APT attack detection method and device based on fine-grained attribute structure diagram

Abstract

The invention discloses an APT (Advanced Persistent Threat) attack detection method based on a fine-grained attribute structure chart, which comprises the following steps of: S1, analyzing a system log, and extracting corresponding attributes of entities to form an attribute structure chart; s2, training a structure perception graph self-encoder model; s3, identifying abnormal nodes in the anomaly detection model; and S4, mapping the abnormal nodes screened out in the step S3 into corresponding entities according to the entity and attribute mapping table, and returning abnormal log entries corresponding to the entities. According to the method, the limitation of inherent information granularity is broken through, the entity in the network behavior is represented by using the attribute structure feature, the structure feature of the attack behavior is fully mined, the detection capability of a hidden APT attack form is improved, the abnormal log range is reduced, and the burden of manually screening and processing hostile attack logs is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of network information security, and in particular to a detection method and device for APT attacks based on a fine-grained attribute structure graph. Background Art

[0002] In recent years, Advanced Persistent Threat (APT) has attracted widespread attention as a growing network attack model. It is highly concealed, long-lasting, and highly targeted. Specifically, it can use a series of covert and deceptive means to penetrate the system; the attack event spans a large span and may last for months or even years; the attack targets are usually critical information infrastructure and important information systems. In network security monitoring and management, it is difficult for security personnel to identify or track such threats for a long time. APT attack detection technology is based on log records obtained by log collection devices and software, and uses anomaly detection technology to identify abnormal behavior patterns and traces that may involve APT attacks. This technology can detect hidden attack behaviors in a timely manner, and feedback anomalies to manual further processing, providing key intelligence support for network security defense. It plays an important role in responding to complex APT attack scenarios and is an indispensable part of the network security field.

[0003] Early APT attack detection technologies rely on security experts to manually collect and summarize APT attack patterns, convert known attack patterns into rules or statistical models, and apply them to network traffic or system log data to discover potential APT attack behaviors. These technologies rely on expert knowledge and prior experience, and are unable to fully and deeply extract features from system logs. They also have poor generalization capabilities and are greatly limited in detecting covert threats and new attack patterns with varied intrusion methods and complex attack stages.

[0004] In recent years, with the development of machine learning, especially deep learning and graph neural networks, some corresponding technologies have been applied to the research of APT attack detection, which has made up for some defects of early APT attack detection technology and improved the generalization ability of the model and the ability to characterize hidden attack features. At present, the more mainstream APT attack detection model usually uses system monitoring log data to construct a traceability graph with strong abstract expression ability to characterize the causal relationship between system log data. After training the graph neural network with the traceability graph constructed by the training log data, the traceability graph constructed by the log to be detected is used as the input of the trained graph neural network, and the feature vectors of the nodes or edges in the graph are extracted, and APT attack detection is realized through classifiers or anomaly detection technology.

[0005] At present, the APT attack detection method based on the traceability graph uses the entities (processes, files, sockets, etc.) in the log behavior as nodes to build the graph. There is an inherent limitation in the granularity of information. Each node can only represent the entities in the network behavior, and it is difficult to fully explore the structural characteristics of the attack behavior, especially for more covert forms of attack. At the same time, when determining the range of abnormal nodes, the existing methods have the problem of too large an output range. Even at the node-level recognition granularity, when the abnormal nodes are mapped back to the log data, the output abnormal range will be too wide, which is still a considerable burden for the subsequent manual screening and processing of malicious attack logs. Summary of the invention

[0006] The technical problem to be solved by the present invention is that the existing APT attack detection method is difficult to fully utilize the network behavior structure characteristics, cannot accurately identify hidden attack patterns, and the scale of abnormal logs containing potential APT attacks screened out is not convenient for subsequent manual rapid processing.

[0007] Technical solution of the present invention:

[0008] A method for detecting APT attacks based on fine-grained attribute structure graph, the specific steps are as follows:

[0009] Step S1: parse the system log, extract the corresponding attributes of the entity, establish a mapping table between the entity and the attribute, build a fully connected attribute structure subgraph for all the attributes of each entity, cut the redundant nodes and associations in all subgraphs based on the fully connected attribute structure subgraph, select subgraph nodes and build associations with other subgraphs based on external knowledge to form an attribute structure graph;

[0010] Step S2: Based on the attribute structure graph generated in step S1, its adjacency matrix and the feature vector of the attribute node are input into the structure perception graph autoencoder model, forward propagation is continuously performed, and the reconstruction loss is calculated based on the reconstruction module in the structure perception graph autoencoder model, and the parameters are updated through back propagation until the training conditions are met, and the model parameters and the output feature vector are saved;

[0011] Step S3: Based on the structure perception graph autoencoder model trained in step S2, the preprocessed attribute structure graph to be detected is input into the structure perception graph autoencoder model to obtain the output node feature vector, and the output node feature vector is input into the anomaly detection model to identify abnormal nodes;

[0012] Step S4: According to the entity and attribute mapping table, the abnormal nodes screened out in step S3 are mapped to corresponding entities, and the abnormal log entries corresponding to the entities are returned.

[0013] Furthermore, step S1 includes the following sub-steps:

[0014] Step S1-1: Identify various key entity objects, such as hosts, processes, files, etc., from the collected system log data, extract corresponding attribute information for each entity object, such as IP address, login time, execution command, etc., and establish an association mapping between the entity and the attribute to form an entity-attribute key-value pair;

[0015] Step S1-2: Taking the attributes of the entity object as nodes, a fully connected attribute structure subgraph is constructed according to the attribute information of the entity. The i-th subgraph is denoted as G i = {V i , E i}, where V i and E i They are the attribute node collection and the attribute relationship collection of the i-th subgraph respectively;

[0016] Step S1-3: Standardize the node features of the fully connected attribute structure subgraph constructed in step S1-2, perform principal component analysis on the standardized feature vector, extract the main feature dimensions, calculate the cosine similarity of the nodes in the principal component space, and remove redundant edges according to the preset similarity threshold to obtain the optimized attribute structure subgraph. The i-th optimized subgraph is denoted as G i '={V i , E i '};

[0017] Step S1-4: Sort the importance of nodes in the attribute structure subgraph optimized by step S1-3, and connect the most important nodes between subgraphs according to the association between entities to form an attribute structure graph, denoted as G = {V, E}, where

[0018] V=V1∩V2∩…∩V n , E=E1'∩E2'∩…∩E n '∩E entity , n is the number of subgraphs, E entity Represents an association between entities.

[0019] Further, step S2 comprises the following sub-steps:

[0020] Step S2-1: Construct a structure-aware graph autoencoder model, including: sub-graph embedding layer, structure-aware encoder, sub-graph structure-aware decoder and full-graph structure reconstruction module. The main functions of each part are:

[0021] The input of the subgraph embedding layer is the node category of the attribute structure subgraph optimized in step S1-3, which is used to extract the optimized attribute structure subgraph G i 'The original feature vector of the node;

[0022] Depending on the selected parameters, the structure-aware encoder can be divided into a sub-image structure-aware encoder and a full-image structure-aware encoder, which encode the sub-image and the full-image respectively.

[0023] The subgraph structure-aware encoder takes as input the node embedding vector output by the subgraph embedding layer and the attribute structure subgraph G optimized in step S1-3. i ''s adjacency matrix, combined with the graph attention mechanism to perform graph convolution operations to obtain the output feature vector of the node;

[0024] The full-graph structure-aware encoder inputs the output feature vector of the node obtained by the subgraph structure-aware encoder and the relationship E between the edges of the subgraphs entity , perform graph convolution operation in combination with graph attention mechanism to obtain the subgraph output feature vector;

[0025] The full-graph structure reconstruction module reconstructs the full-graph based on the feature vectors output by the sub-graph and outputs the structural reconstruction loss of the full-graph;

[0026] The subgraph structure-aware decoder includes a fully connected layer, a node feature reconstruction module and a structure reconstruction module, and outputs a node feature reconstruction loss and a structure reconstruction loss. The fully connected layer connects the subgraph structure-aware encoder and the node feature reconstruction module, and adjusts the dimension of the output feature vector of the node obtained by the subgraph structure-aware encoder to ensure that the dimension of the output feature of the subgraph structure-aware encoder matches the dimension of the input feature of the node feature reconstruction; the node feature output by the node feature reconstruction is consistent with the dimension of the original node feature, which is used to calculate the node feature reconstruction loss error; structure reconstruction, that is, sampling the subgraph nodes and reconstructing the association between the nodes;

[0027] Step S2-2: Input the attribute structure graph constructed by the training set into the structure-aware graph autoencoder model, perform forward pass and reconstruct the loss error based on the node features;

[0028] Step S2-3: Update the parameters of each layer using the back propagation method;

[0029] Step S2-4: Repeat steps S2-2 to S2-3 until the preset loss threshold is reached, and save the parameters of each layer of the trained structure-aware graph autoencoder and the output feature vectors of the nodes obtained by the subgraph structure-aware decoder.

[0030] An APT attack detection device based on a fine-grained attribute structure graph includes: an attribute structure graph construction module for log data preprocessing, an APT attack detection model construction and training module for encapsulating a structure perception graph autoencoder model, an anomaly detection module for outlier determination, and a log feedback module for mapping abnormal entities according to abnormal attribute nodes and extracting abnormal logs. The functions completed by the four modules correspond to the operations of step S1, step S2, step S3, and step S4 of the above-mentioned APT attack detection method based on a fine-grained attribute structure graph.

[0031] Beneficial Effects

[0032] In the present invention, compared with the existing methods, this network behavior modeling method based on the attribute structure graph fully mines the rich attribute structure information, establishes a graph model that describes the entity behavior relationship and the entity attribute structure, which not only has powerful expression ability, but also has wide applicability, and has obvious advantages in complex and hidden APT attack detection scenarios. When performing structure-aware encoding, the structure-aware graph autoencoder model adopts an attention mechanism to perform graph convolution operations, adaptively assigns different importance weights to different neighbor nodes and graph structure features, and enhances the model's ability to represent attribute structure information. The structure-aware encoder adopts a hierarchical design (subgraph level, full graph level), first encodes the subgraph level, and then encodes the full graph level. This feature extraction method from local to overall can better capture structural information at different granularities, describe the topological structure of the graph from local to overall, and effectively utilize entity-level features. In the anomaly detection module, since the detection is attribute-level anomalies, when mapping back to the corresponding abnormal entity, the detection accuracy is higher than that of the existing multiple APT attack detection methods, effectively reducing the cost of manual screening. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a flow chart of a detection method of APT attack based on fine-grained attribute structure graph of the present invention;

[0034] Figure 2 It is a schematic diagram of the structure of the structure perception graph autoencoder model of the present invention;

[0035] Figure 3 It is a module schematic diagram of the detection device of APT attack based on fine-grained attribute structure graph of the present invention. DETAILED DESCRIPTION

[0036] In order to solve the technical problems existing in the prior art, an embodiment of the present invention provides a detection method for APT attacks based on a fine-grained attribute structure graph.

[0037] like Figure 1,The detection method of APT attack based on fine-grained attribute structure graph includes the following steps:

[0038] Step S1: parse the system log, extract the corresponding attributes of the entity, establish a mapping table between the entity and the attribute, build a fully connected attribute structure subgraph for all the attributes of each entity, trim the redundant nodes and associations in all subgraphs, select subgraph nodes and build associations with other subgraphs based on external knowledge to form an attribute structure graph;

[0039] In the present invention, entity attributes and attribute structures are utilized, which are more detailed information not utilized by previous methods, so it is called fine-grained.

[0040] In this embodiment, the open source DARPA E3 partial data set is used as the training set. The DARPA E3 CADETS data set is part of the DARPA TC program and is collected in enterprise networks during adversarial engagements. The DARPA E3 CADETS contains a total of 18.38GB of audit records, including up to 719,818 system entities and 8,663,569 interactions. Step S1 specifically includes the following sub-steps:

[0041] Step S1-1: Based on the collected system log data, identify various key entity objects, such as hosts, processes, files, etc. For each entity object, extract its corresponding attribute information, such as IP address, login time, execution command, etc., and establish an association mapping between the entity and the attribute to form an entity-attribute key-value pair. Table 1 lists the corresponding relationship between some entities and attributes;

[0042] Table 1

[0043]

[0044] Step S1-2: Take the attributes of each entity object as nodes and construct a fully connected attribute structure subgraph based on all its attribute information; the i-th subgraph is denoted as G i = {V i , E i}, where V i and E i They are the attribute node collection and the attribute relationship collection of the i-th subgraph respectively;

[0045] Step S1-3: Perform Z-score normalization on the eigenvector of each subgraph node, subtract the mean of the eigenvector, divide by the standard deviation, and eliminate the dimensional differences between the features. Perform principal component analysis on the standardized feature matrix, calculate the covariance matrix of the eigenvector, and find the eigenvalues ​​and corresponding eigenvectors, select the first k principal components with larger variance contribution rates, and in this embodiment, take k=5, project the standardized eigenvectors to the principal component space, obtain the coordinate representation of each node in the principal component space, and calculate the cosine similarity of any two nodes u and v in the principal component space:

[0046]

[0047] Set the similarity threshold θ, the value range is [-1, 1], here it is 0.3, for any two nodes u, v whose similarity needs to be calculated, if Sim(u, v) < θ, then the edge between them is considered redundant and can be deleted;

[0048] Step S1-4: For each subgraph, select the PageRank algorithm to sort the importance of the nodes.

[0049]

[0050] Where u is the neighbor node of node v, Outdegree(u) is the outdegree of u, and d is the damping coefficient, which is 0.85. The importance score of each node is obtained by PageRank calculation. The nodes in the subgraph are sorted in descending order according to the score. For the top-ranked nodes, the subgraphs are connected according to the association relationship between entities to complete the attribute structure diagram.

[0051] Step S2: Based on the attribute structure graph generated in step S1, its adjacency matrix and the feature vector of the attribute node are input into the structure perception graph autoencoder model, and forward propagation is continuously performed and the reconstruction loss error is calculated based on the reconstruction module. The parameters are updated through back propagation until the training conditions are met, and the parameters of each layer of the model and the output feature vector are saved;

[0052] The specific steps include:

[0053] Step S2-1: The constructed structure-aware graph autoencoder model contains a subgraph embedding layer, a structure-aware encoder (including a subgraph structure-aware encoder and a full-graph structure-aware encoder), a subgraph structure-aware decoder, and a full-graph structure reconstruction module. The subgraph structure-aware decoder includes a node feature reconstruction module and a subgraph structure reconstruction module. For details, see Figure 2 ;

[0054] The subgraph embedding layer inputs the node category and extracts the original feature vector of the node.

[0055] X=x1,x2,…,x n

[0056] Subgraph structure-aware encoder, input node feature vector and subgraph adjacency matrix A = [a ij ], perform graph convolution operation in combination with graph attention mechanism, obtain the output feature vector of the node, and calculate the attention weight between nodes:

[0057] e ij =LeakyReLU(a T [Wx i |Wx j ])

[0058]

[0059] Where W is the learnable weight matrix, a is the parameter vector of the attention mechanism, and the attention weight a ij It reflects the degree of association between node i and node j. Based on the attention weight a ij Perform graph convolution operations to aggregate feature information of neighboring nodes:

[0060] h i =σ(∑ j a ij Wx j )

[0061] Where σ is a nonlinear activation function, LeakyReLU is used here.

[0062] After the above steps, the output feature vector Z of each node can be obtained:

[0063] Z=[h1,h2,…,h n ]

[0064] The subgraph structure-aware decoder includes a node feature reconstruction module and a subgraph structure reconstruction module, and the outputs are node feature loss and structure reconstruction loss respectively. The details are as follows:

[0065] Node feature reconstruction module:

[0066] To reconstruct the original feature vector of the node, a fully connected layer needs to be introduced:

[0067]

[0068] Where W r and b r are the learnable weight and bias parameters, respectively, and σ is a nonlinear activation function, sigmoid is used here. The encoded node feature h i Map back to the original feature space to obtain the reconstructed features In order to optimize the feature reconstruction effect, the distance between the reconstructed feature and the original feature can be minimized:

[0069]

[0070] That is, the node feature reconstruction loss error is composed of the original feature x i and reconstruction features The L2 norm distance composition;

[0071] Subgraph structure reconstruction module:

[0072] Reconstructing structural features requires sampling and reconstruction of the subgraph. The sampling part randomly samples node pairs in the subgraph and ensures that the number of node pairs with edges and node pairs without edges is the same. Any two nodes constitute a node pair in the sampling process.

[0073] When the number of edges M in the subgraph that needs to reconstruct the structural features is less than the sampling threshold T, the total number of samples N = M. When the number of edges M in the subgraph that needs to reconstruct the structural features is greater than the sampling threshold T, the total number of samples N = T. The subgraph structure reconstruction module consists of three parts: the connection layer, the feedforward neural network classifier, and the subgraph structure reconstruction.

[0074] Among them, the feature vectors of the two nodes in the connection layer splicing node pair are:

[0075]

[0076] The feedforward neural network classifier inputs the concatenated features and outputs the probability prediction of whether the node has an edge:

[0077]

[0078] Where W c and b c are learnable weight and bias parameters.

[0079] Subgraph structure reconstruction reconstructs the subgraph according to the probability values ​​of the edges output by the feedforward neural network classifier and calculates the structure reconstruction loss.

[0080] During training, the model is optimized by minimizing the cross entropy loss function between positive and negative samples:

[0081]

[0082] The N parameter is set to balance the ratio of positive and negative samples, struct The structure reconstruction loss of the subgraph structure-aware decoder is back-propagated; the full-graph structure reconstruction operation is consistent with the subgraph structure reconstruction operation process;

[0083] Step S2-2: Input the constructed attribute structure graph for training into the structure perception graph autoencoder, perform forward propagation, and calculate L rec and L struct ;

[0084] Step S2-3: Use the back propagation method to update W, a, W in step S2-1 r , b r , W c , b c Parameters such as , make the reconstructed features as close to the original features as possible;

[0085] Step S2-4: Repeat steps S2-2 to S2-3 until the training requirements are met. The condition for ending the training is that the reconstruction loss is less than 0.05 or the change in two adjacent weight losses is less than 0.1%. The trained structure-aware graph autoencoder is used as a feature extraction model to extract subgraph node features, subgraph structure features, and global structure features.

[0086] Step S3: Extract the feature of the attribute structure graph to be detected as Z = [h1, h2, ..., h n ] is used as the input of the anomaly detection module to identify abnormal nodes.

[0087] The anomaly detection module adopts the isolation forest model. The specific operations are:

[0088] The first step is to build a single decision tree in the isolation forest model, according to the input Z = [h1,h2,…,h n ] Randomly select h1-h n A feature of h x (x ranges from 1 to n), randomly select a split point within the range of the feature, divide the data into two parts according to this split point, and recursively repeat this process until the split part contains only one sample and reaches the predefined maximum tree depth, where the predefined maximum depth is deep = 12;

[0089] Secondly, repeat the above steps to build multiple decision trees. The number of trees selected here is 100;

[0090] Finally, the model outputs the anomaly score of each node

[0091]

[0092] Among them, E(z(h)) is the average path length of all trees in the isolation forest for sample h. The shorter the path, the easier it is to be isolated and the more likely it is an outlier. c(n) is the average path length of the tree when n points are given.

[0093] According to the anomaly score s, attribute-level abnormal nodes are identified. The anomaly threshold set here is 0.8. If it is higher than this threshold, it will be judged as an anomaly. After being judged as an anomaly, this module will output the number of the abnormal node.

[0094] Step S4: According to the entity and attribute mapping table, map the abnormal node to the corresponding entity, and return the abnormal log entry corresponding to the entity.

[0095] Using this method, the present invention also provides an APT attack detection device based on a fine-grained attribute structure graph, including: an attribute structure graph construction module for log data preprocessing, an APT attack detection model construction and training module for encapsulating the structure perception graph autoencoder model, an anomaly detection module for outlier determination, and a log feedback module for mapping abnormal entities according to abnormal attribute nodes and extracting abnormal logs. Figure 3 As shown, the functions completed by the four modules correspond to the operations of step S1, step S2, step S3, and step S4 of the above-mentioned APT attack detection method based on fine-grained attribute structure graph.

[0096] The above description is only a description of the preferred embodiments of the present application, and is not intended to limit the scope of the present application. Any changes or modifications made by any person skilled in the art based on the above disclosed technical contents shall be deemed as equivalent effective embodiments and shall fall within the scope of protection of the technical solution of the present application.

Claims

1. A method for detecting APT attacks based on fine-grained attribute structure graph, characterized in that: The following steps are involved: Step S1: parse the system log, extract the corresponding attributes of the entity, establish a mapping table between the entity and the attribute, build a fully connected attribute structure subgraph for all the attributes of each entity, cut the redundant nodes and associations in all subgraphs based on the fully connected attribute structure subgraph, select subgraph nodes and build associations with other subgraphs based on external knowledge to form an attribute structure graph; Step S2: Based on the attribute structure graph generated in step S1, its adjacency matrix and the feature vector of the attribute node are input into the structure perception graph autoencoder model, forward propagation is continuously performed, and the reconstruction loss is calculated based on the reconstruction module in the structure perception graph autoencoder model, and the parameters are updated through back propagation until the training conditions are met, and the model parameters and the output feature vector are saved; Step S3: Based on the structure perception graph autoencoder model trained in step S2, the preprocessed attribute structure graph to be detected is input into the structure perception graph autoencoder model to obtain the output node feature vector, and the output node feature vector is input into the anomaly detection model to identify abnormal nodes; Step S4: According to the entity and attribute mapping table, the abnormal nodes screened out in step S3 are mapped to corresponding entities, and the abnormal log entries corresponding to the entities are returned.

2. According to claim 1, the APT attack detection method based on fine-grained attribute structure graph is characterized in that: Step S1 includes the following sub-steps: Step S1-1: Identify various key entity objects from the collected system log data, extract the corresponding attribute information for each entity object, and establish an association mapping between the entity and the attribute to form an entity-attribute key-value pair; Step S1-2: Taking the attributes of the entity object as nodes, a fully connected attribute structure subgraph is constructed according to the attribute information of the entity. The i-th subgraph is denoted as G i = {V i , E i }, where V i and E i They are the attribute node collection and the attribute relationship collection of the i-th subgraph respectively; Step S1-3: Standardize the node features of the fully connected attribute structure subgraph constructed in step S1-2, perform principal component analysis on the standardized feature vector, extract the main feature dimensions, calculate the cosine similarity of the nodes in the principal component space, and remove redundant edges according to the preset similarity threshold to obtain the optimized attribute structure subgraph. The i-th optimized subgraph is denoted as G i '={V i , E i '}; Step S1-4: Sort the importance of nodes in the attribute structure subgraph optimized by step S1-3, and connect the most important nodes between subgraphs according to the association between entities to form an attribute structure graph, denoted as G = {V, E}, where V = V1∩V2∩…∩V n , E=E1'∩E2'∩…∩E n '∩E entity , n is the number of subgraphs, E entity Represents an association between entities.

3. The APT attack detection method based on fine-grained attribute structure graph according to claim 2 is characterized in that: In step S1-3, the eigenvector of each subgraph node is subjected to Z-score standardization, the mean of the eigenvector is subtracted, and the eigenvector is divided by the standard deviation to eliminate the dimensional differences between the features; the standardized feature matrix is ​​subjected to principal component analysis, the covariance matrix of the eigenvector is calculated, and the eigenvalues ​​and corresponding eigenvectors are obtained, the first k principal components with the largest variance contribution rate are selected, and the standardized eigenvectors are projected into the principal component space to obtain the coordinate representation of each node in the principal component space, and the cosine similarity of any two nodes u and v in the principal component space is calculated: Set the similarity threshold θ, the value range is [-1,1], here it is 0.3, for any two nodes u, v whose similarity needs to be calculated, if Sim(u,v)<θ, then the edge between them is considered redundant and can be deleted.

4. The APT attack detection method based on fine-grained attribute structure graph according to claim 2 is characterized in that: In step S1-4, for each subgraph, the PageRank algorithm is selected to sort the importance of the nodes. Where u is the neighbor node of node v, Outdegree(u) is the outdegree of u, d is the damping coefficient, which is 0.85; the importance score of each node is obtained through PageRank calculation; the nodes in the subgraph are sorted in descending order according to the score size, and for the top-ranked nodes, the subgraphs are connected according to the association relationship between entities to construct the attribute structure diagram.

5. The APT attack detection method based on fine-grained attribute structure graph according to claim 1 is characterized in that: Step S2 includes the following sub-steps: Step S2-1: Construct a structure-aware graph autoencoder model, including: sub-graph embedding layer, structure-aware encoder, sub-graph structure-aware decoder and full-graph structure reconstruction module. The main functions of each part are: The input of the subgraph embedding layer is the node category of the attribute structure subgraph optimized in step S1-3, which is used to extract the optimized attribute structure subgraph G i 'The original feature vector of the node; Depending on the selected parameters, the structure-aware encoder can be divided into a sub-image structure-aware encoder and a full-image structure-aware encoder, which encode the sub-image and the full-image respectively. The full-graph structure-aware encoder inputs the output feature vector of the node obtained by the subgraph structure-aware encoder and the relationship E between the edges of the subgraphs entity , perform graph convolution operation in combination with graph attention mechanism to obtain the subgraph output feature vector; The full-graph structure reconstruction module reconstructs the full-graph based on the feature vectors output by the sub-graph and outputs the structural reconstruction loss of the full-graph; The subgraph structure-aware decoder includes a fully connected layer, a node feature reconstruction module and a structure reconstruction module, and outputs a node feature reconstruction loss and a structure reconstruction loss. The fully connected layer connects the subgraph structure-aware encoder and the node feature reconstruction module, and adjusts the dimension of the output feature vector of the node obtained by the subgraph structure-aware encoder to ensure that the dimension of the output feature of the subgraph structure-aware encoder matches the dimension of the input feature of the node feature reconstruction; the node feature reconstructed and output by the node feature module is consistent with the original node feature dimension, which is used to calculate the node feature reconstruction loss error; the structure reconstruction module samples the subgraph nodes and reconstructs the association between the nodes; Step S2-2: Input the attribute structure graph constructed by the training set into the structure-aware graph autoencoder model, perform forward pass and reconstruct the loss error based on the node features; Step S2-3: Update the parameters of each layer using the back propagation method; Step S2-4: Repeat steps S2-2 to S2-3 until the preset loss threshold is reached, and save the parameters of each layer of the trained structure-aware graph autoencoder and the output feature vectors of the nodes obtained by the subgraph structure-aware decoder.

6. The APT attack detection method based on fine-grained attribute structure graph according to claim 5 is characterized in that: The subgraph structure-aware encoder takes as input the node embedding vector output by the subgraph embedding layer and the attribute structure subgraph G optimized in step S1-3. i ', and perform graph convolution operations in combination with the graph attention mechanism to obtain the output feature vector of the node.

7. The APT attack detection method based on fine-grained attribute structure graph according to claim 1 is characterized in that: The subgraph structure-aware decoder includes a node feature reconstruction module and a subgraph structure reconstruction module, and the outputs are node feature loss and structure reconstruction loss respectively; specifically, as follows: Node feature reconstruction module: To reconstruct the original feature vector of the node, a fully connected layer needs to be introduced: Where W r and b r are the learnable weights and bias parameters, respectively, and σ is a nonlinear activation function; the encoded node features h are transformed into i Map back to the original feature space to obtain the reconstructed features Minimize the distance between the reconstructed features and the original features: That is, the node feature reconstruction loss error is composed of the original feature x i and reconstruction features The L2 norm distance composition; Subgraph structure reconstruction module: Reconstructing structural features requires sampling and reconstruction of the subgraph; the sampling part randomly samples node pairs in the subgraph and ensures that the number of node pairs with edges and node pairs without edges is the same; any two nodes constitute a node pair in the sampling process; When the number of edges M in the subgraph that needs to reconstruct the structural features is less than the sampling threshold T, the total number of samples N=M; when the number of edges M in the subgraph that needs to reconstruct the structural features is greater than the sampling threshold T, the total number of samples N=T; The subgraph structure reconstruction module consists of three parts: connection layer, feedforward neural network classifier and subgraph structure reconstruction; Among them, the feature vectors of the two nodes in the connection layer splicing node pair are: h ij =[h i ,h j ] The feedforward neural network classifier inputs the concatenated features and outputs the probability prediction of whether the node has an edge: Where W c and b c are learnable weight and bias parameters; Subgraph structure reconstruction reconstructs the subgraph according to the probability value of the edge output by the feedforward neural network classifier and calculates the structure reconstruction loss; During training, the model is optimized by minimizing the cross entropy loss function between positive and negative samples: The N parameter is set to balance the ratio of positive and negative samples, struct The structure reconstruction loss is used as the subgraph structure-aware decoder for back-propagation.

8. The APT attack detection method based on fine-grained attribute structure graph according to claim 1 is characterized in that: The anomaly detection module adopts the isolation forest model. The specific operations are: First, a single decision tree in the isolation forest model is constructed according to the input Z = [h1,h2,…,h n ] Randomly select h1-h n A feature of h x (x ranges from 1 to n), randomly select a split point within the range of the feature, divide the data into two parts according to this split point, and recursively repeat this process until the split part contains only one sample and reaches the predefined maximum tree depth, where the predefined maximum depth is deep = 12; Secondly, repeat the above steps to build multiple decision trees. The number of trees selected here is 100; Finally, the model outputs the anomaly score of each node Where E(z(h)) is the average path length of sample h in all trees in the isolation forest, and c(n) is the average path length of the tree given n points; According to the anomaly score s, attribute-level abnormal nodes are identified. The anomaly threshold set here is 0.

8. If it is higher than this threshold, it will be judged as an anomaly. After being judged as an anomaly, this module will output the number of the abnormal node.

9. An APT attack detection device based on a fine-grained attribute structure graph according to any one of claims 1 to 8, characterized in that: include: An attribute structure graph construction module for log data preprocessing, an APT attack detection model construction and training module for encapsulating the structure perception graph autoencoder model, an anomaly detection module for outlier determination, and a log feedback module for mapping abnormal entities according to abnormal attribute nodes and extracting abnormal logs. The functions completed by the four modules correspond to the operations of step S1, step S2, step S3, and step S4 of the method described in any one of claims 1 to 8.

Images