Host intrusion detection and purification method and device based on link confrontation identification

Abstract

The present invention belongs to the field of artificial intelligence security technology, and discloses a host intrusion detection confrontation purification method and device based on link confrontation identification, including a first heterogeneous traceability graph sample set obtained under normal operation, node feature extraction for each first heterogeneous traceability graph sample, and conversion into a first isomorphic traceability graph sample and subgraph sampling, and training a link prediction model with subgraphs and extracted node features; based on a second heterogeneous traceability graph sample set containing malicious behavior and rare behavior, a link prediction model is used to identify all abnormal links, and a malicious behavior link sample set and a rare behavior link sample set are extracted; the second heterogeneous traceability graph sample set is subjected to confrontation disturbance to generate a confrontation attack link sample set; and an abnormal link classification model is trained based on a malicious behavior link sample set, a rare behavior link sample set, and a confrontation attack link sample set. The present invention has adaptive capabilities and improves the effect of resisting new attacks.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence security technology, and in particular relates to a host intrusion detection and confrontation purification method and device based on link confrontation identification. Background Art

[0002] Intrusion detection based on traceability graph is an active defense technology. It learns the behavior patterns of normal nodes and malicious nodes, identifies key information from a large amount of data, and provides timely services such as issuing alarms or taking measures when suspicious process nodes are found. However, existing graph learning-based intrusion detection algorithms cannot effectively resist adversarial attacks. Adversarial attacks refer to attackers deliberately hiding or fine-tuning their attack behaviors to interfere with the construction of traceability graphs, which ultimately causes the learning algorithm to make incorrect predictions or classifications and fail to correctly identify abnormal behaviors of the network.

[0003] In order to improve the robustness of the model, some studies have proposed the following methods for defense: putting adversarial samples back into the classification model for retraining; reconstructing adversarial samples through trained autoencoders; applying rules to input data for normalization and smoothing to reduce the impact of attack samples, etc. However, in actual application scenarios, intrusion detection models are difficult to retrain after being deployed on the server, and there is a risk of accuracy loss during retraining, which makes adversarial training extremely difficult. In addition, unsupervised learning methods such as autoencoders may make it difficult to track and verify whether the removal of adversarial links always meets the expected security standards when it is difficult to clearly explain the internal learned features and reconstruction process. At present, rule-based adversarial defense methods often only target a single attack method, which makes them unable to adapt to complex attack environments.

[0004] In summary, the current adversarial defense methods have the following shortcomings: (1) They require a high level of authority, which makes it difficult to meet the deployment requirements of commercial intrusion detection systems. (2) They only defend against a single attack method, lack generalization, and cannot effectively enhance the security of the entire intrusion detection system. (3) They are difficult to cope with the challenges of adaptive attacks. Summary of the invention

[0005] The purpose of the present invention is to provide a host intrusion detection and purification method and device based on link confrontation identification, which has adaptive capabilities and improves the effect of resisting new attacks.

[0006] To achieve the above object, the technical solution adopted by the present invention is:

[0007] A first aspect: A host intrusion detection and purification method based on link confrontation identification, the host intrusion detection and purification method based on link confrontation identification comprising:

[0008] Based on the first heterogeneous provenance graph sample set obtained under normal operation, node features are extracted for each first heterogeneous provenance graph sample, and the sample is converted into a first homogeneous provenance graph sample and subgraph sampling is performed, and the link prediction model is obtained by training the subgraph and the extracted node features;

[0009] Based on the second heterogeneous provenance graph sample set containing malicious behaviors and rare behaviors, a link prediction model is used to identify all abnormal links in the second heterogeneous provenance graph sample set, and malicious behavior link sample sets and rare behavior link sample sets are extracted from all abnormal links;

[0010] Performing adversarial perturbation on the second heterogeneous provenance graph sample set, and generating an adversarial attack link sample set according to the adversarial perturbation result;

[0011] Train the abnormal link classification model based on malicious behavior link sample sets, rare behavior link sample sets and adversarial attack link sample sets;

[0012] For the heterogeneous traceability graph to be purified, the link prediction model and the abnormal link classification model are used to identify the adversarial attack links, and the adversarial attack links are removed to obtain the purified heterogeneous traceability graph.

[0013] Several optional methods are also provided below, but they are not intended to be additional limitations on the above-mentioned overall solution, but are merely further supplements or preferences. Under the premise that there are no technical or logical contradictions, each optional method can be combined with the above-mentioned overall solution separately, and multiple optional methods can also be combined.

[0014] As a preference, the type of node feature is Class, then the node feature is a Dimensional vector , For the The characteristic values ​​of the types, .

[0015] Preferably, the subgraph sampling is performed for each node in the first isomorphic traceability graph sample. , sample its second-order neighbor subgraph to obtain a subgraph set, where the second-order neighbor subgraph is sampled, including:

[0016] First-order neighbor collection: Get nodes A collection of directly connected nodes , , is the total number of nodes in the first isomorphic traceability graph sample;

[0017] Second-order neighbor collection: For each node , get the node A collection of directly connected nodes , , For a node collection Length;

[0018] Subgraph construction: node collection With node collection The nodes in the first heterogeneous traceability graph are connected according to the structure of the sample, and the nodes are obtained. The corresponding subgraph, each node in the subgraph is represented as the corresponding node feature.

[0019] Preferably, the link prediction model is obtained by training the subgraph and the extracted node features, comprising:

[0020] The adjacency matrix of the subgraph and the node features corresponding to the nodes in the subgraph are taken as the input of the graph convolutional neural network. The cross entropy loss function is calculated based on the output of the graph convolutional neural network as follows:

[0021] ;

[0022] In the formula, is the cross entropy loss function, For the The node set of the subgraph, For a node collection The nodes in For Node and nodes The true label of the link between nodes and nodes If there is a link between ;otherwise , For Node and nodes List of confidence scores of link predictions , where the first element is the confidence level of the predicted link not existing, and the second element is the confidence level of the predicted link existing;

[0023] The graph convolutional neural network is optimized and updated according to the value of the cross entropy loss function until the training is completed and the link prediction model is output.

[0024] Preferably, the adopting of the link prediction model to identify all abnormal links in the second heterogeneous provenance graph sample set includes:

[0025] (1) Take the second heterogeneous traceability graph sample in the second heterogeneous traceability graph sample set and convert it into the second homogeneous traceability graph sample , delete the second isomorphic traceability graph sample All the links in the graph are obtained as a graph with only nodes. , is the second isomorphic traceability graph sample The node set in is an empty set;

[0026] (2) In each time step, a link is randomly selected ,in and , the link Add to collection In the diagram, The corresponding adjacency matrix With Figure The node features of the nodes in the link prediction model are input into the link prediction model. Predict each link in and obtain the confidence of the predicted link corresponding to each link;

[0027] (3) Repeat step (2) until , for the set The confidence of the predicted link existence obtained for each link in all time steps is averaged to obtain the final score of each link;

[0028] (4) All links whose final scores are less than the abnormal threshold are regarded as abnormal links and saved in the abnormal link set.

[0029] Preferably, the step of generating a counter-attack link sample set according to the counter-perturbation result includes:

[0030] The adversarial perturbation result is the second heterogeneous traceability graph sample set after the adversarial perturbation. , compared with the original second heterogeneous traceability graph sample set And the second heterogeneous traceability graph sample set after adversarial perturbation , we get the second heterogeneous traceability graph sample set after adversarial perturbation and does not exist in the original second heterogeneous traceability graph sample set The links in are taken as anti-attack links and saved in the anti-attack link sample set.

[0031] Preferably, the training of the abnormal link classification model based on the malicious behavior link sample set, the rare behavior link sample set and the adversarial attack link sample set includes:

[0032] The malicious behavior link sample set, the rare behavior link sample set and the adversarial attack link sample set are concatenated to obtain a classification training sample set;

[0033] Based on the second heterogeneous traceability graph sample set, the starting node and the target node of each link in the classification training sample set are obtained, and the node features of the starting node and the target node are concatenated to obtain the merged features;

[0034] The convolutional neural network is trained using the merged features to obtain the abnormal link classification model.

[0035] The second aspect: A host intrusion detection and countermeasure purification device based on link countermeasure identification, comprising a processor and a memory storing a plurality of computer instructions, wherein the computer instructions, when executed by the processor, implement the steps of a host intrusion detection and countermeasure purification method based on link countermeasure identification.

[0036] The present invention provides a host intrusion detection and confrontation purification method and device based on link confrontation identification. First, the complex heterogeneous traceability graph is converted into a homogeneous traceability graph through node feature extraction, and then combined with subgraph sampling, the complexity of data processing is greatly simplified; using the abnormal link detection model, not only can potential abnormal patterns be quickly identified, but also by classifying abnormal links into three categories: malicious, rare and confrontational, the system has adaptive capabilities and improves the effect of resisting new attacks. Finally, the traceability graph is purified by removing the identified confrontation links, which significantly enhances the defense capability of the intrusion detection system. In addition, the method of the present invention is deployed as an independent component, without the need for invasive changes to the existing system, easy to integrate, and reduces implementation costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 It is a flow chart of a host intrusion detection and purification method based on link confrontation identification in the training phase of the present invention;

[0038] Figure 2 The present invention is a flow chart of a host intrusion detection and countermeasure purification method based on link countermeasure identification in the testing or application stage. DETAILED DESCRIPTION

[0039] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0040] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0041] like Figure 1 As shown, the present embodiment provides a host intrusion detection and purification method based on link confrontation identification, which includes the following steps in the training phase:

[0042] Step 1: Based on the first heterogeneous provenance graph sample set obtained under normal operation, node features are extracted for each first heterogeneous provenance graph sample, and the sample is converted into a first homogeneous provenance graph sample and subgraph sampling is performed. The link prediction model is trained with the subgraph and the extracted node features.

[0043] Step 1.1: Heterogeneous traceability graph construction: Collect kernel log data when the system is running normally and construct a heterogeneous traceability graph, which is recorded as the first heterogeneous traceability graph sample. .in, It is a set of nodes, each node represents a system entity. The types of system entities include process, socket, file, and registry. is a set of links, each link represents a system event, and the types of system events are shown in Table 1.

[0044] Table 1 System event types

[0045] Origin Node Type Target node type System event name process document Create file, close file, read file, delete file, rename file, write file document process Loading a process from a file process Sockets Send, receive, initiate connection, accept connection, disconnect, reconnect, retransmit process Registry Open the registry, query the registry, delete the registry, modify the registry, create a new registry, read the registry process process Start a process, end a process

[0046] Step 1.2: Node feature extraction: for the first heterogeneous traceability graph sample Each node in Extract node features and let the types of node features be Class, then the node feature is a Dimensional vector , For the The characteristic values ​​of the types, .

[0047] This implementation Take this as an example, as shown in Table 2, the node The node feature is a 7-dimensional vector , The value of is the value of the corresponding sequence number Fk.

[0048] Table 2 Node feature description

[0049] Serial number Feature Name F1 The number of different categories of first-order neighbor nodes F2 The average number of occurrences of different categories of first-order neighbor nodes F3 The number of times the most common first-order neighbor node category appears F4 The number of occurrences of the second most frequent first-order neighbor node category F5 The standard deviation of the number of node categories in a section of neighbor nodes F6 Total amount of data written (bytes) F7 Total amount of data read (bytes)

[0050] Among them, the number of different categories of first-order neighbor nodes corresponding to F1 refers to the node category. For example, if the first-order neighbor nodes only have two types of nodes, process and socket, then the eigenvalue is 2; if there are three types of nodes, process, socket, and file, then the eigenvalue is 3. The average number of occurrences of different categories of first-order neighbor nodes corresponding to F2 is understood as the ratio of the total number of occurrences of all categories to the number of categories. For example, if the first-order neighbor nodes have 45 processes, 4 sockets, and 49 registries, then the eigenvalue is (45+4+49) / 3=33.

[0051] Step 1.3: Transform heterogeneous graphs into homogeneous graphs: The main purpose of this step is to simplify and unify data representation so as to facilitate the application of link prediction algorithms on traditional homogeneous graphs. All types of nodes in are unified into universal "entity" type nodes, and all different types of links are unified into "relationship" type edges, and finally transformed into an isomorphic graph, which is recorded as the first isomorphic traceability graph sample. This figure can be used A two-dimensional adjacency matrix of size express, is the total number of nodes. Each element in It means the Node to The connection relationship between the two nodes is "Relation" edges, then The value of .

[0052] Step 1.4, subgraph sampling: for the first isomorphic tracing graph sample Each process node in , sample its second-order neighbor subgraph , and finally get the subgraph set The specific ideas are as follows:

[0053] Step 1.4.1, first-order neighbor collection: Get the nodes A collection of directly connected nodes , , is the total number of nodes in the first isomorphic traceability graph sample.

[0054] Step 1.4.2, second-order neighbor collection: for each node , get the node A collection of directly connected nodes , , For a node collection Length.

[0055] Step 1.4.3, subgraph construction: node set With node collection The nodes in the first heterogeneous traceability graph are connected according to the structure of the sample, and the nodes are obtained. The corresponding subgraph, each node in the subgraph is represented by the corresponding node feature, and the subgraph is an isomorphic graph. The subgraph set is obtained by combining the subgraphs corresponding to all nodes .

[0056] Step 1.5: Link prediction model training: Use the graph convolutional neural network (GCN) as the link prediction model and obtain the subgraph set according to step 1.4. , for each subgraph ,by Represents the adjacency matrix With node features As the input of the graph convolutional neural network, For subgraph The node set in For subgraph The cross entropy loss function is calculated based on the output of the graph convolutional neural network as follows:

[0057] ;

[0058] ;

[0059] In the formula, is the cross entropy loss function, For the The node set of the subgraph, For a node collection The nodes in For Node and nodes The true label of the link between nodes and nodes If there is a link between ;otherwise , For Node and nodes List of confidence scores of link predictions , where the first element is the confidence level of the predicted link not existing, and the second element is the confidence level of the predicted link existing. ,but , that is, take The 0th element of ,but , that is, take The first element of .

[0060] The graph convolutional neural network is optimized and updated according to the value of the cross entropy loss function until the training is completed, and the link prediction model is output. Since the link prediction model is trained on heterogeneous traceability graph samples under normal system operation, the predictions given by the link prediction model meet the expectations of normal system behavior. When the predictions given by the link prediction model are inconsistent with the actual system behavior, the link is considered abnormal and may be a potential adversarial attack behavior.

[0061] Step 2: Classification of abnormal links based on small sample learning: The abnormal links obtained by the link prediction model in step 1 may be caused by various reasons (such as malicious behavior, rare behavior, adversarial attacks), and are not necessarily caused by adversarial attacks. Therefore, it is necessary to further classify the abnormal links to determine the abnormal links caused by adversarial attacks.

[0062] Step 2.1, abnormal link sample acquisition and annotation: Different methods are used to obtain malicious behavior links, rare behavior links and adversarial attack links respectively. The specific methods are as follows:

[0063] Step 2.1.1: Acquire and annotate malicious behavior link and rare behavior link samples. Based on the second heterogeneous traceability graph sample set containing malicious behavior and rare behavior , using the link prediction model to identify the second heterogeneous traceability graph sample set All abnormal links in the.

[0064] Step 2.1.1.1: Take the second heterogeneous traceability graph sample in the second heterogeneous traceability graph sample set and convert it into the second homogeneous traceability graph sample , delete the second isomorphic traceability graph sample All the links in the graph are obtained as a graph with only nodes. , is the second isomorphic traceability graph sample The node set in is an empty set.

[0065] Step 2.1.1.2: At each time step, randomly select a link ,in and , the link Add to collection In the diagram, The corresponding adjacency matrix With Figure The node features of the nodes in the link prediction model are input into the link prediction model. Predict each link in and obtain the confidence of the predicted link corresponding to each link.

[0066] Step 2.1.1.3, repeat step 2.1.1.2 until , for the set The confidence of the predicted link existence obtained for each link in all time steps is averaged to obtain the final score of each link.

[0067] Step 2.1.1.4: All links whose final scores are less than the abnormal threshold (for example, the threshold is set to 0.5) are regarded as abnormal links and saved in the abnormal link set.

[0068] Based on the acquired abnormal link set, an existing host intrusion detection system (such as the open source host-based intrusion detection system OSSEC, etc.) is used to re-detect the abnormal links to obtain the link set that is judged to be malicious. , and the set of links judged to be benign . Then the malicious link set As a sample set of malicious behavior links, a malicious behavior label is added to each link, and the benign link set As a sample set of rare behavior links, a rare behavior label is added to each link in it.

[0069] Step 2.1.2, acquisition and annotation of adversarial attack link samples: perform adversarial perturbation on the second heterogeneous provenance graph sample set, and generate an adversarial attack link sample set based on the adversarial perturbation results. Specifically, the existing graph adversarial attack algorithm (such as Network Attack on Node Classification, Nettack algorithm) is used to collect the second heterogeneous provenance graph sample set. Perform adversarial perturbations and compare the sample sets of traceability graphs after adversarial perturbations Sample set of original traceability diagrams The link difference is obtained. In the absence of The link set in is recorded as the link set that fights the disturbance , then the collection As the adversarial attack link sample set, and add an adversarial attack label to each link in it.

[0070] Step 2.2, training of abnormal link classification model based on small sample learning: training the abnormal link classification model based on malicious behavior link sample set, rare behavior link sample set and adversarial attack link sample set. , and Splice to get the classification training sample set , get Each link The starting node and the target node , concatenate the corresponding node features of the two to obtain a 14-dimensional vector as the link The merged feature vector of . Using a prototype network (such as a convolutional neural network) in We train on it and obtain an abnormal link classification model.

[0071] like Figure 2As shown, this embodiment provides a host intrusion detection and purification method based on link adversarial identification. In the testing or application stage, for the heterogeneous traceability graph to be purified, the link prediction model and the abnormal link classification model are used to identify the adversarial attack link, and the adversarial attack link is removed to obtain the purified heterogeneous traceability graph. Specifically, the following steps are included:

[0072] (1) Obtain the heterogeneous provenance graph to be purified according to step 1.1 of the training phase, and extract node features according to steps 1.2 and 1.3 of the training phase and simultaneously convert them into a homogeneous provenance graph.

[0073] (2) Input the node features and isomorphic traceability graph obtained in step (1) into the link prediction model, and obtain the abnormal link set according to step 2.1.1 of the training phase.

[0074] (3) Input the abnormal link set obtained in step (2) into the abnormal link classification model to identify the adversarial attack links in the abnormal link set.

[0075] (4) Remove all adversarial attack links in the heterogeneous traceability graph to be purified to obtain the purified heterogeneous traceability graph.

[0076] The method of the present invention can identify and remove potential adversarial links, significantly improving the defense capabilities of downstream tasks such as host intrusion detection against various adversarial attacks, and can be used as a separate component without the need for invasive development of the host intrusion detection system.

[0077] In another embodiment, the present invention also provides a host intrusion detection and countermeasure purification device based on link countermeasure identification, comprising a processor and a memory storing a plurality of computer instructions, wherein the computer instructions, when executed by the processor, implement the steps of the host intrusion detection and countermeasure purification method based on link countermeasure identification.

[0078] For the specific definition of the host intrusion detection and purification device based on link confrontation identification, please refer to the definition of the host intrusion detection and purification method based on link confrontation identification above, which will not be repeated here.

[0079] The memory and the processor are electrically connected directly or indirectly to achieve data transmission or interaction. For example, these elements can be electrically connected to each other through one or more communication buses or signal lines. The memory stores a computer program that can be run on the processor, and the processor implements the method of the present invention by running the computer program stored in the memory.

[0080] The memory may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), etc. The memory is used to store a program, and the processor executes the program after receiving an execution instruction.

[0081] The processor may be an integrated circuit chip with data processing capabilities. The above-mentioned processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc. The methods, steps and logic block diagrams disclosed in the embodiments of the present invention may be implemented or executed. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0082] In the present invention, the terms "first", "second", etc. are used for descriptive purposes only and cannot be understood as indicating or implying relative importance or implicitly indicating the number or order of the indicated technical features.

[0083] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0084] The above-mentioned embodiments only express several implementation modes of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the invention. It should be pointed out that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the attached claims.

Claims

1. A host intrusion detection and purification method based on link confrontation identification, characterized in that: The host intrusion detection and confrontation purification method based on link confrontation identification includes: Based on the first heterogeneous provenance graph sample set obtained under normal operation, node features are extracted for each first heterogeneous provenance graph sample, and the sample is converted into a first homogeneous provenance graph sample and subgraph sampling is performed, and the link prediction model is obtained by training the subgraph and the extracted node features; Based on the second heterogeneous provenance graph sample set containing malicious behaviors and rare behaviors, a link prediction model is used to identify all abnormal links in the second heterogeneous provenance graph sample set, and malicious behavior link sample sets and rare behavior link sample sets are extracted from all abnormal links; Performing adversarial perturbation on the second heterogeneous provenance graph sample set, and generating an adversarial attack link sample set according to the adversarial perturbation result; Train the abnormal link classification model based on malicious behavior link sample sets, rare behavior link sample sets and adversarial attack link sample sets; For the heterogeneous traceability graph to be purified, the link prediction model and the abnormal link classification model are used to identify the adversarial attack links, and the adversarial attack links are removed to obtain the purified heterogeneous traceability graph.

2. The host intrusion detection and purification method based on link confrontation identification according to claim 1 is characterized in that: The type of node feature is Class, then the node feature is a Dimensional vector , For the The characteristic values ​​of the types, .

3. The host intrusion detection and purification method based on link confrontation identification according to claim 1 is characterized in that: The subgraph sampling is for each node in the first isomorphic traceability graph sample , sample its second-order neighbor subgraph to obtain a subgraph set, where the second-order neighbor subgraph is sampled, including: First-order neighbor collection: Get nodes A collection of directly connected nodes , , is the total number of nodes in the first isomorphic traceability graph sample; Second-order neighbor collection: For each node , get the node A collection of directly connected nodes , , For a node collection Length; Subgraph construction: node collection With node collection The nodes in the first heterogeneous traceability graph are connected according to the structure of the sample, and the nodes are obtained. The corresponding subgraph, each node in the subgraph is represented as the corresponding node feature.

4. The host intrusion detection and purification method based on link confrontation identification according to claim 1 is characterized in that: The link prediction model is obtained by training the subgraph and the extracted node features, including: The adjacency matrix of the subgraph and the node features corresponding to the nodes in the subgraph are taken as the input of the graph convolutional neural network. The cross entropy loss function is calculated based on the output of the graph convolutional neural network as follows: ； In the formula, is the cross entropy loss function, For the The node set of the subgraph, For a node collection The nodes in For Node and nodes The true label of the link between nodes and nodes If there is a link between ;otherwise , For Node and nodes List of confidence scores of link predictions , where the first element is the confidence level of the predicted link not existing, and the second element is the confidence level of the predicted link existing; The graph convolutional neural network is optimized and updated according to the value of the cross entropy loss function until the training is completed and the link prediction model is output.

5. The host intrusion detection and purification method based on link confrontation identification according to claim 1 is characterized in that: The link prediction model is used to identify all abnormal links in the second heterogeneous traceability graph sample set, including: (1) Take the second heterogeneous traceability graph sample in the second heterogeneous traceability graph sample set and convert it into the second homogeneous traceability graph sample , delete the second isomorphic traceability graph sample All the links in the graph are obtained as a graph with only nodes. , is the second isomorphic traceability graph sample The node set in is an empty set; (2) In each time step, a link is randomly selected ,in and , the link Add to collection In the diagram, The corresponding adjacency matrix With Figure The node features of the nodes in the link prediction model are input into the link prediction model. Predict each link in and obtain the confidence of the predicted link corresponding to each link; (3) Repeat step (2) until , for the set The confidence of the predicted existence of each link in all time steps is averaged to obtain the final score of each link; (4) All links whose final scores are less than the abnormal threshold are regarded as abnormal links and saved in the abnormal link set.

6. The host intrusion detection and purification method based on link confrontation identification according to claim 1 is characterized in that: The generating of the adversarial attack link sample set according to the adversarial disturbance result includes: The adversarial perturbation result is the second heterogeneous traceability graph sample set after the adversarial perturbation. , compared with the original second heterogeneous traceability graph sample set And the second heterogeneous traceability graph sample set after adversarial perturbation , we get the second heterogeneous traceability graph sample set after adversarial perturbation and does not exist in the original second heterogeneous traceability graph sample set The links in are taken as anti-attack links and saved in the anti-attack link sample set.

7. The host intrusion detection and purification method based on link confrontation identification according to claim 1 is characterized in that: The training of the abnormal link classification model based on the malicious behavior link sample set, the rare behavior link sample set and the adversarial attack link sample set includes: The malicious behavior link sample set, the rare behavior link sample set and the adversarial attack link sample set are concatenated to obtain a classification training sample set; Based on the second heterogeneous traceability graph sample set, the start node and the target node of each link in the classification training sample set are obtained, and the node features of the start node and the target node are concatenated to obtain the merged features; The convolutional neural network is trained using the merged features to obtain the abnormal link classification model.

8. A host intrusion detection and purification device based on link confrontation identification, comprising a processor and a memory storing a plurality of computer instructions, characterized in that: When the computer instructions are executed by the processor, the steps of the host intrusion detection and countermeasure purification method based on link countermeasure identification described in any one of claims 1 to 7 are implemented.

Images