Network security detection methods, devices, equipment, and media based on data processing units

Abstract

This invention discloses a network security detection method, apparatus, device, and medium based on a data processing unit. The method includes: acquiring network audit log data; preprocessing the network audit log data to obtain preprocessed network audit log data; generating an audit graph based on the preprocessed network audit log data; and inputting the audit graph into a network security assessment model to obtain network security category behaviors. This technical solution, by analyzing system log data and the audit graph structure of its interrelationships, can intuitively reveal and identify complex attack patterns and abnormal behaviors, thereby improving the accuracy and efficiency of network security detection.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network security detection method, apparatus, device, and medium based on a data processing unit. Background Technology

[0002] With the deepening application of emerging Internet technologies such as big data, cloud computing, the Internet of Things, and the Industrial Internet, enterprises are becoming increasingly more information-based and their dependence on information systems has reached an unprecedented level. At the same time, this has led to the frequent occurrence of various new types of network attacks, sensitive information leaks, and other malicious information security incidents.

[0003] Advanced Persistent Threats (APTs) involve sophisticated cyberattack strategies, characterized by their long duration, stealth, and highly concentrated attacks. A prominent feature of APT attacks is the widespread exploitation of zero-day vulnerabilities.

[0004] Currently, signature-based detection techniques are primarily used to detect Advanced Persistent Threat (APT) attacks and zero-day vulnerabilities. These signature matching methods identify potential attacks within information systems by matching keywords and key phrases. Widely used defense mechanisms, such as Web Application Firewalls (WAFs) and Endpoint Detection and Response (EDR) systems, capture attack behavior from HTTP traffic and log information, respectively. However, signature-based detection techniques exhibit significant limitations when facing APT attacks and zero-day vulnerabilities: they are limited to known signatures; the effectiveness of signature-based detection techniques depends on the comprehensiveness and accuracy of their signature database. For APT attacks and zero-day vulnerabilities (which are often unidentified and undocumented), the lack of explicit signature capabilities may lead to these threats being missed. Furthermore, the data for these signature matching methods mainly comes from system logs, which suffers from data gaps when processing large-scale data. Summary of the Invention

[0005] This invention provides a network security detection method, apparatus, device, and medium based on a data processing unit. By analyzing system log data and the audit graph structure of its interrelationships, it can intuitively reveal and identify complex attack patterns and abnormal behaviors, thereby improving the accuracy and efficiency of network security detection.

[0006] According to one aspect of the present invention, a network security detection method based on a data processing unit is provided, comprising:

[0007] Obtain network audit log data;

[0008] The network audit log data is preprocessed to obtain preprocessed network audit log data;

[0009] An audit graph is generated based on the preprocessed network audit log data.

[0010] Input the audit graph into the network security assessment model to obtain network security category behaviors.

[0011] Optionally, the network audit log data is preprocessed to obtain preprocessed network audit log data, including:

[0012] The data format of the network audit log data is converted into a standard format to obtain standardized network audit log data;

[0013] The standardized network audit log data is cleaned to obtain preprocessed network audit log data.

[0014] Optionally, generating an audit graph based on the preprocessed network audit log data includes:

[0015] Based on the audit log data, determine multiple metagraph information aggregated within a set time period;

[0016] An audit diagram is generated using a graph generator based on the aforementioned metagraph information.

[0017] Optionally, based on the audit log data, determine multiple metagraph information aggregated within a set time period, including:

[0018] The subject node and object node are determined based on the audit log data;

[0019] Multiple events are formed based on topic nodes and object nodes, and these events are converted into multiple metagraph information.

[0020] Optionally, an audit diagram is generated using a graph generator based on the multiple metagraph information, including:

[0021] Node information and edge information are extracted from the metagraph information, and the node information and edge information are used to generate an audit graph through an image generator.

[0022] Optionally, the training method for the network security assessment model is as follows:

[0023] Obtain network audit log data samples and an initial network security assessment model;

[0024] The network audit log data sample is preprocessed to obtain a preprocessed network audit log data sample;

[0025] Based on the preprocessed network audit log data sample, generate audit graph sample and anomaly graph sample;

[0026] The initial cybersecurity assessment model is trained based on the audit graph samples, the anomaly graph samples, and the correlation graph attention network learning method until a cybersecurity assessment model is obtained.

[0027] Optionally, the initial network security assessment model includes an input layer, a node relationship anomaly capture layer, a node time anomaly capture layer, and an output layer;

[0028] The initial cybersecurity assessment model is trained based on the audit graph samples, the anomaly graph samples, and the correlation graph attention network learning method until a cybersecurity assessment model is obtained, including:

[0029] The audit graph sample and the anomaly graph sample are input through the input layer, and the node information and edge information in the audit graph sample and the anomaly graph sample are converted into node feature data; wherein, the edge information includes time data;

[0030] The node feature data is processed by the node relationship anomaly capture layer to determine the attention coefficient between nodes;

[0031] The node feature data is updated according to the attention coefficient, and pooled data and time data are obtained by pooling the updated node feature data.

[0032] Sequence data is determined based on the pooled data and the time data, and the sequence data is processed through the node time anomaly capture layer to obtain target feature data;

[0033] The target feature data is processed by the activation function of the output layer, and the initial network security category behavior data is output.

[0034] The initial cybersecurity assessment model is iteratively optimized based on the loss function and initial cybersecurity category behavior data until a cybersecurity assessment model is obtained.

[0035] According to another aspect of the present invention, a network security detection device based on a data processing unit is provided, comprising:

[0036] The data acquisition module is used to acquire network audit log data;

[0037] The data preprocessing module is used to preprocess the network audit log data to obtain preprocessed network audit log data;

[0038] The graph generation module is used to generate an audit graph based on the preprocessed network audit log data;

[0039] The security category acquisition module is used to input the audit graph into the network security assessment model to obtain network security category behaviors.

[0040] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0041] At least one processor; and

[0042] A memory communicatively connected to the at least one processor; wherein,

[0043] The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to perform the network security detection method based on a data processing unit as described in any embodiment of the present invention.

[0044] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the network security detection method based on a data processing unit as described in any embodiment of the present invention.

[0045] The technical solution of this invention involves acquiring network audit log data; preprocessing the network audit log data to obtain preprocessed network audit log data; generating an audit graph based on the preprocessed network audit log data; and inputting the audit graph into a network security assessment model to obtain network security category behaviors. This technical solution, by analyzing the system log data and the audit graph structure of their interrelationships, can intuitively reveal and identify complex attack patterns and abnormal behaviors, thereby improving the accuracy and efficiency of network security detection.

[0046] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0047] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0048] Figure 1 This is a flowchart of a network security detection method based on a data processing unit according to Embodiment 1 of the present invention;

[0049] Figure 2 This is a flowchart of a network security detection method based on a data processing unit according to Embodiment 2 of the present invention;

[0050] Figure 3 This is a schematic diagram of a network security detection device based on a data processing unit according to Embodiment 3 of the present invention;

[0051] Figure 4 This is a schematic diagram of the structure of an electronic device provided according to Embodiment 4 of the present invention. Detailed Implementation

[0052] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0053] It should be noted that the terms "first," "second," and "target," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0054] Example 1

[0055] Figure 1 This is a flowchart of a network security detection method based on a data processing unit according to Embodiment 1 of the present invention. This embodiment is applicable to the detection of network security in a network system. The method can be executed by a network security detection device, which can be implemented in hardware and / or software, and can be configured in an electronic device with data processing capabilities. Figure 1 As shown, the method includes:

[0056] The technical solution in this embodiment can be applied to network security detection in power network systems. By employing data acquisition and preprocessing technology based on data processing units (DPUs), combined with system-side network security detection methods and graph learning algorithms, and utilizing relational graph attention networks and gated recursive units to capture and analyze complex attack behaviors, the adaptability, accuracy, and efficiency of detection are improved, false alarms are reduced, the challenges of large-scale datasets are effectively addressed, and ultimately, network security defenses are strengthened to protect critical infrastructure and organizations from increasingly complex and covert network attack threats, thereby improving the accuracy of network security detection.

[0057] S110. Obtain network audit log data based on the data processing unit.

[0058] Among them, the Data Processing Unit (DPU), as a new type of computing acceleration hardware, is capable of real-time data acquisition and analysis, distributed network threat detection, and solving the difficulties of large-scale data processing. Network audit log data can be understood as records automatically generated by computer systems, devices, or software when specific events or operations occur. Network audit log data can include various operations, events, and state changes within the network system.

[0059] In this embodiment, network audit log data can be collected in a distributed manner using a Data Processing Unit (DPU). Considering the incompleteness and large volume of data collected by the log system, the DPU performs distributed collection and preprocessing operations on the network audit log data. The log data processed by the DPU is then aggregated to the system threat analysis component for further processing. On one hand, the data collected by the DPU is closer to potential threat sources, making the data more accurate. The preprocessing provides more precise descriptions of attack threats and environmental characteristics, and the data attribute transformation range is smaller, resulting in higher accuracy during data completion. On the other hand, the data collected and preprocessed by the DPU significantly reduces network data communication volume compared to centralized collection, resulting in higher data collection and transmission efficiency. By deploying the DPU on the end device, this embodiment allows for a more intelligent and flexible network architecture.

[0060] S120. Preprocess the network audit log data to obtain preprocessed network audit log data.

[0061] Preprocessing can be understood as data cleaning and data format conversion. The preprocessed network audit log data can be data obtained after data format conversion and data cleaning. In this embodiment, the network audit log data can be converted to a new format using a Data Processing Unit (DPU) and then preprocessed with data cleaning to obtain the preprocessed network audit log data.

[0062] In this embodiment, optionally, the network audit log data is preprocessed to obtain preprocessed network audit log data, including: converting the data format of the network audit log data into a standard format to obtain standardized network audit log data; and cleaning the standardized network audit log data to obtain preprocessed network audit log data.

[0063] The standard format can be CDM format. Standardized network audit log data refers to network audit log data in CDM format. Cleaning can be understood as removing duplicate information, correcting errors, and ensuring data consistency. In this embodiment, the purpose of converting the network audit log data to CDM format is to facilitate the generation of audit graphs for subsequent processing.

[0064] In this embodiment, after the DPU collects network audit log data in various formats, it converts the data format of the network audit log data into CDM format to obtain standardized network audit log data. Then, the standardized network audit log data is processed to remove duplicate information, correct existing errors, and provide data consistency processing operations to obtain preprocessed network audit log data.

[0065] Specifically, in this embodiment, the raw network audit log data format can be converted to CDM format using tools provided by Darpa TC to obtain standardized network audit log data. Raw network audit log data typically arrives as a packaged, unreadable binary file. To improve data readability, the data format is standardized and stored in an SQLite database, using SQLite build scripts to quickly construct a temporary dataset.

[0066] However, since datasets converted to CDM format often contain many issues, this implementation can collaboratively cleanse standardized network audit log data on the DPU and system threat analysis component sides. Specific cleansing processes include: for network flow objects that may lack IP addresses, the object's unique identifier (UUID) can be used to locate the relevant records and fill in the missing IP addresses. This involves querying the relevant `EVENT_Socket` table in the database or dataset, matching the network flow object's UUID, and extracting the IP address stored in that table. The obtained IP address is then filled into the missing field. For records that may contain undefined UUIDs, the UUID field can be checked for empty or invalid (e.g., incorrect format) during data processing, and these records can be deleted. Regular expressions or validation mechanisms are used to ensure that the UUID format conforms to the standard (e.g., a 32-bit UUID standard). If an empty or incorrectly formatted UUID is found, the relevant data is directly deleted to avoid introducing data pollution. For cases where duplicate UUIDs may exist within network stream objects, the uniqueness of a UUID can be ensured by first identifying the duplicate records and then modifying the UUID of one of the duplicate objects. In this embodiment, a hash table or other data structure can be used to check the uniqueness of a UUID. If objects with the same UUID are found, the UUID of one of the objects is modified based on certain rules (such as generating a new UUID or using an algorithm to generate a unique ID). Regarding inconsistent URL paths for file objects, data differences may arise due to different file path formats. Therefore, file paths need to be standardized to unify their format and avoid discrepancies. This embodiment can unify relative and absolute paths by removing redundant characters from the path, such as unnecessary forward slashes and case sensitivity issues, ensuring a consistent path representation for the same file.

[0067] In this embodiment, by setting up the data and cleaning it for different situations as described above, the integrity, uniqueness, and consistency of the data are ensured, thereby improving the quality of subsequent data processing and analysis.

[0068] S130. Generate an audit graph based on the preprocessed network audit log data.

[0069] The audit graph can be a graph structure generated from preprocessed network audit log data. The audit graph records detailed information about various events in the system (such as process creation, file access, and network connections). The data in the audit graph typically includes detailed information about system processes, applications, and registry edits, which helps improve the accuracy of attack identification. In this embodiment, the audit graph may include multiple metagraph pieces of information. Each metagraph piece of information can be derived from each event in the network audit log data.

[0070] In this embodiment, the specific method for generating an audit graph based on preprocessed system network audit log data is as follows: Node information and edge information of the audit graph are determined based on the preprocessed system network audit log data; multiple meta-graph information is composed based on the node and edge information; and an audit graph structure is generated based on the multiple meta-graph information. In this embodiment, the audit graph can track and represent behavioral patterns in the system, including normal network behavior and potential malicious behavior. This embodiment can identify complex attack chains and APT (Advanced Persistent Threat) attack patterns by analyzing the audit graph.

[0071] S140. Input the audit graph into the network security assessment model to obtain network security category behaviors.

[0072] The network security assessment model can be a pre-trained network model used to detect network security behaviors. Network security behaviors can include normal network behaviors and abnormal network behaviors.

[0073] In this embodiment, the audit graph generated based on network audit log data can be input into a trained network security assessment model. The network security assessment model analyzes and processes the input audit graph to obtain the network normal behavior category or the network abnormal behavior category.

[0074] The technical solution of this invention involves acquiring network audit log data; preprocessing the network audit log data to obtain preprocessed network audit log data; generating an audit graph based on the preprocessed network audit log data; and inputting the audit graph into a network security assessment model to obtain network security category behaviors. This technical solution, by analyzing the system log data and the audit graph structure of their interrelationships, can intuitively reveal and identify complex attack patterns and abnormal behaviors, thereby improving the accuracy and efficiency of network security detection.

[0075] Example 2

[0076] Figure 2 This is a flowchart of a network security detection method based on a data processing unit according to Embodiment 2 of the present invention. This embodiment is an optimization based on the above embodiment. Specifically, the optimization is as follows: generating an audit graph based on preprocessed network audit log data, including: determining multiple metagraph information aggregated within a set time period based on the network audit log data; and generating an audit graph based on the multiple metagraph information using a graph generator. Figure 2 As shown, the method includes:

[0077] S210. Obtain network audit log data based on the data processing unit.

[0078] S220. Preprocess the network audit log data to obtain preprocessed network audit log data.

[0079] S230. Determine multiple metagraph information aggregated within a set time period based on network audit log data.

[0080] Here, the set duration can be understood as a predetermined time period. In this embodiment, the set duration can be one minute, two minutes, or five minutes. Metagraph information can be information derived from each event in the network audit log data. In this embodiment, each event in the CDM format network audit log data can be used to construct a metagraph information. In this embodiment, the corresponding node type can be determined based on the network audit log data, and based on the node type, all metagraph information derived from each event can be aggregated within the set duration to determine multiple metagraph information within the set duration.

[0081] In this embodiment, optionally, determining multiple metagraph information aggregated within a set time period based on audit log data includes: determining topic nodes and object nodes based on audit log data; and converting multiple events into multiple metagraph information based on the multiple events constituted by topic nodes and object nodes.

[0082] The metagraph information can consist of events, each event consisting of a node type and a process between nodes. A topic node can be one type of node in the audit graph. In this embodiment, the node types in the audit graph can include topic nodes and object nodes. Edges in the audit graph can represent events between topic nodes and object nodes; in this embodiment, the subject of most edges can be defined as a process.

[0083] In this embodiment, various attribute information of the audit log data can be defined to determine topic nodes and object nodes. Specifically, in this embodiment, node types are divided into topics and objects, corresponding to topics and objects in the CDM format information flow. For topic nodes, four attributes are defined: device ID, UUID, parent topic ID, and local subject ID. For object nodes, three attributes are defined: UUID, device ID, and object type. The UUID (Universally Unique Identifier) ​​in both topic and object nodes is used as the node's identifier, and this identifier must be unique. The device ID in topics and objects represents the ID of the device associated with the node. The parent topic ID in a topic node can represent the ID of the parent process of a process; this attribute allows for tracking long-term attack behavior. The local subject ID in a topic node refers to the user's principal identity, such as root in Linux and Administrator in Windows. The same user principal within the same device has the same ID. The "object type" in "object" can represent the ID of the object type; in this embodiment, objects can be divided into ten types. In addition to common types (including folders, files, processes, sockets, network streams, and local entities), this embodiment of the invention also focuses on inter-process communication (IPC), proposing three types of IPC: unnamed IPC pipes, IPC socket pairs, and IPC sources and receivers. The object types in this embodiment cover the three most common IPC types in CDM message formats: source and sink of IPC data streams, general unidirectional communication between parent and child processes (unnamed pipes), and general bidirectional communication modes (socket pairs). For other IPC messages, since the data volume is small and essentially harmless, this embodiment can classify them all as unknown types.

[0084] In this embodiment, multiple events can be constructed based on topic nodes and object nodes. The specific method for converting these multiple events into multiple metagraph information is as follows: Based on the topic nodes and object nodes determined by defining various attributes of the network audit log data, and combined with the execution operations of each object in the network audit log data, multiple events are constructed, and these events are then converted into corresponding metagraph information. In this embodiment, the most basic component of each event is a node type, which can include topic nodes and object nodes. An event can be an operation performed by a process on another object; for example, reading or writing a file or directory can be considered an event. In this embodiment, events such as which user accessed which file recorded in the network audit log can be combined with other events to convert them into multiple metagraph information.

[0085] In this embodiment, the node types in the audit graph can be obtained based on the various attribute definitions in the network audit log data, and the metagraph information can be constructed based on the node types to facilitate the generation of the audit graph based on the metagraph information.

[0086] S240. Generate an audit diagram using a graph generator based on multiple metagraph information.

[0087] The graph generator can be a tool used to generate graphs. In this embodiment, the graph generator can quickly generate a graphical representation of multiple metagraphs derived from multiple events within a set time period to obtain an audit graph.

[0088] In this embodiment, optionally, generating an audit graph based on multiple metagraph information using a graph generator includes: extracting node information and edge information from the metagraph information, and generating an audit graph using the node information and edge information through an image generator.

[0089] In this context, node information can be understood as the node type in the metagraph information, and edge information can be understood as the process relationship between nodes. Specifically, in this embodiment, topic nodes and object nodes can be extracted from the metagraph information. Parent topic nodes are generated based on the parent topic ID attribute of the defined topic nodes and are considered as process-type object nodes. Subject nodes are generated based on the local subject ID attribute of the defined topic nodes and are considered as local subject-type object nodes.

[0090] In this embodiment, due to the rich relationships between nodes, a total of 56 different types of edges are defined for the audit graph. These serve as edges between nodes to fully draw information-rich graphs. Edges represent events between subjects and objects, and the subject of most edges is defined as a process. The object of the event is one of 10 types of nodes defined by attributes. Most edge definitions in this embodiment primarily refer to audit log data information in CDM format, summarizing and organizing potential information. A small number of edge types focus on the attribute information of the subject. Furthermore, to generate parent subject nodes and local subject nodes in subsequent processes, this embodiment specifically adds two edge definitions, SUB_PROCESS and PRINCIPAL_PROCESS, as a supplement to address the ParentSubject-ID and Local Principle ID in the Subject node.

[0091] In this embodiment, in order to convert the raw data into a graphical format that the model can effectively process, a graph generator was developed. This graph generator extracts node and edge information from the metagraph information stored in a pre-configured SQLite database, so that the graph generator processes the information flow minute by minute to create a graph and generate an audit graph.

[0092] In this embodiment, the setup allows for the generation of corresponding audit graphs based on metagraph information and the graph generator. By constructing and analyzing the graph structure of entities and their interrelationships in the system log data, complex attack patterns and abnormal behaviors can be intuitively revealed and identified, thereby helping to promptly detect and respond to security threats.

[0093] S250. Input the audit graph into the network security assessment model to obtain network security category behaviors.

[0094] In this embodiment, optionally, the training method for the network security assessment model is as follows: acquiring network audit log data samples and an initial network security assessment model; preprocessing the network audit log data samples to obtain preprocessed network audit log data samples; generating audit graph samples and anomaly graph samples based on the preprocessed network audit log data samples; training the initial network security assessment model based on the audit graph samples, anomaly graph samples, and a correlation graph attention network learning method until the network security assessment model is obtained.

[0095] The network audit log data sample can be network audit log data within a historical period of the system. In this embodiment, network audit log data within a historical period of the system can be obtained as sample data. In this embodiment, network audit log data from the past month or longer can be collected in a distributed manner using a data processing unit (DPU) to serve as network audit log data samples. In this embodiment, the DPU can perform distributed collection and preprocessing operations on the network audit log data. The initial network security assessment model can be an untrained initial model used to detect network security behavior categories. In this embodiment, the initial network security assessment model can include an input layer, a node relationship anomaly capture layer, a node time anomaly capture layer, and an output layer.

[0096] Preprocessing can include data cleaning and data format conversion. The preprocessed network audit log data sample can be obtained by converting the network audit log data sample into a new format and cleaning it. In this embodiment, the network audit log data sample can be converted into a new format using a DPU, followed by data cleaning and other preprocessing steps to obtain the preprocessed network audit log data sample.

[0097] The audit graph sample can be a graphical structure composed of information such as events and processes from preprocessed network audit log data samples. The audit graph sample contains detailed information about various events in the system, such as process creation, file access, and network connections. In this embodiment, the specific method for generating the audit graph sample based on the preprocessed network audit log data sample is to determine node information and edge information of the audit graph based on the network audit log data sample, compose multiple metagraph information of the audit graph sample based on the node and edge information, and generate the audit graph sample based on the multiple metagraph information. This embodiment can identify complex attack chains and APT (Advanced Persistent Threat) attack patterns by analyzing the audit graph sample.

[0098] The anomaly graph sample can be a graphical structure obtained by copying the initial audit graph and then re-detecting it. In this embodiment, the specific method for generating anomaly graph samples based on preprocessed network audit log data samples is to perform a deep copy of the obtained audit graph, then re-detect the audit graph for abnormal data, and finally aggregate the re-detected abnormal data into a single graph and assign manual labels to it as anomaly graph samples.

[0099] Specifically, this embodiment first evaluates the number of nodes in the input audit graph sample to verify whether there are enough nodes to generate credible context anomalies. Then, after deep copying the audit graph sample, a re-detection operation is performed. The re-detected anomaly data can be aggregated into a single graph, and then manually labeled as anomaly graph samples. In this embodiment, newly created anomalies can also be integrated into the dataset separately. These modified anomaly graphs are temporarily stored in a designated folder for subsequent processing and analysis. The specific re-detection method is as follows: First, feature extraction, followed by context anomaly identification and structural anomaly identification. Relevant features are extracted from the audit graph sample. These features may include node attributes (such as process name and file type) and edge attributes (such as operation type and timestamp). Then, context anomaly identification identifies or generates anomalies based on the mismatch between attribute values ​​and their context environment. Next, structural anomaly identification identifies irregularities in the graph structure, such as unusual connection patterns or sudden increases in network traffic. Finally, these detected graph structure anomalies are aggregated into a single graph to be used to generate the anomaly graph.

[0100] In this embodiment, the anomaly graph samples can simulate potential attack behaviors through anomalies, helping the initial network security assessment model learn how to identify anomalous patterns. This embodiment enhances the model's ability to identify unknown and variant attacks by adding anomaly graph samples to the training set. The anomaly graph can also include artificially designed anomalies, allowing the model to learn more attack characteristics during training, thereby improving the detection rate. In this embodiment, training the model to identify artificially designed anomalies helps distinguish between normal and malicious behavior, reducing false positives.

[0101] In this embodiment, the learning method of the Graph Attention Network (GAT) is mainly based on graph neural networks and introduces an attention mechanism. In this embodiment, audit graph samples and abnormal graph samples can be input into the initial network security assessment model, and the initial network security assessment model can be iteratively trained using the Graph Attention Network learning method until the network security assessment model is obtained.

[0102] In this embodiment, the initial network security assessment model can be trained on sample data until a network security assessment model that meets the requirements is obtained. By generating audit graphs and anomaly graphs, the model can better understand and identify normal and abnormal behaviors in the network, thereby improving the accuracy and efficiency of network security detection.

[0103] In this embodiment, optionally, the initial network security assessment model includes an input layer, a node relationship anomaly capture layer, a node temporal anomaly capture layer, and an output layer. The initial network security assessment model is trained based on audit graph samples, anomaly graph samples, and a relational graph attention network learning method until a network security assessment model is obtained. This includes: inputting audit graph samples and anomaly graph samples through the input layer, converting node information and edge information in the audit graph samples and anomaly graph samples into node feature data; wherein, edge information includes temporal data; processing the node feature data through the node relationship anomaly capture layer to determine the attention coefficients between nodes; updating the node feature data according to the attention coefficients, and performing pooling processing on the updated node feature data to obtain pooled data and temporal data; determining sequence data based on the pooled data and temporal data, and processing the sequence data through the node temporal anomaly capture layer to obtain target feature data; processing the target feature data through the activation function of the output layer to output initial network security category behavior data; and iteratively optimizing the initial network security assessment model based on the loss function and the initial network security category behavior data until a network security assessment model is obtained.

[0104] The input layer receives audit graph samples and anomaly graph samples as input, and transforms the node and edge information in these samples into node feature vectors. The node relationship anomaly capture layer utilizes a relational graph attention network to learn the connections between nodes and evaluate anomaly information in node relationships. The node temporal anomaly capture layer evaluates anomalies in temporal information between nodes.

[0105] Node feature data can be understood as node feature vectors derived from the node and edge information in the audit graph samples and anomaly graph samples. Attention coefficients can be used to characterize the importance between nodes. In this embodiment, the attention coefficients between nodes can be determined by analyzing and processing the node feature data through a node relationship anomaly capture layer.

[0106] Specifically, in this embodiment, the node relationship anomaly information capture layer processes node information through an association graph attention network. It is assumed that the input audit graph sample is passed through the audit graph sample node relationship anomaly information capture layer L times during one model training cycle, with the iteration number defined as l∈{1, 2, ..., L}. In each iteration, the audit graph sample node relationship anomaly information capture layer calculates attention coefficients and updates node features, performing global average pooling and global max pooling. For the l-th iteration of the audit graph sample node relationship anomaly information capture layer, H is defined as the node feature matrix after the embedding layer, and B is defined as the edge index set. For the H nodes in the input audit graph sample, each node i has a feature vector h. i ∈H. For the edge index Edge(i, j) ∈ B between node i and node j, it has edge type e ij ∈R E The total number of edge types is E. Then, an attention mechanism is used to update the nodes, taking edge types into account. For nodes i and j, α... ij The attention coefficient α is the attention coefficient between nodes i and j, reflecting the importance of node j relative to node i. ij The calculation is as follows:

[0107]

[0108] Where R(i) represents the set of neighboring nodes of node i, a is the learnable weight vector, and W is the linear transformation matrix from input features to hidden representation. It is an edge type e ij The embedding vector, || represents the concatenation of matrices.

[0109] Next, the weighted sum of the features of adjacent nodes is calculated, and the updated node feature matrix is ​​defined as H′. Then, the node feature data is updated according to the attention coefficient, and the updated node feature h′ is calculated.i The specific way for ∈H′ can be:

[0110] h′ i =ReLU(∑ j∈O(i) α ij Wh j )#(2);

[0111] The pooling process can be either average pooling or max pooling. The pooling data can be the global average vector and max pooling vector obtained by performing global average pooling and global max pooling based on the updated node features. The time data can be the time point information corresponding to the graph sample information. In this embodiment, the audit log data all have corresponding timestamp information, and the corresponding time data can be determined based on the timestamp information.

[0112] Specifically, in this embodiment, the pooled data obtained by pooling the updated node feature data can be obtained by calculating the global average pool and the global max pool of the updated node information, and using a squeezing operation to remove all dimensions of size 1 from the tensor. Then, these two types of pooling results are concatenated with graph attributes. This helps to capture global features at the entire graph level, providing a more comprehensive information perspective for prediction.

[0113] In this embodiment, for the l-th iteration of the node relationship anomaly information capture layer, the global average vector is calculated.

[0114]

[0115] Calculate the global maximum vector

[0116]

[0117] Among them, X (l) It is the feature matrix of the node updated by the attention coefficients in the m-th layer of the audit graph node relationship anomaly information capture layer, where A is the batch processing vector, f mean It is the global average pooling function, f max It is a global max-pooling function. squ() represents the squeezing operation.

[0118] Subsequently, the global average vector and global maximum vector obtained from each iteration of the node relationship anomaly information capture layer are concatenated to provide sequential data for the time series processing layer—each time point corresponds to a graph representation. In this embodiment, the specific method for determining the sequence data based on pooled data and time data can be as follows: assuming the audit graph node relationship anomaly information capture layer iterates a total of L times, the concatenated sequence data is defined as S, || denotes matrix concatenation, and the corresponding sequence data S can be determined based on pooled data and time data as follows:

[0119]

[0120] Each iteration of the audit graph node relationship anomaly capture layer captures different levels of feature abstraction from the graph data. Earlier layers capture more local graph structure information, while deeper layers may capture higher-level global graph structure patterns. By concatenating features obtained from global average pooling and global max pooling after each audit graph sample node relationship anomaly capture layer, richer graph representations can be constructed, helping the model understand and learn various graph properties. Combining features at different levels enables the model to have higher expressive power when performing graph classification, thereby integrating more contextual information.

[0121] The target feature data can be feature data obtained after processing by the node time anomaly capture layer. In this embodiment, the sequence data is processed by the node time anomaly capture layer to obtain the target feature data. Specifically, an input sequence S = (s1, s2, ..., s3) is obtained based on the pooling data and time data described above. L The node-time anomaly capture layer uses a gated recurrent neural network to capture long-term dependencies in the input sequence, assuming s t ∈R n Let represent the input features at time step t, and n be the dimension of the input. Here, sig is defined as a sigmoid activation function, and b... z Defined as a bias term, the hidden state at time t is defined as h. t And let ⊙ denote element-wise multiplication. For each time step t, the gated recurrent neural network operates as follows:

[0122] W z and U z Defined as a learnable weight matrix, z t Defined as an update gate, its calculation formula is as follows:

[0123] z t =sig(W z s t +U z h t-1 +b z )#(6);

[0124] W r and U r Defined as a learnable weight matrix, r t Defined as a reset door, its calculation formula is as follows:

[0125] r t =sig(W r s t +U r ht-1 +b r )#(7);

[0126] W h and U h Defined as a learnable weight matrix, Defined as a candidate hidden state. The calculation formula is as follows:

[0127]

[0128] The final hidden state calculation formula is as follows:

[0129]

[0130] Finally, the hidden state at time step t is updated based on the hidden state at time step t-1. The time series processing layer updates the hidden state at all time steps, and finally obtains a new representation of the graph features, i.e., the target feature data.

[0131] The initial network security category behavior data can be either normal category behavior or abnormal category behavior. The activation function can be a ReLU activation function.

[0132] In this embodiment, the initial cybersecurity category behavior data is output after the target feature data undergoes two layers of linear transformation using the activation function of the output layer. Specifically, the initial cybersecurity category behavior data is output in the prediction label result output layer, where the ReLU activation function is used as a hidden layer to increase non-linearity. The final prediction result of the graph is output using the Sigmoid activation function. The target feature data G... f Defined as a graphical feature representation processed by the time series processing layer, the corresponding result is obtained after two layers of linear transformation. In other words, the initial cybersecurity category behavior data can be represented as:

[0133]

[0134] Where Sigmoid represents the sigmoid activation function, ReLU represents the ReLU activation function, and Linear1 and Linear2 represent the linear transformation functions of the first and second layers, respectively.

[0135] In this embodiment, the initial network security assessment model outputs the results after training. Based on the results, the model is continuously optimized. Specifically, the method for iteratively optimizing the initial network security assessment model based on the loss function and initial network security category behavior data can be defined as N, where y... n p is the actual label of the Nth sample. nIf the predicted label log of the Nth sample is the natural logarithm, then the binary cross-entropy loss formula is as follows:

[0136]

[0137] In this embodiment, the derivative of the loss function with respect to the output layer activation function is calculated during backpropagation, and the partial derivatives (gradients) of the loss function with respect to each parameter are calculated based on the chain rule. Finally, the calculated gradients and learning rate are used to update the parameters of the initial cybersecurity assessment model.

[0138] Let the final output of the initial cybersecurity assessment model be defined as Y, and the parameters of the initial cybersecurity assessment model be defined as θ. For each parameter, the gradient of the loss function is... The binary cross-entropy loss (BCELoss) calculated based on formula (11), and the derivative of the composite function calculated using the chain rule, can be expressed as:

[0139]

[0140] After the calculation is complete, the result is fed back into the initial cybersecurity assessment model by applying chain rules. The chain rules are then applied continuously to calculate the gradient of each parameter with respect to the loss function, updating the model's parameters. Subsequently, the next training cycle is executed based on the updated parameters until the cybersecurity assessment model is obtained.

[0141] In this embodiment, network audit log data is collected and preprocessed in a distributed manner by a DPU. The processed log data is then aggregated to the system threat analysis component for further processing. A metagraph is created using each event in the collected and cleaned data. By aggregating events of a set duration, a graph generator is used to quickly model the attack graph, resulting in audit and anomaly graphs. The significant capabilities of the relational graph attention network are utilized to manage complex relationships and its adaptive relationship modeling function, capturing anomaly information in node relationships. Furthermore, by combining the efficient and straightforward structure of gate recursive units, this algorithm is suitable for sequence data. It can effectively capture node temporal anomalies and continuously train to obtain a network security assessment model. This embodiment demonstrates better efficiency and accuracy in APT attack detection. Compared with models without an anomaly capture layer, the anomaly capture layer exhibits superior performance in the precision-recall curve, highlighting the importance of gate recursive unit integration in improving the performance of binary classification tasks. These results not only verify the robustness and practicality of the audit graph-based network security assessment model in real-world APT attack scenarios but also demonstrate its scalability and efficiency when handling large-scale datasets.

[0142] The technical solution of this invention involves acquiring network audit log data; preprocessing the network audit log data to obtain preprocessed network audit log data; determining multiple metagraph information aggregated within a set time period based on the audit log data; generating an audit graph based on the multiple metagraph information using a graph generator; and inputting the audit graph into a network security assessment model to obtain network security category behaviors. This technical solution, by analyzing the system log data and the audit graph structure of their interrelationships, can intuitively reveal and identify complex attack patterns and abnormal behaviors, thereby improving the accuracy and efficiency of network security detection.

[0143] Example 3

[0144] Figure 3 This is a schematic diagram of a network security detection device based on a data processing unit according to Embodiment 3 of the present invention. Figure 3 As shown, the device includes:

[0145] Data acquisition module 310 is used to acquire network audit log data based on the data processing unit;

[0146] Data preprocessing module 320 is used to preprocess network audit log data to obtain preprocessed network audit log data;

[0147] The graph generation module 330 is used to generate audit graphs based on preprocessed network audit log data;

[0148] The security category acquisition module 340 is used to input the audit graph into the network security assessment model to obtain network security category behaviors.

[0149] Optionally, the data preprocessing module 320 is specifically used to convert the data format of the network audit log data into a standard format to obtain standardized network audit log data; and to clean the standardized network audit log data to obtain preprocessed network audit log data.

[0150] Optionally, the graphics generation module 330 includes:

[0151] The metagraph information determination unit is used to determine multiple metagraph information aggregated within a set time period based on audit log data;

[0152] The graph generation unit is used to generate audit graphs based on multiple metagraph information through a graph generator.

[0153] Optionally, the metagraph information determination unit is specifically used to determine the subject node and object node based on the audit log data; and to convert multiple events into multiple metagraph information based on the subject node and object node constituting multiple events.

[0154] Optionally, a graph generation unit is used to extract node information and edge information from the metagraph information, and to generate an audit graph using the node information and edge information through an image generator.

[0155] Based on the above scheme, optionally, the network security detection device may also include the following model to enable training to obtain a network security assessment model:

[0156] The sample data acquisition module is used to acquire network audit log data samples and an initial network security assessment model;

[0157] The sample data preprocessing module is used to preprocess the network audit log data sample to obtain the preprocessed network audit log data sample.

[0158] The sample graph generation module is used to generate audit graph samples and anomaly graph samples based on preprocessed network audit log data samples.

[0159] The model training module is used to train the initial cybersecurity assessment model based on audit graph samples, anomaly graph samples, and a relational graph attention network learning method until a cybersecurity assessment model is obtained.

[0160] Optionally, the initial network security assessment model includes an input layer, a node relationship anomaly capture layer, a node time anomaly capture layer, and an output layer;

[0161] The model training module is specifically used to input audit graph samples and anomaly graph samples through the input layer, and transform the node information and edge information in the audit graph samples and anomaly graph samples into node feature data. The edge information includes time data. The node feature data is processed by a node relationship anomaly capture layer to determine the attention coefficients between nodes. The node feature data is updated based on the attention coefficients, and pooled to obtain pooled data and time data. Sequence data is determined based on the pooled data and time data, and processed by a node time anomaly capture layer to obtain target feature data. The target feature data is processed by the activation function of the output layer to output initial cybersecurity category behavior data. The initial cybersecurity assessment model is iteratively optimized based on the loss function and the initial cybersecurity category behavior data until the cybersecurity assessment model is obtained.

[0162] The network security detection device based on a data processing unit provided in this embodiment of the invention can execute the network security detection method based on a data processing unit provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method.

[0163] Example 4

[0164] Figure 4This is a schematic diagram of an electronic device according to Embodiment 4 of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0165] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0166] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0167] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as network security detection methods based on data processing units.

[0168] In some embodiments, the network security detection method based on the data processing unit can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the network security detection method based on the data processing unit described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to perform the network security detection method based on the data processing unit by any other suitable means (e.g., by means of firmware).

[0169] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0170] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0171] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0172] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0173] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0174] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0175] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0176] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A network security detection method based on a data processing unit, characterized in that, include: Network audit log data is obtained based on the data processing unit; The network audit log data is preprocessed to obtain preprocessed network audit log data; An audit graph is generated based on the preprocessed network audit log data. Input the audit graph into the network security assessment model to obtain network security category behaviors; The training method for the network security assessment model is as follows: Obtain network audit log data samples and an initial network security assessment model; The network audit log data sample is preprocessed to obtain a preprocessed network audit log data sample; Based on the preprocessed network audit log data sample, generate audit graph sample and anomaly graph sample; The initial cybersecurity assessment model is trained based on the audit graph samples, the anomaly graph samples, and the correlation graph attention network learning method until a cybersecurity assessment model is obtained. The initial network security assessment model includes an input layer, a node relationship anomaly capture layer, a node time anomaly capture layer, and an output layer; The initial cybersecurity assessment model is trained based on the audit graph samples, the anomaly graph samples, and the correlation graph attention network learning method until a cybersecurity assessment model is obtained, including: The audit graph sample and the anomaly graph sample are input through the input layer, and the node information and edge information in the audit graph sample and the anomaly graph sample are converted into node feature data; wherein, the edge information includes time data; The node feature data is processed by the node relationship anomaly capture layer to determine the attention coefficient between nodes; The node feature data is updated according to the attention coefficient, and pooled data and time data are obtained by pooling the updated node feature data. Sequence data is determined based on the pooled data and the time data, and the sequence data is processed through the node time anomaly capture layer to obtain target feature data; The target feature data is processed by the activation function of the output layer, and the initial network security category behavior data is output. The initial cybersecurity assessment model is iteratively optimized based on the loss function and initial cybersecurity category behavior data until a cybersecurity assessment model is obtained.

2. The method according to claim 1, characterized in that, The network audit log data is preprocessed to obtain preprocessed network audit log data, including: The data format of the network audit log data is converted into a standard format to obtain standardized network audit log data; The standardized network audit log data is cleaned to obtain preprocessed network audit log data.

3. The method according to claim 1, characterized in that, Generate an audit graph based on the preprocessed network audit log data, including: Based on the network audit log data, determine multiple metagraph information aggregated within a set time period; An audit diagram is generated using a graph generator based on the aforementioned metagraph information.

4. The method according to claim 3, characterized in that, Based on the audit log data, determine multiple metagraph information aggregated within a set time period, including: The subject node and object node are determined based on the audit log data; Multiple events are formed based on topic nodes and object nodes, and these events are converted into multiple metagraph information.

5. The method according to claim 3, characterized in that, Based on the aforementioned metagraph information, an audit graph is generated using a graph generator, including: Node information and edge information are extracted from the metagraph information, and the node information and edge information are used to generate an audit graph through an image generator.

6. A network security detection device based on a data processing unit, characterized in that, include: The data acquisition module is used to acquire network audit log data based on the data processing unit; The data preprocessing module is used to preprocess the network audit log data to obtain preprocessed network audit log data; The graph generation module is used to generate an audit graph based on the preprocessed network audit log data; The security category acquisition module is used to input the audit graph into the network security assessment model to obtain network security category behaviors. The network security detection device further includes the following modules to enable training a network security assessment model: The sample data acquisition module is used to acquire network audit log data samples and an initial network security assessment model; The sample data preprocessing module is used to preprocess the network audit log data sample to obtain the preprocessed network audit log data sample. The sample graph generation module is used to generate audit graph samples and anomaly graph samples based on the preprocessed network audit log data samples. The model training module is used to train the initial network security assessment model based on the audit graph samples, the anomaly graph samples, and the correlation graph attention network learning method until a network security assessment model is obtained. The initial network security assessment model includes an input layer, a node relationship anomaly capture layer, a node time anomaly capture layer, and an output layer; The model training module is specifically used to input the audit graph sample and the anomaly graph sample through the input layer, and convert the node information and edge information in the audit graph sample and the anomaly graph sample into node feature data; wherein, the edge information includes time data; process the node feature data through the node relationship anomaly capture layer to determine the attention coefficient between nodes; update the node feature data according to the attention coefficient, and perform pooling processing on the updated node feature data to obtain pooled data and time data; determine sequence data according to the pooled data and the time data, and process the sequence data through the node time anomaly capture layer to obtain target feature data; The target feature data is processed by the activation function of the output layer to output initial network security category behavior data; the initial network security assessment model is iteratively optimized based on the loss function and the initial network security category behavior data until the network security assessment model is obtained.

7. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the network security detection method based on the data processing unit as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the network security detection method based on a data processing unit as described in any one of claims 1-5.

Images