Anomaly detection method and system based on dynamic traceability graph

Abstract

The present invention discloses an anomaly detection method and system based on dynamic traceability graph, which belongs to the field of network anomaly detection, including: constructing a traceability graph, splicing the node features of each node and the features of the edge connected to the node as the state feature vector of the corresponding node; continuously monitoring the system traceability information and dynamically updating the traceability graph; when a new edge is generated, t When executing: t 、around e t The graph structure of t ‑ The state vector s at time t ‑ and e t The generation time t is input into the graph attention network, and e is obtained t The embedding vector z of e t Update the source and destination nodes; input z into the decoder and predict e t Type, get the prediction vector P(e t ); The decoder includes a long short-term memory network and multiple fully connected layers connected in sequence; calculate P(e t ) and e t The reconstruction error RE between the actual edge type vectors is calculated. If RE>Th, it is determined that an anomaly exists. Otherwise, it is determined that no anomaly exists. The present invention can improve the detection accuracy and real-time performance of anomaly detection.

Description

Technical Field

[0001] The present invention belongs to the field of network anomaly detection, and more specifically, relates to an anomaly detection method and system based on a dynamic traceability graph. Background Art

[0002] The cybersecurity threat landscape has evolved significantly in recent years, with advanced persistent threats (APTs) becoming increasingly sophisticated and difficult to detect. APTs are stealthy, persistent, and adaptive cyberattacks designed to gain unauthorized access to a network and remain undetected for extended periods of time. These attacks often target high-value information and are orchestrated by well-resourced adversaries. However, traditional rule-based detection systems (IDS) and signature-based approaches struggle to keep pace with the dynamics and sophistication of APTs.

[0003] Anomaly detection based on provenance has become a promising method to combat APT. This method often first collects provenance information in the system and converts the provenance information into a corresponding provenance graph, and then performs anomaly detection through further analysis of the provenance graph.

[0004] Existing traceability-based anomaly detection methods focus more on detecting existing traceability information and are unable to achieve dynamic and continuous detection. In addition, with the continuous development of neural networks, existing traceability-based anomaly detection methods mostly rely on neural network structures such as convolutional neural networks and autoencoders to implement relevant analysis, while ignoring the semantic information within the traceability information. There is room for further improvement in semantic understanding, detection accuracy, real-time performance, etc. Summary of the Invention

[0005] In response to the defects and improvement needs of the existing technology, the present invention provides an anomaly detection method and system based on a dynamic traceability graph, the purpose of which is to improve the detection accuracy and real-time performance of anomaly detection.

[0006] To achieve the above objectives, according to one aspect of the present invention, a method for detecting anomalies based on a dynamic traceability graph is provided, comprising:

[0007] After collecting system traceability information, it is converted into a traceability graph. For each node in the traceability graph, the node features and the features of the edges connected to the node are extracted and spliced ​​as the state feature vector of the corresponding node;

[0008] Continuously monitor the system traceability information and dynamically update the traceability graph; when a new edge e is generated in the traceability graph t When , an anomaly detection step is performed; the anomaly detection step includes:

[0009] Step S1: Edge e t , around edge e t The graph structure of t- The state vector s at time t- and edge e t The generation time t is input into the graph attention network, and the edge e is obtained t The embedding vector z of edge e t The source node v src and destination node v dst Update the state feature vector;

[0010] t - The time represents the edge e t The moment before the generation moment, s t- By the side t The source node and its neighbor nodes, the destination node and its neighbor nodes are in t - The state feature vector at each moment is aggregated through the graph convolution layer;

[0011] Step S2: Edge e t The embedding vector z is input to the decoder, and the edge e is predicted t The probability of belonging to each type is obtained by predicting the vector P(e t );

[0012] The decoder consists of a long short-term memory network and multiple fully connected layers connected in sequence;

[0013] Step S3: Calculate the prediction vector P(e t ) and edge e t The reconstruction error RE between the actual edge type vectors is Th. If RE>Th, it is determined that there is an anomaly, otherwise, it is determined that there is no anomaly;

[0014] Wherein, Th is the preset abnormal threshold.

[0015] Furthermore, the traceability graph is stored in a distributed hypertable of the time series database.

[0016] Furthermore, in step S1, for edge e t The source node v src and destination node v dst The state feature vector is updated, including:

[0017] The edge e t , around edge e t The source node v src The graph structure of t - The state vector s at time t- (v src ) Input gated neural network, edge e t The source node v src Update the state feature vector;

[0018] The edge et , around edge e t The destination node v dst The graph structure of t - The state vector s at time t- (v dst ) Input gated neural network, edge e t The destination node v dst The state feature vector is updated.

[0019] Furthermore, for a node v in the traceability graph, the node feature Φ(v) is extracted by:

[0020] Divide the attributes of node v into multiple substrings;

[0021] For each substring, use the first hash function h to map each character in the substring to the corresponding dimension of the substring feature, and use the second hash function H to hash each character to {±1} as the feature value of the corresponding dimension in the substring feature;

[0022] Add the substring features of each substring and use them as the node feature Φ(v) of node v.

[0023] Furthermore, for a node v in the traceability graph, the feature Ψ(v) of the edge connected to it is extracted in the following ways:

[0024] Get the edge type vector of each incoming edge of node v respectively, and map each incoming edge to 0~N according to the edge type vector e Integer between -1;

[0025] Get the edge type vector of each outgoing edge of node v respectively, and map each outgoing edge to N according to the edge type vector e ~2N e Integer between -1;

[0026] Concatenate the integers obtained by mapping the incoming and outgoing edges of node v in order to obtain the feature Ψ(v) of the edge connected to node v;

[0027] Among them, N e Indicates the total number of edge types.

[0028] According to another aspect of the present invention, a computer program product is provided, including a computer program. When the computer program is executed by a processor, it implements the above-mentioned anomaly detection method based on dynamic traceability graph provided by the present invention.

[0029] According to another aspect of the present invention, an electronic device is provided, comprising a stored computer program; when the computer program is executed by a processor, the device containing the computer-readable storage medium is controlled to execute the above-mentioned anomaly detection method based on the dynamic traceability graph provided by the present invention.

[0030] According to another aspect of the present invention, there is provided an anomaly detection system based on a dynamic traceability graph, comprising:

[0031] a computer-readable storage medium for storing a computer program;

[0032] and a processor for reading a computer program stored in a computer-readable storage medium and executing the above-mentioned anomaly detection method based on a dynamic traceability graph provided by the present invention.

[0033] In general, the above technical solutions conceived by the present invention can achieve the following beneficial effects:

[0034] (1) After establishing the initial traceability graph and generating the initial state feature vector of each node in the traceability graph, the present invention continuously monitors the system traceability information and dynamically updates the traceability graph, and realizes anomaly detection by detecting the newly generated edges in the traceability graph. Since the relevant detection only involves the newly generated edges and the graph structure around the edges in the traceability graph, the amount of calculation is greatly reduced, and the real-time performance of the detection is effectively improved. When generating the initial state feature vector of the node, the node characteristics of the node itself and the characteristics of the edges connected to it are integrated, so that the semantic information of the initial state feature vector of the node is richer, which is conducive to improving the subsequent detection accuracy. Moreover, each time a new edge is generated, the state feature vectors of the source node and the destination node of the new edge are updated, so that the state characteristics of the node are updated. The eigenvector can accurately reflect the evolution history of the node in the entire graph; when analyzing new edges, the graph attention network is used to generate the embedding vector of the new edge, which can dynamically adjust the attention weight of each node to its neighbors, thereby adaptively capturing the important relationships between different nodes in complex graph structures, and has stronger expressiveness in processing scenarios with multiple node / edge types; further using the long short-term memory network and the connection layer to predict the type of the new edge based on the embedding vector of the new edge, the model's ability to model time dependence is improved, especially in the graph structure of continuous timestamps, which can capture the temporal evolution information of the edge. Combined with the subsequent fully connected layer, the model can better integrate time and structure information for accurate prediction of edge types, thereby effectively improving anomaly accuracy.

[0035] (2) In the preferred embodiment of the present invention, a time series database is used to store the traceability graph. Based on the storage principle of the time series database, the nodes and edges in the traceability graph will be stored in a distributed hypertable provided by the time series database, thereby dispersing a large amount of traceability graph data in different blocks (physical tables), reducing the burden of a single table and helping to improve the query efficiency in the subsequent detection process.

[0036] (3) In the preferred embodiment of the present invention, a gated neural network is used to update the state feature vectors of the source node and the destination node of the new edge, and the state vectors of the new edge and the graph structure surrounding the node at the previous moment are considered simultaneously during the update, thereby accurately recording the historical changes of the node in the traceability graph.

[0037] (4) In the preferred embodiment of the present invention, when extracting node features of a node, its attributes are divided into multiple substrings, and each substring is mapped to a low dimension using a hash function and then added together as the node feature vector of the node. Thus, while mapping high-dimensional attributes to a low-dimensional space, hierarchical similarity is maintained, so that different types of entities under similar directories can also have reasonable feature representations.

[0038] (5) In the preferred embodiment of the present invention, the features of the edges connecting the nodes are extracted by mapping the input and output edges of the nodes to integers according to the edge types. This allows full consideration of the types of edges connected to the nodes, so that the node state feature vector obtained by the fusion of the node features and the edge features has richer semantic information. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 A schematic diagram of a method for constructing a traceability graph according to an embodiment of the present invention;

[0040] Figure 2 A schematic diagram of an anomaly detection method based on a dynamic traceability graph provided by an embodiment of the present invention;

[0041] Figure 3 Schematic diagram of the data structure of nodes and edges in a time series database provided by an embodiment of the present invention; (a) is a structure for storing node information, and (b) is a structure for storing edge (event) information;

[0042] Figure 4 This is a schematic diagram of the distributed hypertable provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0043] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely for the purpose of explaining the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below may be combined with each other as long as they do not conflict with each other.

[0044] In the present invention, the terms "first", "second", etc. (if any) in the present invention and the drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0045] Before explaining the technical solution of the present invention in detail, a brief explanation of the traceability diagram is given as follows:

[0046] The traceability information consists of system calls that reflect user behavior. The objects involved in each system call, such as applications, files, processes, sockets, etc., constitute the nodes of the traceability system, and the ID of each node is globally unique; the content recorded in the traceability information includes node ID, node attributes, and other nodes on which the node depends, which can be collected using the traceability tracking system; the traceability graph established based on the traceability information can be used to represent user behavior. The traceability graph is constructed in the following way: the nodes in the traceability system are used as nodes in the traceability graph, and the attributes of the nodes in the traceability system are used as attributes of the nodes in the traceability graph. If there is a dependency relationship between two nodes in the traceability system, then in the traceability graph, there is a directed edge between the corresponding two nodes, and the directed edge points to the dependent node.

[0047] The amount of traceability information is very large. To ensure the efficiency of behavior detection, this embodiment extracts useful information from the massive traceability information before constructing the traceability graph, including nodes, node attributes, and dependencies between nodes.

[0048] Figure 1 The figure shows an example of building a traceability graph based on traceability information. The left side shows the traceability information, and the right side shows the corresponding traceability graph.

[0049] In the provenance information, "2.0", "3.0", "2.1", etc. represent node IDs. Provenance information can describe node attributes. For example, "2.0NAME / usr / local / sbin / vsftpd" indicates that 2.0 has a NAME attribute, and the attribute value of the NAME attribute is " / usr / local / sbin / vsftpd". Provenance information can also describe the dependency relationship between nodes. For example, "2.0FORKPARENT[ANC]3.0" indicates that node 2.0 depends on node 3.0.

[0050] In the constructed traceability graph, the nodes in the traceability system, i.e., node 2.0, node 3.0, node 2.1, etc., correspond to the nodes in the traceability graph; the attributes of the nodes in the traceability system correspond to the attributes of the nodes in the traceability graph, and in this embodiment, the traceability graph only stores the number of attributes of each node, rather than the specific attribute values; in the traceability system, the dependency relationship between nodes corresponds to the directed edges in the traceability graph. For example, in the traceability system, node 2.0 depends on node 3.0, then in the traceability graph, there is a directed edge from node 2.0 to node 3.0.

[0051] The edges in the provenance graph also reflect specific events. For normal events, such as read operations and write operations, the corresponding edge types in the provenance graph are known. For unknown and potentially abnormal events, such as attack behaviors, their types in the provenance graph need to be determined through further predictive analysis. Based on this, in order to solve the technical problems that the existing provenance-based anomaly detection methods need to be further improved in terms of semantic understanding, detection accuracy, and real-time performance, the present invention provides an anomaly detection method and system based on a dynamic provenance graph. The overall idea is to convert the provenance-based anomaly detection into anomaly detection based on newly generated edges in the provenance graph, and further convert it into predicting the type of the new edge, and calculate the reconstruction error between the new edge type and the normal edge type, and finally realize anomaly detection based on the reconstruction error. Based on this idea, in order to improve the prediction accuracy of the new edge type, the present invention proposes a new method to generate the initial state feature vector of each node in the provenance graph, so that it has richer semantic information, and proposes a new encoder-decoder structure for predicting the new edge type.

[0052] The following are examples.

[0053] Example 1:

[0054] An anomaly detection method based on dynamic traceability graph, such as Figure 2 Shown, including:

[0055] After collecting system traceability information, it is converted into a traceability graph. For each node in the traceability graph, the node features and the features of the edges connected to the node are extracted and spliced ​​as the state feature vector of the corresponding node;

[0056] Continuously monitor the system traceability information and dynamically update the traceability graph; when a new edge e is generated in the traceability graph t When , an anomaly detection step is performed; the anomaly detection step includes:

[0057] Step S1: Edge e t , around edge e t The graph structure of t - The state vector s at time t- and edge e t The generation time t is input into the graph attention network, and the edge e is obtained t The embedding vector z of edge e t The source node v src and destination node v dst Update the state feature vector;

[0058] t - The time represents the edge e t At the moment before the generation moment, the graph structure is at t -The state vector at time t is composed of all nodes in the graph structure at t - The state feature vectors of these nodes together describe the global state of the graph at that moment; specifically, in this embodiment, s t- By the side t The source node and its neighbor nodes, the destination node and its neighbor nodes are in t - The state feature vector at each moment is aggregated through the graph convolution layer;

[0059] Step S2: Edge e t The embedding vector z is input to the decoder, and the edge e is predicted t The probability of belonging to each type is obtained by predicting the vector P(e t );

[0060] The decoder consists of a long short-term memory network and multiple fully connected layers connected in sequence;

[0061] Step S3: Calculate the prediction vector P(e t ) and edge e t The reconstruction error RE between the actual edge type vectors is Th. If RE>Th, it is determined that there is an anomaly, otherwise, it is determined that there is no anomaly;

[0062] Wherein, Th is the preset abnormal threshold.

[0063] This embodiment first establishes an initial traceability graph and generates the initial state feature vector of each node in the traceability graph. It then continuously monitors the system traceability information and dynamically updates the traceability graph. Anomaly detection is achieved by detecting newly generated edges in the traceability graph, and real-time performance is effectively improved.

[0064] After constructing the traceability graph in this embodiment, the traceability graph will be stored in the distributed super table of the time series database TimescaleDB. Specifically, for nodes such as network nodes, main nodes, and file nodes, the traceability graph will be stored in the distributed super table of the time series database TimescaleDB. Figure 3 The structure nodeid shown in (a) in the figure stores the corresponding node information, where node_type indicates the type of node (such as netflow, subject, file), msg stores the node information (such as socket, file path, etc.), and index_id is the unique index of all nodes. For event information, use Figure 3The structure shown in (b) in the figure stores the corresponding edge information, where src_node is the hash ID of the source node, corresponding to the hash_id of the node in nodeid, and src_index_id is the index_id of the node in nodeid. Similarly, dst_node is the hash_id of the destination node, and dst_node_index is the index_id of the destination node; operation is the type of operation between nodes, that is, the type of edge (event); and timestamp_rec is the timestamp of the edge.

[0065] When storing time series data, the distributed hypertable of the time series database TimescaleDB disperses a large amount of data into different blocks (physical tables), reducing the burden of a single table. Figure 4 As shown, each block only contains data within a specific time range. When inserting a time range that does not exist, a new block is automatically created. Figure 4 In the example, "value" represents data within a specific time range. In this embodiment, it represents various information related to traceability data, including node information and event information between nodes. This information is stored in the distributed hypertable of TimescaleDB and organized in the form of time series. This embodiment is based on the distributed hypertable of the time series database timescaledb to store node information and event information. During the query process, the distributed hypertable can determine the physical tables to be retrieved based on the query conditions and only query these tables. Since the amount of data contained in each physical table is smaller than that of a single whole table, the query efficiency will be higher. The longer the time span of the data and the larger the amount of data, the more obvious this advantage is.

[0066] When generating the initial feature vector of a node, this embodiment integrates the node features of the node itself and the features of the edges connected to it, so that the semantic information of the initial state feature vector of the node is richer, which is conducive to improving the subsequent detection accuracy.

[0067] As a preferred implementation, in this embodiment, for a node v in the provenance graph, the node feature Φ(v) is extracted by:

[0068] Divide the attributes of node v into multiple substrings;

[0069] For each substring, use the first hash function h to map each character in the substring to the corresponding dimension of the substring feature, and use the second hash function H to hash each character to {±1} as the feature value of the corresponding dimension in the substring feature;

[0070] Add the substring features of each substring and use them as the node feature Φ(v) of node v.

[0071] The relevant expressions for extracting the node features Φ(v) can be expressed as follows:

[0072]

[0073] Among them, s j represents the jth character in the substring s, φ i (s) represents the i-th dimension eigenvalue in the substring feature of substring s, φ(s) k Represents the substring feature of the kth substring.

[0074] This embodiment divides the attributes of a node into multiple substrings, uses a hash function to map each substring to a low dimension, and then adds them together as the node feature vector of the node. In this way, while mapping high-dimensional attributes to a low-dimensional space, hierarchical similarity is maintained, so that different types of entities under similar directories can also have reasonable feature representations.

[0075] It's easy to understand that in practical applications, the partitioning of node attributes should be determined based on the attribute type and format to ensure that each resulting substring has a corresponding physical meaning. For example, the attribute socket 192.168.11.6 of node v can be divided into four substrings: "192," "192.168," "192.168.11," and "192.168.11.6."

[0076] As a preferred implementation, in this embodiment, for a node v in the provenance graph, the feature Ψ(v) of the edge connected to it is extracted in the following manner:

[0077] Get the edge type vector of each incoming edge of node v respectively, and map each incoming edge to 0~N according to the edge type vector e Integer between -1;

[0078] Get the edge type vector of each outgoing edge of node v respectively, and map each outgoing edge to N according to the edge type vector e ~2N e Integer between -1;

[0079] Concatenate the integers obtained by mapping the incoming and outgoing edges of node v in order to obtain the feature Ψ(v) of the edge connected to node v;

[0080] Among them, N e Indicates the total number of edge types.

[0081] The above method of extracting the features of the edges connected by the nodes can be expressed by the following formula:

[0082]

[0083]

[0084] Among them, In(v) represents the set of incoming edges of node v, and Out(v) represents the set of outgoing edges of node v. A type vector representing edge e; Represents a mapping function, which is used to transform Mapping is 0~N e An integer between -1.

[0085] By mapping each incoming and outgoing edge of a node to an integer according to the edge type, the features of the edges connecting the nodes can be extracted. This can fully consider the type of edges connected to the nodes, so that the node state feature vector obtained by fusing the node features and edge features has richer semantic information.

[0086] In this embodiment, each time a new edge is generated, the state feature vectors of the source node and the destination node of the new edge are updated, so that the state feature vector of the node can accurately reflect the evolution history of the node in the entire graph; as a preferred implementation, this embodiment specifically uses a gated neural network (GRU) to implement the update of the node state feature vector. Accordingly, in step S1 of this embodiment, for edge e t The source node v src and destination node v dst The state feature vector is updated, including:

[0087] The edge e t , around edge e t The source node v src The graph structure of t - The state vector s at time t- (v src ) Input gated neural network, edge e t The source node v src Update the state feature vector of s t (v src ) indicates that after the update v src The state eigenvector of , the corresponding formula is expressed as:

[0088] s t (v src )=GRU(e t ,s t- (v src ))

[0089] The edge e t , around edge e t The destination node v dst The graph structure of t - The state vector s at time t- (v dst) Input gated neural network, edge e t The destination node v dst Update the state feature vector of s t (v dst ) indicates that after the update v dst The state eigenvector of , the corresponding formula can be expressed as:

[0090] s t (v dst )=GRU(e t ,s t- (v dst ))

[0091] This embodiment accurately records the change history of the node in the graph through the state feature vector of the node, and completes the type prediction of the new edge based on the state feature vector of the node, which can effectively improve the prediction accuracy of the edge type.

[0092] It is easy to understand that when a new node appears in the graph structure, its corresponding state feature vector is initialized to all zeros because there is no historical information. When a new edge appears in the graph structure and changes the neighborhood of a node, the system also updates the state of the source and destination nodes.

[0093] When performing anomaly detection on new edges, this embodiment specifically uses a graph attention network to generate an embedding vector, and uses a decoder consisting of a long short-term memory network and two fully connected layers connected in sequence to predict the type of the edge based on the embedding vector of the new edge. The graph attention network and the decoder form an encoder-decoder model. In the encoder part, by introducing the graph attention network, the model can dynamically adjust the attention weight of each node to its neighbors, thereby adaptively capturing the important relationships between different nodes in complex graph structures. This makes the model more expressive in processing scenarios with multiple node / edge types, and provides structural and background information for the decoder to predict the type vector of the new edge. In the decoder part, a long short-term memory network (LSTM) is used to improve the model's ability to model time dependencies, especially in graph structures with continuous timestamps. This change can capture the temporal evolution information of the edge. Subsequently, combined with two fully connected layers, the model can better integrate time and structural information for accurate prediction of edge types.

[0094] The encoding process can be expressed as follows:

[0095] z=GAT(e t ,s t- ,t)

[0096] Among them, GAT represents graph attention network;

[0097] The decoding process can be expressed as follows:

[0098]

[0099] Among them, LSTM represents the long short-term memory network, and Linear represents the fully connected layer.

[0100] Finally, the reconstruction error between the predicted vector of the new edge type output by the decoder and the actual edge type vector of the new edge observed based on the traceability information reflects the degree to which the new edge deviates from normal behavior. The reconstruction error of benign edges will be relatively low, while those edges that obviously deviate from normal behavior will have a higher reconstruction error. In practical applications, normal edge type vectors can be established by constructing a benign traceability graph (i.e., a traceability graph without anomalies). Optionally, in this embodiment, the normal edge type vector is N corresponding to normal events. e dimensional one-hot vector, N e is the total number of normal event types, and in the normal edge type vector, the dimension corresponding to the normal event is 1, and the remaining dimensions are 0. The specific value of the threshold Th used to determine whether it is abnormal can be determined by statistical analysis of known normal events and abnormal events.

[0101] In practical applications, we can use traceability information that contains both known normal events and abnormal events to train the encoder-decoder structure and gated neural network with the goal of minimizing the reconstruction error between the edge type prediction vector output by the decoder and the actual edge type vector, so that the corresponding model structure has more accurate prediction capabilities.

[0102] In order to understand the attack behavior more comprehensively, as a preferred implementation method, based on the detection results of step S3, the attack footprint can be accurately reconstructed by comprehensively considering multiple steps such as time window queue, suspicious nodes, community discovery and graph simplification.

[0103] Example 2:

[0104] A computer program product includes a computer program. When the computer program is executed by a processor, it implements the anomaly detection method based on the dynamic traceability graph provided in the above embodiment 1.

[0105] Example 3:

[0106] An electronic device includes a stored computer program; when the computer program is executed by a processor, the device where the computer-readable storage medium is located is controlled to execute the anomaly detection method based on the dynamic traceability graph provided in the above-mentioned embodiment 1.

[0107] Example 4:

[0108] An anomaly detection system based on a dynamic traceability graph includes:

[0109] a computer-readable storage medium for storing a computer program;

[0110] and a processor for reading a computer program stored in a computer-readable storage medium and executing the anomaly detection method based on a dynamic provenance graph provided in the above-mentioned embodiment 1.

[0111] It will be easily understood by those skilled in the art that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for anomaly detection based on a dynamic traceability graph, characterized in that: include: After collecting system traceability information, it is converted into a traceability graph. For each node in the traceability graph, the node features and the features of the edges connected to the node are extracted and spliced ​​as the state feature vector of the corresponding node; Continuously monitor the system traceability information and dynamically update the traceability graph; when a new edge e is generated in the traceability graph t When , perform the anomaly detection step; The anomaly detection step includes: Step S1: Edge e t , around edge e t The graph structure of t - The state vector at time and edge e t The generation time t is input into the graph attention network, and the edge e is obtained t The embedding vector z of edge e t The source node v src and destination node v dst Update the state feature vector; t - The time represents the edge e t The moment before the generation moment of By the side t The source node and its neighbor nodes, the destination node and its neighbor nodes are in t - The state feature vector at each moment is aggregated through the graph convolution layer; Step S2: Edge e t The embedding vector z is input to the decoder, and the edge e is predicted t The probability of belonging to each type is obtained by predicting the vector P(e t ); The decoder includes a long short-term memory network and a plurality of fully connected layers connected in sequence; Step S3: Calculate the prediction vector P(e t ) and edge e t The reconstruction error RE between the actual edge type vectors is Th. If RE>Th, it is determined that there is an anomaly, otherwise, it is determined that there is no anomaly; Wherein, Th is the preset abnormal threshold.

2. The anomaly detection method based on dynamic traceability graph according to claim 1, characterized in that: The traceability graph is stored in a distributed supertable of the time series database.

3. The anomaly detection method based on a dynamic traceability graph according to claim 1 or 2, characterized in that: In step S1, the edge e t The source node v src and destination node v dst The state feature vector is updated, including: The edge e t , around edge e t The source node v src The graph structure of t - The state vector at time Input gated neural network, edge e t The source node v src Update the state feature vector; The edge e t , around edge e t The destination node v dst The graph structure of t - The state vector at time Input gated neural network, edge e t The destination node v dst The state feature vector is updated.

4. The anomaly detection method based on a dynamic traceability graph according to claim 1 or 2, characterized in that: For a node v in the traceability graph, the node feature Φ(v) is extracted as follows: Divide the attributes of node v into multiple substrings; For each substring, use the first hash function h to map each character in the substring to the corresponding dimension of the substring feature, and use the second hash function H to hash each character to {±1} as the feature value of the corresponding dimension in the substring feature; Add the substring features of each substring and use them as the node feature Φ(v) of node v.

5. The anomaly detection method based on a dynamic traceability graph according to claim 1 or 2, characterized in that: For a node v in the traceability graph, the feature Ψ(v) of the edge connected to it is extracted in the following manner: Get the edge type vector of each incoming edge of node v respectively, and map each incoming edge to 0~N according to the edge type vector e Integer between -1; Get the edge type vector of each outgoing edge of node v respectively, and map each outgoing edge to N according to the edge type vector e ~2N e Integer between -1; Concatenate the integers obtained by mapping the incoming and outgoing edges of node v in order to obtain the feature Ψ(v) of the edge connected to node v; Among them, N e Indicates the total number of edge types.

6. A computer program product, characterized in that The invention comprises a computer program, which, when executed by a processor, implements the anomaly detection method based on a dynamic traceability graph according to any one of claims 1 to 5.

7. A computer-readable storage medium, characterized in that The invention comprises a stored computer program; when the computer program is executed by a processor, the computer program controls the device where the computer-readable storage medium is located to execute the anomaly detection method based on the dynamic traceability graph according to any one of claims 1 to 5.

8. An anomaly detection system based on a dynamic traceability graph, characterized in that: include: a computer-readable storage medium for storing a computer program; and a processor, configured to read the computer program stored in the computer-readable storage medium and execute the anomaly detection method based on the dynamic provenance graph according to any one of claims 1 to 5.

Images