Intrusion detection method and device based on traceability graph, equipment and storage medium

Abstract

The invention provides an intrusion detection method based on a traceability graph, and the method comprises the steps: obtaining structural data of a system log, extracting feature information to generate a system traceability graph which comprises a node corresponding to each piece of entity feature information and an edge corresponding to each piece of interaction feature information, deleting edges corresponding to benign interaction information in the system traceability graph to obtain a reduced traceability graph; and determining a covering structure code of each node according to an interaction feature direction of each edge in the reduced traceability graph, and performing model training based on the covering structure code, each node in the reduced traceability graph and feature information corresponding to each edge to obtain a node classification model so as to detect an intrusion node in the to-be-detected traceability graph, according to the method, interference of benign interaction information and irrelevant nodes can be effectively removed to carry out model training, the precision and efficiency of the intrusion detection method based on the traceability graph can be effectively improved, and then large-scale traceability graph processing is realized.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network security technology, and in particular to an intrusion detection method, apparatus, device and storage medium based on a provenance graph. Background Art

[0002] At present, with the widespread application of the Internet, network intrusions are increasing, especially intrusions against hosts. Attackers exploit various vulnerabilities to gain control of the host and lurk for a long time to steal data or conduct remote control and other activities, which seriously threaten computer security. In order to cope with the above problems, technicians in this field have developed an intrusion detection technology based on host logs. This technology analyzes the host's operating behavior by constructing a traceability graph, thereby identifying malicious behavior.

[0003] However, existing intrusion detection technologies indiscriminately use all interactive information when aggregating node features. A large amount of benign interactive information will dilute the importance of malicious intrusion behavior when performing feature aggregation on the target node. Moreover, when the scale of the traceability graph is large, the interactive information of irrelevant nodes will also interfere with the feature aggregation accuracy of the target node, resulting in limitations in the accuracy and efficiency of existing intrusion detection technologies, making it impossible to achieve large-scale traceability graph processing. Summary of the invention

[0004] An embodiment of the present application provides an intrusion detection method based on a tracing graph, which can generate a masking structure code for each node according to a tracing graph that deletes benign interaction information, remove interference from irrelevant nodes based on the masking structure code, and perform model training to obtain a node classification model for intrusion node detection. This can effectively improve the accuracy and efficiency of the intrusion detection method based on the tracing graph, thereby realizing large-scale tracing graph processing.

[0005] To achieve the above-mentioned purpose, the first aspect of an embodiment of the present application provides an intrusion detection method based on a traceability graph, including: obtaining log data of a target system, and performing data cleaning on the log data to obtain structured data; extracting multiple entity feature information and interaction feature information from the structured data to generate a system traceability graph, wherein the system traceability graph contains nodes corresponding to each entity feature information and edges corresponding to each interaction feature information; identifying benign interaction information from multiple interaction feature information based on preset behavior recognition rules, and deleting edges corresponding to the benign interaction information in the system traceability graph to obtain a reduced traceability graph; determining a masking structure code of each node according to the interaction feature direction of each edge in the reduced traceability graph, wherein the masking structure code represents the interactive message transmission range of each node; performing model training based on the masking structure code, the feature information corresponding to each node and each edge in the reduced traceability graph to obtain a node classification model; performing node category prediction on the traceability graph to be detected based on the node classification model to detect intrusion nodes in the traceability graph to be detected.

[0006] In some embodiments, determining the masking structure encoding of each node according to the interaction feature direction of each edge in the reduced provenance graph includes: generating a masking matrix for each node according to the interaction feature direction of each edge in the reduced provenance graph and a preset message passing depth; forming a provenance subgraph for each node based on each of the masking matrices, and generating a masking structure encoding for the corresponding node according to the provenance subgraph.

[0007] In some embodiments, generating a masking matrix for each node based on the interaction feature direction of each edge in the reduced provenance graph and a preset message passing depth includes: determining a number of message passing nodes corresponding to each node based on the interaction feature direction of each edge in the reduced provenance graph and a preset message passing depth; and generating a masking matrix for the corresponding node based on the number of message passing nodes.

[0008] In some embodiments, the tracing subgraph includes the node and several message passing nodes corresponding to the node, and generating the masked structural coding of the corresponding node according to the tracing subgraph includes: determining the pointing connection relationship between the node and the several message passing nodes according to the tracing subgraph; structurally encoding the pointing connection relationship based on a preset masked coding type to obtain the masked structural coding of the corresponding node.

[0009] In some embodiments, the model training is performed based on the masking structure code, the feature information corresponding to each node and each edge in the reduced traceability graph to obtain a node classification model, including: performing feature integration processing based on the masking structure code, the entity feature information corresponding to each node in the reduced traceability graph, and the interactive feature information corresponding to each edge to obtain multiple traceability features and traceability relationships of the same dimension; model training is performed on the reduced traceability graph according to the masking structure code, the traceability feature, and the traceability relationship corresponding to each node to obtain a node classification model.

[0010] In some embodiments, the reduced provenance graph is model trained according to the masking structure code, the traceability feature and the traceability relationship corresponding to each node to obtain a node classification model, including: dividing the training task of the reduced provenance graph according to the masking structure code, the traceability feature and the traceability relationship corresponding to each node to obtain a training task division result; sending the training data and model initial parameters corresponding to the model training task of the reduced provenance graph to multiple computing units according to the training task division result, so that the multiple computing units respectively perform local model parameter training of the graph transformer model according to the training data and the model initial parameters; obtaining the local model parameter training results fed back by the multiple computing units, and summarizing and iterating the global model parameters of the graph transformer model based on the multiple local model parameter training results to obtain a node classification model.

[0011] In some embodiments, the local model parameter training of the graph transformer model based on the training data and the model initial parameters includes: initializing and generating the graph transformer model corresponding to the masking structure encoding based on the model initial parameters; based on the training data, training the local model parameters in the graph transformer model with the classification of normal nodes and intrusion nodes in the traceability graph as the training target, and obtaining the local model parameter training results.

[0012] In some embodiments, after the benign interaction information is identified from the multiple interaction feature information based on the preset behavior recognition rules, and the edges corresponding to the benign interaction information in the system traceability graph are deleted to obtain the reduced traceability graph, the method also includes: dividing each node in the reduced traceability graph into benign nodes and unknown target nodes based on the benign interaction information to obtain a node division result; in the process of generating the masking structure encoding of each node and performing model training, adjusting the analysis and processing process of each node based on the node division result.

[0013] In some embodiments, the extracting multiple entity feature information and interaction feature information from the structured data includes: performing data analysis processing on the structured data to obtain data features of multiple entities and interaction behaviors; performing natural language processing on the structured data to obtain semantic features of multiple entities and interaction behaviors; extracting multiple entity feature information and interaction feature information from the multiple data features and the semantic features.

[0014] To achieve the above-mentioned purpose, the second aspect of an embodiment of the present application provides an intrusion detection device based on a traceability graph, including: a log processing module, used to obtain log data of a target system, and perform data cleaning on the log data to obtain structured data; a traceability graph processing module, used to extract multiple entity feature information and interaction feature information from the structured data, and generate a system traceability graph, wherein the system traceability graph contains nodes corresponding to each entity feature information and edges corresponding to each interaction feature information; based on a preset behavior recognition rule, benign interaction information is identified from multiple interaction feature information, and the edges corresponding to the benign interaction information in the system traceability graph are deleted to obtain a reduced traceability graph; the masking structure code of each node is determined according to the interaction feature direction of each edge in the reduced traceability graph, and the masking structure code represents the interactive message transmission range of each node; a model training module, used to perform model training based on the masking structure code, the feature information corresponding to each node and each edge in the reduced traceability graph, to obtain a node classification model; an intrusion detection module, used to perform node category prediction on the traceability graph to be detected based on the node classification model, so as to detect the intrusion node in the traceability graph to be detected.

[0015] To achieve the above-mentioned purpose, the third aspect of an embodiment of the present application provides an electronic device, comprising: at least one processor; at least one memory for storing at least one program; when at least one of the programs is executed by at least one of the processors, an intrusion detection method based on a traceability graph as described in any one of the first aspects is implemented.

[0016] To achieve the above-mentioned purpose, the fourth aspect of an embodiment of the present application provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute the intrusion detection method based on the traceability graph as described in any one of the fourth aspects.

[0017] The embodiments of the present application provide an intrusion detection method, apparatus, device and storage medium based on a traceability graph, which can collect log data generated by a target system, perform data cleaning on the original log data to delete irrelevant or erroneous information, and ensure the data quality of subsequent processing. The cleaned data is converted into a structured form to facilitate subsequent processing; further, entity feature information and interaction feature information are extracted from the structured data, and the entity feature information refers to each component or entity in the system, such as a host, a user account, etc., and the interaction feature information refers to the interaction between these entities, such as file access, network communication, etc. These entities and interaction relationships are used to construct a system traceability graph, with entities as nodes and interactions as edges connecting nodes; further, preset behavior recognition rules are used to identify benign interaction behaviors, and edges representing benign interactions are deleted to obtain a simplified traceability graph, that is, a reduced traceability graph, and in the reduced traceability graph, a masking structure code is generated for each node according to the interaction feature direction of the edge. Code, masking structure coding represents the ability and scope of the node to transmit messages between its neighbors; further, masking structure coding and reducing the feature information of nodes and edges in the traceability graph are used for model training. The training goal is to obtain a model that can identify node categories, that is, a node classification model, and use the trained node classification model to analyze the traceability graph to be detected, and predict the node category through the model, so as to identify possible intrusion behaviors or malicious nodes; wherein, the present application constructs a masking matrix by utilizing the directed acyclic property of the traceability graph, limits the scope of message transmission, removes the interference of irrelevant nodes, reduces the scale of the traceability graph, and improves the accuracy of node feature aggregation, thereby reducing false positives and false negatives, improving the accuracy of features, and further enhancing the training effect of subsequent deep learning models, so that the present application can classify nodes with high accuracy and can process large-scale traceability graphs, and realize accurate intrusion detection under a larger range and longer time span, so as to help users more effectively identify potential security threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 A flowchart of an intrusion detection method based on a traceability graph provided in one embodiment of the present application;

[0019] Figure 2 A flowchart for generating a masking structure code in an intrusion detection method based on a traceability graph provided in an embodiment of the present application;

[0020] Figure 3 A flowchart of generating a masking matrix in an intrusion detection method based on a traceability graph provided in an embodiment of the present application;

[0021] Figure 4 A flowchart of obtaining a node classification model in an intrusion detection method based on a traceability graph provided in an embodiment of the present application;

[0022] Figure 5 A flowchart for dividing training tasks in an intrusion detection method based on a traceability graph provided in an embodiment of the present application;

[0023] Figure 6 A flowchart of performing distributed model training in an intrusion detection method based on a traceability graph provided in an embodiment of the present application;

[0024] Figure 7 A flowchart of feature extraction in an intrusion detection method based on a traceability graph provided in an embodiment of the present application;

[0025] Figure 8 A schematic diagram of modules corresponding to an intrusion detection device based on a traceability graph provided in an embodiment of the present application;

[0026] Fig. 9 A schematic diagram of an example corresponding to an intrusion detection device based on a traceability graph provided in an embodiment of the present application;

[0027] Fig.10 A schematic diagram of the structure of an electronic device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0029] In some embodiments, although the functional modules are divided in the system schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the system or the order in the flowchart. The terms first, second, etc. in the specification, claims and the above drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0030] In addition, unless otherwise clearly specified and limited, the term "connected" should be understood in a broad sense. For example, it can be a fixed connection or a movable connection, a detachable connection or a non-detachable connection, or an integral connection; it can be a mechanical connection, an electrical connection, or the two can communicate with each other; it can be a direct connection or an indirect connection through an intermediate medium.

[0031] In the description of the embodiments of the present application, the description of reference terms "one embodiment / implementation", "another embodiment / implementation" or "certain embodiments / implementations", "in the above embodiments / implementations", etc. means that the specific features, structures, materials or characteristics described in combination with the implementation or example are included in at least two embodiments or implementations disclosed in the present application. In the disclosure of this application, the schematic representation of the above terms does not necessarily refer to the same embodiment or implementation. It should be noted that although the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in an order different from that in the flowchart.

[0032] At present, with the widespread application of the Internet, network intrusions are increasing, especially intrusions against hosts. Attackers exploit various vulnerabilities to gain control of the host and lurk for a long time to steal data or conduct remote control and other activities, which seriously threaten computer security. In order to cope with the above problems, technicians in this field have developed an intrusion detection technology based on host logs. This technology analyzes the host's operating behavior by constructing a traceability graph, thereby identifying malicious behavior.

[0033] However, existing intrusion detection technologies indiscriminately use all interactive information when aggregating node features. A large amount of benign interactive information will dilute the importance of malicious intrusion behavior when performing feature aggregation on the target node. Moreover, when the scale of the traceability graph is large, the interactive information of irrelevant nodes will also interfere with the feature aggregation accuracy of the target node, resulting in limitations in the accuracy and efficiency of existing intrusion detection technologies, making it impossible to achieve large-scale traceability graph processing.

[0034] It can be understood that in order to overcome the limitations of the prior art, the present application provides an intrusion detection method based on a traceability graph, including: obtaining structured data of the log of the target system, extracting feature information to generate a system traceability graph, the system traceability graph contains nodes corresponding to each entity feature information and edges corresponding to each interaction feature information, and deleting the edges corresponding to the benign interaction information in the system traceability graph to obtain a reduced traceability graph; determining the masking structure coding of each node according to the interaction feature direction of each edge in the reduced traceability graph, performing model training based on the masking structure coding, the feature information corresponding to each node and each edge in the reduced traceability graph, and obtaining a node classification model to detect intrusion nodes in the traceability graph to be detected, wherein the present application can effectively remove the interference of benign interaction information and irrelevant nodes for model training, and can effectively improve the accuracy and efficiency of the intrusion detection method based on the traceability graph, thereby realizing large-scale traceability graph processing.

[0035] The embodiments of the present application are further described below in conjunction with the accompanying drawings.

[0036] refer to Figure 1 , Figure 1A flowchart of an intrusion detection method based on a traceability graph provided in an embodiment of the present application; in some embodiments, the present application provides an intrusion detection method based on a traceability graph, including but not limited to the following steps:

[0037] Step S110, obtaining log data of the target system, and performing data cleaning on the log data to obtain structured data;

[0038] Step S120, extracting multiple entity feature information and interaction feature information from the structured data, and generating a system traceability graph, wherein the system traceability graph includes a node corresponding to each entity feature information and an edge corresponding to each interaction feature information;

[0039] Step S130, identifying benign interaction information from multiple interaction feature information based on a preset behavior recognition rule, and deleting the edge corresponding to the benign interaction information in the system traceability graph to obtain a reduced traceability graph;

[0040] Step S140, determining the masking structure code of each node according to the interactive feature direction of each edge in the reduced traceability graph, where the masking structure code represents the interactive message transmission range of each node;

[0041] Step S150, performing model training based on the masking structure coding and reducing the feature information corresponding to each node and each edge in the traceability graph to obtain a node classification model;

[0042] Step S160 , predicting the node category of the traceability graph to be detected based on the node classification model, so as to detect the intrusion node in the traceability graph to be detected.

[0043] Among them, corresponding to step S110, the log data of the target system is the log file collected from the monitored or analyzed system. These logs usually record events that occurred during the operation of the system, such as user login attempts, file access records, process startup, etc. Data cleaning can be understood as the process of preprocessing the original log data, including deleting irrelevant or erroneous information, standardizing the data format, etc., in order to ensure the quality of data for subsequent processing. Structured data can be understood as the log data being converted into a structured form after data cleaning, which is convenient for subsequent analysis and processing.

[0044] Corresponding to step S120, the entity feature information is the feature information of each component or entity in the system, such as the host, user account, process, etc., and the interaction feature information is the interaction feature between entities, such as file access, network communication, inter-process communication, etc. The system traceability graph is a graphical representation composed of nodes formed by entity feature information and edges formed by interaction feature information. Nodes represent entities and edges represent the interaction relationship between entities.

[0045] Corresponding to step S130, benign interaction information is the interaction behavior generated during normal operation, which is usually harmless and has no negative impact on the normal operation of the system. The reduced traceability graph is a simplified version of the traceability graph obtained by deleting the edges representing benign interactions in the system traceability graph.

[0046] Corresponding to step S140, the masked structural coding is a structural coding generated for each node according to the interaction feature direction of the edge in the reduced provenance graph. It characterizes the ability and scope of message transmission between the node and its neighbors. It can be understood that since the provenance graph is a directed acyclic graph, the interaction feature direction is the direction of the edge in the provenance graph pointing from one node to another node, and the edge represents the interaction feature information between nodes.

[0047] Corresponding to step S150, model training based on masking structure encoding and reducing the feature information corresponding to each node and each edge in the traceability graph can be distributed model training. Distributed model training is a parallel processing technology that can decompose the model training task into multiple computing units, which can speed up the model training and is suitable for large-scale data sets. The node classification model is a model obtained through training, which can be used to classify the nodes in the graph and distinguish between normal nodes and intrusion nodes.

[0048] Corresponding to step S160, the source tracing graph to be detected is the source tracing graph constructed by the newly collected system log data that needs to be intrusion detected, and then the trained node classification model can be used to classify the nodes in the new source tracing graph to identify potential intrusion nodes or malicious behaviors.

[0049] In some embodiments, the present application can collect log data generated by the target system, perform data cleaning on the original log data to remove irrelevant or erroneous information, ensure the data quality of subsequent processing, and convert the cleaned data into a structured form to facilitate further processing; further, extract entity feature information and interaction feature information from the structured data, the entity feature information refers to the various components or entities in the system, such as hosts, user accounts, etc., and the interaction feature information refers to the interactions between these entities, such as file access, network communication, etc. These entities and interaction relationships are used to construct a system traceability graph, in which entities are nodes and interactions are edges connecting nodes; further, use the preset The behavior recognition rules are used to identify benign interactive behaviors, and the edges representing benign interactions are deleted to obtain a simplified provenance graph, namely the reduced provenance graph. In the reduced provenance graph, a masked structure code is generated for each node according to the interaction feature direction of the edge. The masked structure code represents the ability and scope of the node to pass messages between its neighbors. Furthermore, the masked structure code and the feature information of the nodes and edges in the reduced provenance graph are used for model training. The training goal is to obtain a model that can identify node categories, namely the node classification model. The trained node classification model is used to analyze the provenance graph to be detected, and the node category is predicted by the model, thereby identifying possible intrusion behaviors or malicious nodes.

[0050] It can be understood that the present application utilizes the directed acyclic property of the traceability graph to construct a masking matrix, limit the scope of message transmission, remove interference from irrelevant nodes, reduce the scale of the traceability graph, and improve the accuracy of node feature aggregation, thereby reducing false positives and negatives, improving the accuracy of features, and further enhancing the training effect of subsequent deep learning models, so that the present application can classify nodes with high accuracy and process large-scale traceability graphs, and achieve accurate intrusion detection over a larger range and longer time span, to help users more effectively identify potential security threats.

[0051] In some embodiments, the present application identifies benign interaction information from multiple interaction feature information based on preset behavior recognition rules, and deletes the edges corresponding to the benign interaction information in the system traceability graph to obtain a reduced traceability graph for subsequent processing only, while the existing method directly processes the complete traceability graph without deleting redundant information, causing the intrusion features to be diluted by the benign features, resulting in a large number of missed reports. The present application filters easily identifiable benign interactions through predefined rules, increases the proportion of malicious behaviors in the graph, and reduces the scale of the traceability graph. Specifically, the present application can eliminate benign interactions that are unlikely to be attack behaviors based on preset behavior recognition rules, and mark related benign entities. For example, it can eliminate less important and repetitive system process operations such as system startup and backup file updates in the traceability graph, and mark entities such as resource files as benign entities; further, the present application can also use the characteristic of the traceability graph as a directed acyclic graph to generate a masking matrix to limit the message propagation range in the graph neural network, thereby improving the expression ability of the encoding and effectively reducing the number of missed reports.

[0052] In some embodiments, the present application collects log data of the target system, cleans and structures the log data, generates a system traceability graph, identifies and removes benign interaction information from the traceability graph based on preset behavior recognition rules, constructs a masking matrix, limits the scope of message passing in the graph neural network, trains the model to classify nodes, and directly outputs whether the node is a malicious node and the malicious category to which it belongs; it can be understood that the existing traceability graph-based intrusion detection method determines whether there is an intrusion behavior in the traceability graph at the graph level, and cannot specifically point out the intrusion node and the intrusion behavior, which increases the subsequent analysis workload. In the above steps, the present application encodes and classifies the node-level and edge-level features in the traceability graph through the training of the graph neural network, directly outputs whether the node is malicious and the malicious category to which it belongs, effectively reducing the analysis workload of security personnel, and thus realizing fine-grained intrusion detection on the traceability graph.

[0053] refer to Figure 2 , Figure 2 In the intrusion detection method based on the provenance graph provided in one embodiment of the present application, a flowchart of generating a mask structure code is provided; in some embodiments, the mask structure code of each node is determined according to the interactive feature direction of each edge in the reduced provenance graph, including but not limited to the following steps:

[0054] Step S210, generating a masking matrix for each node according to the interactive feature direction of each edge in the reduced traceability graph and a preset message passing depth;

[0055] Step S220 , forming a provenance subgraph of each node based on each masking matrix, and generating a masking structure code of the corresponding node according to the provenance subgraph.

[0056] Among them, the masking matrix is ​​used to represent other nodes from which a node can receive messages within its preset message passing depth. The elements in the masking matrix can be used to indicate the reachability between nodes or the possibility of message passing. The message passing depth specifies the maximum distance a message can be transmitted from one node to another, that is, how far it can go along the edge in the graph. The provenance subgraph is a subgraph consisting of a central node and all its nodes that can receive messages through the preset message passing depth. The masking structure encoding is the encoding generated based on the structure of the provenance subgraph, which represents the interaction scope and mode of a node within a specific message passing depth.

[0057] It can be understood that in the above process, since the present application not only relies on establishing a normal behavior model, but also considers normal samples and malicious samples at the same time, extracts the similarities and behavioral patterns of malicious samples from a topological perspective, and enhances the model's detection ability for unknown malicious samples; compared with existing methods that mostly adopt the method of modeling normal behavior and treating deviations as abnormal behaviors for intrusion detection, resulting in a large number of false alarms, the present application can train normal samples and malicious samples at the same time, extract the similarities and behavioral patterns of malicious samples from a topological perspective, and thus have the ability to detect unknown malicious samples. Compared with comparative detection methods, the number of false alarms of the model can be reduced.

[0058] refer to Figure 3 , Figure 3 In the intrusion detection method based on the traceability graph provided in one embodiment of the present application, a flowchart of generating a masking matrix is ​​provided; in some embodiments, the masking matrix of each node is generated according to the interactive feature direction of each edge in the reduced traceability graph and the preset message passing depth, including but not limited to the following steps:

[0059] Step S310, determining a number of message passing nodes corresponding to each node according to the interactive feature direction of each edge in the reduced traceability graph and a preset message passing depth;

[0060] Step S320: generating a masking matrix of corresponding nodes according to a number of message transmission nodes.

[0061] The message passing node is a node that can directly or indirectly interact with a node within a preset message passing depth range. The masking matrix is ​​constructed by determining which nodes can pass messages to each other within the preset message passing depth.

[0062] In some embodiments, a masking matrix of corresponding nodes is generated according to several message passing nodes, including: determining the maximum depth n of message passing, which means that each node can pay attention to the neighbors within n steps away from it at most. Since the message passing path follows the rules of the directed acyclic graph (DAG), that is, it can only be transmitted along the direction of the edge and cannot be transmitted in the reverse direction, the message passing path confirmation can be performed. For each node, the message passing path of its inbound node (that is, the node pointing to it) can only continue to be transmitted along these inbound nodes. Similarly, for the outbound node (that is, the node it points to), the message passing path can only continue to be transmitted along the outbound node.

[0063] Specifically, suppose a malicious script triggers a series of events in the traceability graph: the malicious script first triggers the packaging operation of sensitive data, followed by the encryption operation, and finally the upload operation. In this process, there is also a user using a packaging tool (such as bz ip2) to process a file A; in the above example, the two-layer neighbor transmission of the upload process includes two input nodes, namely the encryption process and the packaging process. Although file A is associated with the packaging process, it is the output node of the packaging process and does not belong to the two-layer neighbor range of the upload process, so it will not be included. Therefore, for the upload process, its masking matrix will identify the encryption process and the packaging process as valid neighbor nodes, while file A is not within its consideration range, thereby ensuring that during the message transmission process, the upload process only pays attention to the nodes closely related to it, namely the encryption process and the packaging process, rather than indirect nodes such as file A.

[0064] In some embodiments, the provenance subgraph includes a node and several message passing nodes corresponding to the node, and a masked structural code of the corresponding node is generated according to the provenance subgraph, including: determining the pointing connection relationship between the node and several message passing nodes according to the provenance subgraph; structurally encoding the pointing connection relationship based on a preset masking coding type to obtain the masked structural code of the corresponding node, wherein the masking structural code is generated to better limit the message passing range in the graph neural network, improve the accuracy of node feature aggregation, and reduce the influence of irrelevant nodes. The present application can determine the connection relationship between the node and several other message passing nodes according to the provenance subgraph, that is, which nodes can send messages to other nodes, and encode these pointing connection relationships based on the preset masking coding type to obtain the masked structural code, and then through the masked structural coding, only specific message passing paths are allowed, which can reduce the influence of irrelevant nodes on the target node feature aggregation, and can more accurately represent the node neighbor relationship, thereby improving the expressiveness of node features and the accuracy of the model.

[0065] In some embodiments, the pointing connection relationship is structurally encoded based on a preset mask coding type. The mask coding types of the mask structure coding include but are not limited to: mask position coding, mask centrality coding, mask edge coding, etc. The following are examples of the above mask coding types: the mask position coding of node v can be expressed as:

[0066]

[0067] Among them, d is the node feature dimension used after the aggregation is completed, i is the shortest spatial distance between node v and its neighbor u under the masking matrix, and the encoding can be spliced ​​into the encoding result after the feature passes through the encoder, and then passes through the softmax layer to generate the output.

[0068] The masked centrality encoding measures the structural lowness of a node in the graph, which can be measured in terms of degree:

[0069]

[0070] Among them, z is the embedding that can be learned through in-degree and out-degree under the masking matrix. After obtaining the masked centrality encoding, it can be directly spliced ​​into the original features of the node for subsequent processing.

[0071] Masked edge encoding can be added to the similarity matrix of the attention mechanism when calculating node similarity:

[0072]

[0073] Among them, the mask edge code c uv is the edge feature sequence of the shortest path between node u and node v (e 1 ,e 2 ,…,e N ) with weights It can be understood that the purpose of the above mask coding type example is to embed the spatial information and edge information between nodes in the subgraph corresponding to the mask matrix in addition to using node features, and integrate them into the attention calculation process to optimize the training of the model. A variety of variant encoding methods can be set according to the training situation.

[0074] refer to Figure 4 , Figure 4 In the intrusion detection method based on the traceability graph provided in one embodiment of the present application, a flowchart of a node classification model is obtained; in some embodiments, model training is performed based on masking structure coding and reducing feature information corresponding to each node and each edge in the traceability graph to obtain a node classification model, including but not limited to the following steps:

[0075] Step S410, based on the masking structure coding, the entity feature information corresponding to each node in the reduced traceability graph and the interactive feature information corresponding to each edge are integrated to obtain a plurality of traceability features and traceability relationships of the same dimension;

[0076] Step S420 , performing model training on the reduced traceability graph according to the masking structure code, traceability feature and traceability relationship corresponding to each node to obtain a node classification model.

[0077] It can be understood that, corresponding to steps S410 to S420, the present application can integrate node features, edge features and masking structure coding, and align the dimensions of these features to ensure that they can be used correctly in the model. Node features: represent the attributes of each node, such as type, status, etc.; edge features represent the information of the edge connecting two nodes, which may include weight, type, etc.; masking structure coding is to encode the connection relationship between nodes and neighbors based on the masking matrix, which is used to control the scope of message transmission. The above three features are combined according to preset rules, and the dimensions of all features are ensured to be consistent so that the model can process these features.

[0078] In some embodiments, feature integration processing can combine the node's masking structure encoding, entity feature information, and interaction feature information to form a unified representation to facilitate model training. The traceability feature is the feature representation obtained after comprehensively considering the node's own entity features and its interaction characteristics with other nodes. The traceability relationship is the corresponding relationship representation of the processed nodes and edges.

[0079] In some embodiments, a distributed computing framework can be used to distribute training tasks to multiple computing nodes for execution to accelerate the model training process. The node classification model is a model obtained through training, and it can be determined whether a node is an intrusion node based on the node's feature information.

[0080] refer to Figure 5 , Figure 5 A flowchart for dividing the training tasks in the intrusion detection method based on the traceability graph provided in one embodiment of the present application; in some embodiments, the reduced traceability graph is model trained according to the masking structure code, traceability feature and traceability relationship corresponding to each node to obtain a node classification model, including but not limited to the following steps:

[0081] Step S510, dividing the training task of the reduced provenance graph according to the masking structure code, the traceability feature and the traceability relationship corresponding to each node, and obtaining a training task division result;

[0082] Step S520, sending the training data and model initial parameters corresponding to the model training task of reducing the traceability graph to multiple computing units according to the training task division result, so that the multiple computing units perform local model parameter training of the graph transformer model according to the training data and the model initial parameters respectively;

[0083] Step S530, obtaining local model parameter training results fed back by multiple computing units, and summarizing and iterating the global model parameters of the graph transformer model based on the multiple local model parameter training results to obtain a node classification model.

[0084] In some embodiments, the present application can divide the entire graph into several small tasks according to the masking structure encoding, traceability characteristics and traceability relationships of the nodes. These small tasks can be processed in parallel on different computing units, and then the training data and model initial parameters corresponding to the model training task of the reduced traceability graph are sent to multiple computing units according to the training task division results, so that multiple computing units perform local model parameter training of the graph transformer model according to the training data and model initial parameters, respectively. The training data includes the feature information and labels (normal or intrusion) of the nodes, and the model initial parameters include the parameter settings when the model starts training. The distributed model training process is that each computing unit is responsible for a part of the training data, and uses the same model initial parameters to train the local model parameters.

[0085] In some embodiments, local model parameter training results fed back by multiple computing units are obtained, local model parameter training results from all computing units are collected to summarize the global model parameters of the graph transformer model, and the global parameters of the graph transformer model are iteratively adjusted based on the summarized results to improve model performance, thereby obtaining a node classification model that can distinguish between normal nodes and intrusion nodes.

[0086] It can be understood that through steps S510 to S530, the present application can reasonably distribute training tasks to different computing nodes according to factors such as the masking matrix size of each node, the number of neighbors, and the feature complexity, so as to achieve the purpose of load balancing. Among them, the masking matrix size is the size of the masking matrix of each node, which affects the amount of data that the node needs to process. The more neighbors a node has, the more computing resources are usually required. The complexity of node features and edge features, complex features require more calculations to process. According to these factors, the model training task is divided into multiple subtasks and these subtasks are assigned to different computing nodes to ensure the efficiency of distributed training.

[0087] refer to Figure 6 , Figure 6A flowchart of distributed model training in an intrusion detection method based on a traceability graph provided in an embodiment of the present application; in some embodiments, local model parameter training of a graph transformer model is performed according to training data and model initial parameters, including but not limited to the following steps:

[0088] Step S610, generating a graph transformer model corresponding to the masking structure encoding based on the initial model parameter initialization;

[0089] Step S620 , based on the training data, classify the normal nodes and the intrusion nodes in the traceability graph as training targets to train the local model parameters in the graph transformer model, and obtain the local model parameter training results.

[0090] Among them, the graph transformer model is the graph transformer encoder-decoder, which is a model suitable for graph structured data and can handle complex relationships between nodes. After setting the initial parameters of the model and determining that the training purpose of the model is to learn how to accurately distinguish normal nodes from intrusion nodes, each computing unit can obtain intermediate results based on its own training data and model parameters. Among them, the graph transformer model in this application is a customized graph transformer model, which is modified on the basis of the original graph transformer, and adds masking matrix constraints to control the message transmission range, and uses masking structure encoding instead of traditional structure encoding. Each node independently executes the training task of local model parameters in the graph transformer model according to the assigned subtask, and sends the results back to the central node. Through the collaborative work of these modules, the entire system can efficiently process large-scale graph data and utilize distributed computing resources to accelerate the training process.

[0091] It can be imagined that due to the limitation of computing power, the graph neural network model used in the existing methods only processes small-scale traceability graphs and cannot capture long-term intrusion behaviors in large-scale traceability graphs. The present application generates a graph transformer model corresponding to the masking structure encoding based on the initial parameter initialization of the model, including the use of a customized graph Transformer encoder-decoder under the masking matrix, which can reduce the amount of training calculations while enabling nodes to pay more attention to distant neighbors, thereby improving the expressive power of feature aggregation. At the same time, the encoder-decoder supports distributed training and realizes the processing of large-scale traceability graphs.

[0092] In some embodiments, after identifying benign interaction information from multiple interaction feature information based on a preset behavior recognition rule, and deleting the edge corresponding to the benign interaction information in the system traceability graph, and obtaining a reduced traceability graph, the method further includes: dividing each node in the reduced traceability graph into a benign node and an unknown target node based on the benign interaction information, and obtaining a node division result; in the process of generating the cover structure code of each node and performing model training, adjusting the analysis and processing process of each node based on the node division result; wherein, it can be understood that, in this embodiment, by eliminating benign interactions that are unlikely to be attack behaviors according to preset rules, and marking related benign entities, dividing nodes into benign nodes and unknown target nodes, the unknown nodes can be better analyzed in a centralized manner, thereby improving the ability to detect unknown malicious behaviors. For example, less important and repeated system process operations such as system startup and backup file update in the traceability graph are eliminated, and entities such as resource files are marked as benign entities. Since malicious processes may generate information flow interactions through benign entities, benign entities are retained in the traceability graph, and then in the process of generating the cover structure code and performing model training, the analysis and processing process of each node is adjusted according to the node division result.

[0093] It is understandable that by deleting benign interaction information, the amount of data to be processed subsequently can be reduced, the proportion of malicious behaviors can be increased, and the model can be more focused on detecting unknown malicious behaviors. Clearly dividing nodes into benign nodes and unknown target nodes can help the model better learn the patterns of unknown malicious behaviors, thereby improving the ability to detect unknown malicious behaviors. Through such a division, false alarms caused by benign behaviors can be reduced, and the detection rate of malicious behaviors can be improved, reducing missed alarms.

[0094] refer to Figure 7 , Figure 7 A flowchart of feature extraction in an intrusion detection method based on a traceability graph provided in an embodiment of the present application; in some embodiments, extracting multiple entity feature information and interactive feature information from structured data includes but is not limited to the following steps:

[0095] Step S710, performing data analysis and processing on the structured data to obtain data features of multiple entities and interaction behaviors;

[0096] Step S720, performing natural language processing on the structured data to obtain semantic features of multiple entities and interaction behaviors;

[0097] Step S730: extracting a plurality of entity feature information and interaction feature information from a plurality of data features and semantic features.

[0098] In some embodiments, numerical features extracted from raw data by statistical analysis and other methods, and features extracted from text data by natural language processing technology, such as relationships between entities, can then extract multiple entity feature information and interaction feature information from multiple data features and semantic features. Entity feature information is information that describes the attributes and states of a single entity, and interaction feature information is information that describes the interactions between entities. Through the above steps, the present application can effectively improve the performance of the model by extracting and utilizing entity and interaction feature information in structured data.

[0099] In some embodiments, corresponding to steps S710 to S730, the present application may collect log records from the host system, and perform a series of processing and cleaning on the unstructured log records to convert them into structured data, so as to facilitate subsequent processing, such as extracting features, eliminating null values ​​and outliers, etc.; wherein the extracted features include but are not limited to statistical features related to entities and behaviors, numerical features, numerical features that are data features, semantic features obtained using natural language processing technology, etc.

[0100] In some embodiments, an example of extracting semantic features is as follows: consider the following attributes in each entity and interaction attribute, such as the process name and command line parameters of the process node, the file path of the file node, the network IP address and port of the socket node, and the module name of the module node, etc., and arrange them into sentences in order. Then, use the Word2Vec model to predict the context of the word, generate a low-dimensional dense vector for each word, and encode each sentence into a vector of fixed length to achieve embedding at the entity and interaction semantic level to extract semantic features.

[0101] The second aspect of the embodiment of the present application provides an intrusion detection device based on a traceability graph, including: a log processing module, which is used to obtain log data of a target system and perform data cleaning on the log data to obtain structured data; a traceability graph processing module, which is used to extract multiple entity feature information and interaction feature information from the structured data to generate a system traceability graph, wherein the system traceability graph contains nodes corresponding to each entity feature information and edges corresponding to each interaction feature information; based on a preset behavior recognition rule, benign interaction information is identified from multiple interaction feature information, and the edges corresponding to the benign interaction information in the system traceability graph are deleted to obtain a reduced traceability graph; the masking structure coding of each node is determined according to the interaction feature direction of each edge in the reduced traceability graph, and the masking structure coding represents the interactive message transmission range of each node; a model training module, which is used to perform model training based on the masking structure coding, the feature information corresponding to each node and each edge in the reduced traceability graph to obtain a node classification model; an intrusion detection module, which is used to perform node category prediction on the traceability graph to be detected based on the node classification model to detect the intrusion node in the traceability graph to be detected.

[0102] refer to Figure 8 , Figure 8 A schematic diagram of modules corresponding to an intrusion detection device based on a traceability graph provided in an embodiment of the present application; in some embodiments, Figure 8 The host log processing module corresponds to the log processing module in this application. The host log processing module includes a log cleaning module and a traceability graph generation module; the traceability graph processing module includes a benign interaction elimination module, a masking matrix construction module and a masking structure encoding generation module; the model training module includes a feature alignment module, a subtask allocation module, a distributed training module and a model parameter update module; the intrusion detection module includes a node classification module and an intrusion node feedback module.

[0103] Among them, the log cleaning module is used to clean and format the original log data, such as deleting irrelevant information, standardizing fields, etc., to ensure the quality and consistency of the log data, and prepare a clean data set for subsequent processing; the traceability graph generation module is used to build a system traceability graph based on the cleaned log data to generate a graphical representation that can reflect the internal interaction relationship of the system, which is convenient for subsequent analysis and detection of potential abnormal behaviors; the benign interaction elimination module is used to identify and remove benign interaction records generated during normal operation to reduce noise and focus on abnormal behaviors that may pose security threats; the masking matrix construction module is used to create a masking matrix to identify which parts are sensitive or irrelevant based on known security policies or rules, so as to protect privacy information while highlighting key security-related data; the masking structure encoding generation module is used to convert the masked traceability graph into a form that can be understood by the machine learning model, in preparation for model training or Data representation for reasoning; feature alignment module, used to adjust data features to meet the requirements of model input to ensure the consistency and applicability of training data; subtask allocation module, used to split large training tasks into smaller subtasks for parallel processing to improve training efficiency and utilize multi-processor resources; distributed training module, used to use multiple computers or multiple GPUs for model training to accelerate the training process, especially when processing large-scale data sets; model parameter update module, used to regularly update the parameters of the model to improve model performance, so as to optimize the model weights through techniques such as back propagation and improve prediction accuracy; node classification module, used to use the trained model to classify the nodes in the graph, distinguish normal nodes from potential malicious nodes, and identify system components that may be attacked; intrusion node feedback module, used to use the classification results to generate alarms or take actions, such as isolating suspicious nodes, to respond to security incidents in a timely manner and reduce damage

[0104] It can be understood that the above-mentioned device can achieve fine-grained intrusion detection through a series of processing steps. Specifically, the device of the present application can extract necessary information from the log data, and then filter out benign interactions through rules, increase the proportion of malicious behaviors, and use masking matrices to limit the scope of message transmission in graph neural networks, improve the accuracy of node feature aggregation, and then the model obtained through distributed training can perform node-level intrusion detection on the new traceability graph, thereby greatly reducing the possibility of false alarms and missed alarms.

[0105] refer to Fig. 9 , Fig. 9 Schematic diagram of an example corresponding to an intrusion detection device based on a traceability graph provided in an embodiment of the present application; in some embodiments, corresponding Fig. 9 , this application may include the following steps:

[0106] Data collection: Collect log files from the host to be inspected. These logs contain system operation records.

[0107] Feature extraction and provenance graph construction: Extract features from log files and construct a provenance graph (PG), where nodes represent entities (such as users, processes, files, etc.) and edges represent the interactions between them.

[0108] Benign interaction elimination: Use predefined rules to filter out known benign interaction behaviors to form a reduced provenance graph (RPG), which helps reduce the amount of data to be processed later and increase the proportion of malicious behaviors.

[0109] Abstraction and feature alignment: Abstract the RPG into a graph to be processed and align the features, which can include semantic features and meta-features, to facilitate subsequent analysis and processing.

[0110] Masking matrix construction: Based on the directed acyclic characteristics of the traceability graph, a masking matrix is ​​constructed to limit the scope of message propagation in the graph neural network. The use of the masking matrix helps to improve the accuracy of node feature aggregation and reduce the demand for computing resources.

[0111] Graph neural network training: Use masking matrices to guide the message propagation process of graph neural networks, ensure that the interactive feature direction of message aggregation conforms to the actual structure of the traceability graph, and combine with the graph Transformer encoder-decoder to allow nodes to pay attention to more distant neighbors and capture a wider range of related information.

[0112] Distributed training: Use distributed computing clusters to train models to improve training speed and efficiency.

[0113] Model prediction: Apply the trained model to perform node-level intrusion detection on the traceability graph to be detected. The output results include potential intrusion nodes and their malicious categories.

[0114] Result feedback and application: The security administrator receives the detection results, analyzes and makes decisions, and the model prediction server returns the results to the security administrator for reference and action.

[0115] Among them, it can be understood that through the above series of steps, the present application can perform efficient and accurate analysis on large-scale traceability graphs. Compared with traditional methods, the traceability graph rule filtering method proposed in this application can reduce the processing scale, and the customized masking matrix can limit the feature transmission direction and more accurately express the nodes in the traceability graph. The graph Transformer encoder-decoder supports distributed training, so that the model can converge quickly on large-scale data sets, and can realize fine-grained intrusion detection, thereby effectively reducing the number of false alarms and missed alarms and improving detection accuracy.

[0116] Some embodiments of the present application provide an electronic device, Fig.10 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, referring to Fig.10 The electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the intrusion detection method based on the traceability graph of any of the above embodiments is implemented. For example, the above described intrusion detection method based on the traceability graph is implemented. Figure 1 Steps S110 to S160 of the method, Figure 2 Steps S210 to S220 of the method, Figure 3 Steps S310 to S320 of the method, Figure 4 Steps S410 to S420 of the method, Figure 5 Steps S510 to S530 of the method, Figure 6 Steps S610 to S620 of the method, Figure 7 The method comprises steps S710 to S730.

[0117] The electronic device 1000 of the embodiment of the present application includes one or more processors 1010 and a memory 1020. Fig.10 In the figure, a processor 1010 and a memory 1020 are taken as an example.

[0118] The processor 1010 and the memory 1020 may be connected via a bus or other means. Fig.10 The example of connecting through bus is taken in the following.

[0119] The memory 1020, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer executable programs. In addition, the memory 1020 may include a high-speed random access memory, and may also include a non-transitory memory, such as at least one disk storage device, a flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory 1020 may optionally include a memory 1020 remotely disposed relative to the processor 1010, and these remote memories may be connected to the electronic device 1000 via a network. At the same time, examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0120] In some embodiments, when the processor executes the computer program, it executes the intrusion detection method based on the traceability graph of any of the above embodiments at preset intervals.

[0121] Those skilled in the art will understand that Fig.10 The device structure shown in the figure does not constitute a limitation on the electronic device 1000, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0122] exist Fig.10 In the electronic device 1000 shown, the processor 1010 can be used to call the intrusion detection method based on the tracing graph stored in the memory 1020, so as to implement the intrusion detection method based on the tracing graph.

[0123] Based on the hardware structure of the above-mentioned electronic device 1000, various embodiments of the intrusion detection device based on the tracing graph of the present application are proposed. At the same time, the non-transient software programs and instructions required to implement the intrusion detection method based on the tracing graph of the above-mentioned embodiments are stored in the memory. When executed by the processor, the intrusion detection method based on the tracing graph of the above-mentioned embodiments is executed.

[0124] The embodiment of the present application also provides a computer-readable storage medium, which stores computer-executable instructions, which are used to execute the above-mentioned intrusion detection method based on the traceability graph, and can enable the above-mentioned one or more processors to execute the intrusion detection method based on the traceability graph of any of the above-mentioned embodiments, for example, to execute the above-mentioned Figure 1 Steps S110 to S160 of the method, Figure 2 Steps S210 to S220 of the method, Figure 3 Steps S310 to S320 of the method, Figure 4 Steps S410 to S420 of the method, Figure 5 Steps S510 to S530 of the method, Figure 6 Steps S610 to S620 of the method, Figure 7 The method comprises steps S710 to S730.

[0125] The present application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. A processor of a computer device reads the computer program from the computer-readable storage medium, and the processor executes the computer program, so that the computer device executes the intrusion detection method based on the traceability graph to implement any one of the above embodiments, for example, executing the above described Figure 1 Steps S110 to S160 of the method, Figure 2 Steps S210 to S220 of the method, Figure 3 Steps S310 to S320 of the method, Figure 4 Steps S410 to S420 of the method, Figure 5 Steps S510 to S530 of the method, Figure 6 Steps S610 to S620 of the method, Figure 7 The method steps S710 to S730 in the above device embodiment are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network nodes. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0126] It will be appreciated by those skilled in the art that all or some of the steps and systems in the disclosed method above may be implemented as software, firmware, hardware and appropriate combinations thereof. Some physical components or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or may be implemented as hardware, or may be implemented as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer-readable storage medium (or a non-transitory medium) and a communication medium (or a temporary medium). As known to those skilled in the art, the term computer-readable storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer-readable storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD to ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that may be used to store desired information and may be accessed by a computer. In addition, it is well known to those skilled in the art that communication media typically include computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery media. The above is a specific description of the preferred implementation of the present application, but the present application is not limited to the above implementation mode. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present application, and these equivalent modifications or substitutions are all included in the scope defined by the claims of the present application.

Claims

1. An intrusion detection method based on a traceability graph, characterized in that: include: Obtaining log data of the target system and performing data cleaning on the log data to obtain structured data; Extracting multiple entity feature information and interaction feature information from the structured data, and generating a system traceability graph, wherein the system traceability graph includes a node corresponding to each entity feature information and an edge corresponding to each interaction feature information; Based on a preset behavior recognition rule, benign interaction information is identified from the plurality of interaction feature information, and the edges corresponding to the benign interaction information in the system traceability graph are deleted to obtain a reduced traceability graph; Determining a masking structure code of each node according to the interactive feature direction of each edge in the reduced traceability graph, wherein the masking structure code represents the interactive message transmission range of each node; Model training is performed based on the masking structure encoding and the feature information corresponding to each node and each edge in the reduced traceability graph to obtain a node classification model; Based on the node classification model, node category prediction is performed on the traceability graph to be detected to detect intrusion nodes in the traceability graph to be detected.

2. The intrusion detection method based on the traceability graph according to claim 1 is characterized in that: The step of determining the masking structure encoding of each node according to the interactive feature direction of each edge in the reduced traceability graph includes: Generate a masking matrix for each node according to the interactive feature direction of each edge in the reduced traceability graph and a preset message passing depth; A provenance subgraph of each node is formed based on each of the masking matrices, and a masking structure code of the corresponding node is generated according to the provenance subgraph.

3. The intrusion detection method based on the traceability graph according to claim 2 is characterized in that: The step of generating a masking matrix for each node according to the interactive feature direction of each edge in the reduced traceability graph and a preset message passing depth includes: Determine a number of message passing nodes corresponding to each node according to the interactive feature direction of each edge in the reduced traceability graph and a preset message passing depth; A masking matrix of a corresponding node is generated according to the plurality of message passing nodes.

4. The intrusion detection method based on the traceability graph according to claim 3 is characterized in that: The provenance subgraph includes the node and a plurality of message transmission nodes corresponding to the node, and the step of generating a mask structure code of the corresponding node according to the provenance subgraph includes: Determining a pointing connection relationship between the node and the plurality of message transfer nodes according to the traceability subgraph; The pointing connection relationship is structurally encoded based on a preset masked encoding type to obtain a masked structural encoding of the corresponding node.

5. The intrusion detection method based on the traceability graph according to claim 1 is characterized in that: The model training is performed based on the masking structure encoding and the feature information corresponding to each node and each edge in the reduced traceability graph to obtain a node classification model, including: Based on the masking structure coding, the entity feature information corresponding to each node in the reduced traceability graph, and the interactive feature information corresponding to each edge, feature integration processing is performed to obtain multiple traceability features and traceability relationships of the same dimension; Model training is performed on the reduced traceability graph according to the masking structure code, the traceability feature and the traceability relationship corresponding to each node to obtain a node classification model.

6. The intrusion detection method based on the traceability graph according to claim 5 is characterized in that: The performing model training on the reduced traceability graph according to the masking structure code, the traceability feature and the traceability relationship corresponding to each node to obtain a node classification model includes: Performing training task division on the reduced traceability graph according to the masking structure code, the traceability feature, and the traceability relationship corresponding to each node, to obtain a training task division result; According to the training task division result, the training data and the model initial parameters corresponding to the model training task of the reduced traceability graph are sent to multiple computing units, so that the multiple computing units respectively perform local model parameter training of the graph transformer model according to the training data and the model initial parameters; The local model parameter training results fed back by the multiple computing units are obtained, and the global model parameters of the graph transformer model are summarized and iterated based on the multiple local model parameter training results to obtain a node classification model.

7. The intrusion detection method based on the traceability graph according to claim 6 is characterized in that: The performing local model parameter training of the graph transformer model according to the training data and the initial model parameters comprises: Initialize and generate a graph transformer model corresponding to the masking structure encoding based on the initial parameters of the model; Based on the training data, local model parameters in the graph transformer model are trained with the classification of normal nodes and intrusion nodes in the provenance graph as a training target to obtain local model parameter training results.

8. The intrusion detection method based on traceability graph according to claim 1 is characterized in that: After identifying benign interaction information from the plurality of interaction feature information based on the preset behavior recognition rule and deleting the edge corresponding to the benign interaction information in the system traceability graph to obtain a reduced traceability graph, the method further includes: Dividing each node in the reduced traceability graph into a benign node and an unknown target node based on the benign interaction information, and obtaining a node division result; In the process of generating the mask structure encoding of each node and performing model training, the analysis and processing process of each node is adjusted based on the node division result.

9. The intrusion detection method based on traceability graph according to claim 1 is characterized in that: The extracting a plurality of entity feature information and interaction feature information from the structured data includes: Performing data analysis and processing on the structured data to obtain data features of multiple entities and interaction behaviors; Performing natural language processing on the structured data to obtain semantic features of multiple entities and interaction behaviors; A plurality of entity feature information and interaction feature information are extracted from the plurality of data features and the semantic features.

10. An intrusion detection device based on a traceability graph, characterized in that: include: The log processing module is used to obtain the log data of the target system and perform data cleaning on the log data to obtain structured data; A traceability graph processing module is used to extract multiple entity feature information and interaction feature information from the structured data to generate a system traceability graph, wherein the system traceability graph contains nodes corresponding to each entity feature information and edges corresponding to each interaction feature information; based on a preset behavior recognition rule, benign interaction information is identified from multiple interaction feature information, and edges corresponding to the benign interaction information in the system traceability graph are deleted to obtain a reduced traceability graph; a masking structure code of each node is determined according to the interaction feature direction of each edge in the reduced traceability graph, wherein the masking structure code represents the interactive message transmission range of each node; A model training module, used to perform model training based on the mask structure encoding and the feature information corresponding to each node and each edge in the reduced traceability graph to obtain a node classification model; The intrusion detection module is used to predict the node category of the traceability graph to be detected based on the node classification model, so as to detect the intrusion node in the traceability graph to be detected.

11. An electronic device, characterized in that: include: at least one processor; at least one memory for storing at least one program; When at least one of the programs is executed by at least one of the processors, the intrusion detection method based on the provenance graph as described in any one of claims 1 to 9 is implemented.

12. A computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute the intrusion detection method based on a provenance graph as described in any one of claims 1 to 9.

Images