Complex network attack detection method based on deep learning

Abstract

The invention discloses a complex network attack detection method based on deep learning, and belongs to the technical field of network security and machine learning. The method comprises the following steps: (1) constructing a knowledge graph KG based on a system log; (2) node features are extracted on the basis of word2vec; and (3) performing host attack intrusion detection based on the GNN model. The method has the advantages that (1) the knowledge graph is constructed based on the system log, so that the relationship between events can be observed more intuitively, and attack investigation is facilitated; (2) semantic information of logs is fused into feature embedding of nodes, and information of more dimensions is considered, so that the model detection effect is better; (3) node context information is learned through a GNN model and an attention mechanism, so that behavior characteristics of a benign graph can be learned more accurately, and waste of a large amount of manpower can be avoided by using an unsupervised learning method; and (4) an unknown attack mode can be detected by adopting an anomaly detection mode.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security and machine learning, and specifically relates to a complex network attack detection method based on deep learning. Background Art

[0002] Current network attacks are no longer limited to using simple attack techniques, such as viruses and worms, but use more complex and advanced techniques, such as zero-day vulnerabilities, advanced Trojans, customized malware, etc. The attack methods are also more covert and sophisticated. This type of attack is a highly complex and continuous network attack method with the following characteristics:

[0003] Advanced: Attackers are usually highly skilled and can use sophisticated attack methods, such as zero-day vulnerabilities and customized malware.

[0004] Persistent: The attack is not a one-off one. The attacker will lurk in the target network for a long time, continuously stealing data, controlling the system, and collecting intelligence.

[0005] Concealment: Attackers will take measures to hide their attack behavior, making it difficult for traditional security measures and monitoring systems to detect the attack.

[0006] In the face of such attacks, traditional log-based analysis and detection have disadvantages such as poor real-time performance and waste of a lot of human resources. The emergence of data provenance provides a new idea for the research community. Data provenance can capture system activities, which are represented as graphs that describe the causal relationship between data and processes in the system in detail. Using machine learning technology to process these graphs has great potential in detecting such attacks. However, traditional detection methods based on traceability graphs are too simple in feature extraction and often ignore the attribute information of nodes. At the same time, their ability to capture node context information is insufficient, resulting in poor model detection results. Summary of the invention

[0007] In view of the above-mentioned problems existing in the prior art, the purpose of the present invention is to provide a complex network attack detection method based on deep learning, which effectively considers the attribute information of the node during embedding, and can effectively learn the context information of the node based on the GNN model and attention mechanism. At the same time, the anomaly detection method can detect unknown zero-day vulnerabilities and effectively respond to attacks.

[0008] The present invention provides the following technical solution: a complex network attack detection method based on deep learning, comprising the following steps:

[0009] (1) Knowledge graph construction: Build a knowledge graph by reading system logs;

[0010] (2) Node feature extraction: Based on the constructed knowledge graph, the node attribute information is embedded to generate the node feature vector;

[0011] (3) Anomaly detection based on GNN: The node feature vector is used as input, and the node features are generated based on the GNN model and attention mechanism. The graph features are aggregated and sent to the MLP model for binary classification.

[0012] Furthermore, the specific process of (1) is as follows:

[0013] Through a set of vertices V = {v1,v2,......v n} and edge E={e1,e2,......e m}Define a knowledge graph KG, which is in the form of triples <S id ,D id ,T>Store each edge in KG, where S id represents the source node of the edge, D id represents the destination node of the edge, T represents the attributes of the edge, including the operation type and timestamp, v n represents the number of vertices, e n Indicates the number of edges; at the same time, the knowledge graph KG stores the relevant attributes of the nodes.

[0014] Furthermore, the specific process of (2) is as follows:

[0015] Based on the knowledge graph constructed in step (1), the attribute information of each node in the knowledge graph is obtained, and the attribute information of the node is converted into a low-dimensional feature vector using the word2vec embedding method, and the converted low-dimensional feature vector is used as the initial feature vector of each node.

[0016] Furthermore, the specific process of (3) is as follows:

[0017] (3-1) Aggregate nodes based on the semantic self-attention mechanism, as follows:

[0018] (3-1-1) Through formula (1), the local feature vector representation of the node for relation r is obtained, and the formula is as follows:

[0019]

[0020] in, Represents the vector representation of node v in the t-th layer network for a specific relationship r, represents the vector representation of its own node v from the previous layer, represents the vector representation of each neighbor u from the previous layer;

[0021] (3-1-2) Each relationship of the nodes is represented by stacking into a sequence using formula (2), as follows:

[0022]

[0023] (3-1-3) Use formula (3) to get the attention weight of each relationship, the formula is as follows:

[0024]

[0025] Where R represents the type of relationship, represents the stacked sequence of nodes in formula (2), w t is a trainable relational attention matrix, W t is a trainable transformation matrix: the final embedding of node v is shown in formula (4):

[0026]

[0027] (3-2) Graph feature vector generation and attack detection

[0028] (3-2-1) In order to generate the feature representation of the graph, the node feature vector generated based on formula (4) The feature representation of the generated graph is aggregated; the specific formula definition is shown in formula (5):

[0029]

[0030] (3-2-2) The vector F G The data is sent to the multi-layer perceptron MLP model for binary classification, and the GNN model and the multi-layer perceptron MLP model are trained using binary cross entropy loss.

[0031] By adopting the above technology, compared with the prior art, the beneficial effects of the present invention are as follows:

[0032] 1) The present invention constructs a knowledge graph based on system logs, which can more intuitively observe the relationship between events and facilitate attack investigation;

[0033] 2) The present invention integrates the semantic information of the log into the feature embedding of the node, taking into account information of more dimensions, so that the model detection effect is better;

[0034] 3) The present invention learns node context information through the GNN model and attention mechanism, so that the behavioral characteristics of benign graphs can be learned more accurately. The use of unsupervised learning methods can avoid wasting a lot of manpower;

[0035] 4) The present invention adopts an abnormality detection method to detect unknown attack patterns. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 It is a method architecture diagram of the present invention;

[0037] Figure 2 This is an example diagram of the knowledge graph of the present invention. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments of the specification. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0039] On the contrary, the present invention covers any substitution, modification, equivalent method and scheme made on the essence and scope of the present invention as defined by the claims. Further, in order to make the public have a better understanding of the present invention, some specific details are described in detail in the detailed description of the present invention below. Those skilled in the art can fully understand the present invention without the description of these details.

[0040] See also Figure 1-2 , a complex network attack detection method based on deep learning, comprising the following steps:

[0041] (1) Knowledge graph construction: Build a knowledge graph by reading system logs.

[0042] (2) Node feature extraction: Based on the constructed knowledge graph, the node attribute information is embedded to generate the node feature vector.

[0043] (2) Anomaly detection based on GNN: The node feature vector is used as input, and the node features are generated based on the GNN model and attention mechanism. The graph features are aggregated and then sent to the MLP model for binary classification.

[0044] In step (1), the detailed steps of knowledge graph construction are as follows:

[0045] By reading the system log information, a knowledge graph KG can be constructed. In this embodiment, a set of vertices V = {v1, v2, ... v n} and edge E={e1,e2,......e n}Define a knowledge graph KG, which is in the form of triples <S id ,D id ,T>Store each edge in KG, where S id represents the source node of the edge, D idrepresents the destination node of the edge, and T represents the attributes of the edge, including the operation type and timestamp. At the same time, the knowledge graph KG also stores the necessary attributes of the node, such as process name, related command line, etc. Table 1 shows the subject and object stored in the KG, as well as the corresponding attributes and time relationship.

[0046] Table 1 Subject, object, event type, and related attributes

[0047]

[0048] In step (2), the detailed steps of node feature extraction are as follows:

[0049] Based on the knowledge graph constructed in step (1), the attribute information of each node can be obtained, and the attribute information of the node is converted into a low-dimensional feature vector using the word2vec embedding method, and the converted low-dimensional feature vector is used as the initial feature vector of each node.

[0050] In step (3), the detailed steps of anomaly detection based on GNN are as follows:

[0051] Based on the detection in step (2), the initial feature vector of each node can be obtained. On this basis, the final feature vector of the node is obtained using GNN and attention mechanism. The details are as follows:

[0052] (3-1) Node aggregation based on semantic self-attention mechanism.

[0053] In the traceability graph, there are often intricate relationship connections between nodes. For the same node, different relationship types have different importance. Therefore, it is particularly important to use relationship-specific message functions combined with relationship self-attention mechanism to learn the characteristics of each node.

[0054] In this embodiment, as shown in formula (1), Represents the vector representation of node v in the t-th layer network for a specific relationship r. Represents the vector representation of the own node v from the previous layer. Represents the vector representation of each neighbor u (specific relationship) from the previous layer.

[0055]

[0056] Through formula (1), the local feature vector representation of the node for the specific relationship r can be obtained. Afterwards, each specific relationship representation of the node is stacked into a sequence, as shown in formula (2).

[0057]

[0058] To obtain the attention weight of each relation, we use formula (3) to obtain the attention weight, where w t is a trainable relational attention matrix, W t is a trainable transformation matrix.

[0059]

[0060] The final embedding of node v is shown in formula (4).

[0061]

[0062] (3-2) Graph feature vector generation and attack detection. In order to generate the feature representation of the graph, the node feature vector generated based on formula (4) Aggregation is performed to generate the characteristic representation of the graph. The specific formula definition is shown in formula (5).

[0063]

[0064] Then the vector F G The data is sent to the multi-layer perceptron MLP for binary classification, and the GNN and MLP are trained using binary cross entropy loss.

[0065] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A complex network attack detection method based on deep learning, characterized in that: The following steps are involved: (1) Knowledge graph construction: Build a knowledge graph by reading system logs; (2) Node feature extraction: Based on the constructed knowledge graph, the node attribute information is embedded to generate the node feature vector; (3) Anomaly detection based on GNN: The node feature vector is used as input, and the node features are generated based on the GNN model and attention mechanism. The graph features are aggregated and sent to the MLP model for binary classification.

2. According to a complex network attack detection method based on deep learning according to claim 1, it is characterized in that: The specific process of (1) is as follows: Through a set of vertices V = {v1,v2,......v n } and edge E = {e1,e2,......e m }Define a knowledge graph KG, which is in the form of triples <S id ,D id ,T>Store each edge in KG, where S id represents the source node of the edge, D id represents the destination node of the edge, T represents the attributes of the edge, including the operation type and timestamp, v n represents the number of vertices, e n Indicates the number of edges; at the same time, the knowledge graph KG stores the relevant attributes of the nodes.

3. According to claim 2, a complex network attack detection method based on deep learning is characterized in that: The specific process of (2) is as follows: Based on the knowledge graph constructed in step (1), the attribute information of each node in the knowledge graph is obtained, and the attribute information of the node is converted into a low-dimensional feature vector using the word2vec embedding method, and the converted low-dimensional feature vector is used as the initial feature vector of each node.

4. According to a complex network attack detection method based on deep learning according to claim 3, it is characterized in that: The specific process of (3) is as follows: (3-1) Aggregate nodes based on the semantic self-attention mechanism, as follows: (3-1-1) Through formula (1), the local feature vector representation of the node for relation r is obtained, and the formula is as follows: in, Represents the vector representation of node v in the t-th layer network for a specific relationship r, represents the vector representation of its own node v from the previous layer, represents the vector representation of each neighbor u from the previous layer; (3-1-2) Each relationship of the nodes is represented by stacking into a sequence using formula (2), as follows: (3-1-3) Use formula (3) to get the attention weight of each relationship, the formula is as follows: Where R represents the type of relationship, represents the stacked sequence of nodes in formula (2), w t is a trainable relational attention matrix, W t is a trainable transformation matrix: the final embedding of node v is shown in formula (4): (3-2) Graph feature vector generation and attack detection (3-2-1) In order to generate the feature representation of the graph, the node feature vector generated based on formula (4) The feature representation of the generated graph is aggregated; the specific formula definition is shown in formula (5): (3-2-2) The vector F G The data is sent to the multi-layer perceptron MLP model for binary classification, and the GNN model and the multi-layer perceptron MLP model are trained using binary cross entropy loss.

Images