Technical Field

[0001] The present invention relates to a method for monitoring power system network security, and in particular to a method and system for monitoring high-level security threats based on a graph neural network. Background Art

[0002] As new technologies such as "cloud, big data, Internet of Things, mobile, intelligence, and blockchain" are deeply integrated into the construction of new power systems, the number of smart devices connected increases, data information is highly interconnected, the attack surface of the power system expands, and advanced attacks (APT) pose an increasing security threat to the power system, which may lead to extremely serious consequences. High-level network attacks are generally based on unknown vulnerabilities and use multiple paths and combinations of attacks through various advanced means such as supply chain and social engineering. They are highly concealed, targeted, and persistent. Traditional methods are difficult to accurately detect and remove in a timely manner, and can easily cause serious harm. Summary of the invention

[0003] Purpose of the invention: In response to the above problems, the present invention proposes a high-level security threat monitoring method and system based on graph neural network, which solves the problem of high-level security threats faced by power monitoring systems.

[0004] Technical solution: The technical solution adopted by the present invention is a high-level security threat monitoring method based on graph neural network, including: constructing a sample set of network attack graphs of power monitoring system according to network attack reports of network security events and network attack reports in the historical alarm library of network security situation awareness system;

[0005] Performing sample enhancement on the network attack graph sample set of the power monitoring system; processing the enhanced network attack graph sample set of the power monitoring system, taking the processed enhanced network attack graph sample set of the power monitoring system as input, and training the graph neural network with the high-level network attack evolution path as output to obtain a graph neural network model;

[0006] Perform security monitoring on each key node on the high-level network attack evolution path, collect security information of each key node and analyze it through the graph neural network model to obtain a real-time high-level network attack evolution path, and when a network security incident is detected, send the corresponding security information to the network security situation awareness system to update the network security situation awareness system.

[0007] As a preferred solution of the high-level security threat monitoring method based on graph neural network described in the present invention, the construction of the network attack graph sample set of the power monitoring system includes: extracting binary data pairs from the network attack report of the network security event and the network attack report in the historical alarm library of the network security situation awareness system, wherein the binary data pairs include the attack event type, the attack event occurrence node and the event impact;

[0008] The binary data pairs are used to construct a network attack path diagram, which includes multiple coupled attack links to represent the influence and association between different attack paths.

[0009] As a preferred solution of the high-level security threat monitoring method based on graph neural network described in the present invention, sample enhancement is performed on the network attack graph sample set of the power monitoring system, including:

[0010] Randomly extract network attack graph samples from the constructed power monitoring system network attack graph sample set;

[0011] The nodes and links of the extracted network attack graph samples are randomly deleted and added to expand the network attack graph sample set, and topology-related node features that conform to the ATT&CK mechanism are added according to the ATT&CK mechanism.

[0012] As a preferred solution of the high-level security threat monitoring method based on graph neural network described in the present invention, the enhanced power monitoring system network attack graph sample set is processed, including:

[0013] According to the samples in the sample set of the network attack graph of the power monitoring system, the corresponding feature matrix A is calculated, where the feature matrix A is an m×n matrix, where m is the number of nodes in the graph and n is the number of input features of each node;

[0014] The feature of each node of the feature matrix A is represented as an n-dimensional vector, and the n-dimensional vector includes the clustering coefficient and the out-degree / in-degree of the node;

[0015] The clustering coefficient is a coefficient used to measure the degree of clustering of a node among its neighboring nodes, and the in / out degree is a coefficient used to measure the degree of connection between a node and other nodes.

[0016] As a preferred solution of the high-level security threat monitoring method based on graph neural network described in the present invention, the graph neural network training method includes:

[0017] Input the training set and calculate the node information of node n in the training sample;

[0018] Aggregate node information around node n and learn an embedded feature of node n, where the embedded feature represents an attribute or state of the node in the graph;

[0019] Calculate the importance coefficient of each feature channel and weight the embedded features by multiplication weighting;

[0020] Update the embedding representation vector of node n according to the weighted embedding features;

[0021] Calculate the mutual information of node n and use it as a learning function of the graph neural network;

[0022] The high-level network attack evolution path extracted after training is output.

[0023] The present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the high-level security threat monitoring method based on graph neural network is implemented.

[0024] The present invention provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the high-level security threat monitoring method based on graph neural network is implemented.

[0025] The present invention provides a computer program product, including a computer program and / or instructions, which, when executed by a processor, implement the high-level security threat monitoring method based on a graph neural network.

[0026] The present invention provides a high-level security threat monitoring system based on graph neural network, which includes a security information collection module, a security information analysis module and an alarm information output module, and also includes a historical alarm information input module and a training and learning module;

[0027] The historical alarm information input module is used to: construct a sample set of network attack graphs for the power monitoring system based on network attack reports of network security events and network attack reports in the historical alarm library of the network security situation awareness system; and perform sample enhancement on the sample set of network attack graphs for the power monitoring system;

[0028] The training and learning module is used to: process the enhanced power monitoring system network attack graph sample set, use the processed enhanced power monitoring system network attack graph sample set as input, and use the high-level network attack evolution path as output to train the graph neural network to obtain a graph neural network model;

[0029] The security information collection module is used to: perform security monitoring on each key node on the evolution path of the high-level network attack, and collect security information of each key node;

[0030] The security information analysis module is used to obtain the security information of each key node through the graph neural network model analysis to obtain a real-time high-level network attack evolution path;

[0031] The alarm information output module is used to send corresponding security information to the network security situation awareness system when a network security event is detected, so as to update the network security situation awareness system.

[0032] As a preferred solution of the high-level security threat monitoring system based on graph neural network described in the present invention, the construction of a sample set of network attack graphs of the power monitoring system includes:

[0033] Extracting binary data pairs from network attack reports of network security events and network attack reports in a historical alarm library of a network security situation awareness system, wherein the binary data pairs include attack event type, attack event occurrence node, and event impact;

[0034] The binary data pairs are used to construct a network attack path diagram, wherein the network attack path diagram includes a plurality of coupled attack links to represent the influence and association between different attack paths.

[0035] As a preferred solution of the high-level security threat monitoring system based on graph neural network described in the present invention, sample enhancement is performed on the network attack graph sample set of the power monitoring system, including:

[0036] Randomly extract network attack graph samples from the constructed power monitoring system network attack graph sample set;

[0037] The nodes and links of the extracted network attack graph samples are randomly deleted and added to expand the network attack graph sample set, and topology-related node features that conform to the ATT&CK mechanism are added according to the ATT&CK mechanism.

[0038] As a preferred solution of the high-level security threat monitoring system based on graph neural network described in the present invention, the enhanced network attack graph sample set of the power monitoring system is processed, including:

[0039] According to the samples in the sample set of the network attack graph of the power monitoring system, the corresponding feature matrix A is calculated, where the feature matrix A is an m×n matrix, where m is the number of nodes in the graph and n is the number of input features of each node;

[0040] The feature of each node of the feature matrix A is represented as an n-dimensional vector, and the n-dimensional vector includes the clustering coefficient and the out-degree / in-degree of the node;

[0041] The clustering coefficient is a coefficient used to measure the degree of clustering of a node among its neighboring nodes, and the in / out degree is a coefficient used to measure the degree of connection between a node and other nodes.

[0042] As a preferred solution of the high-level security threat monitoring system based on graph neural network described in the present invention, the training learning module includes: an input end, a propagation module and an output end; wherein,

[0043] The input end is used to receive and process a training set, wherein the processing of the training set includes: calculating node information of node n in the training sample;

[0044] The propagation module includes an aggregation module, a self-attention mechanism module, an update module and a mutual information calculation module connected in sequence, wherein the aggregation module is used to aggregate node information around node n and learn the embedded features of node n, wherein the embedded features represent the attributes or states of the nodes in the graph; the self-attention mechanism module is used to calculate the importance coefficient of each feature channel and weight the embedded features by multiplication weighting; the update module is used to update the embedded representation vector of node n according to the weighted embedded features; the mutual information calculation module is used to calculate the mutual information of node n and use it as the learning function of the graph neural network;

[0045] The output end is used to extract and output the obtained high-level network attack evolution path.

[0046] Beneficial effects: Compared with the prior art, the present invention has the following advantages: 1. The present invention integrates security attack and defense and graph neural network, extracts and refines the alarm information of the network security situation awareness system of the power enterprise as input items and provides it to the graph neural network model, and then strengthens the monitoring of key nodes of the attack path according to the calculation results of the graph neural network model, and the monitoring information can be sent to the network security situation awareness system of the power enterprise on demand, so as to achieve dynamic improvement of network security and solve the protection problem of high-level security threats. 2. The present invention uses various network attack events on the Internet and the risk factors and correlations extracted from the alarm library of the network security situation awareness system of the power enterprise to construct an attack path network of the power monitoring system to meet the needs of reconstructing the network security attack and defense scenarios of the power monitoring system, and uses the graph neural network method to extract the key evolution path of high-level attacks on the power monitoring system, which can improve the effectiveness of the prevention and control of key targets of network security protection of the power monitoring system. In addition, the graph neural network uses deep learning to directly learn graph structure data, which integrates the rich causal semantic expression ability of the graph structure and the deep representation advantages of deep learning. 3. The present invention uses the static structural topology index of the complex network as the feature vector ratio of the node, and simply uses the number of neighboring nodes as the node feature, which is rich in information and more conducive to the extraction of network attack graph features of the power monitoring system. 4. The present invention uses the graph neural network model, which has good adaptability for the interpretation of the network attack graph of the power monitoring system, and applies the attention mechanism and mutual information to the graph neural network, which can better extract the key information of the attack path network, so as to achieve good results. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 It is a flowchart of a high-level security threat monitoring method based on graph neural network;

[0048] Figure 2 This is a module diagram of a high-level security threat monitoring system based on graph neural network;

[0049] Figure 3 It is a flowchart for extracting the evolutionary path of high-level network attacks. DETAILED DESCRIPTION

[0050] The technical solution of the present invention is further described below in conjunction with the accompanying drawings and embodiments.

[0051] Example 1

[0052] The high-level security threat monitoring method based on graph neural network described in the present invention is as follows: Figure 1 As shown. It includes: constructing a sample set of network attack graphs of a power monitoring system according to the network attack reports of network security events and the network attack reports in the historical alarm library of the network security situation awareness system; performing sample enhancement on the sample set of network attack graphs of the power monitoring system; processing the enhanced sample set of network attack graphs of the power monitoring system, taking the processed enhanced sample set of network attack graphs of the power monitoring system as input, and training the graph neural network with the high-level network attack evolution path as output to obtain a graph neural network model; performing security monitoring on each key node on the high-level network attack evolution path, collecting the security information of each key node, analyzing it through the graph neural network model, obtaining a real-time high-level network attack evolution path, and sending the corresponding security information to the network security situation awareness system when a network security event is detected to update the network security situation awareness system.

[0053] The following is a detailed description of each part.

[0054] 1. Construct a sample set of network attack graphs for power monitoring systems;

[0055] First, a sample set of network attack graphs for the power monitoring system is constructed. The sample graph set is constructed by extracting network attack reports from various network attack events on the Internet and the alarm library of the network security situation awareness system of the power enterprise, and then extracting binary data pairs (risk factors, correlation relationships) from them to construct a network attack path graph. Each graph is coupled by multiple attack links. The network security situation awareness system of the power enterprise is an existing network security monitoring system that can monitor the network in real time, identify and deal with potential threat events.

[0056] 2. Performing sample enhancement on the sample set of network attack graphs of the power monitoring system;

[0057] Network attack graph samples are randomly extracted from the constructed sample set, node connection graphs are randomly deleted and added from the sample graphs to enhance the sample set, and the network attack graph sample set is expanded to form a sample library of network attack graphs for the power monitoring system.

[0058] Because network security attacks require certain logical rationality, the present invention manually adds additional topology-related node features based on the ATT&CK mechanism to enhance the data set.

[0059] 3. Process the enhanced network attack graph sample set of the power monitoring system, take the processed enhanced network attack graph sample set of the power monitoring system as input, and use the high-level network attack evolution path as output to train the graph neural network to obtain the graph neural network model;

[0060] The data set is divided into training set, test set, and validation set according to the 7-2-1 ratio, that is, 70% for training set, 20% for test set, and 10% for validation set, to obtain a database that can be used for extracting the evolution path of high-level network attacks.

[0061] The training set is then input into the input end of the graph neural network, and the clustering coefficient and out / degree values ​​of the training sample nodes are calculated as the attributes of the nodes. The encoder in the graph neural network aggregates the information of the surrounding nodes of node n, learns the embedding features of node n, and continuously updates the embedding representation vector of node n. For the neighboring nodes of node n, the mutual information is used to calculate the importance of node n. If the mutual information drops a lot after a neighboring node is removed, it means that the neighboring node is very important to node n and needs to be retained. The above process is repeated for node n and its neighboring nodes to complete the graph neural network training and realize the extraction of the evolution path of network attacks.

[0062] The network enhancement method used solves the problem that small sample sizes cannot meet the needs of graph neural network training. By randomly adding or deleting connections between two nodes, the number of network attack path graphs is increased, and the number of attack evolution paths is increased, solving the problem of small sample training sets.

[0063] In this embodiment, the graph neural network pre-training process includes:

[0064] Input, propagation module, and output.

[0065] Among them, the propagation module includes four parts: aggregation (aggregator), self-attention mechanism, update (updater), and mutual information calculation.

[0066] In this implementation example, the input of the graph neural network is A and B, given a graph G = (V, E). An input feature matrix A with an m×n dimension, where m is the number of nodes in the graph network and n is the number of input features of each node. Here, the feature vector is represented by the clustering coefficient and out-degree / in-degree of each node in the network graph. Therefore, the structural dimension of the input graph is represented as an m×m matrix. Out-degree refers to the number of edges starting from a vertex, while in-degree refers to the number of edges pointing to the vertex.

[0067] The aggregation module (Aggregator) is used to aggregate the node information around node n and learn the embedding representation of node n.

[0068] The present invention adopts the idea of ​​attention mechanism and adds SE attention mechanism module (Squeeze-and-Excitation Networks). SE attention mainly considers the relationship between feature channels and adds attention mechanism on the channel. The key point is to obtain the importance of each feature channel by continuous learning, and use the importance to suppress unimportant features and highlight important features. The main process is to first compress the spatial dimension through the global information embedding (squeeze) operation, that is, to globally pool each feature vector and average it into a real value with a global receptive field. Then it is an adaptive recalibration (excitation) operation, which first reduces the dimension of C channels and then expands them back to C channels, increasing the nonlinear ability of the network. The main purpose of this operation is to output the importance of each channel and multiply it to the previous features by weighted multiplication, so as to achieve the purpose of strengthening important features and suppressing unimportant features.

[0069] The updater module iteratively updates the embedding vector of node n.

[0070] 4. Predict and extract the evolution path of high-level network attacks through the graph neural network model.

[0071] Mutual information is used to measure the importance of nodes to the network graph, and important nodes and their connections are retained to achieve high-level network attack evolution path extraction. For node n, the importance of neighboring nodes to n is calculated using mutual information. If the mutual information drops a lot after a neighboring node is removed, the neighboring node is very important to node n and needs to be retained. The above process is repeated for node n and its neighboring nodes to complete the extraction of network attack evolution path.

[0072] The readout function in the graph neural network is used to aggregate the features of the nodes to form a graph-level representation. The output of the graph neural network in the present invention uses the readout function to aggregate the node features from the last iteration to obtain the representation vector of the entire graph.

[0073] The final test process of the present invention is to load the model, input the network attack path graph, set the feature vector function, learn the graph structure characteristics, use the mutual information of the nodes as the learning function, perform graph neural network pre-training, and output the high-level network attack evolution path.

[0074] 5. Conduct security monitoring on key nodes on the evolution path of the high-level network attack.

[0075] Monitor each key node on the evolution path of the high-level network attack and collect relevant security information.

[0076] The present invention utilizes network attack reports extracted from various network attack events on the Internet and the alarm library of the network security situation awareness system of the power enterprise, and based on the principle of ATT&CK, sorts out the correlation between the network security risk factors of the power monitoring system and the network attack path to form a binary sequence pair, and uses the go programming language to convert the binary sequence pair into a complex network graph to form a sample set of network attack graphs of the power monitoring system. In order to expand the data of the sample set of network attack graphs of the power monitoring system, any network attack path graphs are selected from the sample set, and the sample size of the sample set is increased by randomly adding or deleting node connections. The network graph is used as the input of the graph neural network, and the clustering coefficient and in / out degree of the node are used as the feature vector of the node. The graph neural network is used to learn the network structure of the network attack path graph, and it is determined which nodes and their edges constitute the core subgraph of the attack path network, and the evolutionary path is extracted.

[0077] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the enlightenment of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the purpose of the present invention and the claims, which all fall within the protection of the present invention.

[0078] Example 2

[0079] The high-level security threat monitoring system based on graph neural network described in the present invention has a module schematic diagram as shown in FIG. Figure 2As shown. The system includes a security information collection module, a security information analysis module and an alarm information output module, and also includes a historical alarm information input module and a training and learning module. The security information collection module is deployed at each key node on the high-level network attack evolution path of the power monitoring system to collect relevant security information and input it into the security information analysis module. The security information analysis module uses the graph neural network model trained by the training and learning module to analyze and predict the high-level network attack evolution path of this system in real time, and sends the information to the alarm output module when a network security incident is detected. The alarm output module matches the security risk information with the system environment to form a security threat alarm, which is sent to the network situation awareness system of the power enterprise.

[0080] Specifically, the system includes:

[0081] A historical alarm information input module is used to: construct a sample set of network attack graphs for a power monitoring system based on network security events and historical alarms output by a network security situation awareness system; and perform sample enhancement on the sample set of network attack graphs for a power monitoring system;

[0082] The training and learning module is used to: train the graph neural network based on the enhanced sample set of network attack graphs of the power monitoring system and take the high-level network attack evolution path as the output to obtain the graph neural network model;

[0083] A security information collection module is used to: perform security monitoring on each key node on the evolution path of the high-level network attack, and collect security information of each key node;

[0084] The security information analysis module is used to obtain the security information of each key node through the graph neural network model analysis to obtain the real-time high-level network attack evolution path;

[0085] The alarm information output module is used to: when a network security incident is detected, the corresponding security information is sent to the network security situation awareness system to update the network security situation awareness system.

[0086] Among them, the training and learning module includes: an input end, a propagation module and an output end; the propagation module includes a sequentially connected aggregation module, a self-attention mechanism module, an update module and a mutual information calculation module, and the aggregation module is used to aggregate the node information around node n and learn the embedded representation of node n. The training and learning module in the high-level security threat monitoring system based on graph neural network performs the extraction of the evolution path of high-level network attacks. Figure 3 The figure shows a flowchart of extracting the evolution path of high-level network attacks.

[0087] Example 3

[0088] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned high-level security threat monitoring method based on graph neural network when executing the computer program.

[0089] Example 4

[0090] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the above-mentioned high-level security threat monitoring method based on graph neural network is implemented.

[0091] Example 5

[0092] In one embodiment, a computer program product is provided, including a computer program / instruction, which, when executed by a processor, implements the high-level security threat monitoring method based on a graph neural network.

[0093] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0094] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0095] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0096] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

Claims

1. A high-level security threat monitoring method based on graph neural network, characterized in that: include: According to the network attack reports of network security events and the network attack reports in the historical alarm library of the network security situation awareness system, a sample set of network attack graphs for the power monitoring system is constructed; Performing sample enhancement on the sample set of the network attack graph of the power monitoring system; The enhanced network attack graph sample set of the power monitoring system is processed, the processed enhanced network attack graph sample set of the power monitoring system is used as input, and the high-level network attack evolution path is used as output to train the graph neural network to obtain the graph neural network model; Perform security monitoring on each key node on the high-level network attack evolution path, collect security information of each key node and analyze it through the graph neural network model to obtain a real-time high-level network attack evolution path, and when a network security incident is detected, send the corresponding security information to the network security situation awareness system to update the network security situation awareness system.

2. The high-level security threat monitoring method based on graph neural network according to claim 1 is characterized in that: The constructing of the sample set of network attack graphs of the power monitoring system includes: extracting binary data pairs from network attack reports of network security events and network attack reports in a historical alarm library of a network security situation awareness system, wherein the binary data pairs include attack event types, attack event occurrence nodes, and event impacts; The binary data pairs are used to construct a network attack path diagram, which includes multiple coupled attack links to represent the influence and association between different attack paths.

3. The high-level security threat monitoring method based on graph neural network according to claim 1 is characterized in that: The sample set of the network attack graph of the power monitoring system is enhanced, including: Randomly extract network attack graph samples from the constructed power monitoring system network attack graph sample set; The nodes and links of the extracted network attack graph samples are randomly deleted and added to expand the network attack graph sample set, and topology-related node features that conform to the ATT&CK mechanism are added according to the ATT&CK mechanism.

4. The high-level security threat monitoring method based on graph neural network according to claim 1 is characterized in that: The enhanced power monitoring system network attack graph sample set is processed, including: According to the samples in the sample set of the network attack graph of the power monitoring system, the corresponding feature matrix A is calculated, where the feature matrix A is an m×n matrix, where m is the number of nodes in the graph and n is the number of input features of each node; The feature of each node of the feature matrix A is represented as an n-dimensional vector, and the n-dimensional vector includes the clustering coefficient and the out-degree / in-degree of the node; The clustering coefficient is a coefficient used to measure the degree of clustering of a node among its neighboring nodes, and the in / out degree is a coefficient used to measure the degree of closeness of connection between a node and other nodes.

5. The high-level security threat monitoring method based on graph neural network according to claim 1 is characterized in that: The method for training the graph neural network includes: Input the training set and calculate the node information of node n in the training sample; Aggregate node information around node n and learn an embedded feature of node n, where the embedded feature represents an attribute or state of the node in the graph; Calculate the importance coefficient of each feature channel and weight the embedded features by multiplication weighting; Update the embedding representation vector of node n according to the weighted embedding features; Calculate the mutual information of node n and use it as a learning function of the graph neural network; The high-level network attack evolution path extracted after training is output.

6. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the high-level security threat monitoring method based on graph neural network described in any one of claims 1 to 5 is implemented.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the high-level security threat monitoring method based on graph neural network described in any one of claims 1 to 5 is implemented.

8. A computer program product comprising a computer program and / or instructions, characterized in that: When the computer program and / or instructions are executed by a processor, the high-level security threat monitoring method based on graph neural network described in any one of claims 1 to 5 is implemented.

9. A high-level security threat monitoring system based on graph neural network, characterized by: The system includes a safety information collection module, a safety information analysis module and an alarm information output module, and also includes a historical alarm information input module and a training and learning module; The historical alarm information input module is used to: construct a sample set of network attack graphs for the power monitoring system based on network attack reports of network security events and network attack reports in the historical alarm library of the network security situation awareness system; and perform sample enhancement on the sample set of network attack graphs for the power monitoring system; The training and learning module is used to: process the enhanced power monitoring system network attack graph sample set, use the processed enhanced power monitoring system network attack graph sample set as input, and use the high-level network attack evolution path as output to train the graph neural network to obtain a graph neural network model; The security information collection module is used to: perform security monitoring on each key node on the evolution path of the high-level network attack, and collect security information of each key node; The security information analysis module is used to obtain the security information of each key node through the graph neural network model analysis to obtain a real-time high-level network attack evolution path; The alarm information output module is used to send corresponding security information to the network security situation awareness system when a network security event is detected, so as to update the network security situation awareness system.

10. The high-level security threat monitoring system based on graph neural network according to claim 9 is characterized in that: The construction of a sample set of network attack graphs for a power monitoring system includes: Extracting binary data pairs from network attack reports of network security events and network attack reports in a historical alarm library of a network security situation awareness system, wherein the binary data pairs include attack event type, attack event occurrence node, and event impact; The binary data pairs are used to construct a network attack path diagram, wherein the network attack path diagram includes a plurality of coupled attack links to represent the influence and association between different attack paths.

11. The high-level security threat monitoring system based on graph neural network according to claim 9 is characterized in that: The sample set of the network attack graph of the power monitoring system is enhanced, including: Randomly extract network attack graph samples from the constructed power monitoring system network attack graph sample set; The nodes and links of the extracted network attack graph samples are randomly deleted and added to expand the network attack graph sample set, and topology-related node features that conform to the ATT&CK mechanism are added according to the ATT&CK mechanism.

12. The high-level security threat monitoring system based on graph neural network according to claim 9, characterized in that: The enhanced power monitoring system network attack graph sample set is processed, including: According to the samples in the sample set of the network attack graph of the power monitoring system, the corresponding feature matrix A is calculated, where the feature matrix A is an m×n matrix, where m is the number of nodes in the graph and n is the number of input features of each node; The feature of each node of the feature matrix A is represented as an n-dimensional vector, and the n-dimensional vector includes the clustering coefficient and the out-degree / in-degree of the node; The clustering coefficient is a coefficient used to measure the degree of clustering of a node among its neighboring nodes, and the in / out degree is a coefficient used to measure the degree of closeness of connection between a node and other nodes.

13. The high-level security threat monitoring system based on graph neural network according to claim 9 is characterized in that: The training and learning module includes: an input end, a propagation module and an output end; wherein, The input end is used to receive and process a training set, wherein the processing of the training set includes: calculating node information of node n in the training sample; The propagation module includes an aggregation module, a self-attention mechanism module, an update module and a mutual information calculation module connected in sequence, wherein the aggregation module is used to aggregate node information around node n and learn the embedded features of node n, wherein the embedded features represent the attributes or states of the nodes in the graph; the self-attention mechanism module is used to calculate the importance coefficient of each feature channel and weight the embedded features by multiplication weighting; the update module is used to update the embedded representation vector of node n according to the weighted embedded features; the mutual information calculation module is used to calculate the mutual information of node n and use it as the learning function of the graph neural network; The output end is used to extract and output the obtained high-level network attack evolution path.

Images