Intrusion detection methods, devices, equipment, and storage media based on source maps

Abstract

The application provides an intrusion detection method based on a traceability graph, comprising: obtaining structured data of system logs, extracting feature information, generating a system traceability graph, the system traceability graph containing nodes corresponding to each entity feature information and edges corresponding to each interaction feature information, and deleting edges corresponding to benign interaction information in the system traceability graph to obtain a reduced traceability graph; determining the masking structure code of each node according to the interaction feature direction of each edge in the reduced traceability graph, training a model based on the masking structure code, each node in the reduced traceability graph and the feature information corresponding to each edge to obtain a node classification model, and detecting intrusion nodes in a to-be-detected traceability graph, wherein the application can effectively remove the interference of benign interaction information and irrelevant nodes to perform model training, can effectively improve the precision and efficiency of the intrusion detection method based on the traceability graph, and further realizes large-scale traceability graph processing.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of network security, and particularly relate to an intrusion detection method and device based on a traceability graph, an apparatus, and a storage medium. BACKGROUND

[0002] Currently, with the widespread use of the Internet, network intrusion behaviors are increasing, especially host intrusion. Attackers use various vulnerabilities to obtain control of the host and long-term lurk to perform data theft or remote control activities, which seriously threatens computer security. In order to cope with the above problems, the technical personnel in the field have developed an intrusion detection technology based on host logs. This technology analyzes the operation behavior of the host by constructing a traceability graph, so as to identify malicious behavior.

[0003] However, the existing intrusion detection technology indiscriminately uses all interaction information when performing node feature aggregation. A large amount of benign interaction information will dilute the importance of malicious intrusion behavior when the target node performs feature aggregation. Moreover, when the scale of the traceability graph is large, the interaction information of irrelevant nodes will also interfere with the feature aggregation accuracy of the target node, resulting in that the existing intrusion detection technology has limitations in accuracy and efficiency, and cannot realize large-scale traceability graph processing. SUMMARY

[0004] Embodiments of the present application provide an intrusion detection method based on a traceability graph. The method can generate a masking structure code for each node according to a traceability graph from which benign interaction information is deleted. The method removes the interference of irrelevant nodes based on the masking structure code to perform model training, and obtains a node classification model for intrusion node detection. The method can effectively improve the precision and efficiency of the intrusion detection method based on the traceability graph, and further realize large-scale traceability graph processing.

[0005] To achieve the above objectives, a first aspect of this application provides an intrusion detection method based on a source graph, comprising: acquiring log data of a target system and cleaning the log data to obtain structured data; extracting multiple entity feature information and interaction feature information from the structured data to generate a system source graph, wherein the system source graph contains a node corresponding to each entity feature information and an edge corresponding to each interaction feature information; identifying benign interaction information from the multiple interaction feature information based on preset behavior recognition rules, and deleting the edges corresponding to the benign interaction information in the system source graph to obtain a reduced source graph; determining a masking structure code for each node based on the interaction feature direction of each edge in the reduced source graph, wherein the masking structure code characterizes the interaction message transmission range of each node; training a model based on the masking structure code, the feature information corresponding to each node and each edge in the reduced source graph to obtain a node classification model; and predicting the node category of the source graph to be detected based on the node classification model to detect intrusion nodes in the source graph to be detected.

[0006] In some embodiments, determining the occlusion structure encoding of each node based on the interaction feature direction of each edge in the reduced source graph includes: generating an occlusion matrix for each node based on the interaction feature direction of each edge in the reduced source graph and a preset message passing depth; forming a source subgraph for each node based on each occlusion matrix; and generating the occlusion structure encoding of the corresponding node based on the source subgraph.

[0007] In some embodiments, generating the masking matrix of each node based on the interaction feature direction of each edge in the reduced source graph and a preset message passing depth includes: determining a plurality of message passing nodes corresponding to each node based on the interaction feature direction of each edge in the reduced source graph and a preset message passing depth; and generating the masking matrix of the corresponding node based on the plurality of message passing nodes.

[0008] In some embodiments, the tracing subgraph includes the node and a plurality of message passing nodes corresponding to the node, and generating the masking structure code of the corresponding node according to the tracing subgraph includes: determining the pointing connection relationship between the node and the plurality of message passing nodes according to the tracing subgraph; and performing structural encoding on the pointing connection relationship based on a preset masking encoding type to obtain the masking structure code of the corresponding node.

[0009] In some embodiments, the step of training a model based on the occlusion structure encoding, the feature information corresponding to each node and each edge in the reduced source graph to obtain a node classification model includes: performing feature integration processing based on the occlusion structure encoding, the entity feature information corresponding to each node in the reduced source graph, and the interaction feature information corresponding to each edge to obtain multiple source features and source relationships of the same dimension; and training a model on the reduced source graph according to the occlusion structure encoding, the source features, and the source relationships corresponding to each node to obtain a node classification model.

[0010] In some embodiments, training a model on the reduced source graph based on the occlusion structure encoding, the source features, and the source relationships corresponding to each node to obtain a node classification model includes: dividing the reduced source graph into training tasks based on the occlusion structure encoding, the source features, and the source relationships corresponding to each node to obtain training task division results; sending the training data and initial model parameters corresponding to the model training tasks of the reduced source graph to multiple computing units based on the training task division results, so that the multiple computing units respectively train the local model parameters of the graph transformer model based on the training data and the initial model parameters; obtaining the local model parameter training results fed back by the multiple computing units; and summarizing and iterating the global model parameters of the graph transformer model based on the multiple local model parameter training results to obtain a node classification model.

[0011] In some embodiments, training the local model parameters of the graph transformer model based on the training data and the initial model parameters includes: initializing and generating the graph transformer model corresponding to the occlusion structure encoding based on the initial model parameters; and training the local model parameters in the graph transformer model based on the training data, with the classification of normal nodes and intrusion nodes in the source tracing graph as the training objective, to obtain the local model parameter training results.

[0012] In some embodiments, after identifying benign interaction information from multiple interaction feature information based on preset behavior recognition rules and deleting the edges corresponding to the benign interaction information in the system source graph to obtain a reduced source graph, the method further includes: dividing each node in the reduced source graph into benign nodes and unknown target nodes based on the benign interaction information to obtain node partitioning results; and adjusting the analysis and processing of each node based on the node partitioning results during the generation of the occlusion structure encoding of each node and the model training process.

[0013] In some embodiments, extracting multiple entity feature information and interaction feature information from the structured data includes: performing data analysis processing on the structured data to obtain data features of multiple entities and interactive behaviors; performing natural language processing on the structured data to obtain semantic features of multiple entities and interactive behaviors; and extracting multiple entity feature information and interaction feature information from the multiple data features and the semantic features.

[0014] To achieve the above objectives, a second aspect of this application provides an intrusion detection device based on a source graph, comprising: a log processing module for acquiring log data of a target system and cleaning the log data to obtain structured data; a source graph processing module for extracting multiple entity feature information and interaction feature information from the structured data to generate a system source graph, wherein the system source graph contains a node corresponding to each entity feature information and an edge corresponding to each interaction feature information; identifying benign interaction information from the multiple interaction feature information based on preset behavior recognition rules and deleting the edges corresponding to the benign interaction information in the system source graph to obtain a reduced source graph; determining a masking structure encoding for each node based on the interaction feature direction of each edge in the reduced source graph, wherein the masking structure encoding characterizes the interaction message transmission range of each node; a model training module for training a model based on the masking structure encoding, the feature information corresponding to each node and each edge in the reduced source graph to obtain a node classification model; and an intrusion detection module for predicting the node category of the source graph to be detected based on the node classification model to detect intrusion nodes in the source graph to be detected.

[0015] To achieve the above objectives, a third aspect of the present application provides an electronic device, comprising: at least one processor; at least one memory for storing at least one program; and, when at least one of the programs is executed by at least one of the processors, implementing the intrusion detection method based on the source map as described in any one of the first aspects.

[0016] To achieve the above objectives, a fourth aspect of the present application provides a computer-readable storage medium storing computer-executable instructions for performing the intrusion detection method based on a source map as described in any one of the fourth aspects.

[0017] This application provides an intrusion detection method, apparatus, device, and storage medium based on a source graph. It collects log data generated by a target system, cleans this raw log data to remove irrelevant or erroneous information, ensuring data quality for subsequent processing. The cleaned data is converted into a structured form for easier processing. Furthermore, entity feature information and interaction feature information are extracted from the structured data. Entity feature information refers to various components or entities in the system, such as hosts and user accounts. Interaction feature information refers to the interactions between these entities, such as file access and network communication. These entities and interactions are used to construct a system source graph, with entities as nodes and interactions as edges connecting nodes. Further, preset behavior recognition rules are used to identify benign interactions, and edges representing benign interactions are deleted, resulting in a simplified source graph (reduced source graph). In the reduced source graph, a masking structure is generated for each node based on the interaction feature direction of the edges. The masking structure encoding represents the ability and scope of a node to pass messages among its neighbors. Furthermore, the masking structure encoding, along with the feature information of nodes and edges in the reduced source graph, is used for model training. The goal of the training is to obtain a model capable of identifying node categories, i.e., a node classification model. This trained node classification model is then used to analyze the source graph to be detected, predicting node categories to identify potential intrusion behaviors or malicious nodes. Specifically, this application utilizes the directed acyclic property of the source graph to construct a masking matrix, limiting the message passing range, removing interference from irrelevant nodes, reducing the size of the source graph, and improving the accuracy of node feature aggregation. This reduces false positives and false negatives, improves feature accuracy, and enhances the training effect of subsequent deep learning models. This enables high-accuracy node classification and the processing of large-scale source graphs, achieving precise intrusion detection over a wider range and longer time span, thus helping users more effectively identify potential security threats. Attached Figure Description

[0018] Figure 1 A flowchart illustrating an embodiment of the intrusion detection method based on a source map provided in this application;

[0019] Figure 2 A flowchart illustrating the generation of masking structure encoding in an intrusion detection method based on a source map provided in an embodiment of this application;

[0020] Figure 3 A flowchart illustrating the generation of a masking matrix in an intrusion detection method based on a source map provided in an embodiment of this application;

[0021] Figure 4 A flowchart illustrating the node classification model in an intrusion detection method based on a source graph provided in an embodiment of this application;

[0022] Figure 5 A flowchart illustrating the training task division in an intrusion detection method based on a source map provided in an embodiment of this application;

[0023] Figure 6 A flowchart illustrating distributed model training in an intrusion detection method based on a source graph provided in an embodiment of this application;

[0024] Figure 7 A flowchart of feature extraction in an intrusion detection method based on a source map provided in an embodiment of this application;

[0025] Figure 8 A schematic diagram of the modules corresponding to an intrusion detection device based on a source map provided in an embodiment of this application;

[0026] Figure 9 A schematic diagram of an example of an intrusion detection device based on a source map provided in an embodiment of this application;

[0027] Figure 10 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0029] In some embodiments, although functional modules are divided in the system diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the system or the order in the flowchart. The terms "first," "second," etc., in the specification, claims, and the foregoing drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0030] Furthermore, unless otherwise explicitly specified and limited, the term "connection / linkage" should be interpreted broadly, for example, it can be a fixed connection or a movable connection, a detachable connection or a non-detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection or a connection that can communicate with each other; it can be a direct connection or an indirect connection through an intermediate medium.

[0031] In the description of the embodiments in this application, the terms "one embodiment / implementation," "another embodiment / implementation," or "some embodiments / implementations," "in the above embodiments / implementations," etc., refer to specific features, structures, materials, or characteristics described in conjunction with embodiments or examples that are included in at least two embodiments or implementations disclosed in this application. In this application disclosure, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or implementation. It should be noted that although a logical order is shown in the flowcharts, in some cases, the steps shown or described may be performed in a different order than that shown in the flowcharts.

[0032] Currently, with the widespread application of the Internet, network intrusions are increasing, especially host intrusions. Attackers exploit various vulnerabilities to gain control of hosts and remain dormant for extended periods, engaging in activities such as data theft or remote control, seriously threatening computer security. To address these issues, those skilled in the art have developed intrusion detection technology based on host logs. This technology analyzes host operational behavior by constructing a source graph, thereby identifying malicious behavior.

[0033] However, existing intrusion detection technologies indiscriminately use all interaction information when performing node feature aggregation. A large amount of benign interaction information dilutes the importance of malicious intrusion behavior when performing feature aggregation on target nodes. Furthermore, when the source graph is large, the interaction information of irrelevant nodes can also interfere with the accuracy of feature aggregation on target nodes. This results in limitations in the accuracy and efficiency of existing intrusion detection technologies, making it impossible to process large-scale source graphs.

[0034] Understandably, in order to overcome the limitations of existing technologies, this application provides an intrusion detection method based on a source graph, comprising: acquiring structured data of the target system's logs, extracting feature information to generate a system source graph, wherein the system source graph contains nodes corresponding to each entity feature information and edges corresponding to each interaction feature information, and deleting edges corresponding to benign interaction information in the system source graph to obtain a reduced source graph; determining the masking structure encoding of each node based on the interaction feature direction of each edge in the reduced source graph, and training a model based on the masking structure encoding, the feature information corresponding to each node and each edge in the reduced source graph to obtain a node classification model to detect intrusion nodes in the source graph to be detected. This application can effectively remove interference from benign interaction information and irrelevant nodes for model training, effectively improving the accuracy and efficiency of the intrusion detection method based on the source graph, thereby achieving large-scale source graph processing.

[0035] The embodiments of this application will be further described below with reference to the accompanying drawings.

[0036] refer to Figure 1 , Figure 1A flowchart illustrating an embodiment of the intrusion detection method based on a source graph provided in this application; in some embodiments, this application provides an intrusion detection method based on a source graph, including but not limited to the following steps:

[0037] Step S110: Obtain log data from the target system and perform data cleaning on the log data to obtain structured data;

[0038] Step S120: Extract multiple entity feature information and interaction feature information from the structured data to generate a system traceability graph. The system traceability graph contains the node corresponding to each entity feature information and the edge corresponding to each interaction feature information.

[0039] Step S130: Based on preset behavior recognition rules, identify benign interaction information from multiple interaction feature information, and delete the edges corresponding to benign interaction information in the system source graph to obtain a reduced source graph;

[0040] Step S140: Determine the occlusion structure encoding of each node based on the interaction feature direction of each edge in the reduced source graph. The occlusion structure encoding represents the range of interaction message transmission of each node.

[0041] Step S150: Based on the occlusion structure encoding, the feature information corresponding to each node and each edge in the source graph is reduced to train the model and obtain the node classification model.

[0042] Step S160: Based on the node classification model, predict the node category of the source map to be detected in order to detect the intrusion node in the source map.

[0043] In step S110, the log data of the target system is the log files collected from the monitored or analyzed system. These logs typically record events that occur during system operation, such as user login attempts, file access records, process startups, etc. Data cleaning can be understood as the process of preprocessing the raw log data, including deleting irrelevant or erroneous information and standardizing data formats, with the aim of ensuring the quality of data in subsequent processing. Structured data can be understood as the log data being converted into a structured form after data cleaning, which facilitates subsequent analysis and processing.

[0044] Corresponding to step S120, entity feature information refers to the feature information of each component or entity in the system, such as host, user account, process, etc. Interaction feature information refers to the interaction features between entities, such as file access, network communication, inter-process communication, etc. The system traceability graph is a graphical representation composed of nodes formed by entity feature information and edges formed by interaction feature information. Nodes represent entities, and edges represent the interaction relationships between entities.

[0045] Corresponding to step S130, benign interaction information refers to the interaction behavior generated during normal operation, which is usually harmless and has no negative impact on the normal operation of the system. The reduced source graph is a simplified version of the source graph obtained by deleting the edges representing benign interactions in the system source graph.

[0046] In step S140, the masking structure encoding is a structure encoding generated for each node based on the interaction feature direction of the edges in the reduced source graph. It represents the ability and range of message passing between the node and its neighbors. It can be understood that since the source graph is a directed acyclic graph, the interaction feature direction is the direction of the edge from one node to another in the source graph, and the edge represents the interaction feature information between the nodes.

[0047] Corresponding to step S150, model training based on the occlusion structure encoding and the reduction of the feature information corresponding to each node and each edge in the source graph can be distributed model training. Distributed model training is a parallel processing technique that can decompose the model training task into multiple computing units, which can speed up the model training and is suitable for large-scale datasets. The node classification model is the model obtained through training, which can be used to classify the nodes in the graph and distinguish between normal nodes and intrusion nodes.

[0048] In step S160, the source map to be detected is the source map constructed from the newly collected system log data that needs to be used for intrusion detection. Then, the trained node classification model can be used to classify the nodes in the new source map to identify potential intrusion nodes or malicious behaviors.

[0049] In some embodiments, this application can collect log data generated by the target system, perform data cleaning on this raw log data to remove irrelevant or erroneous information, and ensure the data quality for subsequent processing. The cleaned data is converted into a structured form for easier further processing. Furthermore, entity feature information and interaction feature information are extracted from the structured data. Entity feature information refers to various components or entities in the system, such as hosts and user accounts, while interaction feature information refers to the interactions between these entities, such as file access and network communication. These entity and interaction relationships are used to construct a system origin graph, where entities are nodes and interactions are edges connecting nodes. Further, a preset... Behavioral recognition rules are used to identify benign interactions, and edges representing benign interactions are removed to obtain a simplified source graph, i.e., a reduced source graph. In the reduced source graph, a masking structure code is generated for each node based on the interaction feature direction of the edges. The masking structure code represents the node's ability and range to pass messages among its neighbors. Further, the masking structure code and the feature information of nodes and edges in the reduced source graph are used to train a model. The goal of the training is to obtain a model that can identify node categories, i.e., a node classification model. The trained node classification model is then used to analyze the source graph to be detected. By predicting node categories through the model, potential intrusion behaviors or malicious nodes can be identified.

[0050] Understandably, this application utilizes the directed acyclic property of the source graph to construct a masking matrix, limiting the message transmission range, removing interference from irrelevant nodes, reducing the size of the source graph, and improving the accuracy of node feature aggregation. This reduces false positives and false negatives, improves feature accuracy, and enhances the training effect of subsequent deep learning models. As a result, this application can achieve high-accuracy node classification and handle large-scale source graphs, enabling precise intrusion detection over a wider range and longer time span, thus helping users more effectively identify potential security threats.

[0051] In some embodiments, this application identifies benign interaction information from multiple interaction feature information based on preset behavior recognition rules, and deletes the edges corresponding to benign interaction information in the system source graph, resulting in a reduced source graph that is only processed subsequently. In contrast, existing methods directly process the complete source graph without deleting redundant information, causing intrusion features to be diluted by benign features, leading to a large number of missed detections. This invention filters easily identifiable benign interactions through predefined rules, increasing the proportion of malicious behavior in the graph and reducing the size of the source graph. Specifically, this application can eliminate benign interactions that are unlikely to be attack behaviors based on preset behavior recognition rules, and mark related benign entities. For example, it can eliminate less important and repetitive system process operations such as system startup and backup file updates in the source graph, and mark entities such as resource files as benign entities. Furthermore, this application can also utilize the characteristic that the source graph is a directed acyclic graph to generate a masking matrix to limit the message propagation range in the graph neural network, improving the expressive power of the encoding and effectively reducing the number of missed detections.

[0052] In some embodiments, this application collects log data from the target system, cleans and structures the log data, generates a system source map, identifies and removes benign interaction information from the source map based on preset behavior recognition rules, constructs a masking matrix to limit the scope of message transmission in the graph neural network, trains a model to classify nodes, and directly outputs whether a node is a malicious node and its malicious category. It is understood that existing intrusion detection methods based on source maps determine the existence of intrusion behavior in the source map at the graph level, but cannot specifically point out the intrusion node and intrusion behavior, increasing the workload of subsequent analysis. In the above steps, this application encodes and classifies the node-level and edge-level features in the source map through the training of the graph neural network, and directly outputs whether the node is malicious and its malicious category, effectively reducing the analysis workload of security personnel, thus realizing fine-grained intrusion detection on the source map.

[0053] refer to Figure 2 , Figure 2 In one embodiment of the intrusion detection method based on a source graph provided in this application, a flowchart for generating the masking structure encoding is included. In some embodiments, the masking structure encoding of each node is determined based on the interaction feature direction of each edge in the reduced source graph, including but not limited to the following steps:

[0054] Step S210: Generate the occlusion matrix of each node based on the interaction feature direction of each edge in the reduced source graph and the preset message passing depth.

[0055] Step S220: Form a source subgraph for each node based on each masking matrix, and generate the masking structure code for the corresponding node based on the source subgraph.

[0056] The masking matrix represents the other nodes that a node can receive messages from within its preset message passing depth. The elements in the masking matrix can be used to indicate the reachability between nodes or the possibility of message passing. The message passing depth specifies the maximum distance a message can travel from one node to another, i.e., how far it can travel along an edge in the graph. The source subgraph is a subgraph consisting of a central node and all nodes that can receive messages through the preset message passing depth. The masking structure encoding is an encoding generated based on the structure of the source subgraph, which represents the interaction range and pattern of a node within a specific message passing depth.

[0057] Understandably, in the above process, this application not only relies on establishing a normal behavior model, but also considers normal samples and malicious samples simultaneously, extracting the similarity and behavioral patterns of malicious samples from a topological perspective, thereby enhancing the model's ability to detect unknown malicious samples. Compared with existing methods that mostly model normal behavior and treat deviations as abnormal behavior for intrusion detection, resulting in a large number of false positives, this application can train on both normal and malicious samples simultaneously, extracting the similarity and behavioral patterns of malicious samples from a topological perspective, thus possessing the ability to detect unknown malicious samples. Compared with comparative detection methods, this can reduce the number of false positives of the model.

[0058] refer to Figure 3 , Figure 3 In an intrusion detection method based on a source graph provided in one embodiment of this application, a flowchart for generating a masking matrix is ​​included. In some embodiments, the masking matrix of each node is generated based on the interaction feature direction of each edge in the reduced source graph and a preset message passing depth, including but not limited to the following steps:

[0059] Step S310: Determine several message passing nodes corresponding to each node based on the interaction feature direction of each edge in the reduced source graph and the preset message passing depth.

[0060] Step S320: Generate the masking matrix of the corresponding node based on the several message passing nodes.

[0061] Among them, the message passing node is a node that can be directly or indirectly interacted with within a preset message passing depth of a node. The masking matrix is ​​constructed by determining which nodes can pass messages to each other within the preset message passing depth.

[0062] In some embodiments, generating a masking matrix for a corresponding node based on a plurality of message passing nodes includes: determining the maximum depth n of message passing, which means that each node can focus on its neighbors within n steps at most. Since the message passing path follows the rules of a directed acyclic graph (DAG), that is, it can only be passed along the direction of the edge and cannot be passed in reverse, the message passing path can be confirmed. For each node, the message passing path of its ingress node (i.e. the node pointing to it) can only continue to be passed along these ingress nodes. Similarly, for the outgress node (i.e. the node it points to), the message passing path can only continue to be passed along the outgress nodes.

[0063] Specifically, suppose a malicious script triggers a series of events in the source graph: the malicious script first triggers a packaging operation on sensitive data, followed by an encryption operation, and finally an upload operation. During this process, there is also a situation where a user uses a packaging tool (such as bz ip2) to process a file A. In the above example, the two-layer neighbor transmission of the upload process includes two ingress nodes, namely the encryption process and the packaging process. Although file A is related to the packaging process, it is an outgress node of the packaging process and does not belong to the two-layer neighbor range of the upload process, so it will not be included. Therefore, for the upload process, its masking matrix will identify the encryption process and the packaging process as valid neighbor nodes, while file A is not considered. This ensures that during message transmission, the upload process only focuses on nodes closely related to it, namely the encryption process and the packaging process, and not indirect nodes such as file A.

[0064] In some embodiments, the tracing subgraph includes nodes and several message passing nodes corresponding to the nodes. Generating a masking structure code for the corresponding node based on the tracing subgraph includes: determining the directional connection relationship between the node and several message passing nodes based on the tracing subgraph; and structurally encoding the directional connection relationship based on a preset masking encoding type to obtain the masking structure code for the corresponding node. The purpose of generating the masking structure code is to better limit the message passing range in the graph neural network, improve the accuracy of node feature aggregation, and reduce the influence of irrelevant nodes. This application can determine the connection relationship between the node and several other message passing nodes based on the tracing subgraph, i.e., which nodes can send messages to other nodes. Based on a preset masking encoding type, these directional connection relationships are encoded to obtain the masking structure code. Furthermore, through the masking structure code, only specific message passing paths are allowed. This reduces the influence of irrelevant nodes on the feature aggregation of the target node, more accurately represents the neighbor relationship of the node, and thus improves the expressive power of node features and the accuracy of the model.

[0065] In some embodiments, the pointing connection relationship is structurally encoded based on a preset masking encoding type. The masking encoding type includes, but is not limited to: masking position encoding, masking centrality encoding, masking edge encoding, etc. The following are examples of the above masking encoding types: The masking position encoding of node v can be represented as:

[0066]

[0067] Where d is the node feature dimension used after aggregation, and i is the shortest spatial distance between node v and its neighbor u under the masking matrix. This encoding can be concatenated into the encoding result after the features are encoded, and then passed through the softmax layer to generate the output.

[0068] Masking centrality encoding measures the low position of a node in the graph's structure, and can be measured in degrees.

[0069]

[0070] Here, z is the embedding that can be learned using the in-degree and out-degree under the masking matrix. After obtaining the masking centrality encoding, it can be directly concatenated to the original features of the node for further processing.

[0071] Masked edge encoding can be incorporated into the similarity matrix during node similarity calculation using an attention mechanism.

[0072]

[0073] Among them, the occlusion edge encoding c uv It is the edge feature sequence (e1, e2, ..., e) traversed by the shortest path between nodes u and v. N ) with weights The averaging effect, as understood in the examples of the masking encoding types described above, aims to embed spatial and edge information between nodes into the subgraph corresponding to the masking matrix, in addition to using node features, and integrate this information into the attention calculation process to optimize model training. Various variant encoding methods can be set according to the training situation.

[0074] refer to Figure 4 , Figure 4 In one embodiment of the intrusion detection method based on a source graph provided in this application, a flowchart of obtaining a node classification model is shown. In some embodiments, the node classification model is obtained by training the model based on occlusion structure encoding and reducing the feature information corresponding to each node and each edge in the source graph, including but not limited to the following steps:

[0075] Step S410: Based on the masking structure encoding, the entity feature information corresponding to each node in the source graph and the interaction feature information corresponding to each edge are reduced and then integrated to obtain multiple source features and source relationships with the same dimension.

[0076] Step S420: Train the model of the reduced source map based on the occlusion structure encoding, source features and source relationships corresponding to each node to obtain the node classification model.

[0077] It is understood that, corresponding to steps S410 to S420, this application can integrate node features, edge features, and occlusion structure encoding, and align the dimensions of these features to ensure that they can be used correctly in the model. Node features represent the attributes of each node, such as type and state; edge features represent the information of the edge connecting two nodes, which may include weight, type, etc.; occlusion structure encoding is to encode the connection relationship between nodes and their neighbors based on the occlusion matrix, which is used to control the scope of message passing. The above three features are combined according to preset rules, and the dimensions of all features are consistent so that the model can process these features.

[0078] In some embodiments, feature integration processing can combine the occlusion structure encoding, entity feature information, and interaction feature information of a node to form a unified representation to facilitate model training. The source feature is the feature representation obtained by comprehensively considering the entity features of the node itself and its interaction features with other nodes. The source relationship is the correspondence between the processed nodes and edges.

[0079] In some embodiments, a distributed computing framework can be used to distribute the training task across multiple computing nodes to accelerate the model training process. The node classification model is the model obtained through training, which can determine whether a node is an intrusion node based on the node's feature information.

[0080] refer to Figure 5 , Figure 5 The flowchart below illustrates the training task partitioning process in an intrusion detection method based on a source graph, provided in one embodiment of this application. In some embodiments, a reduced source graph is trained using a model based on the occlusion structure encoding, source features, and source relationships corresponding to each node to obtain a node classification model, including but not limited to the following steps:

[0081] Step S510: Divide the training task into the reduced source map according to the occlusion structure encoding, source features and source relationships corresponding to each node, and obtain the training task division result.

[0082] Step S520: Based on the training task division results, the training data and initial parameters of the model training task corresponding to the reduced source graph are sent to multiple computing units so that the multiple computing units can train the local model parameters of the graph transformer model according to the training data and initial parameters of the model.

[0083] Step S530: Obtain the local model parameter training results fed back by multiple computing units, and summarize and iterate the global model parameters of the graph transformer model based on the training results of multiple local model parameters to obtain the node classification model.

[0084] In some embodiments, this application can divide the entire graph into several small tasks based on the occlusion structure encoding, source tracing features, and source tracing relationships of the nodes. These small tasks can be processed in parallel on different computing units. Then, based on the training task division results, the training data and initial parameters of the model training task corresponding to the reduced source tracing graph are sent to multiple computing units so that multiple computing units can train the local model parameters of the graph transformer model according to the training data and initial model parameters. The training data includes the feature information and labels (normal or intrusive) of the nodes, and the initial model parameters include the parameter settings when the model starts training. The distributed model training process is that each computing unit is responsible for a part of the training data and trains the local model parameters using the same initial model parameters.

[0085] In some embodiments, the training results of local model parameters fed back by multiple computing units are obtained, the training results of local model parameters from all computing units are collected to summarize the global model parameters of the graph transformer model, and the global parameters of the graph transformer model are iteratively adjusted based on the summarized results to improve the model performance, thereby obtaining a node classification model that can distinguish between normal nodes and intrusive nodes.

[0086] Understandably, through steps S510 to S530, this application can reasonably allocate training tasks to different computing nodes based on factors such as the size of the masking matrix of each node, the number of neighbors, and the complexity of features, in order to achieve load balancing. The size of the masking matrix is ​​the size of the masking matrix of each node, which affects the amount of data that the node needs to process. The more neighbors a node has, the more computing resources it usually needs. The complexity of node features and edge features means that complex features require more computation to process. Based on these factors, the model training task is divided into multiple sub-tasks, and these sub-tasks are allocated to different computing nodes to ensure the efficiency of distributed training.

[0087] refer to Figure 6 , Figure 6The flowchart below illustrates the distributed model training process in an intrusion detection method based on a source graph according to one embodiment of this application. In some embodiments, local model parameter training of the graph transformer model is performed based on training data and initial model parameters, including but not limited to the following steps:

[0088] Step S610: Initialize and generate the graph transformer model corresponding to the occlusion structure encoding based on the initial parameters of the model;

[0089] Step S620: Based on the training data, the local model parameters in the graph transformer model are trained with the classification of normal nodes and intrusion nodes in the source tracing graph as the training objective, and the training results of the local model parameters are obtained.

[0090] The graph transformer model, also known as the graph transformer encoder-decoder, is a model suitable for graph-structured data. It can handle complex relationships between nodes. After setting the initial parameters of the model and determining that the training objective is to learn how to accurately distinguish between normal and intrusive nodes, each computing unit can obtain intermediate results based on its own training data and model parameters. The graph transformer model in this application is a customized graph transformer model. This model is modified based on the original graph transformer model, adding masking matrix constraints to control the message passing range and using masking structure encoding instead of traditional structure encoding. Each node independently executes the training task of local model parameters in the graph transformer model according to the assigned sub-tasks and sends the results back to the central node. Through the collaborative work of these modules, the entire system can efficiently process large-scale graph data and utilize distributed computing resources to accelerate the training process.

[0091] It is conceivable that, due to limitations in computing power, existing methods using graph neural network models can only process small-scale source graphs and cannot capture long-span intrusion behaviors in large-scale source graphs. However, this application generates a graph transformer model corresponding to the masking structure encoding based on the initial parameters of the model. This model includes a customized graph Transformer encoder-decoder under the masking matrix, which can reduce the amount of training computation while enabling nodes to pay more attention to distant neighbors and improve the expressive power of feature aggregation. At the same time, the encoder-decoder supports distributed training and realizes the processing of large-scale source graphs.

[0092] In some embodiments, after identifying benign interaction information from multiple interaction feature information based on preset behavior recognition rules and deleting the edges corresponding to benign interaction information in the system source graph to obtain a reduced source graph, the method further includes: dividing each node in the reduced source graph into benign nodes and unknown target nodes based on benign interaction information to obtain node partitioning results; adjusting the analysis and processing of each node based on the node partitioning results during the generation of the masking structure encoding for each node and the model training process. It can be understood that this embodiment, by eliminating benign interactions that are unlikely to be attack behaviors according to preset rules and marking related benign entities, divides nodes into benign nodes and unknown target nodes, which can better focus the analysis of unknown nodes, thereby improving the ability to detect unknown malicious behaviors. For example, eliminating less important and repetitive system process operations such as system startup and backup file updates in the source graph, and marking entities such as resource files as benign entities. Since malicious processes may interact through benign entities, benign entities are retained in the source graph, and thus, during the generation of the masking structure encoding and the model training process, the analysis and processing of each node is adjusted based on the node partitioning results.

[0093] Understandably, removing benign interaction information can reduce the amount of data processed subsequently, increase the proportion of malicious behavior, and allow the model to focus more on detecting unknown malicious behavior. Explicitly dividing nodes into benign nodes and unknown target nodes can help the model better learn the patterns of unknown malicious behavior, thereby improving its ability to detect unknown malicious behavior. This division can reduce false positives caused by benign behavior and increase the detection rate of malicious behavior, thus reducing false negatives.

[0094] refer to Figure 7 , Figure 7 In an intrusion detection method based on a source map provided in one embodiment of this application, a flowchart of feature extraction is included. In some embodiments, multiple entity feature information and interaction feature information are extracted from structured data, including but not limited to the following steps:

[0095] Step S710: Perform data analysis and processing on the structured data to obtain data features of multiple entities and interactive behaviors;

[0096] Step S720: Perform natural language processing on the structured data to obtain semantic features of multiple entities and interactive behaviors;

[0097] Step S730: Extract multiple entity feature information and interaction feature information from multiple data features and semantic features.

[0098] In some embodiments, numerical features extracted from the original data through statistical analysis and other methods, and features extracted from text data through natural language processing techniques, such as relationships between entities, can be used to extract multiple entity feature information and interaction feature information from multiple data features and semantic features. Entity feature information describes the attributes and states of a single entity, while interaction feature information describes the interactions between entities. Through the above steps, this application can effectively improve the performance of the model by extracting and utilizing entity and interaction feature information in structured data.

[0099] In some embodiments, corresponding to steps S710 to S730, this application can collect log records from the host system and perform a series of processing and cleaning on the unstructured log records to transform them into structured data, which facilitates subsequent processing, such as feature extraction, elimination of null values ​​and outliers, etc.; wherein, the extracted features include, but are not limited to, statistical features related to entities and behaviors, numerical features, numerical features are data features, semantic features obtained using natural language processing technology, etc.

[0100] In some embodiments, the extraction of semantic features is exemplified as follows: Considering the following attributes in each entity and interaction attribute, such as the process name and command-line arguments of the process node, the file path of the file node, the network IP address and port of the socket byte node, and the module name of the module node, etc., after arranging them into sentences in order, the Word2Vec model is used to predict the context of the words, a low-dimensional dense vector is generated for each word, and each sentence is encoded into a fixed-length vector to achieve semantic-level embedding of entities and interactions in order to extract semantic features.

[0101] The second aspect of this application provides an intrusion detection device based on a source graph, comprising: a log processing module for acquiring log data of a target system and cleaning the log data to obtain structured data; a source graph processing module for extracting multiple entity feature information and interaction feature information from the structured data to generate a system source graph, wherein the system source graph contains nodes corresponding to each entity feature information and edges corresponding to each interaction feature information; identifying benign interaction information from multiple interaction feature information based on preset behavior recognition rules and deleting edges corresponding to benign interaction information in the system source graph to obtain a reduced source graph; determining the masking structure encoding of each node based on the interaction feature direction of each edge in the reduced source graph, wherein the masking structure encoding represents the interaction message transmission range of each node; a model training module for training a model based on the masking structure encoding, the feature information corresponding to each node and each edge in the reduced source graph to obtain a node classification model; and an intrusion detection module for predicting the node category of the source graph to be detected based on the node classification model to detect intrusion nodes in the source graph to be detected.

[0102] refer to Figure 8 , Figure 8 This is a schematic diagram of a module corresponding to an intrusion detection device based on a source map provided in one embodiment of this application; in some embodiments, Figure 8 The host log processing module corresponds to the log processing module in this application. The host log processing module includes a log cleaning module and a source graph generation module; the source graph processing module includes a benign interaction elimination module, a masking matrix construction module, and a masking structure encoding generation module; the model training module includes a feature alignment module, a subtask allocation module, a distributed training module, and a model parameter update module; the intrusion detection module includes a node classification module and an intrusion node feedback module.

[0103] The system comprises several modules: a log cleaning module for cleaning and formatting raw log data (e.g., deleting irrelevant information and standardizing fields) to ensure data quality and consistency, preparing a clean dataset for subsequent processing; a source graph generation module for constructing a system source graph based on the cleaned log data, generating a graphical representation that reflects the internal interactions of the system, facilitating subsequent analysis and detection of potential abnormal behaviors; a benign interaction elimination module for identifying and removing benign interaction records generated during normal operation to reduce noise and focus on potentially security-threatening abnormal behaviors; a masking matrix construction module for creating a masking matrix based on known security policies or rules to identify which parts are sensitive or irrelevant, protecting privacy while highlighting key security-related data; and a masking structure encoding generation module for converting the masked source graph into a form understandable by machine learning models, preparing it for model training or... The system comprises the following modules: data representation for inference; feature alignment module to adjust data features to meet model input requirements, ensuring consistency and applicability of training data; subtask allocation module to break down large training tasks into smaller subtasks for parallel processing, improving training efficiency and utilizing multi-processor resources; distributed training module to train models using multiple computers or GPUs, accelerating the training process, especially when dealing with large datasets; model parameter update module to periodically update model parameters to improve model performance, optimizing model weights through techniques such as backpropagation to enhance prediction accuracy; node classification module to classify nodes in the graph using the trained model, distinguishing between normal nodes and potentially malicious nodes to identify system components that may be under attack; and intrusion node feedback module to use the classification results to generate alerts or take actions, such as isolating suspicious nodes, responding promptly to security incidents, and minimizing damage.

[0104] It is understandable that the above-mentioned device can achieve fine-grained intrusion detection through a series of processing steps. Specifically, the device of this application can extract necessary information from log data, then filter out benign interactions through rules to increase the proportion of malicious behavior, use a masking matrix to limit the message transmission range in the graph neural network, improve the accuracy of node feature aggregation, and then the model obtained through distributed training can perform node-level intrusion detection on the new source graph, thereby greatly reducing the possibility of false alarms and false negatives.

[0105] refer to Figure 9 , Figure 9 This is a schematic diagram of an example of an intrusion detection device based on a source map provided in one embodiment of this application; in some embodiments, corresponding to Figure 9 This application may include the following steps:

[0106] Data Acquisition: Collect log files from the host under inspection. These logs contain records of system operations.

[0107] Feature extraction and source graph construction: Extract features from log files and construct a source graph (PG), where nodes represent entities (such as users, processes, files, etc.) and edges represent interactions between them.

[0108] Benign interaction elimination: Known benign interactions are filtered out using predefined rules to form a reduced source graph (RPG), which helps reduce the amount of data to be processed later and increases the proportion of malicious behavior.

[0109] Abstraction and Feature Alignment: Abstract the RPG into a graph to be processed and align its features, which can include semantic features and meta-features, to facilitate subsequent analysis and processing.

[0110] Masking matrix construction: Based on the directed acyclic property of the source graph, a masking matrix is ​​constructed to limit the scope of message propagation in the graph neural network. The use of the masking matrix helps to improve the accuracy of node feature aggregation and reduce the demand for computing resources.

[0111] Graph Neural Network Training: Using a masking matrix to guide the message propagation process of the graph neural network, ensuring that the interaction feature direction of message aggregation conforms to the actual structure of the source graph, and combining a graph Transformer encoder-decoder, allowing nodes to focus on more distant neighbors and capture a wider range of related information.

[0112] Distributed training: Utilizing distributed computing clusters for model training improves training speed and efficiency.

[0113] Model prediction: The trained model is used to perform node-level intrusion detection on the source graph to be detected. The output includes potential intrusion nodes and their respective malicious categories.

[0114] Results Feedback and Application: Security administrators receive the detection results, analyze them, and make decisions. The model prediction server returns the results to the security administrators for their reference and action.

[0115] It is understood that, through the above series of steps, this application can perform efficient and accurate analysis on large-scale source graphs. Compared with traditional methods, the source graph rule filtering method proposed in this application can reduce the processing scale, the customized masking matrix can restrict the feature transmission direction, and more accurately represent the nodes in the source graph. Furthermore, the graph Transformer encoder-decoder supports distributed training, enabling the model to converge quickly on large-scale datasets, achieving fine-grained intrusion detection, thereby effectively reducing the number of false positives and false negatives and improving detection accuracy.

[0116] Some embodiments of this application provide an electronic device. Figure 10 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application, with reference to... Figure 10 The electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the intrusion detection method based on the source map of any of the above embodiments, for example, performing the above-described... Figure 1 Method steps S110 to S160, Figure 2 Method steps S210 to S220, Figure 3 Method steps S310 to S320, Figure 4 Method steps S410 to S420, Figure 5 Method steps S510 to S530, Figure 6 Method steps S610 to S620, Figure 7 Method steps S710 to S730.

[0117] The electronic device 1000 of this application embodiment includes one or more processors 1010 and memory 1020. Figure 10 The example uses a processor 1010 and a memory 1020.

[0118] The processor 1010 and the memory 1020 can be connected via a bus or other means. Figure 10 Taking the example of a connection between China and Israel via a bus.

[0119] Memory 1020, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory 1020 may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory 1020 may optionally include memory 1020 remotely located relative to processor 1010. These remote memories can be connected to electronic device 1000 via a network, and examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0120] In some embodiments, when the processor executes a computer program, it executes the intrusion detection method based on the source map of any of the above embodiments at preset intervals.

[0121] Those skilled in the art will understand that Figure 10 The device structure shown does not constitute a limitation on the electronic device 1000, and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0122] exist Figure 10 In the electronic device 1000 shown, the processor 1010 can be used to call the intrusion detection method based on the source map stored in the memory 1020, thereby realizing the intrusion detection method based on the source map.

[0123] Based on the hardware structure of the aforementioned electronic device 1000, various embodiments of the intrusion detection device based on source graphs of this application are proposed. Meanwhile, the non-transient software programs and instructions required to implement the intrusion detection method based on source graphs of the aforementioned embodiments are stored in a memory. When executed by a processor, the intrusion detection method based on source graphs of the aforementioned embodiments is executed.

[0124] This application also provides a computer-readable storage medium storing computer-executable instructions for executing the aforementioned source-tracing graph-based intrusion detection method. These instructions enable one or more processors to execute the source-tracing graph-based intrusion detection method of any of the above embodiments, for example, executing the methods described above. Figure 1 Method steps S110 to S160, Figure 2 Method steps S210 to S220, Figure 3 Method steps S310 to S320, Figure 4 Method steps S410 to S420, Figure 5 Method steps S510 to S530, Figure 6 Method steps S610 to S620,Figure 7 Method steps S710 to S730.

[0125] This application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. A processor of a computer device reads the computer program from the computer-readable storage medium and executes the computer program, causing the computer device to perform an intrusion detection method based on a source map that implements any of the above embodiments, for example, performing the above-described intrusion detection method. Figure 1 Method steps S110 to S160, Figure 2 Method steps S210 to S220, Figure 3 Method steps S310 to S320, Figure 4 Method steps S410 to S420, Figure 5 Method steps S510 to S530, Figure 6 Method steps S610 to S620, Figure 7 The method steps S710 to S730 described above are merely illustrative. The units described as separate components may or may not be physically separated; that is, they may be located in one place or distributed across multiple network nodes. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0126] Those skilled in the art will understand that all or some of the steps and systems in the methods disclosed above can be implemented as software, firmware, hardware, and suitable combinations thereof. Some or all of the physical components can be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, which can include computer-readable storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer-readable storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer-readable storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, as is known to those skilled in the art, communication media typically include computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium. The above is a detailed description of the preferred embodiments of this application, but this application is not limited to the above embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of this application, and these equivalent modifications or substitutions are all included within the scope defined by the claims of this application.

Claims

1. A method of intrusion detection based on a provenance graph, the method comprising: receiving a query for a provenance graph; retrieving the provenance graph; and providing the provenance graph to the query. The method comprises: obtaining log data of a target system, and performing data cleaning on the log data to obtain structured data; extracting a plurality of entity feature information and interaction feature information from the structured data, and generating a system trace graph, wherein the system trace graph comprises a node corresponding to each entity feature information and an edge corresponding to each interaction feature information; based on a preset behavior recognition rule, identifying benign interaction information from the plurality of interaction feature information, and deleting the edge corresponding to the benign interaction information in the system trace graph to obtain a reduced trace graph; determining a masking structure code of each node according to an interaction feature direction of each edge in the reduced trace graph, wherein the masking structure code represents an interaction message transmission range of each node; based on the masking structure code, each node in the reduced trace graph, and the feature information corresponding to each edge, performing model training to obtain a node classification model; based on the node classification model, predicting the node category of a to-be-detected trace graph to detect an intrusion node in the to-be-detected trace graph; wherein: the determination of the masking structure code of each node according to the interaction feature direction of each edge in the reduced trace graph comprises: generating a masking matrix of each node according to the interaction feature direction of each edge in the reduced trace graph and a preset message transmission depth; forming a trace subgraph of each node based on the masking matrix, and generating a masking structure code of the corresponding node according to the trace subgraph; the generation of the masking matrix of each node according to the interaction feature direction of each edge in the reduced trace graph and the preset message transmission depth comprises: determining a plurality of message transmission nodes corresponding to each node according to the interaction feature direction of each edge in the reduced trace graph and the preset message transmission depth; generating a masking matrix of the corresponding node according to the plurality of message transmission nodes; the trace subgraph comprises the node and the plurality of message transmission nodes corresponding to the node, and the generation of the masking structure code of the corresponding node according to the trace subgraph comprises: determining a directed connection relationship between the node and the plurality of message transmission nodes according to the trace subgraph; based on a preset masking coding type, performing structure coding on the directed connection relationship to obtain the masking structure code of the corresponding node.

2. The provenance graph based intrusion detection method of claim 1, wherein, the model training based on the masking structure code, each node in the reduced trace graph, and the feature information corresponding to each edge to obtain the node classification model comprises: based on the masking structure code, the entity feature information corresponding to each node in the reduced trace graph, and the interaction feature information corresponding to each edge, performing feature integration processing to obtain a plurality of trace features and trace relationships with the same dimension; based on the masking structure code corresponding to each node, the trace features, and the trace relationships, performing model training on the reduced trace graph to obtain the node classification model.

3. The provenance graph based intrusion detection method of claim 2, wherein, the model training based on the masking structure code corresponding to each node, the trace features, and the trace relationships to obtain the node classification model comprises: According to the mask structure code corresponding to each node, the trace feature and the trace relationship, the reduced trace graph is divided into training tasks to obtain a training task division result; According to the training task division result, training data and model initial parameters corresponding to the model training task of the reduced trace graph are sent to a plurality of computing units, so that the plurality of computing units respectively perform local model parameter training of the graph transformer model according to the training data and the model initial parameters; Obtain the local model parameter training result fed back by the plurality of computing units, and perform global model parameter summarization and iteration of the graph transformer model based on the plurality of local model parameter training results to obtain a node classification model.

4. The provenance graph-based intrusion detection method of claim 3, wherein, The local model parameter training of the graph transformer model according to the training data and the model initial parameters comprises: Initializing the generation of the graph transformer model corresponding to the mask structure code based on the model initial parameters; Based on the training data, training the local model parameters in the graph transformer model with the training target of classifying normal nodes and intrusion nodes in the trace graph to obtain a local model parameter training result.

5. The provenance graph based intrusion detection method of claim 1, wherein, After the benign interaction information is identified from the plurality of interaction feature information based on the preset behavior recognition rule, and the edges corresponding to the benign interaction information in the system trace graph are deleted to obtain a reduced trace graph, the method further comprises: Based on the benign interaction information, each node in the reduced trace graph is divided into a benign node and an unknown target node to obtain a node division result; In the process of generating the mask structure code of each node and performing model training, the analysis and processing process of each node is adjusted based on the node division result.

6. The provenance graph based intrusion detection method of claim 1, wherein, The plurality of entity feature information and interaction feature information are extracted from the structured data, comprising: Performing data analysis and processing on the structured data to obtain data features of a plurality of entities and interaction behaviors; Performing natural language processing on the structured data to obtain semantic features of a plurality of entities and interaction behaviors; Extracting a plurality of entity feature information and interaction feature information from a plurality of data features and semantic features.

7. An intrusion detection apparatus based on a provenance graph, characterized by, Comprise: A log processing module for obtaining log data of a target system and performing data cleaning on the log data to obtain structured data; A trace graph processing module for extracting a plurality of entity feature information and interaction feature information from the structured data, generating a system trace graph, the system trace graph comprising a node corresponding to each entity feature information and an edge corresponding to each interaction feature information; identifying benign interaction information from a plurality of interaction feature information based on a preset behavior recognition rule, and deleting edges corresponding to the benign interaction information in the system trace graph to obtain a reduced trace graph; determining the mask structure code of each node according to the interaction feature direction of each edge in the reduced trace graph, the mask structure code representing the interaction message transmission range of each node; A model training module for performing model training based on the mask structure code, the feature information corresponding to each node and each edge in the reduced trace graph to obtain a node classification model; The intrusion detection module is configured to perform node category prediction on a to-be-detected provenance graph based on the node classification model to detect an intrusion node in the to-be-detected provenance graph. Wherein: The determination of the masking structure code of each node according to the interaction feature direction of each edge in the reduced provenance graph comprises: Generating a masking matrix of each node according to the interaction feature direction of each edge in the reduced provenance graph and a preset message passing depth; Forming a provenance subgraph of each node based on the masking matrix, and generating a masking structure code of the corresponding node according to the provenance subgraph; The generation of the masking matrix of each node according to the interaction feature direction of each edge in the reduced provenance graph and the preset message passing depth comprises: Determining a plurality of message passing nodes corresponding to each node according to the interaction feature direction of each edge in the reduced provenance graph and the preset message passing depth; Generating a masking matrix of the corresponding node according to the plurality of message passing nodes; The provenance subgraph comprises the node and the plurality of message passing nodes corresponding to the node, and the generation of the masking structure code of the corresponding node according to the provenance subgraph comprises: Determining a directed connection relationship between the node and the plurality of message passing nodes according to the provenance subgraph; Structurally encoding the directed connection relationship based on a preset masking code type to obtain the masking structure code of the corresponding node.

8. An electronic device, comprising: Comprise: At least one processor; At least one memory for storing at least one program; When at least one of the programs is executed by at least one of the processors, the at least one program implements the provenance graph-based intrusion detection method according to any one of claims 1 to 6.

9. A computer-readable storage medium storing computer-executable instructions for executing the provenance graph-based intrusion detection method according to any one of claims 1 to 6.

Images