Network security monitoring method and device, computer equipment, readable storage medium and program product

Abstract

The application relates to a network security monitoring method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: acquiring a first network entity relationship graph and a second network entity relationship graph according to multi-source log data of a network environment to be monitored; the first network entity relationship graph is used for representing the direct interaction relationship between network entities of different or same entity types in the network environment to be monitored; the second network entity relationship graph is used for representing the dependent interaction relationship between network entities of same or different entity types in the network environment to be monitored; the first network entity relationship graph and the second network entity relationship graph are fused to obtain a fused entity relationship graph; and the abnormal event type corresponding to an abnormal subgraph in the fused entity relationship graph is identified according to the graph node feature vector representation corresponding to the nodes in the fused entity relationship graph. The method can improve the accuracy of network security monitoring.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a network security monitoring method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Technology

[0002] With the deepening of informatization and networking, network devices and the types of services they carry are gradually increasing, and the data stored in the network is also growing explosively. The vulnerabilities and technical means available for exploitation are becoming increasingly abundant, and the confrontation is becoming more intense. These factors make the software, hardware and information in the network more vulnerable to security threats from both internal and external sources, and network security threats are also showing an increasingly complex and ever-changing trend.

[0003] Network security monitoring technologies struggle to comprehensively capture and analyze complex security incidents. In complex cloud and network environments, these technologies fail to provide comprehensive and accurate solutions for network security protection, resulting in poor accuracy in network security monitoring.

[0004] Therefore, the accuracy of network security monitoring in related technologies is relatively low. Summary of the Invention

[0005] Therefore, it is necessary to provide a network security monitoring method, device, computer equipment, computer-readable storage medium, and computer program product that can improve the accuracy of network security monitoring in response to the above-mentioned technical problems.

[0006] Firstly, this application provides a network security monitoring method, including:

[0007] Based on multi-source log data of the network environment to be monitored, a first network entity relationship graph and a second network entity relationship graph are obtained; the first network entity relationship graph is used to characterize the direct interaction relationship between network entities of different or the same entity type in the network environment to be monitored; the second network entity relationship graph is used to characterize the dependency interaction relationship between network entities of the same or different entity types in the network environment to be monitored.

[0008] The first network entity relationship graph and the second network entity relationship graph are merged to obtain a merged entity relationship graph;

[0009] Based on the graph node feature vector representation of the nodes in the fused entity relationship graph, the abnormal event type corresponding to the abnormal subgraph in the fused entity relationship graph is identified.

[0010] In one embodiment, obtaining the first network entity relationship graph and the second network entity relationship graph based on multi-source log data of the network environment to be monitored includes:

[0011] Based on the direct interaction relationships between network entities of different or the same entity type in the network environment to be monitored, construct an object-level network entity relationship graph;

[0012] The object-level network entity relationship graph is used as the first network entity relationship graph; the first network entity relationship graph uses each network entity as a node and the direct interaction relationship as the edge between the corresponding nodes.

[0013] In one embodiment, obtaining the first network entity relationship graph and the second network entity relationship graph based on multi-source log data of the network environment to be monitored includes:

[0014] Based on the dependency and interaction relationships between network entities of the same or different entity types in the network environment to be monitored, construct a network entity relationship graph at the triple level;

[0015] The triple-level network entity relationship graph is used as the second network entity relationship graph; the second network entity relationship graph uses each network entity as a node and the dependency interaction relationship as the edge between the corresponding nodes.

[0016] In one embodiment, the step of fusing the first network entity relationship graph and the second network entity relationship graph to obtain a fused entity relationship graph includes:

[0017] Obtain the target graph node feature vector representation corresponding to each node in the first network entity relationship graph as the first graph node feature vector representation, and obtain the target graph node feature vector representation corresponding to each node in the second network entity relationship graph as the second graph node feature vector representation;

[0018] The feature vector representations of each second graph node are fused into the feature vector representations of the first graph node corresponding to the node representing the same network entity, to obtain the fused graph node feature vector representations of each node in the first network entity relationship graph;

[0019] The first network entity relationship graph, in which each node has a corresponding fused graph node feature vector representation, is used as the fused entity relationship graph; the graph node feature vector representation of each node in the fused entity relationship graph is the corresponding fused graph node feature vector representation.

[0020] In one embodiment, obtaining the target graph node feature vector representations corresponding to each node in the first network entity relationship graph as the first graph node feature vector representation, and obtaining the target graph node feature vector representations corresponding to each node in the second network entity relationship graph as the second graph node feature vector representation, includes:

[0021] Graph representation learning is performed on the first network entity relationship graph and the second network entity relationship graph respectively to obtain the graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph.

[0022] The feature representation capabilities of the graph node feature vectors corresponding to each node in the first network entity relationship graph and the second network entity relationship graph are optimized to obtain the target graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph.

[0023] In one embodiment, optimizing the feature representation capability of the graph node feature vectors corresponding to each node in the first network entity relationship graph and the second network entity relationship graph to obtain the target graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph includes:

[0024] For any network entity relationship graph, the graph node feature vector representations corresponding to each node in the network entity relationship graph are input into a pre-trained feature optimization model, and the target graph node feature vector representations corresponding to each node in the network entity relationship graph are output.

[0025] The target graph node feature vector is obtained by the pre-trained feature optimization model determining the first-order and second-order adjacency information of each node in the network entity relationship graph through the adjacency matrix of the network entity relationship graph, and performing a convolution operation on the graph node feature vector representation corresponding to each node in the network entity relationship graph based on the first-order and second-order adjacency information of each node.

[0026] In one embodiment, identifying the abnormal event type corresponding to the abnormal subgraph in the fused entity relationship graph based on the graph node feature vector representation of the node in the fused entity relationship graph includes:

[0027] Based on the multi-source log data and the graph node feature vector representations corresponding to each node in the fused entity relationship graph, the abnormal subgraphs in the fused entity relationship graph are detected.

[0028] Based on the graph node feature vector representations corresponding to each node in the abnormal subgraph, the abnormal event type corresponding to the abnormal subgraph is identified.

[0029] Secondly, this application also provides a network security monitoring device, comprising:

[0030] The acquisition module is used to acquire a first network entity relationship graph and a second network entity relationship graph based on multi-source log data of the network environment to be monitored; the first network entity relationship graph is used to represent the direct interaction relationship between network entities of different or the same entity type in the network environment to be monitored; the second network entity relationship graph is used to represent the dependency interaction relationship between network entities of the same or different entity types in the network environment to be monitored.

[0031] The fusion module is used to fuse the first network entity relationship graph and the second network entity relationship graph to obtain a fused entity relationship graph;

[0032] The identification module is used to identify the abnormal event type corresponding to the abnormal subgraph in the fused entity relationship graph based on the graph node feature vector representation of the node in the fused entity relationship graph.

[0033] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program that, when executed by the processor, implements the steps of the method described above.

[0034] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, implements the steps of the above-described method.

[0035] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the steps of the above-described method.

[0036] The aforementioned network security monitoring methods, devices, computer equipment, computer-readable storage media, and computer program products, by fusing multi-source log data of the network environment to be monitored, obtain graph representations at different levels: a first network entity relationship graph and a second network entity relationship graph. The first network entity relationship graph is used to characterize the direct interaction relationships between network entities of different or the same entity types in the network environment to be monitored; the second network entity relationship graph is used to characterize the dependency interaction relationships between network entities of the same or different entity types in the network environment to be monitored. By fusing the first network entity relationship graph and the second network entity relationship graph, a fused entity relationship graph is obtained. This fused entity relationship graph combines the information from both the first and second network entity relationship graphs, and can more comprehensively describe the relationships between network entities in the network environment to be monitored. Furthermore, based on the graph node feature vector representations corresponding to the nodes in the fused entity relationship graph, the abnormal event types corresponding to the abnormal subgraphs in the fused entity relationship graph can be more accurately identified. This enables more detailed anomaly detection and more accurate anomaly classification after multi-source data fusion, improving the anomaly detection and response capabilities for security threats in complex cloud network environments, and effectively enhancing the accuracy of network security monitoring. Attached Figure Description

[0037] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 This is a flowchart illustrating a network security monitoring method in one embodiment;

[0039] Figure 2 This is a flowchart illustrating the steps of merging the first network entity relationship graph and the second network entity relationship graph in one embodiment.

[0040] Figure 3 This is a flowchart illustrating the feature extraction steps in one embodiment;

[0041] Figure 4 This is a structural block diagram of a multi-source security log anomaly monitoring and classification system in one embodiment;

[0042] Figure 5 This is a flowchart illustrating a network security monitoring method in another embodiment;

[0043] Figure 6 This is a structural block diagram of a network security monitoring device in one embodiment;

[0044] Figure 7 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0046] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.

[0047] In one embodiment, such as Figure 1 As shown, a network security monitoring method is provided. This embodiment illustrates the method by applying it to a computer device. It is understood that the computer device can be a terminal, a server, or a system including both a terminal and a server. In this embodiment, the method includes the following steps:

[0048] Step S110: Obtain the first network entity relationship diagram and the second network entity relationship diagram based on the multi-source log data of the network environment to be monitored.

[0049] The first network entity relationship graph is used to characterize the direct interaction relationships between network entities of different or the same entity type in the network environment to be monitored.

[0050] The second network entity relationship graph is used to characterize the dependency and interaction relationships between network entities of the same or different entity types in the network environment to be monitored.

[0051] The network environment to be monitored refers to the network environment that requires security monitoring. For example, it could be a cloud network environment.

[0052] Entity type can refer to the type of network entity in the network environment to be monitored. For example, entity type can include host type, network device type, user type, etc.

[0053] Multi-source log data can originate from various security logs within the network environment to be monitored. For example, multi-source log data can include at least two types of data, such as system security logs, host logs, traffic logs, user behavior data, and device sensor data.

[0054] In practice, the computer equipment can acquire multi-source log data of the network environment to be monitored, and obtain a first network entity relationship graph and a second network entity relationship graph based on the multi-source log data. The first network entity relationship graph represents the relationships between network entities of different or the same entity type in the network environment to be monitored, and the second network entity relationship graph represents the relationships between network entities of different or the same entity type in the network environment to be monitored. That is, the first and second network entity relationship graphs use network entities as nodes and the relationships between network entities as edges between the corresponding nodes.

[0055] In practical applications, computer equipment can acquire multi-source log data of the network environment to be monitored, determine the network entities in the network environment to be monitored based on the multi-source log data, and thus obtain a first network entity relationship diagram and a second network entity relationship diagram based on the relationships between the network entities.

[0056] Step S120: Merge the first network entity relationship graph and the second network entity relationship graph to obtain the merged entity relationship graph.

[0057] In practice, the computer device can merge the first network entity relationship diagram and the second network entity relationship diagram to obtain the merged entity relationship diagram.

[0058] In practical applications, each node in the first and second network entity relationship graphs has a corresponding graph node feature vector representation. A computer device can use the information structure of one of the two network entity relationship graphs as a basis, and through mapping and alignment, fuse the graph node feature vector representations of each node in the other network entity relationship graph into the graph node feature vector representations of each node in the base network entity relationship graph, resulting in a fused entity relationship graph. That is, the fused entity relationship graph retains the information structure of one of the network entity relationship graphs, but incorporates the feature vector information of nodes from both network entity relationship graphs.

[0059] Step S130: Based on the graph node feature vector representation of the node in the fused entity relationship graph, identify the abnormal event type corresponding to the abnormal subgraph in the fused entity relationship graph.

[0060] Among them, the abnormal subgraph can be a subgraph that contains anomalies in the merged entity relationship graph.

[0061] Among them, the abnormal event type is used to characterize the abnormal pattern of the network environment under monitoring. Abnormal patterns include network attacks (such as DDoS (Distributed Denial of Service) attacks and malware propagation), system failures (such as device communication interruptions and configuration errors), and data anomalies (such as data leakage and tampering). These abnormal patterns may lead to network security problems, device failures, or data inconsistencies.

[0062] In the specific implementation, each node in the first network entity relationship graph and each node in the second network entity relationship graph have a corresponding graph node feature vector representation. The graph node feature vector representation is the d-dimensional feature vector of each node in the graph calculated by the graph representation learning algorithm.

[0063] Graph representation learning algorithms map each node in a graph G = (V, E) to a d-dimensional feature vector, such that d is much smaller than the number of nodes in G. This approach preserves some of the graph's structural characteristics in the feature vectors; that is, nodes that are closer in distance to each other in G have similarly closer feature vectors in d-dimensional space. Here, d is a user-defined hyperparameter, V is the set of nodes, and E is the set of edges.

[0064] In the process of fusing the first network entity relationship graph and the second network entity relationship graph to obtain the fused entity relationship graph, the fused entity relationship graph can be obtained by retaining the information structure of the first network entity relationship graph and fusing the graph node feature vector representations corresponding to each node in the first and second network entity relationship graphs. That is, the fused entity relationship graph can be based on the information structure of the first network entity relationship graph, and the graph node feature vector representations corresponding to each node in the fused entity relationship graph are the graph node feature vector representations obtained by fusing the graph node feature vector representations corresponding to each node in the first and second network entity relationship graphs.

[0065] In this way, computer equipment can identify the abnormal event type corresponding to the abnormal subgraph in the fused entity relationship graph based on the graph node feature vector representation of the node in the fused entity relationship graph. The abnormal event type can be used to characterize the abnormal mode of the network environment to be monitored, thereby realizing the identification of the abnormal mode of the network environment to be monitored and improving the accuracy of anomaly detection.

[0066] In the aforementioned network security monitoring method, by fusing multi-source log data of the network environment to be monitored, different levels of graph representation are obtained: a first network entity relationship graph and a second network entity relationship graph. The first network entity relationship graph is used to represent the direct interaction relationships between network entities of different or the same entity types in the network environment to be monitored; the second network entity relationship graph is used to represent the dependency interaction relationships between network entities of the same or different entity types in the network environment to be monitored. By fusing the first network entity relationship graph and the second network entity relationship graph, a fused entity relationship graph is obtained. This fused entity relationship graph combines the information of the first and second network entity relationship graphs, and can more comprehensively describe the relationships between network entities in the network environment to be monitored. Furthermore, based on the graph node feature vector representation of the nodes in the fused entity relationship graph, the abnormal event types corresponding to the abnormal subgraphs in the fused entity relationship graph can be more accurately identified. This enables more detailed anomaly detection and more accurate anomaly classification after multi-source data fusion, which can improve the anomaly detection and response capabilities of security threats in complex cloud network environments, and effectively improve the accuracy of network security monitoring.

[0067] In another embodiment, obtaining a first network entity relationship graph and a second network entity relationship graph based on multi-source log data of the network environment to be monitored includes: constructing an object-level network entity relationship graph based on the direct interaction relationships between network entities of different or the same entity types in the network environment to be monitored; and using the object-level network entity relationship graph as the first network entity relationship graph.

[0068] In the first network entity relationship graph, each network entity is used as a node, and the direct interaction relationship is used as the edge between the corresponding nodes.

[0069] In specific implementation, when the computer device obtains the first network entity relationship diagram and the second network entity relationship diagram based on the multi-source log data of the network environment to be monitored, for the first network entity relationship diagram, the computer device can construct an object-level network entity relationship diagram based on the direct interaction relationship between network entities of different or the same entity type in the network environment to be monitored; thus, the object-level network entity relationship diagram can be used as the first network entity relationship diagram.

[0070] Furthermore, the computer equipment can construct a network entity relationship graph corresponding to each entity type based on the direct interaction relationships between network entities of the same entity type in the network environment to be monitored, and then integrate the network entity relationship graphs corresponding to each entity type into a unified comprehensive graph to obtain an object-level heterogeneous network entity relationship graph.

[0071] Taking entity types including host type, network device type and user type as an example, the network entity relationship diagram corresponding to the host type can be named host-level diagram, the network entity relationship diagram corresponding to the network device type can be named network-level diagram, and the network entity relationship diagram corresponding to the user type can be named user-level diagram.

[0072] The user-level graph represents the communication relationships between users, with users as nodes and links constructed based on these relationships. The host-level graph represents the data transmission and service call relationships between hosts, with hosts as nodes and links constructed based on data flow and service calls. The network-level graph represents the traffic forwarding and protocol interaction relationships between network devices, with network devices as nodes and links constructed based on traffic forwarding and protocol interaction. By constructing a comprehensive graph, the relationships between each entity type—user, host, and network device—can be integrated, allowing for the simultaneous display of user communication, host data transmission, and network traffic interaction, thereby comprehensively identifying security threats in the monitored network environment.

[0073] The technical solution of this embodiment constructs an object-level network entity relationship graph based on the direct interaction relationships between network entities of different or the same entity types in the network environment to be monitored. This object-level network entity relationship graph serves as the first network entity relationship graph. The first network entity relationship graph uses each network entity as a node and the direct interaction relationships as edges between the corresponding nodes. Thus, by constructing the object-level network entity relationship graph through the direct interaction relationships between network entities of different or the same entity types in the network environment to be monitored, the first network entity relationship graph can be obtained, which can display the direct interaction relationships between network entities of different or the same entity types, thereby enabling a more comprehensive identification of security threats in the network environment to be monitored.

[0074] In another embodiment, obtaining a first network entity relationship graph and a second network entity relationship graph based on multi-source log data of the network environment to be monitored includes: constructing a triplet-level network entity relationship graph based on the dependency and interaction relationships between network entities of the same or different entity types in the network environment to be monitored; and using the triplet-level network entity relationship graph as the second network entity relationship graph.

[0075] In the second network entity relationship graph, each network entity is used as a node, and the dependency and interaction relationship is used as the edge between the corresponding nodes.

[0076] In specific implementation, during the process of obtaining the first network entity relationship graph and the second network entity relationship graph based on multi-source log data of the network environment to be monitored, for the second network entity relationship graph, the computer device can construct triples based on the dependency and interaction relationships between network entities of the same or different entity types in the network environment to be monitored (trinity: <subject-predicate-object>The network entity relationship graph at the (subject-predicate-object) level is used as the second network entity relationship graph. The second network entity relationship graph uses each network entity as a node and the dependency interaction relationship as the edge between the corresponding nodes.

[0077] This involves constructing a triplet-level network entity relationship graph, which describes the relationships between network entities (trinities: ...). <subject-predicate-object>It captures the dependency and interaction patterns between network entities of the same or different entity types. For example, it constructs a network entity relationship graph at the triple level using triples such as (UA->communicates_with->UB (User A communicates with User B)) and (UB->accesses->S1 (User B accesses network device S1)).

[0078] The technical solution of this embodiment constructs a triplet-level network entity relationship graph based on the dependency and interaction relationships between network entities of the same or different entity types in the network environment to be monitored; this triplet-level network entity relationship graph serves as a second network entity relationship graph; the second network entity relationship graph uses each network entity as a node and the dependency and interaction relationships as edges between the corresponding nodes. Thus, by constructing a triplet-level network entity relationship graph based on the dependency and interaction relationships between network entities of the same or different entity types in the network environment to be monitored, a second network entity relationship graph is obtained, clearly displaying the dependencies between entities in the network, which helps to identify abnormal behavior, potential security vulnerabilities, or attack paths.

[0079] In another embodiment, each node in the first network entity relationship graph and the second network entity relationship graph has a corresponding target graph node feature vector representation, such as... Figure 2 As shown, step S120 involves fusing the first network entity relationship graph and the second network entity relationship graph to obtain the fused entity relationship graph, including the following steps:

[0080] Step S210: Obtain the target graph node feature vector representation corresponding to each node in the first network entity relationship graph as the first graph node feature vector representation; and obtain the target graph node feature vector representation corresponding to each node in the second network entity relationship graph as the second graph node feature vector representation.

[0081] Step S220: The feature vector representations of each second graph node are fused into the feature vector representations of the first graph node corresponding to the node representing the same network entity, to obtain the fused graph node feature vector representations of each node in the first network entity relationship graph.

[0082] Step S230: The first network entity relationship graph, in which each node has a corresponding fusion graph node feature vector representation, is used as the fused entity relationship graph.

[0083] In the fused entity relationship graph, the graph node feature vectors corresponding to each node are represented as the fused graph node feature vectors.

[0084] In specific implementation, during the process of fusing the first network entity relationship graph and the second network entity relationship graph to obtain the fused entity relationship graph, the computer device can obtain the target graph node feature vector representation corresponding to each node in the first network entity relationship graph as the first graph node feature vector representation, and obtain the target graph node feature vector representation corresponding to each node in the second network entity relationship graph as the second graph node feature vector representation. The feature vector representations of each second graph node are then fused into the first graph node feature vector representation corresponding to the node representing the same network entity, thereby obtaining the fused graph node feature vector representation corresponding to each node in the first network entity relationship graph.

[0085] Specifically, based on the information structure of the first network entity relationship graph, through mapping alignment, the feature vector representations of each second graph node are fused and spliced ​​with the feature vector representations of the first graph node corresponding to the node representing the same network entity, to obtain the final graph node feature vector representation of each node in the first network entity relationship graph, that is, to obtain the fused graph node feature vector representation of each node in the first network entity relationship graph, which incorporates the feature information of the second network entity relationship graph, and can more comprehensively describe the features and interaction patterns of network entities.

[0086] Furthermore, the first network entity relationship graph, in which each node has a corresponding fusion graph node feature vector representation, can be used as the fused entity relationship graph; the graph node feature vector representation of each node in the fused entity relationship graph is the corresponding fusion graph node feature vector representation.

[0087] Thus, the fused entity relationship graph refers to the object-level network entity relationship graph that provides the basic information structure and data benchmark. The feature information is a combination of the target graph node feature vector representation of the nodes in the object-level network entity relationship graph and the triplet-level network entity relationship graph. It will provide more comprehensive information and can more comprehensively describe the characteristics and interaction patterns of network entities in the network environment to be monitored, and can be used to detect more complex abnormal patterns.

[0088] The technical solution of this embodiment involves obtaining the target graph node feature vector representations corresponding to each node in the first network entity relationship graph as the first graph node feature vector representations, and obtaining the target graph node feature vector representations corresponding to each node in the second network entity relationship graph as the second graph node feature vector representations; fusing the feature vector representations of each second graph node to the feature vector representations of the first graph node corresponding to the node representing the same network entity to obtain the fused graph node feature vector representations corresponding to each node in the first network entity relationship graph; using the first network entity relationship graph with corresponding fused graph node feature vector representations for each node as the fused entity relationship graph; and using the graph node feature vector representations corresponding to each node in the fused entity relationship graph as the corresponding fused graph node feature vector representations.

[0089] Thus, the fused entity relationship graph retains the information structure of the first network entity relationship graph, but combines the target graph node feature vector representations corresponding to the nodes in the first and second network entity relationship graphs. Therefore, the fused entity relationship graph can more comprehensively describe the characteristics and interaction patterns of network entities in the network environment to be monitored, and can be used to detect more complex abnormal patterns, thereby improving the reliability of network monitoring.

[0090] In some embodiments, such as Figure 3 As shown, the method involves obtaining the feature vector representations of the target graph nodes corresponding to each node in the first network entity relationship graph, as the feature vector representations of the first graph nodes, and obtaining the feature vector representations of the target graph nodes corresponding to each node in the second network entity relationship graph, as the feature vector representations of the second graph nodes, including:

[0091] Step S310: Perform graph representation learning on the first network entity relationship graph and the second network entity relationship graph respectively to obtain the graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph.

[0092] Step S320: Optimize the feature representation capability of the graph node feature vectors corresponding to each node in the first network entity relationship graph and the second network entity relationship graph respectively, to obtain the target graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph.

[0093] In specific implementation, during the process of acquiring the target graph node feature vector representations corresponding to each node in the first network entity relationship graph as the first graph node feature vector representation, and acquiring the target graph node feature vector representations corresponding to each node in the second network entity relationship graph as the second graph node feature vector representation, the computer device can perform graph representation learning on the first network entity relationship graph and the second network entity relationship graph respectively to obtain the graph node feature vector representations corresponding to each node in the first network entity relationship graph and the graph node feature vector representations corresponding to each node in the second network entity relationship graph.

[0094] For example, a computer device can employ H-GATs (Hierarchical Graph Attention Networks, a deep learning model for graph representation learning that introduces a hierarchical graph attention mechanism on top of graph neural networks to effectively capture complex relationships between nodes in the graph) algorithm to perform graph representation learning on the first network entity relationship graph and the second network entity relationship graph, respectively, to obtain the graph node feature vector representations corresponding to each node in the first network entity relationship graph and the graph node feature vector representations corresponding to each node in the second network entity relationship graph. Through these two levels of graph representation, the model can more comprehensively understand information at different levels, thereby improving the anomaly detection and processing capabilities.

[0095] Furthermore, the computer equipment can optimize the feature representation capabilities of the graph node feature vector representations corresponding to each node in the first network entity relationship graph and the graph node feature vector representations corresponding to each node in the second network entity relationship graph, respectively, to obtain the target graph node feature vector representations corresponding to each node in the first network entity relationship graph and the target graph node feature vector representations corresponding to each node in the second network entity relationship graph. The optimized graph node feature vector representations are used as the target graph node feature vector representations.

[0096] For example, computer devices can use the DGCN (Directed Graph Convolutional Networks, a method that extends traditional Graph Convolutional Networks (GCNs) specifically for processing directed graph data) algorithm to optimize the feature learning process. The DGCN algorithm can automatically adjust the network structure and parameters to adapt to different graph structures and data characteristics, thereby improving the accuracy and efficiency of anomaly detection.

[0097] Thus, by using the H-GATs multi-level graph representation learning algorithm to perform graph representation learning on the first and second network entity relationship graphs respectively, feature extraction can be performed from multiple dimensions. Furthermore, by applying the DGCN adaptive graph neural network algorithm, the accuracy and efficiency of anomaly detection can be improved, enabling the extraction of useful features from complex data and enhancing the ability to identify anomalous events. By employing the H-GATs multi-level graph representation learning algorithm and the DGCN adaptive graph neural network algorithm, significant improvements are made in the relationships between graph levels and feature extraction, thereby enhancing the fine-grained analysis and anomaly detection accuracy of complex security events.

[0098] The technical solution of this embodiment, by performing graph representation learning on the first network entity relationship graph and the second network entity relationship graph respectively, can extract features from multiple dimensions to obtain graph node feature vector representations corresponding to each node in the first and second network entity relationship graphs; by optimizing the feature expression capabilities of the graph node feature vector representations corresponding to each node in the first and second network entity relationship graphs respectively, the target graph node feature vector representations corresponding to each node in the first and second network entity relationship graphs can be obtained, which can optimize the feature learning process and improve the detection capability of complex security events.

[0099] In one embodiment, the feature representation capability of the graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph is optimized to obtain the target graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph. This includes: for any network entity relationship graph, inputting the graph node feature vector representations corresponding to each node in any network entity relationship graph into a pre-trained feature optimization model, and outputting the target graph node feature vector representations corresponding to each node in any network entity relationship graph.

[0100] The target graph node feature vector is obtained by the pre-trained feature optimization model determining the first-order and second-order adjacency information of each node in any network entity relationship graph through the adjacency matrix of any network entity relationship graph, and performing a convolution operation on the graph node feature vector representation corresponding to each node in any network entity relationship graph based on the first-order and second-order adjacency information of each node.

[0101] In specific implementation, during the optimization of the graph node feature vectors corresponding to the nodes, the computer device can, for any one of the first network entity relationship graphs and the second network entity relationship graph, input the graph node feature vector representations corresponding to each node in that network entity relationship graph into the pre-trained feature optimization model, and output the target graph node feature vector representations corresponding to each node in that network entity relationship graph.

[0102] In practical applications, the pre-trained feature optimization model can employ the DGCN algorithm. Based on the adjacency matrix of the input network entity relationship graph, the DGCN algorithm determines the first-order and second-order adjacency information of each node in the graph. Then, based on this information, a convolution operation is performed on the graph node feature vector representations corresponding to each node in the graph, yielding the target graph node feature vector representations. This approach utilizes richer adjacency information, optimizes the feature learning process, and enhances the representational power of nodes.

[0103] Thus, by inputting the graph node feature vectors corresponding to each node in the first network entity relationship graph and the graph node feature vectors corresponding to each node in the second network entity relationship graph into the pre-trained feature optimization model, we can obtain the target graph node feature vector representations corresponding to each node in the first network entity relationship graph and the target graph node feature vector representations corresponding to each node in the second network entity relationship graph.

[0104] The technical solution of this embodiment, for any network entity relationship graph, inputs the graph node feature vector representations corresponding to each node in the graph into a pre-trained feature optimization model, and outputs the target graph node feature vector representations corresponding to each node in the graph. The target graph node feature vector representations are obtained by the pre-trained feature optimization model using the adjacency matrix of the graph to determine the first-order and second-order adjacency information of each node, and then performing a convolution operation on the graph node feature vector representations corresponding to each node based on the first-order and second-order adjacency information of each node. This achieves the utilization of richer adjacency information, optimizes the feature learning process, enhances the representational ability of nodes, and improves the detection capability for complex security events.

[0105] In some embodiments, based on the graph node feature vector representations corresponding to nodes in the fused entity relationship graph, the abnormal event type corresponding to the abnormal subgraph in the fused entity relationship graph is identified, including: detecting abnormal subgraphs in the fused entity relationship graph based on multi-source log data and the graph node feature vector representations corresponding to each node in the fused entity relationship graph; and identifying the abnormal event type corresponding to the abnormal subgraph based on the graph node feature vector representations corresponding to each node in the abnormal subgraph.

[0106] In specific implementation, when the computer device identifies the abnormal event type corresponding to the abnormal subgraph in the merged entity relationship graph based on the graph node feature vector representation of the node in the merged entity relationship graph, the computer device can detect the abnormal subgraph in the merged entity relationship graph based on multi-source log data and the graph node feature vector representation of each node in the merged entity relationship graph.

[0107] In practical applications, computer equipment can combine multi-source log data and the graph node feature vector representations corresponding to each node in the fused entity relationship graph, and use a multimodal graph autoencoder to detect abnormal subgraphs in the fused entity relationship graph and identify complex abnormal patterns.

[0108] Furthermore, computer devices can identify the type of anomalous event corresponding to each node in the anomalous subgraph based on the graph node feature vector representation. In practical applications, computer devices can classify detected anomalous subgraphs using random forest and XGBoost ensemble learning algorithms to improve classification accuracy and robustness. Specifically, multi-label classification models can be used to categorize anomalous subgraphs into corresponding anomalous event types, supporting the identification and processing of complex events.

[0109] Thus, in the anomaly subgraph detection stage, a multimodal graph autoencoder is used in conjunction with multi-source data for anomaly pattern recognition. Random forest and XGBoost algorithms are used to classify anomaly subgraphs, and a multi-label classification model is introduced to handle complex events. This enables the identification of complex anomaly patterns, improves the accuracy of anomaly detection, timely discovery of potential threats, enhances the accuracy and robustness of classification, supports the classification and processing of various complex events, and optimizes event management and response strategies.

[0110] The technical solution of this embodiment detects abnormal subgraphs in the fused entity relationship graph by using graph node feature vector representations corresponding to each node in the multi-source log data and the fused entity relationship graph. Based on the graph node feature vector representations corresponding to each node in the abnormal subgraph, it identifies the abnormal event type corresponding to the abnormal subgraph. This enables the identification of complex abnormal patterns, improves the accuracy of anomaly detection, timely discovery of potential threats, and enhances the accuracy and robustness of classification.

[0111] In some embodiments, such as Figure 4 As shown, a structural block diagram of a multi-source security log anomaly monitoring and classification system is provided. This system can be used to execute the steps of a network security monitoring method in this application, aiming to solve the problems of low efficiency and incomplete information in network security monitoring in related technologies. The system includes a data acquisition unit (data acquisition module), a data preprocessing unit (data preprocessing module), a feature extraction unit (feature extraction module), an anomaly detection and classification unit (anomaly detection and classification module), a dynamic update mechanism unit (dynamic update mechanism module), and a response unit (response module).

[0112] The system comprises several components: a data acquisition unit for collecting multi-source log data from the network environment to be monitored, such as system security logs, host logs, and traffic logs; a data preprocessing unit for constructing object-level and triple-level network entity relationship graphs (entity-level graphs) based on the multi-source log data; a feature extraction unit for performing graph representation learning on the object-level and triple-level graphs using the H-GATs algorithm, and optimizing the graph node feature vector representations obtained through the DGCN algorithm; and an anomaly detection and classification unit for combining multi-source log data and multi-level features (i.e., the graph node feature vector representations corresponding to nodes in the fused entity relationship graph), using a multimodal graph autoencoder to detect anomalous subgraphs in the fused entity relationship graph, identifying complex anomaly patterns, and utilizing random forests and XGBoo algorithms. The OST ensemble learning algorithm classifies detected abnormal subgraphs, improving classification accuracy and robustness. For example, it employs a multi-label classification model to categorize abnormal subgraphs into corresponding abnormal event types, supporting the identification and handling of complex events. The dynamic update mechanism unit uses time series analysis to monitor the dynamic changes of nodes and edges in the graph, identifying potential abnormal behaviors. Specifically, by introducing an adaptive dynamic update mechanism, based on real-time data streams and model feedback, it automatically adjusts model parameters and structure to ensure the system's real-time performance and accuracy. A response module can enable rapid response and adjustment to abnormal events. This real-time dynamic update mechanism optimizes security strategies, enabling rapid response and adjustment to real-time data streams, improving the system's ability to detect, classify, and respond to potential threats, as well as enhancing response speed and accuracy.

[0113] It should be noted that the specific limitations of the above steps can be found in the specific limitations of a network security monitoring method described above.

[0114] Thus, by employing the H-GATs multi-level graph representation learning algorithm and the DGCN adaptive graph neural network algorithm, improvements are made in the accuracy of relationships between graph levels and feature extraction, thereby enhancing the fine-grained analysis and anomaly detection accuracy of complex security events. Furthermore, by introducing a multimodal graph autoencoder and an adaptive dynamic update mechanism, the identification, real-time adjustment, and optimization of complex anomaly patterns are achieved, providing a more efficient automated response mechanism.

[0115] This system can be applied to the following scenarios:

[0116] 1. Dynamic cloud network security monitoring: Enhance the detection and response capabilities for security threats in complex cloud network environments.

[0117] 2. Multi-source data fusion analysis: Integrates various security logs and data to provide accurate anomaly detection and classification.

[0118] In another embodiment, such as Figure 5 As shown, a network security monitoring method is provided. Taking the application of this method to a computer device as an example, the method includes the following steps:

[0119] Step S502: Based on the direct interaction relationships between network entities of different or the same entity types in the network environment to be monitored, construct an object-level network entity relationship graph and use the object-level network entity relationship graph as the first network entity relationship graph.

[0120] Step S504: Based on the dependency and interaction relationships between network entities of different or the same entity types in the network environment to be monitored, construct a network entity relationship graph at the triple level, and use the network entity relationship graph at the triple level as the second network entity relationship graph.

[0121] Step S506: Perform graph representation learning on the first network entity relationship graph and the second network entity relationship graph respectively to obtain the graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph.

[0122] Step S508: Optimize the feature representation capability of the graph node feature vectors corresponding to each node in the first network entity relationship graph and the second network entity relationship graph respectively, to obtain the target graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph.

[0123] Step S510: The feature vector representation of the target graph node corresponding to each node in the first network entity relationship graph is used as the feature vector representation of the first graph node, and the feature vector representation of the target graph node corresponding to each node in the second network entity relationship graph is used as the feature vector representation of the second graph node.

[0124] Step S512: The feature vector representations of each second graph node are fused into the feature vector representations of the first graph node corresponding to the node representing the same network entity, to obtain the fused graph node feature vector representations of each node in the first network entity relationship graph.

[0125] Step S514: The first network entity relationship graph, in which each node has a corresponding fusion graph node feature vector representation, is used as the fused entity relationship graph.

[0126] Step S516: Based on the multi-source log data and the graph node feature vector representations corresponding to each node in the fused entity relationship graph, detect the abnormal subgraphs in the fused entity relationship graph.

[0127] Step S518: Identify the abnormal event type corresponding to the abnormal subgraph based on the graph node feature vector representation of each node in the abnormal subgraph.

[0128] It should be noted that the specific limitations of the above steps can be found in the specific limitations of a network security monitoring method described above.

[0129] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0130] Based on the same inventive concept, this application also provides a network security monitoring device for implementing the network security monitoring method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations in one or more network security monitoring device embodiments provided below can be found in the limitations of the network security monitoring method described above, and will not be repeated here.

[0131] In one exemplary embodiment, such as Figure 6 As shown, a network security monitoring device is provided, including: an acquisition module 610, a fusion module 620, and an identification module 630, wherein:

[0132] The acquisition module 610 is used to acquire a first network entity relationship graph and a second network entity relationship graph based on multi-source log data of the network environment to be monitored; the first network entity relationship graph is used to characterize the direct interaction relationship between network entities of different or the same entity type in the network environment to be monitored; the second network entity relationship graph is used to characterize the dependency interaction relationship between network entities of the same or different entity types in the network environment to be monitored.

[0133] The fusion module 620 is used to fuse the first network entity relationship graph and the second network entity relationship graph to obtain a fused entity relationship graph.

[0134] The identification module 630 is used to identify the abnormal event type corresponding to the abnormal subgraph in the fused entity relationship graph based on the graph node feature vector representation corresponding to the node in the fused entity relationship graph.

[0135] In one embodiment, the acquisition module 610 is specifically configured to construct an object-level network entity relationship graph based on the direct interaction relationships between network entities of different or the same entity type in the network environment to be monitored; and use the object-level network entity relationship graph as the first network entity relationship graph; the first network entity relationship graph uses each of the network entities as nodes and the direct interaction relationships as edges between the corresponding nodes.

[0136] In one embodiment, the acquisition module 610 is specifically configured to construct a triple-level network entity relationship graph based on the dependency and interaction relationships between network entities of the same or different entity types in the network environment to be monitored; and use the triple-level network entity relationship graph as the second network entity relationship graph; the second network entity relationship graph uses each of the network entities as nodes and the dependency and interaction relationships as edges between the corresponding nodes.

[0137] In one embodiment, the fusion module 620 is specifically configured to obtain the target graph node feature vector representations corresponding to each node in the first network entity relationship graph as the first graph node feature vector representations, and to obtain the target graph node feature vector representations corresponding to each node in the second network entity relationship graph as the second graph node feature vector representations; to fuse each of the second graph node feature vector representations into the first graph node feature vector representations corresponding to the nodes representing the same network entity, thereby obtaining the fused graph node feature vector representations corresponding to each node in the first network entity relationship graph; and to use the first network entity relationship graph with each node having a corresponding fused graph node feature vector representation as the fused entity relationship graph; the graph node feature vector representations corresponding to each node in the fused entity relationship graph are the corresponding fused graph node feature vector representations.

[0138] In one embodiment, the fusion module 620 is specifically used to perform graph representation learning on the first network entity relationship graph and the second network entity relationship graph respectively, to obtain graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph; and to optimize the feature expression capabilities of the graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph respectively, to obtain target graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph.

[0139] In one embodiment, the fusion module 620 is specifically used to, for any network entity relationship graph, input the graph node feature vector representations corresponding to each node in the any network entity relationship graph into a pre-trained feature optimization model, and output the target graph node feature vector representations corresponding to each node in the any network entity relationship graph; the target graph node feature vector representations are obtained by the pre-trained feature optimization model through the adjacency matrix of the any network entity relationship graph, determining the first-order adjacency information and second-order adjacency information of each node in the any network entity relationship graph, and performing a convolution operation on the graph node feature vector representations corresponding to each node in the any network entity relationship graph based on the first-order adjacency information and second-order adjacency information of each node.

[0140] In one embodiment, the identification module 630 is specifically used to detect the abnormal subgraph in the fused entity relationship graph based on the multi-source log data and the graph node feature vector representations corresponding to each node in the fused entity relationship graph; and to identify the abnormal event type corresponding to the abnormal subgraph based on the graph node feature vector representations corresponding to each node in the abnormal subgraph.

[0141] Each module in the aforementioned network security monitoring device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0142] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 7 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When the computer program is executed by the processor, it implements a network security monitoring method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0143] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0144] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0145] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0146] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0147] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0148] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0149] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0150] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A network security monitoring method, characterized in that, The method includes: Based on multi-source log data of the network environment to be monitored, a first network entity relationship graph and a second network entity relationship graph are obtained. The first network entity relationship graph is used to represent the direct interaction relationships between network entities of different or the same entity types in the network environment to be monitored. The second network entity relationship graph is used to represent the dependency interaction relationships between network entities of the same or different entity types in the network environment to be monitored. This includes: constructing the first network entity relationship graph at the object level based on the direct interaction relationships between network entities of different or the same entity types in the network environment to be monitored; and constructing the second network entity relationship graph at the triple level based on the dependency interaction relationships between network entities of the same or different entity types in the network environment to be monitored. The first network entity relationship graph and the second network entity relationship graph are fused to obtain a fused entity relationship graph; including: based on the information structure of one of the network entity relationship graphs, through mapping alignment, the graph node feature vector representations of each node in the other network entity relationship graph are fused into the graph node feature vector representations of each node in the network entity relationship graph as the basis, to obtain the fused entity relationship graph; Based on the graph node feature vector representation of the nodes in the fused entity relationship graph, the abnormal event type corresponding to the abnormal subgraph in the fused entity relationship graph is identified.

2. The method according to claim 1, characterized in that, The step of obtaining the first network entity relationship graph and the second network entity relationship graph based on multi-source log data of the network environment to be monitored includes: Based on the direct interaction relationships between network entities of different or the same entity type in the network environment to be monitored, construct an object-level network entity relationship graph; The object-level network entity relationship graph is used as the first network entity relationship graph; the first network entity relationship graph uses each network entity as a node and the direct interaction relationship as the edge between the corresponding nodes.

3. The method according to claim 1, characterized in that, The step of obtaining the first network entity relationship graph and the second network entity relationship graph based on multi-source log data of the network environment to be monitored includes: Based on the dependency and interaction relationships between network entities of the same or different entity types in the network environment to be monitored, construct a network entity relationship graph at the triple level; The triple-level network entity relationship graph is used as the second network entity relationship graph; the second network entity relationship graph uses each of the network entities as nodes and the dependency interaction relationship as the edge between the corresponding nodes.

4. The method according to claim 1, characterized in that, The process of fusing the first network entity relationship graph and the second network entity relationship graph to obtain the fused entity relationship graph includes: Obtain the target graph node feature vector representation corresponding to each node in the first network entity relationship graph as the first graph node feature vector representation, and obtain the target graph node feature vector representation corresponding to each node in the second network entity relationship graph as the second graph node feature vector representation; The feature vector representations of each second graph node are fused into the feature vector representations of the first graph node corresponding to the node representing the same network entity, to obtain the fused graph node feature vector representations of each node in the first network entity relationship graph; The first network entity relationship graph, in which each node has a corresponding fused graph node feature vector representation, is used as the fused entity relationship graph; the graph node feature vector representation of each node in the fused entity relationship graph is the corresponding fused graph node feature vector representation.

5. The method according to claim 4, characterized in that, The step of obtaining the target graph node feature vector representation corresponding to each node in the first network entity relationship graph as the first graph node feature vector representation, and obtaining the target graph node feature vector representation corresponding to each node in the second network entity relationship graph as the second graph node feature vector representation, includes: Graph representation learning is performed on the first network entity relationship graph and the second network entity relationship graph respectively to obtain the graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph. The feature representation capabilities of the graph node feature vectors corresponding to each node in the first network entity relationship graph and the second network entity relationship graph are optimized to obtain the target graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph.

6. The method according to claim 5, characterized in that, The optimization of the feature representation capabilities of the graph node feature vectors corresponding to each node in the first network entity relationship graph and the second network entity relationship graph, respectively, to obtain the target graph node feature vector representations corresponding to each node in the first network entity relationship graph and the second network entity relationship graph, includes: For any network entity relationship graph, the graph node feature vector representations corresponding to each node in the network entity relationship graph are input into a pre-trained feature optimization model, and the target graph node feature vector representations corresponding to each node in the network entity relationship graph are output. The target graph node feature vector is obtained by the pre-trained feature optimization model determining the first-order and second-order adjacency information of each node in the network entity relationship graph through the adjacency matrix of the network entity relationship graph, and performing a convolution operation on the graph node feature vector representation corresponding to each node in the network entity relationship graph based on the first-order and second-order adjacency information of each node.

7. The method according to claim 1, characterized in that, The step of identifying the abnormal event type corresponding to the abnormal subgraph in the fused entity relationship graph based on the graph node feature vector representation of the node in the fused entity relationship graph includes: Based on the multi-source log data and the graph node feature vector representations corresponding to each node in the fused entity relationship graph, the abnormal subgraphs in the fused entity relationship graph are detected. Based on the graph node feature vector representations corresponding to each node in the abnormal subgraph, the abnormal event type corresponding to the abnormal subgraph is identified.

8. A network security monitoring device, characterized in that, The device includes: The acquisition module is used to acquire a first network entity relationship graph and a second network entity relationship graph based on multi-source log data of the network environment to be monitored; the first network entity relationship graph is used to represent the direct interaction relationship between network entities of different or the same entity type in the network environment to be monitored; the second network entity relationship graph is used to represent the dependency interaction relationship between network entities of the same or different entity types in the network environment to be monitored. The acquisition module is specifically used to construct an object-level first network entity relationship graph based on the direct interaction relationships between network entities of different or the same entity types in the network environment to be monitored; and to construct a triple-level second network entity relationship graph based on the dependency interaction relationships between network entities of the same or different entity types in the network environment to be monitored. The fusion module is used to fuse the first network entity relationship graph and the second network entity relationship graph to obtain a fused entity relationship graph; The fusion module is specifically used to take the information structure of one network entity relationship graph as the basis, and through mapping and alignment, fuse the graph node feature vector representations of each node in the other network entity relationship graph into the graph node feature vector representations of each node in the base network entity relationship graph to obtain the fused entity relationship graph. The identification module is used to identify the abnormal event type corresponding to the abnormal subgraph in the fused entity relationship graph based on the graph node feature vector representation of the node in the fused entity relationship graph.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images