APT attack detection method and device based on fine-grained attribute structure graph

Abstract

The present invention discloses an APT attack detection method based on a fine-grained attribute structure graph, comprising the following steps: Step S1: parsing system logs, extracting corresponding attributes of entities, and forming an attribute structure graph; Step S2: training a structure-aware graph autoencoder model; Step S3: identifying abnormal nodes through an anomaly detection model; Step S4: mapping the abnormal nodes screened out in Step S3 to corresponding entities based on an entity-attribute mapping table, and returning the abnormal log entries corresponding to the entities. The present invention breaks through the inherent limitations of information granularity, uses attribute structure features to characterize entities in network behavior, fully explores the structural characteristics of attack behavior, improves the detection capability of hidden APT attack forms, reduces the scope of abnormal logs, and reduces the burden of manually screening and processing malicious attack logs.

Description

Technical Field

[0001] The present invention relates to the technical field of network information security, and in particular to a detection method and device for APT attacks based on a fine-grained attribute structure graph. Background Art

[0002] In recent years, Advanced Persistent Threats (APTs), a growing network attack model, have garnered widespread attention. They are characterized by high stealth, long-lasting, and highly targeted tactics, utilizing a range of covert and deceptive methods to infiltrate systems. Attacks span a wide range of time, potentially lasting months or even years, and often target critical information infrastructure and important information systems. In network security monitoring and management, security personnel struggle to identify and track these threats over the long term. APT attack detection technology, based on log records captured by log collection devices and software, utilizes anomaly detection techniques to identify anomalous behavior patterns and traces that may indicate an APT attack. This technology can promptly detect hidden attack behaviors and provide feedback to human operators for further processing, providing critical intelligence support for network security defenses. It plays a vital role in addressing complex APT attack scenarios and is an indispensable component of the network security field.

[0003] Early APT attack detection technologies relied on security experts to manually collect and summarize APT attack patterns, converting known attack patterns into rules or statistical models. These models were then applied to network traffic or system log data to identify potential APT attacks. These technologies relied on expert knowledge and prior experience, failing to comprehensively and deeply extract features from system logs. They also had poor generalization capabilities and were significantly limited in detecting covert threats with diverse intrusion methods and complex attack phases, as well as new attack patterns.

[0004] In recent years, with the development of machine learning, particularly deep learning and graph neural networks, corresponding technologies have been applied to APT attack detection research. These technologies have addressed some of the shortcomings of earlier APT attack detection technologies and improved the model's generalization capabilities and its ability to characterize hidden attack features. Currently, mainstream APT attack detection models typically use system monitoring log data to construct a provenance graph with strong abstract expression capabilities to characterize the causal relationships between system log data. After training the graph neural network using the provenance graph constructed from the training log data, the provenance graph constructed from the logs to be detected is used as the input to the trained graph neural network. Feature vectors of nodes or edges in the graph are extracted, and APT attack detection is then implemented using classifiers or anomaly detection techniques.

[0005] Currently, APT attack detection methods based on traceability graphs use entities (processes, files, sockets, etc.) in log behavior as nodes to build graphs. This inherently limits the granularity of information, as each node can only represent an entity in network behavior, making it difficult to fully explore the structural characteristics of attack behavior, especially for more subtle attack forms. Furthermore, existing methods suffer from an overly large output range when determining the range of abnormal nodes. Even at the node-level identification granularity, the output of abnormal nodes when mapped back to log data will result in an overly broad range of abnormalities, which still poses a significant burden on the subsequent manual screening and processing of malicious attack logs. Summary of the Invention

[0006] The technical problem to be solved by the present invention is that the existing APT attack detection method is difficult to fully utilize the network behavior structure characteristics, cannot accurately identify hidden attack patterns, and the scale of abnormal logs containing potential APT attacks screened out is not convenient for subsequent manual rapid processing.

[0007] Technical solution of the present invention:

[0008] A method for detecting APT attacks based on fine-grained attribute structure graphs. The specific steps are as follows:

[0009] Step S1: Parse the system log, extract the corresponding attributes of the entity, establish a mapping table between entities and attributes, build a fully connected attribute structure subgraph for all attributes of each entity, prune the redundant nodes and associations in all subgraphs based on the fully connected attribute structure subgraph, select subgraph nodes and establish associations with the remaining subgraphs based on external knowledge to form an attribute structure graph;

[0010] Step S2: Based on the attribute structure graph generated in step S1, its adjacency matrix and the feature vector of the attribute node are input into the structure-perceptual graph autoencoder model, forward propagation is continuously performed, and the reconstruction loss is calculated based on the reconstruction module in the structure-perceptual graph autoencoder model. The parameters are updated through backpropagation until the training conditions are met, and the model parameters and the output feature vector are saved.

[0011] Step S3: Based on the structure perception graph autoencoder model trained in step S2, the preprocessed attribute structure graph to be detected is input into the structure perception graph autoencoder model to obtain the output node feature vector, and the output node feature vector is input into the anomaly detection model to identify abnormal nodes;

[0012] Step S4: According to the entity and attribute mapping table, the abnormal nodes screened out in step S3 are mapped to corresponding entities, and the abnormal log entries corresponding to the entities are returned.

[0013] Furthermore, step S1 includes the following sub-steps:

[0014] Step S1-1: Based on the collected system log data, various key entity objects are identified, such as hosts, processes, files, etc. For each entity object, its corresponding attribute information, such as IP address, login time, execution command, etc., is extracted, and an association mapping is established between the entity and the attribute to form entity-attribute key-value pairs;

[0015] Step S1-2: Take the attributes of the entity object as nodes and construct a fully connected attribute structure subgraph based on its attribute information. The i-th subgraph is denoted as G i ={V i , E i}, where V i and E i are respectively the set of attribute nodes and the set of relations between attributes of the i-th subgraph;

[0016] Step S1-3: Normalize the node features of the fully connected attribute structure subgraph constructed in step S1-2, perform principal component analysis on the standardized feature vector, extract the main feature dimensions, calculate the cosine similarity of the nodes in the principal component space, and remove redundant edges according to the preset similarity threshold to obtain the optimized attribute structure subgraph. The i-th optimized subgraph is denoted as G i '={V i , E i '};

[0017] Step S1-4: Sort the importance of nodes in the attribute structure subgraph optimized by step S1-3, and connect the most important nodes between subgraphs according to the association between entities to form an attribute structure graph, which is recorded as G = {V, E}, where

[0018] V=V1∩V2∩…∩V n , E=E1'∩E2'∩…∩E n '∩E entity , n is the number of subgraphs, E entity Represents an association between entities.

[0019] Furthermore, step S2 includes the following sub-steps:

[0020] Step S2-1: Construct a structure-aware graph autoencoder model, including: subgraph embedding layer, structure-aware encoder, subgraph structure-aware decoder, and full-graph structure reconstruction module. The main functions of each part are:

[0021] The input of the subgraph embedding layer is the node category of the attribute structure subgraph optimized in step S1-3, which is used to extract the optimized attribute structure subgraph G i 'The original feature vector of the node;

[0022] Depending on the selected parameters, the structure-aware encoder can be divided into a sub-graph structure-aware encoder and a full-graph structure-aware encoder, which encode the sub-graph and the full-graph respectively.

[0023] Subgraph structure-aware encoder, whose input is the node embedding vector output by the subgraph embedding layer and the attribute structure subgraph G optimized in step S1-3 i ''s adjacency matrix, combined with the graph attention mechanism to perform graph convolution operations to obtain the output feature vector of the node;

[0024] The full-graph structure-aware encoder inputs the output feature vector of the node obtained by the subgraph structure-aware encoder and the relationship E between the edges of the subgraphs entity , combined with the graph attention mechanism to perform graph convolution operations and obtain the subgraph output feature vector;

[0025] The full-graph structure reconstruction module reconstructs the full graph based on the feature vectors output by the subgraphs and outputs the full-graph structure reconstruction loss.

[0026] The subgraph structure-aware decoder includes a fully connected layer, a node feature reconstruction module, and a structure reconstruction module, which outputs a node feature reconstruction loss and a structure reconstruction loss. The fully connected layer connects the subgraph structure-aware encoder and the node feature reconstruction module, and adjusts the dimension of the output feature vector of the node obtained by the subgraph structure-aware encoder to ensure that the dimension of the output feature of the subgraph structure-aware encoder matches the dimension of the input feature of the node feature reconstruction. The node features output by the node feature reconstruction are consistent with the original node feature dimension and are used to calculate the node feature reconstruction loss error. Structure reconstruction involves sampling the subgraph nodes and reconstructing the associations between the nodes.

[0027] Step S2-2: Input the attribute structure graph constructed by the training set into the structure-aware graph autoencoder model, perform forward pass and reconstruct the loss error based on the node features;

[0028] Step S2-3: Update the parameters of each layer using the back propagation method;

[0029] Step S2-4: Repeat steps S2-2 to S2-3 until the preset loss threshold is reached, and save the parameters of each layer of the trained structure-aware graph autoencoder and the output feature vectors of the nodes obtained by the subgraph structure-aware decoder.

[0030] A fine-grained attribute structure graph-based APT attack detection device includes: an attribute structure graph construction module for log data preprocessing, an APT attack detection model construction and training module for encapsulating a structure-perceptual graph autoencoder model, an anomaly detection module for outlier determination, and a log feedback module for mapping anomalous entities based on anomalous attribute nodes and extracting anomalous logs. The functions performed by these four modules correspond to the operations of steps S1, S2, S3, and S4 of the aforementioned fine-grained attribute structure graph-based APT attack detection method.

[0031] Beneficial effects

[0032] In the present invention, this network behavior modeling method based on attribute structure graph fully mines rich attribute structure information compared with the existing method, and establishes a graph model that describes the entity behavior relationship and entity attribute structure. It not only has powerful expression ability, but also has wide applicability, and has obvious advantages in complex and hidden APT attack detection scenarios. The structure-aware graph autoencoder model adopts an attention mechanism to perform graph convolution operations when performing structure-aware encoding, adaptively assigning different importance weights to different neighbor nodes and graph structure features, and enhancing the model's ability to represent attribute structure information. The structure-aware encoder adopts a hierarchical design (subgraph level, full graph level), first encoding the subgraph level and then encoding the full graph level. This feature extraction method from local to global can better capture structural information at different granularities, describe the topological structure of the graph from local to global, and effectively utilize entity-level features. In the anomaly detection module, since the detection is attribute-level anomalies, when mapping back to the corresponding abnormal entities, the detection accuracy is higher than that of the existing multiple APT attack detection methods, effectively reducing the cost of manual screening. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a flow chart of a method for detecting APT attacks based on a fine-grained attribute structure graph according to the present invention;

[0034] Figure 2 Schematic diagram of the structure of the structural perception graph autoencoder model of the present invention;

[0035] Figure 3 It is a module schematic diagram of the detection device of APT attack based on fine-grained attribute structure graph of the present invention. DETAILED DESCRIPTION

[0036] In order to solve the technical problems existing in the prior art, an embodiment of the present invention provides a detection method for APT attacks based on a fine-grained attribute structure graph.

[0037] like Figure 1,The detection method of APT attacks based on fine-grained attribute structure graph includes the following steps:

[0038] Step S1: Parse the system log, extract the corresponding attributes of the entity, establish a mapping table between entities and attributes, build a fully connected attribute structure subgraph for all attributes of each entity, trim the redundant nodes and associations in all subgraphs, select subgraph nodes based on external knowledge and build associations with other subgraphs to form an attribute structure graph;

[0039] In the present invention, entity attributes and attribute structures are utilized, which is more detailed information that has not been utilized by previous methods, so it is called fine-grained.

[0040] In this example, the open-source DARPA E3 dataset was used as the training set. The DARPA E3 CADETS dataset is part of the DARPA TC program and was collected in enterprise networks during adversarial engagements. DARPA E3 CADETS contains 18.38GB of audit records, encompassing 719,818 system entities and 8,663,569 interactions. Step S1 specifically includes the following substeps:

[0041] Step S1-1: Based on the collected system log data, identify various key entity objects, such as hosts, processes, and files. For each entity object, extract its corresponding attribute information, such as IP address, login time, and execution command, and establish an association mapping between the entity and the attribute, forming entity-attribute key-value pairs. Table 1 lists the corresponding relationships between some entities and attributes;

[0042] Table 1

[0043]

[0044] Step S1-2: Take the attributes of each entity object as nodes and construct a fully connected attribute structure subgraph based on all its attribute information; the i-th subgraph is denoted as G i ={V i , E i}, where V i and E i are respectively the set of attribute nodes and the set of relations between attributes of the i-th subgraph;

[0045] Step S1-3: Perform Z-score normalization on the eigenvectors of each subgraph node, subtract the mean of the eigenvectors, divide by the standard deviation, and eliminate the dimensional differences between the features. Perform principal component analysis on the standardized feature matrix, calculate the covariance matrix of the eigenvectors, and find the eigenvalues ​​and corresponding eigenvectors. Select the first k principal components with the largest variance contribution rate. In this embodiment, k = 5. Project the standardized eigenvectors into the principal component space to obtain the coordinate representation of each node in the principal component space. Calculate the cosine similarity of any two nodes u and v in the principal component space:

[0046]

[0047] Set the similarity threshold θ in the range of [-1, 1], here we take 0.3. For any two nodes u and v whose similarity needs to be calculated, if Sim(u, v) < θ, then the edge between them is considered redundant and can be deleted;

[0048] Step S1-4: For each subgraph, select the PageRank algorithm to sort the importance of the nodes.

[0049]

[0050] Where u is a neighbor of node v, Outdegree(u) is u's outdegree, and d is the damping coefficient, set to 0.85. The PageRank algorithm calculates the importance score of each node. Nodes within the subgraph are sorted in descending order based on their scores. For top-ranked nodes, the subgraphs are connected based on the relationships between entities to construct the attribute structure graph.

[0051] Step S2: Based on the attribute structure graph generated in step S1, its adjacency matrix and the feature vector of the attribute node are input into the structure perception graph autoencoder model, and forward propagation is continuously performed and the reconstruction loss error is calculated based on the reconstruction module. The parameters are updated through backpropagation until the training conditions are met, and the parameters of each layer of the model and the output feature vector are saved;

[0052] The specific steps include:

[0053] Step S2-1: The constructed structure-aware graph autoencoder model contains a subgraph embedding layer, a structure-aware encoder (including a subgraph structure-aware encoder and a full-graph structure-aware encoder), a subgraph structure-aware decoder, and a full-graph structure reconstruction module. The subgraph structure-aware decoder includes a node feature reconstruction module and a subgraph structure reconstruction module. For details, see Figure 2 ;

[0054] The subgraph embedding layer inputs the node category and extracts the original feature vector of the node.

[0055] X=x1,x2,…,x n

[0056] Subgraph structure perception encoder, input node feature vector and subgraph adjacency matrix A = [a ij ], combined with the graph attention mechanism to perform graph convolution operations, obtain the output feature vector of the node, and calculate the attention weights between nodes:

[0057] e ij =LeakyReLU(a T [Wx i |Wx j ])

[0058]

[0059] Where W is the learnable weight matrix, a is the parameter vector of the attention mechanism, and the attention weight a ij Reflects the degree of association between node i and node j. Based on the attention weight a ij Perform graph convolution operations to aggregate feature information of neighboring nodes:

[0060] h i =σ(∑ j a ij Wx j )

[0061] Where σ is a nonlinear activation function, LeakyReLU is used here.

[0062] After the above steps, the output feature vector Z of each node can be obtained:

[0063] Z=[h1,h2,…,h n ]

[0064] The subgraph structure-aware decoder includes a node feature reconstruction module and a subgraph structure reconstruction module, and its outputs are node feature loss and structure reconstruction loss respectively. The details are as follows:

[0065] Node feature reconstruction module:

[0066] To reconstruct the original feature vector of the node, a fully connected layer needs to be introduced:

[0067]

[0068] Where W r and b r are the learnable weight and bias parameters, respectively, and σ is a nonlinear activation function, sigmoid is used here. The encoded node feature h is converted into i Map back to the original feature space to obtain the reconstructed features In order to optimize the feature reconstruction effect, the distance between the reconstructed feature and the original feature can be minimized:

[0069]

[0070] That is, the node feature reconstruction loss error is composed of the original feature x i and reconstruction features The L2 norm distance composition;

[0071] Subgraph structure reconstruction module:

[0072] Reconstructing structural features requires sampling and reconstructing the subgraph. The sampling process randomly samples node pairs in the subgraph, ensuring that the number of node pairs with and without edges is equal. Any two nodes constitute a node pair in the sampling process.

[0073] When the number of edges M in the subgraph whose structural features need to be reconstructed is less than the sampling threshold T, the total number of samples N = M. When the number of edges M in the subgraph whose structural features need to be reconstructed is greater than the sampling threshold T, the total number of samples N = T. The subgraph structure reconstruction module consists of three parts: the connection layer, the feedforward neural network classifier, and the subgraph structure reconstruction.

[0074] Among them, the feature vectors of the two nodes in the connection layer splicing node pair are:

[0075]

[0076] The feedforward neural network classifier inputs the concatenated features and outputs the probability prediction of whether the node has an edge:

[0077]

[0078] Where W c and b c are learnable weight and bias parameters.

[0079] Subgraph structure reconstruction reconstructs the subgraph according to the probability values ​​of the edges output by the feedforward neural network classifier and calculates the structure reconstruction loss.

[0080] During training, the model is optimized by minimizing the cross entropy loss function between positive and negative samples:

[0081]

[0082] The N parameter is set to balance the ratio of positive and negative samples, struct The structure reconstruction loss of the subgraph structure-aware decoder is back-propagated; the full-graph structure reconstruction operation is consistent with the subgraph structure reconstruction operation process;

[0083] Step S2-2: Input the constructed attribute structure graph for training into the structure perception graph autoencoder, perform forward propagation, and calculate L rec and L struct ;

[0084] Step S2-3: Use the back propagation method to update W, a, W in step S2-1 r 、b r 、W c 、b c Parameters such as , make the reconstructed features as close to the original features as possible;

[0085] Step S2-4: Repeat steps S2-2 to S2-3 until the training requirements are met. The training termination condition set here is that the reconstruction loss is less than 0.05 or the change in two adjacent re-losses is less than 0.1%. The trained structure-aware graph autoencoder is used as a feature extraction model to extract subgraph node features, subgraph structure features, and global structure features.

[0086] Step S3: Extract the feature of the attribute structure graph to be detected as Z = [h1, h2, ..., h n ] is used as the input of the anomaly detection module to identify abnormal nodes.

[0087] The anomaly detection module uses the isolation forest model. The specific operations are:

[0088] The first step is to build a single decision tree in the isolation forest model, according to the input Z = [h1,h2,…,h n ] Randomly select h1-h n A feature h x (x ranges from 1 to n), randomly select a split point within the range of the feature, divide the data into two parts based on this split point, and recursively repeat this process until the split part contains only one sample and reaches the predefined maximum tree depth, which is deep = 12 here;

[0089] Secondly, repeat the above steps to build multiple decision trees. The number of trees selected here is 100.

[0090] Finally, the model outputs the anomaly score of each node

[0091]

[0092] Where E(z(h)) is the average path length of sample h across all trees in the isolation forest. The shorter the path, the easier it is to isolate and the more likely it is an outlier. c(n) is the average path length of the tree for a given number of n points.

[0093] According to the anomaly score s, attribute-level abnormal nodes are identified. The abnormal threshold set here is 0.8. If it is higher than this threshold, it will be judged as an abnormality. After being judged as an abnormality, this module will output the number of the abnormal node.

[0094] Step S4: According to the entity and attribute mapping table, map the abnormal node to the corresponding entity, and return the abnormal log entry corresponding to the entity.

[0095] Using this method, the present invention also provides an APT attack detection device based on a fine-grained attribute structure graph, comprising: an attribute structure graph construction module for log data preprocessing, an APT attack detection model construction and training module for encapsulating a structure perception graph autoencoder model, an anomaly detection module for outlier determination, and a log feedback module for mapping abnormal entities according to abnormal attribute nodes and extracting abnormal logs. Figure 3 As shown, the functions completed by the four modules correspond to the operations of step S1, step S2, step S3, and step S4 of the above-mentioned APT attack detection method based on fine-grained attribute structure graph.

[0096] The above description is only a description of the preferred embodiments of the present application and does not limit the scope of the present application. Any changes or modifications made by any person skilled in the art based on the above disclosed technical content should be regarded as equivalent valid embodiments and fall within the scope of protection of the technical solution of the present application.

Claims

1. A method for detecting APT attacks based on fine-grained attribute structure graph, characterized in that: The following steps are involved: Step S1: Parse the system log, extract the corresponding attributes of the entity, establish a mapping table between entities and attributes, build a fully connected attribute structure subgraph for all attributes of each entity, prune the redundant nodes and associations in all subgraphs based on the fully connected attribute structure subgraph, select subgraph nodes and establish associations with the remaining subgraphs based on external knowledge to form an attribute structure graph; Step S2: Based on the attribute structure graph generated in step S1, its adjacency matrix and the feature vector of the attribute node are input into the structure-perceptual graph autoencoder model, forward propagation is continuously performed, and the reconstruction loss is calculated based on the reconstruction module in the structure-perceptual graph autoencoder model. The parameters are updated through backpropagation until the training conditions are met, and the model parameters and the output feature vector are saved. Step S3: Based on the structure perception graph autoencoder model trained in step S2, the preprocessed attribute structure graph to be detected is input into the structure perception graph autoencoder model to obtain the output node feature vector, and the output node feature vector is input into the anomaly detection model to identify abnormal nodes; Step S4: According to the entity and attribute mapping table, the abnormal nodes screened out in step S3 are mapped to corresponding entities, and the abnormal log entries corresponding to the entities are returned.

2. The APT attack detection method based on fine-grained attribute structure graph according to claim 1 is characterized in that: Step S1 includes the following sub-steps: Step S1-1: Identify various key entity objects from the collected system log data, extract the corresponding attribute information for each entity object, and establish an association mapping between the entity and the attribute to form entity-attribute key-value pairs; Step S1-2: Take the attributes of the entity object as nodes and construct a fully connected attribute structure subgraph based on the attribute information of the entity. The i-th subgraph is denoted as G i ={V i , E i }, where V i and E i are respectively the set of attribute nodes and the set of relationships between attributes of the i-th subgraph; Step S1-3: Normalize the node features of the fully connected attribute structure subgraph constructed in step S1-2, perform principal component analysis on the standardized feature vector, extract the main feature dimensions, calculate the cosine similarity of the nodes in the principal component space, and remove redundant edges according to the preset similarity threshold to obtain the optimized attribute structure subgraph. The i-th optimized subgraph is denoted as G i '={V i , E i '}; Step S1-4: Sort the importance of nodes in the attribute structure subgraph optimized by step S1-3, and connect the most important nodes between subgraphs according to the association between entities to form an attribute structure graph, denoted as G={V, E}, where V=V1∩V2∩…∩V n , E=E1'∩E2'∩…∩E n '∩E entity , n is the number of subgraphs, E entity Represents an association between entities.

3. The APT attack detection method based on fine-grained attribute structure graph according to claim 2 is characterized in that: In step S1-3, the eigenvector of each subgraph node is Z-score standardized, the mean of the eigenvector is subtracted, and the eigenvector is divided by the standard deviation to eliminate the dimensional differences between the features; the standardized feature matrix is ​​subjected to principal component analysis, the covariance matrix of the eigenvector is calculated, and the eigenvalues ​​and corresponding eigenvectors are obtained. The first k principal components with the largest variance contribution are selected, and the standardized eigenvectors are projected into the principal component space to obtain the coordinate representation of each node in the principal component space. The cosine similarity of any two nodes u and v in the principal component space is calculated: Set the similarity threshold θ, which ranges from [-1, 1] and is 0.3 here. For any two nodes u and v whose similarity needs to be calculated, if Sim(u, v) < θ, the edge between them is considered redundant and can be deleted.

4. The APT attack detection method based on fine-grained attribute structure graph according to claim 2 is characterized in that: In step S1-4, for each subgraph, the PageRank algorithm is used to sort the importance of the nodes. Where u is the neighbor node of node v, Outdegree(u) is the outdegree of u, and d is the damping coefficient, which is 0.

85. The importance score of each node is obtained through the PageRank algorithm. The nodes in the subgraph are sorted in descending order according to the score. For the top-ranked nodes, the subgraphs are connected according to the association relationship between entities to construct the attribute structure diagram.

5. The APT attack detection method based on fine-grained attribute structure graph according to claim 1 is characterized in that: Step S2 includes the following sub-steps: Step S2-1: Construct a structure-aware graph autoencoder model, including: subgraph embedding layer, structure-aware encoder, subgraph structure-aware decoder, and full-graph structure reconstruction module. The main functions of each part are: The input of the subgraph embedding layer is the node category of the attribute structure subgraph optimized in step S1-3, which is used to extract the optimized attribute structure subgraph G i 'The original feature vector of the node; According to the different parameters selected, the structure-aware encoder can be divided into a sub-image structure-aware encoder and a full-image structure-aware encoder, which encode the sub-image and the full-image respectively; The full-graph structure-aware encoder inputs the output feature vector of the node obtained by the subgraph structure-aware encoder and the relationship E between the edges of the subgraphs entity , combined with the graph attention mechanism to perform graph convolution operations and obtain the subgraph output feature vector; The full-graph structure reconstruction module reconstructs the full graph based on the feature vectors output by the subgraphs and outputs the full-graph structure reconstruction loss. The subgraph structure-aware decoder includes a fully connected layer, a node feature reconstruction module, and a structure reconstruction module, which outputs a node feature reconstruction loss and a structure reconstruction loss. The fully connected layer connects the subgraph structure-aware encoder and the node feature reconstruction module, and adjusts the dimension of the output feature vector of the node obtained by the subgraph structure-aware encoder to ensure that the dimension of the output feature of the subgraph structure-aware encoder matches the dimension of the input feature of the node feature reconstruction; the node feature reconstructed by the node feature module is consistent with the original node feature dimension, which is used to calculate the node feature reconstruction loss error; the structure reconstruction module samples the subgraph nodes and reconstructs the association between the nodes; Step S2-2: Input the attribute structure graph constructed by the training set into the structure-aware graph autoencoder model, perform forward pass and reconstruct the loss error based on the node features; Step S2-3: Update the parameters of each layer using the back propagation method; Step S2-4: Repeat steps S2-2 to S2-3 until the preset loss threshold is reached, and save the parameters of each layer of the trained structure-aware graph autoencoder and the output feature vectors of the nodes obtained by the subgraph structure-aware decoder.

6. The APT attack detection method based on fine-grained attribute structure graph according to claim 5 is characterized in that: The subgraph structure perception encoder takes as input the node embedding vector output by the subgraph embedding layer and the attribute structure subgraph G optimized in step S1-3. i 's adjacency matrix, and performs graph convolution operations in combination with the graph attention mechanism to obtain the output feature vector of the node.

7. The APT attack detection method based on fine-grained attribute structure graph according to claim 1 is characterized in that: The subgraph structure-aware decoder includes a node feature reconstruction module and a subgraph structure reconstruction module, and its outputs are node feature loss and structure reconstruction loss respectively; the details are as follows: Node feature reconstruction module: To reconstruct the original feature vector of the node, a fully connected layer needs to be introduced: Where W r and b r are the learnable weight and bias parameters, σ is the nonlinear activation function; the encoded node features h are transformed into i Map back to the original feature space to obtain the reconstructed features ; Minimize the distance between the reconstructed features and the original features: That is, the node feature reconstruction loss error is composed of the original feature x i and reconstruction features The L2 norm distance composition; Subgraph structure reconstruction module: Reconstructing structural features requires sampling and reconstructing the subgraph. The sampling part randomly samples node pairs in the subgraph and ensures that the number of node pairs with edges and node pairs without edges is equal. Any two nodes constitute a node pair in the sampling process. When the number of edges M in the subgraph that needs to reconstruct the structural features is less than the sampling threshold T, the total number of samples N=M; when the number of edges M in the subgraph that needs to reconstruct the structural features is greater than the sampling threshold T, the total number of samples N=T; The subgraph structure reconstruction module consists of three parts: connection layer, feedforward neural network classifier and subgraph structure reconstruction; Among them, the feature vectors of the two nodes in the connection layer splicing node pair are: The feedforward neural network classifier inputs the concatenated features and outputs the probability prediction of whether the node has an edge: Where W c and b c are learnable weight and bias parameters; Subgraph structure reconstruction reconstructs the subgraph according to the probability value of the edge output by the feedforward neural network classifier and calculates the structure reconstruction loss; During training, the model is optimized by minimizing the cross entropy loss function between positive and negative samples.

8. The APT attack detection method based on fine-grained attribute structure graph according to claim 1 is characterized in that: The anomaly detection module uses the isolation forest model, and the specific operations are as follows: First, a single decision tree in the isolation forest model is constructed, based on the input Randomly select h1-h n A feature h x (x ranges from 1 to n), randomly select a split point within the range of the feature, divide the data into two parts based on this split point, and recursively repeat this process until the split part contains only one sample and reaches the predefined maximum tree depth, which is deep=12 here; Secondly, repeat the above steps to build multiple decision trees. The number of trees selected here is 100. Finally, the model outputs the anomaly score of each node ， Where E(z(h)) is the average path length of sample h across all trees in the isolation forest, and c(n) is the average path length of a tree given n points. According to the anomaly score s, attribute-level abnormal nodes are identified. The anomaly threshold set here is 0.

8. If it is higher than this threshold, it will be judged as an anomaly. After being judged as an anomaly, the anomaly detection module will output the number of the abnormal node.

9. An APT attack detection device based on a fine-grained attribute structure graph according to the method according to any one of claims 1 to 8, characterized in that: include: An attribute structure graph construction module for log data preprocessing, an APT attack detection model construction and training module for encapsulating a structure perception graph autoencoder model, an anomaly detection module for outlier determination, and a log feedback module for mapping abnormal entities according to abnormal attribute nodes and extracting abnormal logs; the functions performed by the four modules correspond to the operations of steps S1, S2, S3, and S4 of the method described in any one of claims 1 to 8, respectively.

Images