Network security monitoring method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a network security monitoring method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: acquiring a first network entity relation graph and a second network entity relation graph according to multi-source log data of a to-be-monitored network environment; the first network entity relation graph is used for representing a direct interaction relation between network entities of different or the same entity type in the network environment to be monitored; the second network entity relation graph is used for representing a dependency interaction relation between network entities of the same or different entity types in the network environment to be monitored; fusing the first network entity relation graph and the second network entity relation graph to obtain a fused entity relation graph; and according to the graph node feature vector representation corresponding to the node in the fused entity relation graph, identifying an abnormal event type corresponding to the abnormal sub-graph in the fused entity relation graph. By adopting the method, the accuracy of network security monitoring can be improved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a network security monitoring method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] With the continuous deepening of informatization and networking, the types of network equipment and the services they carry are gradually increasing, the data stored in the network is also growing explosively, the exploitable vulnerabilities and technical means are becoming increasingly abundant, and the confrontation is becoming more intense. These make the software, hardware and information in the network more vulnerable to internal and external security threats, and network security threats are also becoming more complex and changeable.

[0003] Network security monitoring in related technologies is difficult to fully capture and analyze complex security events. In a complex cloud network environment, related technologies cannot provide comprehensive and accurate solutions for network security protection, resulting in poor accuracy of network security monitoring.

[0004] Therefore, there is a problem of low accuracy in network security monitoring in the related technology. Summary of the invention

[0005] Based on this, it is necessary to provide a network security monitoring method, apparatus, computer equipment, computer-readable storage medium and computer program product that can improve the accuracy of network security monitoring in response to the above technical problems.

[0006] In a first aspect, the present application provides a network security monitoring method, comprising:

[0007] According to the multi-source log data of the network environment to be monitored, a first network entity relationship diagram and a second network entity relationship diagram are obtained; the first network entity relationship diagram is used to characterize the direct interaction relationship between network entities of different or same entity types in the network environment to be monitored; the second network entity relationship diagram is used to characterize the dependent interaction relationship between network entities of the same or different entity types in the network environment to be monitored;

[0008] Merging the first network entity relationship graph and the second network entity relationship graph to obtain a merged entity relationship graph;

[0009] According to the graph node feature vector representation corresponding to the node in the fused entity relationship graph, the abnormal event type corresponding to the abnormal subgraph in the fused entity relationship graph is identified.

[0010] In one embodiment, obtaining the first network entity relationship diagram and the second network entity relationship diagram according to the multi-source log data of the network environment to be monitored includes:

[0011] Constructing an object-level network entity relationship diagram according to direct interaction relationships between network entities of different or same entity types in the network environment to be monitored;

[0012] The object-level network entity relationship diagram is used as the first network entity relationship diagram; the first network entity relationship diagram uses each of the network entities as the node and the direct interaction relationship as the edge between the corresponding nodes.

[0013] In one embodiment, obtaining the first network entity relationship diagram and the second network entity relationship diagram according to the multi-source log data of the network environment to be monitored includes:

[0014] Constructing a triplet-level network entity relationship graph according to the dependent interaction relationship between network entities of the same or different entity types in the network environment to be monitored;

[0015] The triple-level network entity relationship graph is used as the second network entity relationship graph; the second network entity relationship graph uses each of the network entities as the node and the dependent interaction relationship as the edge between the corresponding nodes.

[0016] In one embodiment, the fusing the first network entity relationship graph and the second network entity relationship graph to obtain a fused entity relationship graph includes:

[0017] Obtaining a target graph node feature vector representation corresponding to each node in the first network entity relationship graph as the first graph node feature vector representation, and obtaining a target graph node feature vector representation corresponding to each node in the second network entity relationship graph as the second graph node feature vector representation;

[0018] Fusion of each of the second graph node feature vector representations to the first graph node feature vector representation corresponding to the node representing the same network entity, to obtain a fused graph node feature vector representation corresponding to each node in the first network entity relationship graph;

[0019] The first network entity relationship graph in which each node has a corresponding fused graph node feature vector representation is used as the fused entity relationship graph; the graph node feature vector representation corresponding to each node in the fused entity relationship graph is used as the corresponding fused graph node feature vector representation.

[0020] In one embodiment, the step of obtaining a target graph node feature vector representation corresponding to each node in the first network entity relationship graph as the first graph node feature vector representation, and obtaining a target graph node feature vector representation corresponding to each node in the second network entity relationship graph as the second graph node feature vector representation, includes:

[0021] Performing graph representation learning on the first network entity relationship graph and the second network entity relationship graph respectively to obtain graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph;

[0022] The feature expression capabilities of the graph node feature vector representation corresponding to each node in the first network entity relationship graph and the second network entity relationship graph are optimized respectively to obtain the target graph node feature vector representation corresponding to each node in the first network entity relationship graph and the second network entity relationship graph.

[0023] In one embodiment, the feature expression capability of the graph node feature vector representation corresponding to each node in the first network entity relationship graph and the second network entity relationship graph is optimized to obtain the target graph node feature vector representation corresponding to each node in the first network entity relationship graph and the second network entity relationship graph, including:

[0024] For any network entity relationship graph, input the graph node feature vector representation corresponding to each of the nodes in the any network entity relationship graph into a pre-trained feature optimization model, and output the target graph node feature vector representation corresponding to each of the nodes in the any network entity relationship graph;

[0025] The target graph node feature vector is represented by the pre-trained feature optimization model through the adjacency matrix of any network entity relationship graph, determining the first-order adjacency information and second-order adjacency information of each node in any network entity relationship graph, and performing a convolution operation on the graph node feature vector representation corresponding to each node in any network entity relationship graph according to the first-order adjacency information and second-order adjacency information of each node.

[0026] In one embodiment, identifying the abnormal event type corresponding to the abnormal subgraph in the fused entity relationship graph according to the graph node feature vector representation corresponding to the node in the fused entity relationship graph includes:

[0027] Detecting the abnormal subgraph in the fused entity relationship graph according to the multi-source log data and the graph node feature vector representation corresponding to each node in the fused entity relationship graph;

[0028] According to the graph node feature vector representation corresponding to each node in the abnormal subgraph, the abnormal event type corresponding to the abnormal subgraph is identified.

[0029] In a second aspect, the present application also provides a network security monitoring device, comprising:

[0030] An acquisition module is used to acquire a first network entity relationship diagram and a second network entity relationship diagram according to multi-source log data of the network environment to be monitored; the first network entity relationship diagram is used to characterize the direct interaction relationship between network entities of different or same entity types in the network environment to be monitored; the second network entity relationship diagram is used to characterize the dependent interaction relationship between network entities of the same or different entity types in the network environment to be monitored;

[0031] A fusion module, used to fuse the first network entity relationship diagram and the second network entity relationship diagram to obtain a fused entity relationship diagram;

[0032] The identification module is used to identify the abnormal event type corresponding to the abnormal subgraph in the fused entity relationship graph according to the graph node feature vector representation corresponding to the node in the fused entity relationship graph.

[0033] In a third aspect, the present application further provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of the above method are implemented.

[0034] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the above method when executed by a processor.

[0035] In a fifth aspect, the present application further provides a computer program product, wherein the computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0036] The network security monitoring method, device, computer equipment, computer-readable storage medium and computer program product described above obtain different levels of graph representations by fusing multi-source log data of the network environment to be monitored: a first network entity relationship graph and a second network entity relationship graph, wherein the first network entity relationship graph is used to characterize the direct interaction relationship between network entities of different or the same entity types in the network environment to be monitored; and the second network entity relationship graph is used to characterize the dependent interaction relationship between network entities of the same or different entity types in the network environment to be monitored. By fusing the first network entity relationship graph and the second network entity relationship graph, a fused entity relationship graph is obtained, so that the fused entity relationship graph combines the information of the first network entity relationship graph and the second network entity relationship graph, and can more comprehensively describe the relationship between network entities in the network environment to be monitored. Furthermore, according to the graph node feature vector representation corresponding to the node in the fused entity relationship graph, the abnormal event type corresponding to the abnormal subgraph in the fused entity relationship graph can be more accurately identified, thereby realizing more detailed anomaly detection and more accurate anomaly classification after multi-source data fusion, and can improve the anomaly detection and response capabilities of security threats in a complex cloud network environment, and effectively improve the accuracy of network security monitoring. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0038] Figure 1 A schematic diagram of a flow chart of a network security monitoring method in one embodiment;

[0039] Figure 2 It is a schematic diagram of a flow chart of steps of fusing a first network entity relationship diagram and a second network entity relationship diagram in one embodiment;

[0040] Figure 3 is a flow chart of a feature extraction step in one embodiment;

[0041] Figure 4 A structural block diagram of a multi-source security log anomaly monitoring and classification system in one embodiment;

[0042] Figure 5 A schematic diagram of a flow chart of a network security monitoring method in another embodiment;

[0043] Figure 6 is a structural block diagram of a network security monitoring device in one embodiment;

[0044] FIG. 7 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0046] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0047] In one embodiment, Figure 1 As shown, a network security monitoring method is provided. This embodiment uses the method applied to a computer device as an example. It can be understood that the computer device can be a terminal, a server, or a system including a terminal and a server. In this embodiment, the method includes the following steps:

[0048] Step S110 , obtaining a first network entity relationship diagram and a second network entity relationship diagram according to multi-source log data of the network environment to be monitored.

[0049] The first network entity relationship diagram is used to characterize the direct interaction relationship between network entities of different or same entity types in the network environment to be monitored.

[0050] The second network entity relationship diagram is used to characterize the dependent interaction relationship between network entities of the same or different entity types in the network environment to be monitored.

[0051] The network environment to be monitored is a network environment that needs to be monitored for security, for example, a cloud network environment.

[0052] The entity type may refer to the type of network entity in the network environment to be monitored, for example, the entity type may include a host type, a network device type, a user type, and the like.

[0053] The multi-source log data may be derived from various security logs in the network environment to be monitored. For example, the multi-source log data may include at least two types of data, such as system security logs, host logs, traffic logs, user behavior data, and device sensor data.

[0054] In a specific implementation, a computer device can obtain multi-source log data of a network environment to be monitored, obtain a first network entity relationship graph and a second network entity relationship graph based on the multi-source log data of the network environment to be monitored, and use the first network entity relationship graph to represent the relationship between network entities of different or same entity types in the network environment to be monitored, and use the second network entity relationship graph to represent the relationship between network entities of different or same entity types in the network environment to be monitored. That is, the first network entity relationship graph and the second network entity relationship graph use network entities as nodes, and the relationship between network entities as edges between corresponding nodes.

[0055] In practical applications, computer equipment can obtain multi-source log data of the network environment to be monitored, determine the network entities in the network environment to be monitored based on the multi-source log data, and thus obtain the first network entity relationship diagram and the second network entity relationship diagram based on the relationship between the network entities.

[0056] Step S120: fusing the first network entity relationship graph and the second network entity relationship graph to obtain a fused entity relationship graph.

[0057] In a specific implementation, the computer device may fuse the first network entity relationship graph and the second network entity relationship graph to obtain a fused entity relationship graph.

[0058] In practical applications, each node in the first network entity relationship graph and the second network entity relationship graph has a corresponding graph node feature vector representation. The computer device can use the information structure of one of the first network entity relationship graph and the second network entity relationship graph as a basis, and through mapping alignment, fuse the graph node feature vector representation of each node in the other network entity relationship graph into the graph node feature vector representation of each node in the network entity relationship graph as the basis to obtain a fused entity relationship graph. That is, the fused entity relationship graph retains the information structure of one of the network entity relationship graphs, but fuses the feature vector information of the nodes in the two network entity relationship graphs.

[0059] Step S130, identifying the abnormal event type corresponding to the abnormal subgraph in the fused entity relationship graph according to the graph node feature vector representation corresponding to the node in the fused entity relationship graph.

[0060] The abnormal subgraph may be a subgraph having an abnormality in the fused entity relationship graph.

[0061] Among them, the abnormal event type is used to characterize the abnormal mode of the network environment to be monitored, including network attacks (such as DDoS (Distributed Denial of Service Attack) attacks and malware propagation), system failures (such as device communication interruption and configuration errors), and data anomalies (such as data leakage and tampering). These abnormal modes may lead to network security problems, device failures, or data inconsistencies.

[0062] In a specific implementation, each node in the first network entity relationship graph and each node in the second network entity relationship graph has a corresponding graph node feature vector representation, and the graph node feature vector representation is a d-dimensional feature vector of each node in the graph calculated by a graph representation learning algorithm.

[0063] Graph representation learning algorithm: Map each node in the graph G = (V, E) to a d-dimensional feature vector, so that d is much smaller than the number of nodes in G, and the structural characteristics of the graph can be retained in the feature vector to a certain extent, that is, the closer the nodes on G are, the closer their feature vectors are in the d-dimensional space. Among them, d is a user-defined hyperparameter. V is the node set, and E is the edge set.

[0064] In the process of fusing the first network entity relationship graph and the second network entity relationship graph to obtain the fused entity relationship graph, the fused entity relationship graph can be obtained by retaining the information structure of the first network entity relationship graph and fusing the graph node feature vector representation corresponding to each node in the first network entity relationship graph and the second network entity relationship graph. That is, the fused entity relationship graph can be based on the information structure of the first network entity relationship graph, the graph node feature vector representation corresponding to each node in the fused entity relationship graph, and the graph node feature vector representation obtained by fusing the graph node feature vector representation corresponding to each node in the first network entity relationship graph and the second network entity relationship graph.

[0065] In this way, the computer device can identify the abnormal event type corresponding to the abnormal subgraph in the fused entity relationship graph based on the graph node feature vector representation corresponding to the node in the fused entity relationship graph. The abnormal event type can be used to characterize the abnormal mode of the network environment to be monitored, thereby identifying the abnormal mode of the network environment to be monitored and improving the accuracy of anomaly detection.

[0066] In the above network security monitoring method, by fusing multi-source log data of the network environment to be monitored, different levels of graph representations are obtained: a first network entity relationship graph and a second network entity relationship graph, the first network entity relationship graph is used to characterize the direct interaction relationship between network entities of different or the same entity types in the network environment to be monitored; the second network entity relationship graph is used to characterize the dependent interaction relationship between network entities of the same or different entity types in the network environment to be monitored, and by fusing the first network entity relationship graph and the second network entity relationship graph, a fused entity relationship graph is obtained, so that the fused entity relationship graph combines the information of the first network entity relationship graph and the second network entity relationship graph, and can more comprehensively describe the relationship between network entities in the network environment to be monitored, and then according to the graph node feature vector representation corresponding to the node in the fused entity relationship graph, the abnormal event type corresponding to the abnormal subgraph in the fused entity relationship graph can be more accurately identified, so as to achieve more detailed anomaly detection and more accurate anomaly classification after multi-source data fusion, and can improve the anomaly detection and response capabilities of security threats in a complex cloud network environment, and effectively improve the accuracy of network security monitoring.

[0067] In another embodiment, a first network entity relationship diagram and a second network entity relationship diagram are obtained based on multi-source log data of the network environment to be monitored, including: constructing an object-level network entity relationship diagram based on the direct interaction relationship between network entities of different or same entity types in the network environment to be monitored; and using the object-level network entity relationship diagram as the first network entity relationship diagram.

[0068] The first network entity relationship graph uses each network entity as a node and direct interaction relationships as edges between corresponding nodes.

[0069] In a specific implementation, when a computer device obtains a first network entity relationship diagram and a second network entity relationship diagram based on multi-source log data of a network environment to be monitored, for the first network entity relationship diagram, the computer device can construct an object-level network entity relationship diagram based on the direct interaction relationship between network entities of different or same entity types in the network environment to be monitored; in this way, the object-level network entity relationship diagram can be used as the first network entity relationship diagram.

[0070] Furthermore, the computer device can construct a network entity relationship graph corresponding to each entity type based on the direct interaction relationship between network entities of the same entity type in the network environment to be monitored, and then integrate the network entity relationship graph corresponding to each entity type into a unified comprehensive graph to obtain an object-level network entity relationship heterogeneous graph.

[0071] Taking the entity types including host type, network device type and user type as an example, the network entity relationship diagram corresponding to the host type can be named as a host-level diagram, the network entity relationship diagram corresponding to the network device type can be named as a network-level diagram, and the network entity relationship diagram corresponding to the user type can be named as a user-level diagram.

[0072] Among them, the user-level graph represents the communication relationship between users. The user-level graph uses users as nodes and builds links based on communication relationships. The host-level graph represents the data transmission and service call relationship between hosts. The host-level graph uses hosts as nodes and builds links based on data flow and service calls. The network-level graph represents the traffic forwarding and protocol interaction relationship between network devices. The network-level graph uses network devices as nodes and builds links based on traffic forwarding and protocol interaction. By building a comprehensive graph, the relationship between each entity type of user, host and network device can be integrated, so that user communication, host data transmission and network traffic interaction can be displayed together, thereby comprehensively identifying security threats to the network environment to be monitored.

[0073] The technical solution of this embodiment is to construct an object-level network entity relationship diagram according to the direct interaction relationship between network entities of different or same entity types in the network environment to be monitored; the object-level network entity relationship diagram is used as the first network entity relationship diagram; the first network entity relationship diagram uses each network entity as a node and the direct interaction relationship as the edge between the corresponding nodes. In this way, the object-level network entity relationship diagram is constructed through the direct interaction relationship between network entities of different or same entity types in the network environment to be monitored, and the first network entity relationship diagram is obtained, which can display the direct interaction relationship between network entities of different or same entity types, so that the security threats of the network environment to be monitored can be more comprehensively identified.

[0074] In another embodiment, based on multi-source log data of the network environment to be monitored, a first network entity relationship graph and a second network entity relationship graph are obtained, including: constructing a triple-level network entity relationship graph based on the dependent interaction relationship between network entities of the same or different entity types in the network environment to be monitored; and using the triple-level network entity relationship graph as the second network entity relationship graph.

[0075] The second network entity relationship graph uses each network entity as a node and uses dependent interaction relationships as edges between corresponding nodes.

[0076] In a specific implementation, when the computer device obtains the first network entity relationship graph and the second network entity relationship graph according to the multi-source log data of the network environment to be monitored, for the second network entity relationship graph, the computer device can construct a triplet (triplet: <subject-predicate-object>The network entity relationship diagram at the (subject-predicate-object) level is used as the third network entity relationship diagram, and the network entity relationship diagram at the triple level is used as the second network entity relationship diagram. The second network entity relationship diagram uses each network entity as a node and the dependent interaction relationship as the edge between the corresponding nodes.

[0077] Among them, a triple-level network entity relationship diagram is constructed by describing the relationship between network entities (triplets: <subject-predicate-object>) captures the dependencies and interaction patterns between network entities of the same or different entity types. For example, a triple-level network entity relationship graph is constructed with triples such as (UA->communicates_with->UB (user A communicates with user B)) and (UB->accesses->S1 (user B accesses network device S1)).

[0078] The technical solution of this embodiment is to construct a triple-level network entity relationship diagram according to the dependency interaction relationship between network entities of the same or different entity types in the network environment to be monitored; the triple-level network entity relationship diagram is used as the second network entity relationship diagram; the second network entity relationship diagram uses each network entity as a node and the dependency interaction relationship as the edge between the corresponding nodes. In this way, the triple-level network entity relationship diagram is constructed through the dependency interaction relationship between network entities of the same or different entity types in the network environment to be monitored, and the second network entity relationship diagram is obtained, so that the dependency relationship between entities in the network is clearly displayed, which helps to identify abnormal behavior, potential security vulnerabilities or attack paths.

[0079] In another embodiment, each node in the first network entity relationship graph and the second network entity relationship graph has a corresponding target graph node feature vector representation, such as Figure 2 As shown, step S120, fusing the first network entity relationship diagram and the second network entity relationship diagram to obtain a fused entity relationship diagram, includes the following steps:

[0080] Step S210, obtaining a target graph node feature vector representation corresponding to each node in the first network entity relationship graph as the first graph node feature vector representation, and obtaining a target graph node feature vector representation corresponding to each node in the second network entity relationship graph as the second graph node feature vector representation.

[0081] Step S220, merging the feature vector representations of each second graph node into the feature vector representations of the first graph node corresponding to the nodes representing the same network entity, to obtain the fused graph node feature vector representations corresponding to each node in the first network entity relationship graph.

[0082] Step S230, taking the first network entity relationship graph in which each node has a corresponding fusion graph node feature vector as the fused entity relationship graph.

[0083] Among them, the graph node feature vector corresponding to each node in the fused entity relationship graph is represented by the corresponding fused graph node feature vector.

[0084] In a specific implementation, when a computer device fuses a first network entity relationship diagram and a second network entity relationship diagram to obtain a fused entity relationship diagram, the computer device can obtain a target graph node feature vector representation corresponding to each node in the first network entity relationship diagram as the first graph node feature vector representation, and obtain a target graph node feature vector representation corresponding to each node in the second network entity relationship diagram as the second graph node feature vector representation, and fuse each second graph node feature vector representation to the first graph node feature vector representation corresponding to the node representing the same network entity to obtain a fused graph node feature vector representation corresponding to each node in the first network entity relationship diagram.

[0085] Specifically, based on the information structure of the first network entity relationship graph, through mapping alignment, the feature vector representation of each second graph node is fused and spliced ​​with the first graph node feature vector representation corresponding to the node representing the same network entity, so as to obtain the final graph node feature vector representation of each node in the first network entity relationship graph, that is, the fused graph node feature vector representation corresponding to each node in the first network entity relationship graph is obtained, which incorporates the feature information of the second network entity relationship graph and can more comprehensively describe the characteristics and interaction patterns of network entities.

[0086] Furthermore, the first network entity relationship graph in which each node has a corresponding fused graph node feature vector representation can be used as a fused entity relationship graph; the graph node feature vector representation corresponding to each node in the fused entity relationship graph is the corresponding fused graph node feature vector representation.

[0087] In this way, the fused entity relationship diagram refers to the object-level network entity relationship diagram, which provides the basic information structure and data benchmark, and the feature information is a combination of the target graph node feature vector representation corresponding to the nodes in the object-level network entity relationship diagram and the triple-level network entity relationship diagram, which will provide more comprehensive information and can more comprehensively describe the characteristics and interaction patterns of network entities in the monitored network environment, and be used to detect more complex abnormal patterns.

[0088] The technical solution of this embodiment is to obtain the target graph node feature vector representation corresponding to each node in the first network entity relationship graph as the first graph node feature vector representation, and obtain the target graph node feature vector representation corresponding to each node in the second network entity relationship graph as the second graph node feature vector representation; fuse each second graph node feature vector representation to the first graph node feature vector representation corresponding to the node representing the same network entity, to obtain the fused graph node feature vector representation corresponding to each node in the first network entity relationship graph; use the first network entity relationship graph in which each node has a corresponding fused graph node feature vector representation as the fused entity relationship graph; use the graph node feature vector representation corresponding to each node in the fused entity relationship graph as the corresponding fused graph node feature vector representation.

[0089] In this way, the fused entity relationship diagram retains the information structure of the first network entity relationship diagram, but combines the target graph node feature vector representation corresponding to the nodes in the first network entity relationship diagram and the second network entity relationship diagram, so that the fused entity relationship diagram can more comprehensively describe the characteristics and interaction patterns of network entities in the network environment to be monitored, and is used to detect more complex abnormal patterns and improve the reliability of network monitoring.

[0090] In some embodiments, Figure 3 As shown, obtaining a target graph node feature vector representation corresponding to each node in the first network entity relationship graph as the first graph node feature vector representation, and obtaining a target graph node feature vector representation corresponding to each node in the second network entity relationship graph as the second graph node feature vector representation, including:

[0091] Step S310 , performing graph representation learning on the first network entity relationship graph and the second network entity relationship graph respectively, and obtaining graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph.

[0092] Step S320, respectively optimizing the feature expression capabilities of the graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph, and obtaining target graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph.

[0093] In a specific implementation, when a computer device obtains a target graph node feature vector representation corresponding to each node in a first network entity relationship graph as a first graph node feature vector representation, and obtains a target graph node feature vector representation corresponding to each node in a second network entity relationship graph as a second graph node feature vector representation, the computer device can perform graph representation learning on the first network entity relationship graph and the second network entity relationship graph respectively to obtain a graph node feature vector representation corresponding to each node in the first network entity relationship graph, and a graph node feature vector representation corresponding to each node in the second network entity relationship graph.

[0094] Exemplarily, a computer device may use the H-GATs (Hierarchical Graph Attention Networks, a deep learning model for graph representation learning, which introduces a hierarchical graph attention mechanism based on the graph neural network to effectively capture the complex relationships between nodes in the graph) algorithm to perform graph representation learning on the first network entity relationship graph and the second network entity relationship graph, respectively, to obtain the graph node feature vector representation corresponding to each node in the first network entity relationship graph, and the graph node feature vector representation corresponding to each node in the second network entity relationship graph. Through these two levels of graph representation, the model can more comprehensively understand information at different levels, thereby improving the anomaly detection and processing capabilities.

[0095] In addition, the computer device can optimize the feature expression capabilities of the graph node feature vector representation corresponding to each node in the first network entity relationship graph and the graph node feature vector representation corresponding to each node in the second network entity relationship graph, respectively, to obtain the target graph node feature vector representation corresponding to each node in the first network entity relationship graph and the target graph node feature vector representation corresponding to each node in the second network entity relationship graph. The optimized graph node feature vector representation is used as the target graph node feature vector representation.

[0096] Exemplarily, the computer device can use a DGCN (Directed Graph Convolutional Networks, a method for extending traditional graph convolutional networks (GCNs) specifically for processing directed graph data) algorithm to optimize the feature learning process. The DGCN algorithm can automatically adjust the network structure and parameters to adapt to different graph structures and data characteristics, thereby improving the accuracy and efficiency of anomaly detection.

[0097] In this way, the H-GATs multi-level graph representation learning algorithm is used to perform graph representation learning on the first network entity relationship graph and the second network entity relationship graph respectively, and features can be extracted from multiple dimensions. The DGCN adaptive graph neural network algorithm is applied to improve the accuracy and efficiency of anomaly detection, extract useful features from complex data, and enhance the ability to identify abnormal events. By adopting the H-GATs multi-level graph representation learning algorithm and the DGCN adaptive graph neural network algorithm, there is a significant improvement in the relationship between graph levels and feature extraction, thereby improving the fine-grained analysis of complex security events and the accuracy of anomaly detection.

[0098] The technical solution of this embodiment can extract features from multiple dimensions by respectively performing graph representation learning on the first network entity relationship graph and the second network entity relationship graph, and obtain graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph; and optimize the feature expression capabilities of the graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph, and obtain target graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph, which can optimize the feature learning process and improve the detection capability of complex security incidents.

[0099] In one of the embodiments, the feature expression capabilities of the graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph are optimized respectively to obtain target graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph, including: for any network entity relationship graph, the graph node feature vector representations corresponding to each node in any network entity relationship graph are input into a pre-trained feature optimization model, and the target graph node feature vector representations corresponding to each node in any network entity relationship graph are output.

[0100] Among them, the target graph node feature vector is represented by a pre-trained feature optimization model. The first-order adjacency information and second-order adjacency information of each node in any network entity relationship graph are determined through the adjacency matrix of any network entity relationship graph. According to the first-order adjacency information and second-order adjacency information of each node, the graph node feature vector representation corresponding to each node in any network entity relationship graph is convolved.

[0101] In a specific implementation, when a computer device optimizes a graph node feature vector corresponding to a node, the computer device can input the graph node feature vector representation corresponding to each node in the first network entity relationship graph and the second network entity relationship graph into a pre-trained feature optimization model, and output the target graph node feature vector representation corresponding to each node in any network entity relationship graph.

[0102] In practical applications, the pre-trained feature optimization model can use the DGCN algorithm, which determines the first-order and second-order adjacency information of each node in the network entity relationship graph based on the input adjacency matrix of the network entity relationship graph. According to the first-order and second-order adjacency information of each node, the graph node feature vector representation corresponding to each node in the network entity relationship graph is convolved to obtain the target graph node feature vector representation corresponding to each node in the network entity relationship graph. This achieves the use of richer adjacency information, optimizes the feature learning process, and improves the representation ability of nodes.

[0103] In this way, by respectively inputting the graph node feature vectors corresponding to each node in the first network entity relationship graph and the graph node feature vectors corresponding to each node in the second network entity relationship graph into the pre-trained feature optimization model, the target graph node feature vector representation corresponding to each node in the first network entity relationship graph and the target graph node feature vector representation corresponding to each node in the second network entity relationship graph can be obtained.

[0104] The technical solution of this embodiment, by inputting the graph node feature vector representation corresponding to each node in any network entity relationship graph into the pre-trained feature optimization model for any network entity relationship graph, outputs the target graph node feature vector representation corresponding to each node in any network entity relationship graph; the target graph node feature vector representation is obtained by performing convolution operation on the graph node feature vector representation corresponding to each node in any network entity relationship graph according to the first-order and second-order adjacency information of each node through the adjacency matrix of any network entity relationship graph by the pre-trained feature optimization model. In this way, more abundant adjacency information is utilized, the feature learning process is optimized, the representation ability of nodes is improved, and the detection ability of complex security events is improved.

[0105] In some embodiments, based on the graph node feature vector representation corresponding to the node in the fused entity relationship graph, the abnormal event type corresponding to the abnormal subgraph in the fused entity relationship graph is identified, including: detecting the abnormal subgraph in the fused entity relationship graph based on multi-source log data and the graph node feature vector representation corresponding to each node in the fused entity relationship graph; identifying the abnormal event type corresponding to the abnormal subgraph based on the graph node feature vector representation corresponding to each node in the abnormal subgraph.

[0106] In a specific implementation, in the process of identifying the abnormal event type corresponding to the abnormal subgraph in the fused entity relationship graph based on the graph node feature vector representation corresponding to the node in the fused entity relationship graph, the computer device can detect the abnormal subgraph in the fused entity relationship graph based on multi-source log data and the graph node feature vector representation corresponding to each node in the fused entity relationship graph.

[0107] In practical applications, computer equipment can combine multi-source log data and the graph node feature vector representation corresponding to each node in the fused entity relationship graph, and use a multimodal graph autoencoder to detect abnormal subgraphs in the fused entity relationship graph and identify complex abnormal patterns.

[0108] Furthermore, the computer device can identify the abnormal event type corresponding to the abnormal subgraph based on the graph node feature vector representation corresponding to each node in the abnormal subgraph. In practical applications, the computer device can classify the detected abnormal subgraphs through random forest and XGBoost ensemble learning algorithms to improve the accuracy and robustness of the classification. Specifically, a multi-label classification model can be used to classify abnormal subgraphs into corresponding abnormal event types to support the identification and processing of complex events.

[0109] Therefore, in the abnormal subgraph detection stage, a multimodal graph autoencoder is used in combination with multi-source data to identify abnormal patterns, the random forest and XGBoost algorithms are used to classify abnormal subgraphs, and a multi-label classification model is introduced to handle complex events. This makes it possible to identify complex abnormal patterns, improve the accuracy of anomaly detection, discover potential threats in a timely manner, improve the accuracy and robustness of classification, support the classification and processing of various complex events, and optimize event management and response strategies.

[0110] The technical solution of this embodiment detects the abnormal subgraph in the fused entity relationship graph based on the multi-source log data and the graph node feature vector representation corresponding to each node in the fused entity relationship graph; and identifies the abnormal event type corresponding to the abnormal subgraph based on the graph node feature vector representation corresponding to each node in the abnormal subgraph. In this way, it is possible to identify complex abnormal patterns, improve the accuracy of abnormal detection, discover potential threats in a timely manner, and improve the accuracy and robustness of classification.

[0111] In some embodiments, Figure 4 As shown, a structural block diagram of a multi-source security log anomaly monitoring and classification system is provided, which can be used to execute the steps of a network security monitoring method in the present application, aiming to solve the problems of low efficiency and incomplete information in network security monitoring in related technologies. The system includes a data acquisition unit (data acquisition module), a data preprocessing unit (data preprocessing module), a feature extraction unit (feature extraction module), an anomaly detection classification unit (anomaly detection classification module), a dynamic update mechanism unit (dynamic update mechanism module) and a response unit (response module).

[0112] Among them, the data collection unit is used to collect multi-source log data of the network environment to be monitored, such as system security logs, host logs, traffic logs, etc.; the data preprocessing unit is used to construct object-level network entity relationship graphs (object-level graphs) and triple-level network entity relationship graphs (triplet-level graphs) according to multi-source log data; the feature extraction unit is used to perform graph representation learning on the object-level graph and triple-level graph respectively according to the H-GATs algorithm, and optimize the graph node feature vector representation obtained by graph representation learning through the DGCN algorithm; the anomaly detection classification unit combines multi-source log data and multi-level features (i.e., the graph node feature vector representation corresponding to the nodes in the fused entity relationship graph), and uses the multimodal graph autoencoder to detect abnormal subgraphs in the fused entity relationship graph, identify complex abnormal patterns, and use random forests and XGBo to classify the abnormal subgraphs. The ost ensemble learning algorithm classifies the detected abnormal subgraphs to improve the accuracy and robustness of the classification. For example, a multi-label classification model is used to classify abnormal subgraphs into corresponding abnormal event types, supporting the identification and processing of complex events. The dynamic update mechanism unit uses time series analysis to monitor the dynamic changes of nodes and edges in the graph and identify potential abnormal behaviors. Specifically, by introducing an adaptive dynamic update mechanism, the model parameters and structure are automatically adjusted based on real-time data streams and model feedback to ensure the real-time and accuracy of the system. The response module can be used to quickly respond to and adjust abnormal events. This real-time dynamic update mechanism optimizes security policies, can quickly respond to and adjust real-time data streams, and improve the system's ability to detect, classify and respond to potential threats, as well as improve response speed and accuracy.

[0113] It should be noted that the specific limitations of the above steps can refer to the specific limitations of a network security monitoring method mentioned above.

[0114] In this way, by adopting the H-GATs multi-level graph representation learning algorithm and the DGCN adaptive graph neural network algorithm, the relationship between graph levels and the accuracy of feature extraction are improved, thereby improving the fine-grained analysis of complex security events and the accuracy of anomaly detection. By introducing a multimodal graph autoencoder and an adaptive dynamic update mechanism, the recognition, real-time adjustment and optimization of complex abnormal patterns are achieved, providing a more efficient automated response mechanism.

[0115] The system can be applied to the following scenarios:

[0116] 1. Dynamic cloud network security monitoring: Improve the ability to detect and respond to security threats in complex cloud network environments.

[0117] 2. Multi-source data fusion analysis: Integrate various security logs and data to provide accurate anomaly detection and classification.

[0118] In another embodiment, Figure 5 As shown, a network security monitoring method is provided, which is described by taking the method applied to a computer device as an example, and includes the following steps:

[0119] Step S502: construct an object-level network entity relationship diagram according to the direct interaction relationship between network entities of different or same entity types in the network environment to be monitored, and use the object-level network entity relationship diagram as the first network entity relationship diagram.

[0120] Step S504: construct a triplet-level network entity relationship graph according to the dependent interaction relationship between network entities of different or same entity types in the network environment to be monitored, and use the triplet-level network entity relationship graph as the second network entity relationship graph.

[0121] Step S506 , performing graph representation learning on the first network entity relationship graph and the second network entity relationship graph respectively, and obtaining graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph.

[0122] Step S508, respectively optimizing the feature expression capabilities of the graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph, and obtaining target graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph.

[0123] Step S510, the target graph node feature vector representation corresponding to each node in the first network entity relationship graph is used as the first graph node feature vector representation, and the target graph node feature vector representation corresponding to each node in the second network entity relationship graph is used as the second graph node feature vector representation.

[0124] Step S512: fuse the feature vector representations of the second graph nodes into the feature vector representations of the first graph nodes corresponding to the nodes representing the same network entity, to obtain the fused graph node feature vector representations corresponding to the nodes in the first network entity relationship graph.

[0125] Step S514, taking the first network entity relationship graph in which each node has a corresponding fusion graph node feature vector as the fused entity relationship graph.

[0126] Step S516, detecting abnormal subgraphs in the fused entity relationship graph according to the multi-source log data and the graph node feature vector representation corresponding to each node in the fused entity relationship graph.

[0127] Step S518, identifying the abnormal event type corresponding to the abnormal subgraph according to the graph node feature vector representation corresponding to each node in the abnormal subgraph.

[0128] It should be noted that the specific limitations of the above steps can refer to the specific limitations of a network security monitoring method mentioned above.

[0129] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0130] Based on the same inventive concept, the embodiment of the present application also provides a network security monitoring device for implementing the network security monitoring method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more network security monitoring device embodiments provided below can refer to the limitations of the network security monitoring method above, and will not be repeated here.

[0131] In an exemplary embodiment, Figure 6 As shown, a network security monitoring device is provided, including: an acquisition module 610, a fusion module 620 and an identification module 630, wherein:

[0132] The acquisition module 610 is used to obtain a first network entity relationship diagram and a second network entity relationship diagram based on multi-source log data of the network environment to be monitored; the first network entity relationship diagram is used to characterize the direct interaction relationship between network entities of different or same entity types in the network environment to be monitored; the second network entity relationship diagram is used to characterize the dependent interaction relationship between network entities of the same or different entity types in the network environment to be monitored.

[0133] The fusion module 620 is used to fuse the first network entity relationship diagram and the second network entity relationship diagram to obtain a fused entity relationship diagram.

[0134] The identification module 630 is used to identify the abnormal event type corresponding to the abnormal subgraph in the fused entity relationship graph according to the graph node feature vector representation corresponding to the node in the fused entity relationship graph.

[0135] In one embodiment, the acquisition module 610 is specifically used to construct an object-level network entity relationship diagram based on the direct interaction relationship between network entities of different or same entity types in the network environment to be monitored; the object-level network entity relationship diagram is used as the first network entity relationship diagram; the first network entity relationship diagram uses each of the network entities as a node and the direct interaction relationship as the edge between the corresponding nodes.

[0136] In one of the embodiments, the acquisition module 610 is specifically used to construct a triple-level network entity relationship graph based on the dependency interaction relationship between network entities of the same or different entity types in the network environment to be monitored; use the triple-level network entity relationship graph as the second network entity relationship graph; the second network entity relationship graph uses each of the network entities as a node and the dependency interaction relationship as the edge between the corresponding nodes.

[0137] In one embodiment, the fusion module 620 is specifically used to obtain the target graph node feature vector representation corresponding to each node in the first network entity relationship graph as the first graph node feature vector representation, and obtain the target graph node feature vector representation corresponding to each node in the second network entity relationship graph as the second graph node feature vector representation; fuse each of the second graph node feature vector representations into the first graph node feature vector representation corresponding to the node representing the same network entity to obtain the fused graph node feature vector representation corresponding to each node in the first network entity relationship graph; use the first network entity relationship graph in which each node has a corresponding fused graph node feature vector representation as the fused entity relationship graph; and use the graph node feature vector representation corresponding to each node in the fused entity relationship graph as the corresponding fused graph node feature vector representation.

[0138] In one embodiment, the fusion module 620 is specifically used to perform graph representation learning on the first network entity relationship diagram and the second network entity relationship diagram, respectively, to obtain graph node feature vector representations corresponding to each node in the first network entity relationship diagram and the second network entity relationship diagram; optimize the feature expression capabilities of the graph node feature vector representations corresponding to each node in the first network entity relationship diagram and the second network entity relationship diagram, respectively, to obtain target graph node feature vector representations corresponding to each node in the first network entity relationship diagram and the second network entity relationship diagram.

[0139] In one embodiment, the fusion module 620 is specifically used to input the graph node feature vector representation corresponding to each node in any network entity relationship graph into a pre-trained feature optimization model, and output the target graph node feature vector representation corresponding to each node in any network entity relationship graph; the target graph node feature vector representation is obtained by the pre-trained feature optimization model determining the first-order adjacency information and second-order adjacency information of each node in any network entity relationship graph through the adjacency matrix of the any network entity relationship graph, and performing a convolution operation on the graph node feature vector representation corresponding to each node in the any network entity relationship graph according to the first-order adjacency information and second-order adjacency information of each node.

[0140] In one of the embodiments, the identification module 630 is specifically used to detect the abnormal subgraph in the fused entity relationship graph based on the multi-source log data and the graph node feature vector representation corresponding to each node in the fused entity relationship graph; and identify the abnormal event type corresponding to the abnormal subgraph based on the graph node feature vector representation corresponding to each node in the abnormal subgraph.

[0141] Each module in the above network security monitoring device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0142] In an exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be shown in FIG7. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, the memory, and the input / output interface are connected via a system bus, and the communication interface, the display unit, and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner may be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a network security monitoring method is implemented. The display unit of the computer device is used to form a visually visible picture, which may be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0143] Those skilled in the art will understand that the structure shown in FIG. 7 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0144] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0145] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0146] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0147] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0148] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0149] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0150] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A network security monitoring method, characterized in that: The method comprises: According to the multi-source log data of the network environment to be monitored, a first network entity relationship diagram and a second network entity relationship diagram are obtained; the first network entity relationship diagram is used to characterize the direct interaction relationship between network entities of different or same entity types in the network environment to be monitored; the second network entity relationship diagram is used to characterize the dependent interaction relationship between network entities of the same or different entity types in the network environment to be monitored; Merging the first network entity relationship graph and the second network entity relationship graph to obtain a merged entity relationship graph; According to the graph node feature vector representation corresponding to the node in the fused entity relationship graph, the abnormal event type corresponding to the abnormal subgraph in the fused entity relationship graph is identified.

2. The method according to claim 1, characterized in that The step of obtaining the first network entity relationship diagram and the second network entity relationship diagram according to the multi-source log data of the network environment to be monitored includes: Constructing an object-level network entity relationship diagram according to direct interaction relationships between network entities of different or same entity types in the network environment to be monitored; The object-level network entity relationship diagram is used as the first network entity relationship diagram; the first network entity relationship diagram uses each of the network entities as a node and the direct interaction relationship as an edge between the corresponding nodes.

3. The method according to claim 1, characterized in that The step of obtaining the first network entity relationship diagram and the second network entity relationship diagram according to the multi-source log data of the network environment to be monitored includes: Constructing a triplet-level network entity relationship graph according to the dependent interaction relationship between network entities of the same or different entity types in the network environment to be monitored; The triple-level network entity relationship graph is used as the second network entity relationship graph; the second network entity relationship graph uses each of the network entities as a node and the dependent interaction relationships as edges between the corresponding nodes.

4. The method according to claim 1, characterized in that The step of fusing the first network entity relationship graph and the second network entity relationship graph to obtain a fused entity relationship graph includes: Obtaining a target graph node feature vector representation corresponding to each node in the first network entity relationship graph as the first graph node feature vector representation, and obtaining a target graph node feature vector representation corresponding to each node in the second network entity relationship graph as the second graph node feature vector representation; Fusion of each of the second graph node feature vector representations to the first graph node feature vector representation corresponding to the node representing the same network entity, to obtain a fused graph node feature vector representation corresponding to each node in the first network entity relationship graph; The first network entity relationship graph in which each node has a corresponding fused graph node feature vector representation is used as the fused entity relationship graph; the graph node feature vector representation corresponding to each node in the fused entity relationship graph is used as the corresponding fused graph node feature vector representation.

5. The method according to claim 4, characterized in that The step of obtaining a target graph node feature vector representation corresponding to each node in the first network entity relationship graph as the first graph node feature vector representation, and obtaining a target graph node feature vector representation corresponding to each node in the second network entity relationship graph as the second graph node feature vector representation, includes: Performing graph representation learning on the first network entity relationship graph and the second network entity relationship graph respectively to obtain graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph; The feature expression capabilities of the graph node feature vector representation corresponding to each node in the first network entity relationship graph and the second network entity relationship graph are optimized respectively to obtain the target graph node feature vector representation corresponding to each node in the first network entity relationship graph and the second network entity relationship graph.

6. The method according to claim 5, characterized in that The optimizing the feature expression capability of the graph node feature vector representation corresponding to each node in the first network entity relationship graph and the second network entity relationship graph respectively to obtain the target graph node feature vector representation corresponding to each node in the first network entity relationship graph and the second network entity relationship graph includes: For any network entity relationship graph, input the graph node feature vector representation corresponding to each node in the any network entity relationship graph into the pre-trained feature optimization model, and output the target graph node feature vector representation corresponding to each node in the any network entity relationship graph; The target graph node feature vector is represented by the pre-trained feature optimization model through the adjacency matrix of any network entity relationship graph, determining the first-order adjacency information and second-order adjacency information of each node in any network entity relationship graph, and performing a convolution operation on the graph node feature vector representation corresponding to each node in any network entity relationship graph based on the first-order adjacency information and second-order adjacency information of each node.

7. The method according to claim 1, characterized in that The identifying, according to the graph node feature vector representation corresponding to the node in the fused entity relationship graph, the abnormal event type corresponding to the abnormal subgraph in the fused entity relationship graph comprises: Detecting the abnormal subgraph in the fused entity relationship graph according to the multi-source log data and the graph node feature vector representation corresponding to each node in the fused entity relationship graph; According to the graph node feature vector representation corresponding to each node in the abnormal subgraph, the abnormal event type corresponding to the abnormal subgraph is identified.

8. A network security monitoring device, characterized in that: The device comprises: An acquisition module is used to acquire a first network entity relationship diagram and a second network entity relationship diagram according to multi-source log data of the network environment to be monitored; the first network entity relationship diagram is used to characterize the direct interaction relationship between network entities of different or same entity types in the network environment to be monitored; the second network entity relationship diagram is used to characterize the dependent interaction relationship between network entities of the same or different entity types in the network environment to be monitored; A fusion module, used to fuse the first network entity relationship diagram and the second network entity relationship diagram to obtain a fused entity relationship diagram; The identification module is used to identify the abnormal event type corresponding to the abnormal subgraph in the fused entity relationship graph according to the graph node feature vector representation corresponding to the node in the fused entity relationship graph.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images