GCN-based honey situation map analysis method

Abstract

The invention provides a GCN-based honey situation map analysis method, and relates to the technical field of neural networks. Node information and side information are obtained, a honey array subgraph is constructed, and a # imgabs0 #-order Laplacian matrix is obtained; updating and recurring a characteristic value of the # imgabs1 #-order Laplacian matrix based on the maximum characteristic value of the honey array subgraph to obtain a normalized Laplacian matrix; performing random feature masking on each node to obtain a plurality of updated node feature matrixes; and obtaining node outputs of the plurality of honey array sub-graphs on the plurality of levels based on the updated node feature matrix, obtaining a prediction value, carrying out iteration on parameters of the graph neural network based on the prediction value, obtaining an updated graph neural network, and generating a prediction result. According to the invention, the convolution calculation is carried out on the graph signal, and the Laplacian matrix and the Chebyshev polynomial of the graph are combined, so that an efficient graph convolution kernel is constructed, and the accuracy and the performance of network situation graph analysis are improved.

Description

Technical Field

[0001] The present invention relates to the field of neural network technology, and in particular to a honey array situation diagram analysis method based on GCN. Background Art

[0002] As a graph structure that represents network nodes and their relationships, network situation graphs are widely used in network security, traffic analysis and other fields. Traditional network security analysis methods often rely on the static characteristics of nodes and are difficult to fully capture the correlation information between nodes, especially when dealing with complex and dynamic network attacks. In order to effectively respond to the ever-changing attack methods, honeypot technology is widely used in the field of network security as an active defense strategy. It traps attackers into a virtual environment and collects attackers' behavior data in order to identify and prevent potential threats in advance.

[0003] However, traditional honeypot deployment methods are usually limited to static rules or simple strategies, which are difficult to optimize and adjust in real time according to the dynamic behavior of attackers and changes in the network environment. For this reason, honey arrays have emerged as an extension of honeypots. Honey arrays consist of multiple honeypots, simulating a more complex and distributed environment, aiming to attract and confuse more advanced attackers. Honey arrays can provide richer attack trapping and analysis capabilities than single honeypots, but the complexity of their deployment and management also increases.

[0004] Therefore, it is urgent to provide a solution to improve the above problems. Summary of the invention

[0005] The purpose of the present invention is to provide a GCN-based honey array situation map analysis method to improve the problem that the existing technology often relies on the static characteristics of nodes, is difficult to fully capture the correlation information between nodes, and leads to low network security node status prediction ability.

[0006] The present invention provides a GCN-based honey array situation map analysis method using the following technical solutions: Acquire node information based on the behavior data of the honeypot, acquire edge information based on the traffic characteristics on the attack path, and construct a honey array subgraph based on the node information and the edge information, wherein the honey array subgraph includes multiple nodes and multiple edges, and the honey array is composed of multiple honey array subgraphs; Based on the adjacency matrix The Laplace matrix of order is updated based on the maximum eigenvalue of the honey matrix subgraph. The eigenvalues ​​of the Laplace matrix of order are obtained to obtain the normalized Laplace matrix; Perform a random feature mask on each of the nodes to obtain multiple initial node feature matrices, based on the normalized Laplace matrix The first-order graph convolution kernel is reduced in order to obtain an updated first-order graph convolution kernel, and each initial node feature matrix in the graph neural network is updated based on the first-order graph convolution kernel to obtain multiple updated node feature matrices; Based on the updated node feature matrix, the node outputs of multiple honeycomb subgraphs at multiple levels are obtained, and based on multi-layer perception, convolution and pooling processing are performed on the node outputs to obtain prediction values, and based on the cross entropy loss, the parameters of the graph neural network are iterated to obtain the updated graph neural network and generate prediction results.

[0007] The beneficial effects of a GCN-based honey array situation map analysis method provided by the present invention are that, firstly, in order to process the undetermined parameters in the graph convolution kernel, the present invention approximates the normalized Laplace matrix through Chebyshev polynomials, thereby avoiding the explicit calculation of eigenvalues, reducing the computational complexity, making the model more compact, and reducing the memory consumption and overfitting risk of the training process; secondly, by adjusting the order of the Chebyshev polynomials, the present invention can control the trade-off between the accuracy of the approximation and the computational complexity, thereby improving flexibility and scalability.

[0008] Optionally, the traffic characteristics include: throughput, round-trip delay and pulse signal strength. The nodes have multi-dimensional feature vectors, including: subnet traffic change rate, number of security alarms, security audit coverage, number of security devices, vulnerability exploitation frequency, average survival time of key devices in the sub-gateway. The security status of the nodes is from high to low: high risk, medium risk, suspicious, unknown risk, isolated, and no risk.

[0009] Optionally, the The mathematical expression of the Laplacian matrix is: ; in, express The Laplacian matrix of order, represents the identity matrix, represents the adjacency matrix, express The degree matrix of .

[0010] Optionally, the mathematical expression of the normalized Laplace matrix is: ; in, represents the normalized Laplacian matrix, express The Laplacian matrix of order, is the maximum eigenvalue of the honey array graph, Represents the identity matrix.

[0011] Optionally, the The order graph convolution kernel is represented as a graph The order of the domain, among which Step Graph Convolution Kernel The mathematical expression is: ; in, is the Chebyshev polynomial of the Laplace matrix, are the parameters of the convolution kernel, Represents the order of the graph convolution kernel.

[0012] Optional, yes The process of reducing the order of the first-order graph convolution kernel to obtain the updated first-order graph convolution kernel includes: ; in, , ; when hour, The Laplace matrix of order becomes the normalized Laplace matrix, and the mathematical expression is: ; in, represents the normalized Laplacian matrix.

[0013] Optionally, the process of updating the feature matrix of each initial node in the graph neural network based on the first-order graph convolution kernel includes: ; in, represents the updated node feature matrix, express The convolution kernel of order , Indicates The node feature matrix of the graph convolutional network layer, represents the RELU activation function, represents the parameter matrix, Indicates when The corresponding convolution kernel parameters are: Indicates when The corresponding convolution kernel parameters are represents the normalized Laplacian matrix.

[0014] Optional, After multiple simplifications of the first-order graph convolution kernel, the mathematical expression of the first-order graph convolution kernel is obtained as follows: ; in, express The convolution kernel of order , express The parameters of the order graph convolution kernel, represents the Chebyshev polynomial of the Laplace matrix, , represents a constant term, , represents the normalized Laplacian matrix.

[0015] Optionally, the process of performing random feature masking for each of the nodes includes: randomly discarding one or more nodes or modifying the features of one or more nodes from all nodes corresponding to the honey matrix subgraph, and generating a corresponding source code value matrix for each node , among which Retained nodes No. feature channels, Indicates discarding the channel.

[0016] Optionally, the process of performing convolution and pooling processing on the node output based on multi-layer perception to obtain a prediction value includes: ; ; in, Represents the predicted value, which represents the security status information of the node in the output honeymatrix. represents multi-layer perception, represents the pooling operation, Indicates The sub-graph Layer output, Represents a two-dimensional convolution operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a flow chart of a GCN-based honey array situation diagram analysis method provided by the present invention. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0019] The embodiment of the present invention provides a method for analyzing a honey array situation graph based on GCN, including: S1. Obtain node information based on the behavior data of the honeypot, obtain edge information based on the traffic characteristics on the attack path, and construct a honey array subgraph based on the node information and edge information, wherein the honey array subgraph includes multiple nodes and multiple edges, and the honey array is composed of multiple honey array subgraphs; S2, based on the adjacency matrix to obtain The Laplace matrix of order is updated based on the maximum eigenvalue of the honey matrix subgraph. The eigenvalues ​​of the Laplace matrix of order are obtained to obtain the normalized Laplace matrix; S3, performing random feature masking for each of the nodes to obtain multiple initial node feature matrices, based on the normalized Laplace matrix The first-order graph convolution kernel is reduced in order to obtain an updated first-order graph convolution kernel, and each initial node feature matrix in the graph neural network is updated based on the first-order graph convolution kernel to obtain multiple updated node feature matrices; S4. Based on the updated node feature matrix, node outputs of multiple honeycomb subgraphs at multiple levels are obtained, and based on multi-layer perception, convolution and pooling processing are performed on the node outputs to obtain prediction values, and the parameters of the graph neural network are iterated based on the cross entropy loss to obtain an updated graph neural network and generate prediction results.

[0020] In some embodiments, when executing step S1, the traffic characteristics include: throughput, round-trip delay and pulse signal strength. The nodes have multi-dimensional feature vectors, including: subnet traffic change rate, number of security alarms, security audit coverage, number of security devices, vulnerability exploitation frequency, and average survival time of key devices in the sub-gateway. The security status of the nodes is from high to low: high risk, medium risk, suspicious, unknown risk, isolated, and no risk.

[0021] Specifically, there are several subgraphs in the honey matrix, represented as , each honey array situation diagram is Each honeypot is considered as a node in the graph model. ,The behavior data of the honeypot is collected as node information. The traffic characteristics of the attacker on the honeypot attack path are defined as side information , is the feature matrix of the node, where any node Both The feature vector of , usually including subnet traffic change rate, number of security alerts, security audit coverage, number of security devices, frequency of vulnerability exploitation, and average survival time of key devices in the sub-gateway.

[0022] in, Indicates the number of honey array sub-graphs, Indicates the number of nodes.

[0023] Furthermore, each subgraph With a set of tags association, is a description of the security status of a set of subgraph nodes, denoted as ,in, Indicates the number of security states.

[0024] In some embodiments, when executing step S2, the The mathematical expression of the Laplacian matrix is: ; in, express The Laplacian matrix of order, represents the identity matrix, represents the adjacency matrix, express The degree matrix of .

[0025] In fact, in graph convolutional networks (GCNs), the goal is to learn the representation of node features by performing convolution operations on the structure of the graph. However, traditional convolution operations are usually defined on regular structures in Euclidean space, such as two-dimensional grids (images) or one-dimensional sequences (text), while graph data has a non-Euclidean structure and no clear grid points. Therefore, in graph convolution, convolution operations are usually defined by the Laplacian matrix or adjacency matrix of the graph, which can effectively capture the relationship and connection pattern between nodes in the graph, and then transform and propagate node features.

[0026] Furthermore, the eigenvalue decomposition of the Laplace matrix can represent the frequency domain information of the graph, but it is very expensive to calculate it directly, especially for large-scale honey array graphs. Therefore, the Chebyshev polynomials can be used to approximate the Laplace matrix to avoid directly transforming it in the frequency domain. The Chebyshev polynomials are efficient mathematical tools that can approximate the high-order eigenvalues ​​of the Laplace matrix without the expensive eigenvalue decomposition.

[0027] Furthermore, in order to deal with the unknown parameters in the graph convolution kernel, the normalized Laplace matrix is ​​normalized by the Chebyshev polynomial Specifically, the expansion of Chebyshev polynomials is used to approximate the convolution operation on the graph signal. Step Graph Convolution Kernel is restricted to only depend on the graph The order neighborhood, that is ; in, is the Chebyshev polynomial of the Laplace matrix, are the parameters of the convolution kernel, Represents the order of the graph convolution kernel.

[0028] Furthermore, in order to facilitate the expansion and calculation of Chebyshev polynomials, it is usually necessary to further linearly transform the Laplace matrix. This is because the expansion of Chebyshev polynomials usually assumes that the eigenvalue range of the operation object is between [−1, 1]. Therefore, the eigenvalue range of the Laplace matrix needs to be scaled to obtain a normalized Laplace matrix.

[0029] Specifically, in order to simplify the honey matrix convolution kernel, the order of the Chebyshev polynomial is usually Restrictions are made, in particular, high-order Chebyshev polynomials are simplified to low-order polynomials, where when The recursive mathematical expression is: ; Among them, when the order hour, , when the order hour, .

[0030] when hour, The first-order Laplacian matrix becomes a first-order graph convolution kernel, and the mathematical expression is: ; in, represents the first-order graph convolution kernel, represents the normalized Laplacian matrix.

[0031] In fact, when When the first-order Laplace matrix becomes a first-order graph convolution kernel, it means that the first-order graph convolution kernel is just a linear transformation of the normalized Laplace matrix, and no complex polynomial calculation is required. If we only use the first-order Chebyshev polynomial, that is, , then the expression of the graph convolution kernel is simplified to: ; in, , represents a constant term, , represents the normalized Laplacian matrix, so the first-order graph convolution kernel can be further simplified as: ; in, represents the first-order graph convolution kernel, Indicates when The corresponding convolution kernel parameters are Indicates when The corresponding convolution kernel parameters are represents the normalized Laplacian matrix.

[0032] In fact, the graph convolution operation can be defined by simply combining the normalized Laplacian matrix and a constant term. For this order of graph convolution kernel simplification, the parameters and It is learnable and the computational complexity of the model is greatly reduced.

[0033] Furthermore, After multiple simplifications of the first-order graph convolution kernel, the mathematical expression of the first-order graph convolution kernel is obtained as follows: ; in, express The convolution kernel of order , represents the parameters of the convolution kernel, represents the Chebyshev polynomial of the Laplace matrix, , represents a constant term, , represents the normalized Laplacian matrix.

[0034] Furthermore, in order to improve the generalization ability of the model and prevent overfitting, it is necessary to perform random feature masking on each node information. By randomly discarding or modifying some node features to simulate different graph data perturbations, the graph model's tolerance to noise and changes is improved. A source code value matrix is ​​generated for each node. ,in Retained nodes No. feature channels, Indicates discarding the channel.

[0035] After passing through the mask matrix once, the normalized Laplacian matrix It can be expressed as: ; in, Represents a mask matrix.

[0036] In fact, for each channel, the mask value is determined by a random variable, usually sampled from a Bernoulli distribution, i.e. ,in It is a hyperparameter, usually set between 0.5 and 1. Can increase the regularization effect.

[0037] Furthermore, once the feature masking operation is completed, the masked node features can be input into the graph neural network for further calculation. For example, for a model based on graph convolution (GCN), for each layer of graph convolution, the process of updating each initial node feature matrix in the graph neural network based on the first-order graph convolution kernel includes: ; in, represents the updated node feature matrix, express The convolution kernel of order , Indicates The node feature matrix of the graph convolutional network layer, represents the RELU activation function, represents the parameter matrix, Indicates when The corresponding convolution kernel parameters are Indicates when The corresponding convolution kernel parameters are represents the normalized Laplacian matrix.

[0038] In some embodiments, the process of performing convolution and pooling processing on the node output based on multi-layer perception to obtain a prediction value in step S4 includes: ; ; in, represents the predicted value, represents multi-layer perception, represents the pooling operation, Indicates The sub-graph Layer output, Represents a two-dimensional convolution operation.

[0039] Furthermore, the default convolution kernel size is 5 and the pooling size is 2. is the set of predicted values ​​of all graphs, where the following relationship is satisfied: ; in, Represents the predicted values ​​of all honey array subgraphs that execute the Softmax function.

[0040] Furthermore, when executing step S4, the distance between the predicted value and the true label can be calculated using the cross entropy loss to optimize the network parameters, wherein the cross entropy loss The mathematical expression is: ; in, represents the true label, Indicates the execution of the Softmax function The predicted value of a honey array graph, Indicates the number of honey array sub-graphs.

[0041] In summary, through the above steps, the present invention can effectively improve the prediction accuracy of the node security status in the honey array graph and discover potential threats in a timely manner.

[0042] Although the embodiments of the present invention are described in detail above, it is obvious to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as described in the claims. Moreover, the present invention described herein may have other embodiments and may be implemented or realized in a variety of ways.

Claims

1. A honey array situation map analysis method based on GCN, comprising: Acquire node information based on the behavior data of the honeypot, acquire edge information based on the traffic characteristics on the attack path, and construct a honey array subgraph based on the node information and the edge information, wherein the honey array subgraph includes multiple nodes and multiple edges, and the honey array is composed of multiple honey array subgraphs; Based on the adjacency matrix The Laplace matrix of order is updated based on the maximum eigenvalue of the honey matrix subgraph. The eigenvalues ​​of the Laplace matrix of order are obtained to obtain the normalized Laplace matrix; Perform a random feature mask on each of the nodes to obtain multiple initial node feature matrices, based on the normalized Laplace matrix The first-order graph convolution kernel is reduced in order to obtain an updated first-order graph convolution kernel, and each initial node feature matrix in the graph neural network is updated based on the first-order graph convolution kernel to obtain multiple updated node feature matrices; Based on the updated node feature matrix, the node outputs of multiple honeycomb subgraphs at multiple levels are obtained, and based on multi-layer perception, convolution and pooling processing are performed on the node outputs to obtain prediction values, and based on the cross entropy loss, the parameters of the graph neural network are iterated to obtain the updated graph neural network and generate prediction results.

2. According to the GCN-based honey array situation map analysis method of claim 1, it is characterized in that: The traffic characteristics include: throughput, round-trip delay and pulse signal strength. The nodes have multi-dimensional feature vectors, including: subnet traffic change rate, number of security alarms, security audit coverage, number of security devices, vulnerability exploitation frequency, and average survival time of key devices in the sub-gateway. The security status of the nodes is from high to low: high risk, medium risk, suspicious, unknown risk, isolated, and no risk.

3. The method for analyzing a honey array situation diagram based on GCN according to claim 1, characterized in that: Said The mathematical expression of the Laplacian matrix is: ； in, express The Laplacian matrix of order, represents the identity matrix, represents the adjacency matrix, express The degree matrix of .

4. The method for analyzing a honey array situation diagram based on GCN according to claim 1, characterized in that: The mathematical expression of the normalized Laplace matrix is: ； in, represents the normalized Laplacian matrix, express The Laplacian matrix of order, is the maximum eigenvalue of the honey array graph, Represents the identity matrix.

5. The method for analyzing a honey array situation diagram based on GCN according to claim 1, characterized in that: Said The order graph convolution kernel is represented as a graph The order of the domain, among which Step Graph Convolution Kernel The mathematical expression is: ； in, is the Chebyshev polynomial of the Laplace matrix, are the parameters of the convolution kernel, Represents the order of the graph convolution kernel.

6. The method for analyzing a honey array situation diagram based on GCN according to claim 1, characterized in that: right The process of reducing the order of the first-order graph convolution kernel to obtain the updated first-order graph convolution kernel includes: ； in, , ; when hour, The Laplace matrix of order becomes the normalized Laplace matrix, and the mathematical expression is: ； in, represents the normalized Laplacian matrix.

7. The method for analyzing a honey array situation diagram based on GCN according to claim 1, characterized in that: The process of updating the feature matrix of each initial node in the graph neural network based on the first-order graph convolution kernel includes: ； in, represents the updated node feature matrix, express The convolution kernel of order , Indicates The node feature matrix of the graph convolutional network layer, represents the RELU activation function, represents the parameter matrix, Indicates when The corresponding convolution kernel parameters are Indicates when The corresponding convolution kernel parameters are represents the normalized Laplacian matrix.

8. The method for analyzing a honey array situation diagram based on GCN according to claim 6, characterized in that: Said After multiple simplifications of the first-order graph convolution kernel, the mathematical expression of the first-order graph convolution kernel is obtained as follows: ； in, express The convolution kernel of order , express The parameters of the order graph convolution kernel, represents the Chebyshev polynomial of the Laplace matrix, , represents a constant term, , represents the normalized Laplacian matrix.

9. The method for analyzing a honey array situation diagram based on GCN according to claim 1, characterized in that: The process of performing random feature masking for each of the nodes includes: randomly discarding one or more nodes or modifying the features of one or more nodes from all nodes corresponding to the honey matrix subgraph, and generating a corresponding source code value matrix for each node , among which Retained nodes No. feature channels, Indicates discarding the channel.

10. The method for analyzing a honey array situation diagram based on GCN according to claim 1, characterized in that: The process of performing convolution and pooling processing on the node output based on multi-layer perception to obtain a predicted value includes: ； ； in, Represents the predicted value, which represents the security status information of the node in the output honeymatrix. represents multi-layer perception, represents the pooling operation, Indicates The sub-graph Layer output, Represents a two-dimensional convolution operation.

Images