Network threat detection method, device, equipment and program product

Abstract

The invention provides a network threat detection method, apparatus and device, and a program product. The method comprises the steps of obtaining a first double-layer traceability graph determined by a plurality of first behavior logs of a target system; the first double-layer traceability graph comprises a first layer and a second layer, the first layer comprises a plurality of first sub-graphs, each first sub-graph comprises a plurality of first nodes, the first nodes are entities corresponding to the first behavior logs in the target system, and edges between the first nodes correspond to operations of the first behavior logs; the second layer comprises a plurality of first super nodes, each first super node corresponds to one first sub-graph, and edges between the first sub-graphs are super edges of the second layer; determining abnormal super nodes in a plurality of first super nodes included in the second layer according to the first double-layer traceability graph; and determining an abnormal node from the first sub-graph corresponding to the abnormal super node. According to the method, the abnormal node is determined in the first sub-graph corresponding to the abnormal super node, so that the calculation amount for detecting the abnormal node can be greatly reduced, and the abnormal node can be positioned more quickly.

Description

Technical Field

[0001] The present application belongs to the field of network security technology, and in particular, relates to a network threat detection method, device, equipment and program product. Background Art

[0002] Advanced Persistent Threat (APT) represents a class of highly sophisticated and long-lasting cyber attacks that aim to infiltrate target systems in a covert manner, steal sensitive data, disrupt normal operations, and maintain control over the systems. These attacks pose a serious challenge to global cybersecurity.

[0003] As the main means of defending against APT attacks, intrusion detection systems (IDS) traditionally use traceability graphs to describe the interaction between system entities (such as processes and files), use nodes and edges to represent behavioral operations (such as reading and writing) in system logs, and use rule-based or statistical methods to detect anomalies. However, as attack methods become increasingly complex, these traditional methods are unable to cope with advanced threats.

[0004] In recent years, the rise of graph neural network (GNN) models has brought new opportunities to IDS. GNN can learn and model the normal behavior patterns of the system from the data traceability graph, so as to identify anomalies more effectively. However, GNN faces computing and memory bottlenecks when processing ultra-large-scale graphs. A typical system traceability graph may cover weeks to months of operating data and contain millions or even tens of millions of nodes, which far exceeds the processing capacity of existing GNN models. Summary of the invention

[0005] The embodiments of the present application provide a network threat detection method, apparatus, device and program product, which can solve the problems of computing and memory bottlenecks faced by traditional graph neural network models when processing ultra-large-scale graphs.

[0006] In a first aspect, an embodiment of the present application provides a network threat detection method, including:

[0007] Obtain a first two-layer traceability graph determined by multiple first behavior logs of the target system; the first two-layer traceability graph includes a first layer and a second layer, wherein the first layer includes multiple first subgraphs, the first subgraph includes multiple first nodes, the first nodes are entities corresponding to the first behavior logs in the target system, and the edges between the first nodes correspond to operations / behaviors of the first behavior logs; the second layer includes multiple first super nodes, each of the first super nodes corresponds to one first subgraph, and the edges between the first subgraphs are super edges of the second layer;

[0008] Determine, according to the first two-layer traceability graph, an abnormal super node among the plurality of first super nodes included in the second layer;

[0009] An abnormal node is determined from the first subgraph corresponding to the abnormal supernode.

[0010] In a possible implementation manner of the first aspect, a plurality of first behavior logs in the target system are obtained;

[0011] According to the plurality of first behavior logs, a plurality of first nodes connected with edges are obtained;

[0012] According to the plurality of first nodes connected with edges, a first layer of the first double-layer traceability graph is constructed, wherein the first layer includes a plurality of first subgraphs, and the plurality of first behavior logs are all added to the first subgraphs;

[0013] Each of the first subgraphs corresponds to a first supernode, and the edges between the first subgraphs are used as superedges to construct the second layer of the first double-layer traceability graph, thereby obtaining the first double-layer traceability graph.

[0014] In a possible implementation manner of the first aspect, the method further includes:

[0015] If the first supernode exceeds one or more of the preset number, a new first double-layer traceability graph is jointly constructed based on the one or more first supernodes that exceed and the multiple first supernodes that are connected to the one or more first supernodes that exceed through hyperedges; the sum of the number of the one or more first supernodes that exceed and the multiple first supernodes that are connected to the one or more first supernodes that exceed through hyperedges is less than or equal to the preset number;

[0016] Alternatively, if the first supernodes reach the preset number, a third layer of the first two-layer traceability graph is constructed, the supernodes of the third layer include a plurality of the first supernodes, and the hyperedges of the third layer are the hyperedges between the supernodes in the third layer; until the number of supernodes in the top layer is less than or equal to the preset number;

[0017] Alternatively, if the first super nodes reach the preset number, one or more first super nodes that are constructed earliest or are the farthest away and the corresponding first nodes are discarded.

[0018] In a possible implementation manner of the first aspect, obtaining a plurality of first nodes connected with edges according to the first behavior log includes:

[0019] Each time a first behavior log is obtained, the first behavior log is preprocessed into a unified format; the preprocessed first behavior log includes one or more of the following: a timestamp, a source UUID, a target UUID, a source system entity type, a target system entity type, and a behavior type;

[0020] The source UUID and the target UUID are used as the first nodes of the first layer of the first two-layer traceability graph, and the source system entity type and the target system entity type are used as the node types of the first layer of the first two-layer traceability graph. An edge is established between the UUID and the target UUID according to the timestamp and the behavior type to obtain multiple first nodes connected with edges.

[0021] In a possible implementation manner of the first aspect, the method further includes:

[0022] Determining a predicted behavior feature vector of the first supernode through a graph neural network model;

[0023] If a deviation between the predicted behavior feature vector of the first super node and the actual behavior feature vector of the first super node is greater than or equal to a first threshold, the first super node is determined to be an abnormal super node.

[0024] In a possible implementation manner of the first aspect, determining the predicted behavior feature vector of the first super node by using a graph neural network model includes:

[0025] Extracting a behavior feature vector of each of the first super nodes through the graph neural network model;

[0026] Masking one or more of the first supernode types, corresponding hyperedges, and attributes;

[0027] The graph neural network model is used to predict the behavior feature vector of the masked first super node based on the behavior feature vectors of the first super nodes around the masked first super node.

[0028] In a possible implementation manner of the first aspect, determining the abnormal node from the first subgraph corresponding to the abnormal supernode includes:

[0029] Predicting, by means of a graph neural network model, a predicted behavior feature vector of any first node in the first subgraph corresponding to the abnormal supernode;

[0030] If a deviation between the predicted behavior feature vector of the first node and the actual behavior feature vector of the first node is greater than or equal to a second threshold, the first node is determined to be an abnormal node.

[0031] In a possible implementation manner of the first aspect, determining the abnormal node from the first subgraph corresponding to the abnormal supernode includes:

[0032] Extracting the feature vector of each first node and the feature vector of the edge in the abnormal super node through a graph neural network model;

[0033] Determine, according to the feature vector of the first node in the abnormal supernode, the feature vector of the edge and the attribute, the behavior feature vector of each of the first nodes in the abnormal supernode and the behavior feature vector of the abnormal supernode;

[0034] Masking one or more of the first nodes, corresponding edges and attributes within the abnormal supernode;

[0035] Predicting, by the graph neural network model, a feature vector of the masked first node and a feature vector of the edge based on feature vectors of the first nodes and feature vectors of the edges around the masked first node;

[0036] The abnormal node is determined based on the error between the predicted feature vector of the first node and the actual feature vector of the first node, the error between the predicted feature vector of the edge and the actual feature vector of the edge, and the similarity between the predicted behavior feature vector of the masked first node and the behavior feature vector of the abnormal super node.

[0037] In a possible implementation manner of the first aspect, after determining the abnormal node from the first subgraph corresponding to the abnormal supernode, the method further includes:

[0038] The abnormal nodes are connected to obtain an attack activity graph.

[0039] In a possible implementation manner of the first aspect, the method further includes:

[0040] Obtain multiple security behavior logs in the target system;

[0041] According to the plurality of the security behavior logs, a second two-layer traceability graph is constructed; the first layer of the second two-layer traceability graph includes a plurality of second subgraphs, the second subgraph includes a plurality of second nodes, the second nodes are entities corresponding to the security behavior logs in the target system, and the edges between the second nodes correspond to the operations / behaviors of the security behavior logs; each second supernode of the second layer of the second two-layer traceability graph corresponds to one second subgraph, and the edges between the second subgraphs are the hyperedges of the second layer of the second two-layer traceability graph;

[0042] Training an initial graph neural network model based on the first layer of the second two-layer traceability graph, so that the initial graph neural network model learns the behavior characteristics between the second nodes in the second subgraph;

[0043] The initial graph neural network model is trained based on the second layer of the second two-layer traceability graph, so that the initial graph neural network model learns the behavioral characteristics between the second super nodes to obtain the graph neural network model.

[0044] In a possible implementation manner of the first aspect, the training of an initial graph neural network model based on the first layer of the second two-layer traceability graph so that the initial graph neural network model learns behavioral characteristics between the second nodes in the second subgraph includes:

[0045] Extracting a behavior feature vector of the second node in the second subgraph by using the initial graph neural network model;

[0046] Masking one or more of the second node types, corresponding edges, and attributes in the second subgraph;

[0047] Recovering the behavior feature vector of the masked second node according to the behavior feature vector of the second node around the masked second node through the initial graph neural network model;

[0048] Based on the restored behavior feature vector of the masked second node and the actual behavior feature vector of the masked second node, the loss function of the initial graph neural network model is trained to enable the initial graph neural network model to learn the behavior characteristics between the second nodes in the second subgraph.

[0049] In a possible implementation manner of the first aspect, the training of the initial graph neural network model based on the second layer of the second two-layer traceability graph so that the initial graph neural network model learns the behavior characteristics between the second super nodes to obtain the graph neural network model includes:

[0050] Mapping the behavior feature vector of the second node in the second subgraph to the corresponding second supernode;

[0051] Extracting a behavior feature vector of the second super node through the initial graph neural network model;

[0052] Masking one or more of the second supernode types, corresponding hyperedges and attributes;

[0053] Recovering the behavior feature vector of the masked second super node according to the behavior feature vectors of the second super nodes around the masked second super node through the initial graph neural network model;

[0054] The initial graph neural network model is trained according to the restored masked behavior feature vector of the second super node and the actual masked behavior feature vector of the second super node, so that the initial graph neural network model learns the behavior characteristics between the second super nodes to obtain the graph neural network model.

[0055] In a second aspect, an embodiment of the present application provides a network threat detection device, including:

[0056] An acquisition module is used to acquire a first two-layer traceability graph determined by multiple first behavior logs of a target system; the first two-layer traceability graph includes a first layer and a second layer, wherein the first layer includes multiple first subgraphs, the first subgraph includes multiple first nodes, the first nodes are entities corresponding to the first behavior logs in the target system, and the edges between the first nodes correspond to operations / behaviors of the first behavior logs; the second layer includes multiple first super nodes, each of the first super nodes corresponds to one first subgraph, and the edges between the first subgraphs are super edges of the second layer;

[0057] A first determining module, configured to determine an abnormal super node among a plurality of first super nodes included in the second layer according to the first double-layer traceability graph;

[0058] The second determining module is used to determine an abnormal node from the first subgraph corresponding to the abnormal supernode.

[0059] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements a method as described in any one of the first aspects when executing the computer program.

[0060] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described in any one of the first aspects is implemented.

[0061] In a fifth aspect, an embodiment of the present application provides a computer program product. When the computer program product is run on an electronic device, the electronic device executes the method described in the first aspect.

[0062] It can be understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here.

[0063] Compared with the prior art, the embodiments of the present application have the following beneficial effects: the embodiments of the present application construct a first double-layer traceability graph to first determine whether there is an abnormal super node in the first super node. If there is an abnormal super node, since the abnormal node is determined in the first node in the first subgraph corresponding to the abnormal super node, the amount of calculation for detecting the abnormal node can be greatly reduced, and the abnormal node can be located more quickly. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0065] Figure 1 It is a schematic diagram of the principle of a network threat detection method provided by an embodiment of the present application;

[0066] Figure 2 This is a schematic diagram of the process of a network threat detection method provided by an embodiment of the present application. Figure 1 ;

[0067] Figure 3 It is a schematic diagram of processing edges in different situations in the process of constructing a second double-layer traceability graph provided by an embodiment of the present application;

[0068] Figure 4 It is a schematic diagram of a multi-layer traceability graph structure provided by an embodiment of the present application;

[0069] Figure 5 This is a schematic diagram of the process of a network threat detection method provided by an embodiment of the present application. Figure 2 ;

[0070] Figure 6 It is a structural diagram of a network threat detection device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0071] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0072] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0073] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0074] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0075] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0076] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0077] See also Figure 1-Figure 2 , Figure 1 The schematic diagram of the network threat detection method provided by the present application is shown. Figure 1It can be seen from the figure that the method includes four stages: second double-layer traceability graph construction, model training, anomaly detection, and attack activity graph generation. The second double-layer traceability graph construction stage refers to constructing a two-layer traceability graph through security behavior logs. The first layer traceability graph includes multiple second subgraphs, each second subgraph includes multiple second nodes; each second subgraph corresponds to a second supernode of the second layer traceability graph. The model training stage refers to training the initial graph neural network model through the second double-layer traceability graph, so that the initial graph neural network model learns the behavioral feature vectors of the second supernode and the second node, and obtains the graph neural network model. The anomaly detection stage is equivalent to the model deployment stage. The first double-layer traceability graph is constructed by obtaining the first behavior log of the target system. The first double-layer traceability graph includes multiple first subgraphs, each first subgraph includes multiple first nodes; then the graph neural network model is used to predict whether the first supernode is an abnormal supernode. If so, the abnormal node is determined in the first subgraph corresponding to the abnormal supernode. The attack activity graph generation stage refers to connecting the abnormal nodes through the edges between them for security analysts to conduct in-depth investigations.

[0078] Figure 2 A schematic flowchart of a network threat detection method provided in an embodiment of the present application is shown, including steps S110-S140.

[0079] S110: Acquire multiple security behavior logs in the target system.

[0080] Target systems are systems that require network threat detection.

[0081] Behavior logs are log files that record various activities that occur in a system or network. These logs can contain information about user logins, file accesses, system command executions, network connections, etc. Behavior logs can be divided into safe behavior logs and malicious behavior logs based on whether the behavior logs are safe. Safe behavior logs are normal behavior logs / non-abnormal behavior logs / non-malicious behavior logs.

[0082] S120: Based on multiple security behavior logs, obtain (i.e., construct) a second two-layer traceability graph; the first layer of the second two-layer traceability graph includes multiple second subgraphs, the second subgraph includes multiple second nodes, the second nodes are entities corresponding to the security behavior logs in the target system, and the edges between the second nodes correspond to the operations / behaviors of the security behavior logs; the second supernode of the second layer of each second two-layer traceability graph corresponds to a second subgraph, and the edges between the second subgraphs are hyperedges of the second layer of the second two-layer traceability graph.

[0083] After obtaining the security behavior log, the security behavior log may be preprocessed. Exemplarily, the preprocessing is to convert the security behavior log into a unified format, including one or more of the following fields: timestamp, source UUID, target UUID, source system entity type, target system entity type, and behavior type.

[0084] The timestamp records the time when the action occurred.

[0085] UUID (Universally Unique Identifier) ​​is a standardized identifier used to uniquely identify information in a computer system. The design goal of UUID is to ensure that identifiers generated in different systems and at different times are not repeated, thereby ensuring their uniqueness.

[0086] The system entity can be identified based on the source UUID and target UUID in the security behavior log. When constructing the second two-layer traceability graph, the system entity corresponding to the source UUID and the target UUID will become the second node in the first layer graph, where the system entity corresponding to the source UUID is equivalent to the head node, and the system entity corresponding to the target UUID is equivalent to the tail node.

[0087] System entity types include: process, file, user, device, memory, system service, etc. The source system entity type is the system entity type of the head node, and the target system entity type is the system entity type of the tail node.

[0088] Behavior refers to operations / events. Behavior types include: read, write, delete, create, log in, access, send, download, upload, copy, modify, permission change, backup, restore, move, compress, decompress, open, close, etc.

[0089] When constructing the second two-layer traceability graph, each security behavior log record corresponds to an edge of the first layer of the second two-layer traceability graph, indicating the interaction relationship / association relationship between the head node and the tail node.

[0090] For example, "At 12:00:00 on November 5, 2024, user A sent a request to service B", where November 5, 2024, 12:00:00 is the timestamp, user A is the head node, service B is the tail node, user is the system entity type of the head node, service is the system entity type of the tail node, and send is the behavior type, then an edge is established between user A and service B.

[0091] It is easy to understand that the head node and tail node refer to a certain security behavior log. The tail node of the previous security behavior log may be the head node of the next security behavior log.

[0092] Optionally, each time a security behavior log is obtained, the security behavior log is established in the first layer of the second double-layer traceability graph, until all 20,000 security behavior logs or half an hour are built into the first layer of the second double-layer traceability graph. When the number of second nodes in the first layer of the second double-layer traceability graph reaches a preset number (such as 300), the current second subgraph is obtained, and a new second subgraph is started.

[0093] Each second supernode of the second layer of the second two-layer traceability graph represents a second subgraph in the first layer, and the hyperedges represent the interaction relationship between the second subgraphs.

[0094] For example, see Figure 3 , Figure 3 The figure shows the processing diagram of the edges in different situations in the process of constructing the second two-layer traceability graph. When constructing the first layer of the second two-layer traceability graph, for each edge corresponding to the security behavior log record (for example, A→B), it is processed according to the following strategy: First, if the second node A and the second node B do not appear in the first layer graph, a new second subgraph is created, including the second node A and the second node B, and an edge from the second node A to the second node B is added between them (such as Figure 3 Second, if the second node A already exists in the first-layer graph, and the number of second nodes in the second subgraph where it is located is less than 300, add the second node B to the second subgraph and add the edge A→B (corresponding to Figure 3 If the second subgraph where the second node A is located is full (the number of second nodes reaches 300), a new second subgraph is created; the new second subgraph contains the second node A and the second node B, an edge A→B is added, and the second node A in the new second subgraph is connected to the second node A in the previous second subgraph through a virtual edge to maintain the association of the second node A (such as Figure 3 S2.2 in ).

[0095] When the second node A and the second node B both exist in the first-layer graph, no matter they are in the same second subgraph or different second subgraphs, an edge A→B will be directly added between them (corresponding to Figure 3 S3.1 and S3.2 in ). If the edge A→B already exists, update its timestamp. Continue to process all security behavior logs within the time window (such as half an hour) according to the above strategy until all edges are added to the first layer graph.

[0096] Once the second subgraph of the first layer of the second two-layer traceability graph is determined, the structure of the second layer is naturally formed. Thus, a corresponding second supernode is created in the second layer for each second subgraph of the first layer, and edges (i.e., hyperedges) are added between these second supernodes. The hyperedges represent the association relationship between the second subgraphs. If there is an edge across the second subgraph in the first layer (i.e., there is an edge A→B between the second node in one second subgraph and the second node in another second subgraph), an edge is added between the corresponding second supernodes in the second layer. When the edge types across the second subgraphs are the same (for example, they are all write operations), only the timestamps of the edges are updated, similar to the way existing edges are processed in the first layer processing. Through this method, the embodiment of the present invention effectively constructs a simplified graph of the second layer and captures the global associations between the second subgraphs.

[0097] Due to the computational bottleneck problem, if the initial graph neural network model processes the node size of each layer, it needs to be controlled within 300. If the number of second super nodes in the second layer reaches 300 (that is, the number of second subgraphs reaches 300), any of the following three methods can be used:

[0098] (1) Continue to generate the second super nodes. For the part exceeding 300 second super nodes, for example, exceeding 50 second super nodes, the 50 second super nodes exceeding the limit and the 250 second super nodes connected to the 50 second super nodes through hyperedges are used to construct a new second double-layer traceability graph. That is to say, when selecting the 250 second super nodes, it is necessary to select the 250 second super nodes connected to the 50 second super nodes exceeding the limit through hyperedges. The 50 second super nodes not selected from the original 300 second super nodes do not participate in the construction of the second double-layer graph, but the 50 second super nodes not selected are not deleted, and the 50 second super nodes not selected can be saved. It should be noted that when selecting the 250 second super nodes, since each second super node may have more than one hyperedge, multiple links may be formed, so there are multiple selection possibilities, such as selection based on time, connectivity (connection weight), average selection of multiple links, etc. This embodiment does not limit this. It is worth noting that it is not necessary to select 250 second super nodes, and the number selected can be less than 250.

[0099] (2) Discard multiple (e.g., 50) second super nodes and corresponding second nodes that are constructed earliest or are the farthest away. This allows the second double-layer traceability graph to accommodate 50 new second super nodes and maintain contextual coherence. The 50 second super nodes with the farthest distance refer to the 50 second super nodes with the farthest distance in the link formed by the 300 second super nodes.

[0100] (3) Start to build the third layer on top of the second layer of the second double-layer traceability graph, pack the 300 second supernodes as the supernodes of the third layer, and the hyperedges of the third layer are the hyperedges between the supernodes in the third layer; and so on, until the number of supernodes in the top layer is less than or equal to 300. Therefore, each layer is an abstract or compressed version of the layer below it, and the top layer can reflect the overall behavioral characteristics. If it is necessary to build a third layer, a fourth layer, and so on, the second double-layer traceability graph becomes a multi-layer traceability graph. The structure of the completed multi-layer traceability graph is shown in Figure 4 .

[0101] Through the above strategy, the embodiment of the present invention constructs a second two-layer traceability graph from the security behavior log without first generating a large traceability graph and then dividing it. This not only improves the construction efficiency, but also ensures that the graph of each layer is within the scale that the graph neural network can handle, while retaining the integrity and relevance of the security behavior log. This greatly alleviates the computational bottleneck problem of the graph neural network model when processing ultra-large-scale traceability graphs, laying a solid foundation for subsequent model training and anomaly detection.

[0102] S130: Train an initial graph neural network model based on the first layer of the second double-layer traceability graph, so that the initial graph neural network model learns the behavioral characteristics between the second nodes in the second subgraph.

[0103] By using the initial graph neural network model to learn the interior of each second subgraph, local behavioral characteristics can be learned.

[0104] Behavioral characteristics refer to the behavior patterns exhibited by the second node during system operation. These behavioral characteristics may include:

[0105] Activity type: different behaviors or operations, such as logging in, accessing data, modifying records, etc.

[0106] Frequency: The number of times a behavior occurs, reflecting how common it is;

[0107] Temporal characteristics: the time distribution of the behavior, such as peak period, trough period, etc.

[0108] Sequentiality: The order in which behaviors occur, which can reveal certain causal relationships or dependencies.

[0109] Behavioral features include structural features. Structural features refer to a structure composed of multiple second nodes and multiple edges. This structure may be linear, circular, tree-like, mesh-like, center-divergent, etc. The process of constructing the first layer of the second two-layer traceability graph based on security behavior logs is the process of forming structural features.

[0110] S140: Train the initial graph neural network model based on the second layer of the second double-layer traceability graph, so that the initial graph neural network model learns the behavioral characteristics between the second super nodes, and obtains the graph neural network model.

[0111] By learning the second layer of the second double-layer traceability graph, we can make up for the deficiency of ignoring the relationship between the second subgraphs in the first layer learning, and the obtained graph neural network model can understand the overall behavioral characteristics.

[0112] The embodiment of the present invention learns behavioral features in order from the bottom layer (first layer) to the top layer (second layer), and the second layer integrates the behavioral features of the first layer. The model learning process is also the process of the model understanding the behavioral features of the second double-layer traceability graph, which reflects the order and dependencies of system activities. Normal system behavior usually follows specific behavioral patterns, while malicious activities often destroy these patterns.

[0113] Since the second double-layer traceability graph is constructed from security behavior logs, the second nodes in the second double-layer traceability graph are all normal nodes, and the second super nodes are all normal super nodes; the graph neural network model trained based on the second double-layer traceability graph can enable the graph neural network model to learn the behavioral characteristics of normal nodes and normal super nodes. After the model is deployed (i.e., the model anomaly detection phase), if there is a significant deviation in the behavioral characteristics of a node / super node and a normal node / normal super node, it is determined that the node / super node may be abnormal, and thus it is detected.

[0114] This embodiment establishes a second two-layer system traceability graph to retain the complete data flow in the large-scale graph while ensuring that the scale of each layer of the graph is within the range that the graph neural network can effectively process, thereby learning sufficient behavioral information without causing excessive system overhead.

[0115] It is understandable that the above steps S110-S140 may correspond to Figure 1 The second double-layer provenance graph construction and model training stage.

[0116] As an optional implementation, S130: training the initial graph neural network model based on the first layer of the second double-layer traceability graph, so that the initial graph neural network model learns the behavioral characteristics between the second nodes in the second subgraph, specifically including S131-S134.

[0117] S131: Extracting a behavior feature vector of a second node in a second subgraph through an initial graph neural network model.

[0118] Specifically, extracting the behavior feature vector of the second node in the second subgraph includes: extracting the feature vector of the second node through the initial graph neural network model, and extracting the feature vector of the corresponding edge; according to the feature vector of the second node and the feature vector of the corresponding edge, the structural feature vector of the second node can be obtained. Combining the structural feature vector of the second node with the attribute vector of the second node and the corresponding edge can obtain the behavior feature vector of the second node.

[0119] In the first layer of the second two-layer traceability graph, the initial graph neural network model is used to extract the behavioral features in the second subgraph and learn the behavioral information in each second subgraph. In this process, the structural features in the second subgraph are also learned, that is, the structural association relationship within the second subgraph.

[0120] S132: Mask one or more second node types, corresponding edges and attributes in the second subgraph.

[0121] The node type is the entity system type.

[0122] Attributes refer to the content attached to nodes (or supernodes) and edges (or superedges), and not all nodes (or supernodes) and edges (or superedges) have attributes. Therefore, masking attributes means masking the attributes of the second node and the attributes of the edge together. Attributes include: process name, file name, path, executed command line, network port number, IP address, etc.

[0123] S133: Restore the behavior feature vector of the masked second node based on the second node behavior feature vectors around the masked second node through the initial graph neural network model.

[0124] The behavior feature vector of the second node can reflect the behavior pattern of the second node, that is, the causal dependency / correlation relationship between behaviors.

[0125] Since normal system behavior usually follows a specific behavior pattern, the behavior feature vector of the masked second node can be restored based on the behavior feature vectors of the surrounding second nodes.

[0126] S134: Based on the restored behavior feature vector of the masked second node and the actual behavior feature vector of the masked second node, train the loss function of the initial graph neural network model so that the initial graph neural network model learns the behavior characteristics between the second nodes in the second subgraph.

[0127] The process of training the loss function of the initial graph neural network model is to gradually approach the restored behavior feature vector of the masked second node to the actual behavior feature vector of the masked second node until the loss function converges.

[0128] As an optional implementation, S140: train the initial graph neural network model based on the second layer of the second double-layer traceability graph, so that the initial graph neural network model learns the behavioral characteristics between the second super nodes to obtain a graph neural network model, including S141-S145.

[0129] S141: Mapping the behavior feature vector of the second node in the second subgraph to the corresponding second supernode.

[0130] After mapping, the initial graph neural network model learns the behavioral characteristics of the second node in the second subgraph.

[0131] S142: Extracting the behavior feature vector of the second super node through the initial graph neural network model.

[0132] Specifically, the feature vector of the second supernode is extracted through the initial graph neural network model, and the feature vector of the corresponding hyperedge is extracted. The structural feature vector of the second supernode can be obtained according to the feature vector of the second supernode and the feature vector of the corresponding hyperedge. The behavioral feature vector of the second supernode can be obtained by combining the structural feature vector of the second supernode with the attribute vector of the second supernode and the corresponding hyperedge.

[0133] The behavior feature vector of the second super node can reflect the behavior pattern of the second super node, that is, the causal dependency / correlation relationship between behaviors.

[0134] S143: Mask one or more second supernode types, corresponding hyperedges and attributes.

[0135] S144: Recovering the behavior feature vector of the masked second super node based on the behavior feature vectors of the second super nodes around the masked second super node through the initial graph neural network model.

[0136] S145: Train the initial graph neural network model based on the restored behavior feature vector of the masked second super node and the actual behavior feature vector of the masked second super node, so that the initial graph neural network model learns the behavior characteristics between the second super nodes, and obtains the graph neural network model.

[0137] Exemplarily, the model training proposed in this embodiment includes the following three stages:

[0138] (1) Masking stage: Mask one or more second nodes to create conditions for recovery. This involves randomly masking (i.e. covering) one or more second nodes (including node types, edges, and attributes) to increase the sensitivity of the initial graph neural network model to structural information.

[0139]

[0140] Where S represents a set of one or more masked second nodes. noden and repa represent the node type and attribute vector of the second node n, respectively, and edgegen represents the vector of edge e, while the types, attributes, and edges of the masked second nodes are replaced by the labels [MASK]n, 0, and [MASK]e.

[0141] (2) Graph Encoder: Generates vectors of the second nodes, edges, and second subgraphs through feature propagation and aggregation. The encoder uses Graphormer to capture the complex relationships between the second nodes in the second subgraph.

[0142] h′(=MH(L)+h(l-1)(2)

[0143] h(=FFN(LN(-1))+h(3)

[0144] Among them, LN represents layer normalization, MH represents multi-head self-attention module, FFN represents feedforward network block, and h represents hidden layer representation.

[0145] (3) Graph decoder: Provides supervision signals for training by restoring masked features and / or mapping subgraph relationships. The output of the decoder is compared with the actual masked parts to guide model optimization. The loss function is designed as:

[0146]

[0147] Where S represents a set of one or more masked second nodes, Sneg represents a negative sample of S, and N represents the size of the training batch. represents the second subgraph, represents the eigenvector of the second subgraph, represents the eigenvector of S, Ms = {S1, S2, ···, S N} represents the set of S.

[0148] After completing the training of the first layer of the second double-layer provenance graph, continue to train the second layer of the second double-layer provenance graph according to the above three stages.

[0149] This embodiment trains both the encoder and the decoder. There are two training objectives:

[0150] (1) Minimize the difference between the actual behavior characteristics of the second node / second super node and the behavior characteristics of the second node / second super node restored by the decoder. This enables the model to accurately restore the behavior characteristics of the masked second node / second super node.

[0151] (2) Maximize the co-occurrence probability between each second subgraph and one or more masked second nodes within it, while minimizing the co-occurrence probability with irrelevant second nodes within it. This enables the model to better understand the intrinsic relationship between the second subgraph and one or more masked second nodes, and improves the ability to capture behavioral features.

[0152] Through the above training process, the graph neural network model is able to deeply learn the structural information and behavioral information of the two-layer traceability graph, so as to more effectively identify malicious activities that deviate from normal structure and behavior in anomaly detection.

[0153] See also Figure 5 , Figure 5 A schematic flow chart of a network threat detection method provided in an embodiment of the present application is shown, including S150-S180.

[0154] S150: Obtain a first two-layer traceability graph determined by multiple first behavior logs of the target system; the first two-layer traceability graph includes a first layer and a second layer, wherein the first layer includes multiple first subgraphs, the first subgraph includes multiple first nodes, the first node is the corresponding entity in the first behavior log in the target system, and the edge between the first nodes corresponds to the operation / behavior of the first behavior log; the second layer includes multiple first super nodes, each first super node corresponds to a first subgraph, and the edge between the first subgraphs is the hyperedge of the second layer.

[0155] Different from the security behavior log, the first behavior log may be either a security behavior log or an abnormal behavior log.

[0156] The first node may be a normal node or an abnormal node. Similarly, the first subgraph may be composed entirely of normal nodes, in which case the first supernode corresponding to the first subgraph is a normal supernode; the first subgraph may also contain some abnormal nodes, in which case the first supernode corresponding to the first subgraph is an abnormal supernode.

[0157] S160: Determine an abnormal super node among the plurality of first super nodes included in the second layer according to the first double-layer traceability graph.

[0158] If a potential abnormal supernode is detected in the second layer of the first two-layer traceability graph, this indicates that an abnormal node may exist in the first subgraph of the corresponding first layer. Abnormal supernodes usually reflect abnormal associations between multiple system activities and may involve more extensive system behavior anomalies. In other words, the detection of abnormal supernodes achieves the rough positioning of abnormal nodes.

[0159] It is easy to understand that in this embodiment, a detection can be performed once a first behavior log is obtained, or a detection can be performed every half hour or every set number of logs (for example, 20,000).

[0160] S170: Determine an abnormal node from the first subgraph corresponding to the abnormal supernode.

[0161] When the abnormal supernode is determined, the abnormal node in the first node can be determined in the first subgraph corresponding to the abnormal supernode, thus realizing accurate positioning of the abnormal node. If there are multiple abnormal supernodes, the abnormal nodes need to be determined respectively in the first subgraphs corresponding to the multiple abnormal supernodes.

[0162] When processing large-scale provenance graphs in the traditional way, since it is necessary to determine abnormal nodes in all nodes, not only the amount of calculation is large, but also the detection rate and accuracy are not high. This embodiment constructs a first two-layer provenance graph to first determine whether there is an abnormal super node in the first super node. If there is an abnormal super node, the abnormal node can be determined in the first node in the first subgraph corresponding to the abnormal super node. Compared with the traditional processing of large-scale provenance graphs, the amount of calculation for detecting abnormal nodes is greatly reduced, and the abnormal nodes can be located faster and more accurately.

[0163] This embodiment can comprehensively consider the behavioral interaction relationship between the local and global systems, and through the construction method of the first dual traceability layer graph and the graph neural network, it can achieve fast, comprehensive and accurate detection of APT attacks, improve the detection rate and accuracy of APT attacks, greatly reduce the false positives and missed reports of APT organizations, and achieve fine-grained restoration of APT attack behaviors, help reduce the analysis workload of staff, and effectively improve the accuracy and feasibility of detection.

[0164] It is understandable that the above steps S150-S170 may correspond to Figure 1 The anomaly detection phase.

[0165] As an optional implementation, S150: obtaining a first two-layer traceability graph determined by a plurality of first behavior logs of the target system, including S151-S154.

[0166] S151: Acquire multiple first behavior logs in the target system.

[0167] S152: Obtain a plurality of first nodes connected with edges according to the plurality of first behavior logs.

[0168] Specifically, each time a first behavior log is obtained, the first behavior log is preprocessed into a unified format; the preprocessed first behavior log includes: timestamp, source UUID, target UUID, source system entity type, target system entity type and behavior type.

[0169] The source UUID and the target UUID are used as the first nodes of the first layer of the first double-layer provenance graph, and the source system entity type and the target system entity type are used as the node types of the first layer of the first double-layer provenance graph. Edges are established between the UUID and the target UUID according to the timestamp and the behavior type to obtain multiple first nodes connected with edges.

[0170] S153: Constructing a first layer of a first double-layer traceability graph according to the plurality of first nodes connected with edges, wherein the first layer includes a plurality of first subgraphs, and all the plurality of first behavior logs are added to the first subgraph.

[0171] Optionally, when the number of first nodes reaches a preset number, the current first subgraph is obtained, and a new first subgraph is started to be created until all the first behavior logs are added to the first subgraph to obtain the first layer of the first two-layer traceability graph.

[0172] Exemplarily, each first subgraph includes 300 first nodes, and the first layer can accommodate 300 first subgraphs in total.

[0173] S154: With each first subgraph corresponding to a first super node and the edges between the first subgraphs as super edges, a second layer of the first double-layer traceability graph is constructed to obtain the first double-layer traceability graph.

[0174] Exemplarily, the number of first super nodes in the second layer is controlled at 300. Thus, the first double-layer traceability graph can accommodate 300*300=90,000 first nodes. It is worth noting that not every first behavior log will create a new first node. The operation / behavior corresponding to the first behavior log may be an edge between existing first nodes.

[0175] Specifically, the method for constructing the first double-layer provenance graph may be the same as the method for constructing the second double-layer provenance graph.

[0176] Optionally, you can perform a test every half hour, or obtain tens of thousands (such as 20,000) of the first behavior logs for a test. If the first behavior logs obtained in half an hour or the process of obtaining the first behavior logs for more than 20,000 times, the number of first super nodes in the second layer of the first double-layer traceability graph will reach 300, then you can choose any of the following three methods:

[0177] (1) Continue to generate the first supernode, and construct a new first double-layer traceability graph with the one or more first supernodes that exceed (e.g., 50 first supernodes) and the multiple first supernodes that are connected to the 50 first supernodes through hyperedges (e.g., 250 first supernodes). It should be noted that the sum of the number of the one or more first supernodes that exceed and the multiple first supernodes that are connected to the one or more first supernodes through hyperedges is less than or equal to the preset number (the preset number in this embodiment is 300).

[0178] (2) Start constructing the third layer of the first two-layer traceability graph. Each supernode of the third layer includes 300 first supernodes, and the hyperedges of the third layer are the hyperedges between supernodes in the third layer; until the number of supernodes in the top layer is less than or equal to 300.

[0179] (3) Discarding the one or more first super nodes that are constructed earliest or are the farthest away and the corresponding first nodes. The one or more first super nodes that are the farthest away refer to: the one or more first super nodes that are the farthest away in the link formed by multiple first super nodes through hyperedges.

[0180] As an optional implementation, the network threat detection method also includes S155-S156.

[0181] S155: Determine the predicted behavior feature vector of the first super node through the graph neural network model.

[0182] Specifically, the graph neural network model can be obtained through the above model training phase.

[0183] S156: When the deviation between the predicted behavior feature vector of the first super node and the actual behavior feature vector of the first super node is greater than or equal to a first threshold, the first super node is determined to be an abnormal super node.

[0184] Optionally, S155: predicting the behavior feature vector of the first super node through the graph neural network model, including S1551-S1553.

[0185] S1551: Extracting the behavior feature vector of the first super node through the graph neural network model.

[0186] Specifically, the feature vector of the first supernode is extracted through the graph neural network model, and the feature vector of the corresponding hyperedge is extracted. The structural feature vector of the first supernode can be obtained according to the feature vector of the first supernode and the feature vector of the corresponding hyperedge. The behavioral feature vector of the first supernode can be obtained by combining the structural feature vector of the first supernode with the attribute vector of the first supernode and the corresponding hyperedge.

[0187] S1552: Mask one or more first supernode types, corresponding hyperedges, and attributes.

[0188] It should be noted that masking one or more first supernodes and corresponding hyperedges means masking the type and attribute of the first supernodes as well as the type and attribute of the hyperedges.

[0189] S1553: Predicting the behavior feature vector of the masked first super node based on the behavior feature vectors of the first super nodes around the masked first super node through the graph neural network model.

[0190] Since the graph neural network model is obtained after training the second double-layer traceability graph constructed based on the security behavior log, the graph neural network model can accurately predict the behavior feature vectors of normal super nodes.

[0191] The graph neural network model of this embodiment predicts the behavior feature vector of the masked first super node by comparing the behavior feature vectors of the first super nodes around the masked first super node. When there is a significant deviation between the predicted behavior feature vector of the first super node and the actual behavior feature vector of the first super node, the currently predicted first super node is determined to be an abnormal super node. To achieve this goal, this embodiment introduces a new loss function for the second layer of the first two-layer traceability graph:

[0192]

[0193] Among them, M Gs represents the set of the first supernodes that are covered, G s The first supernode represented by E Gs is the feature vector representing the first supernode, MLP(h Gs ) is the first supernode G s The predicted value of the hidden feature vector in the last layer after passing through the multi-layer perceptron (MLP).

[0194] In the anomaly detection phase, this embodiment assigns an anomaly score to each first supernode in the second layer of the first two-layer traceability graph. When the anomaly score of a node exceeds a set threshold, it is marked as an anomaly, indicating possible malicious activities or influence from neighboring first supernodes.

[0195] As an optional implementation, S170: determining an abnormal node from a first subgraph corresponding to the abnormal supernode, specifically includes S171-S172.

[0196] S171: Predicting a predicted behavior feature vector of any first node in the first subgraph corresponding to the abnormal supernode through a graph neural network model.

[0197] S172: If the deviation between the predicted behavior feature vector of the first node and the actual behavior feature vector of the first node is greater than or equal to a second threshold, the first node is determined to be an abnormal node.

[0198] Optionally, in S171, a behavior feature vector of the first node in the abnormal super node is predicted through a graph neural network model, including S1711-S1713.

[0199] S1811: Extracting the behavior feature vector of the first node in the abnormal super node through the graph neural network model.

[0200] Specifically, the feature vector of the first node is extracted through the graph neural network model, and the feature vector of the corresponding edge is extracted. The structural feature vector of the first node can be obtained according to the feature vector of the first node and the feature vector of the corresponding edge. The structural feature vector of the first node is combined with the attribute vector of the first node and the corresponding edge to obtain the behavioral feature vector of the first node.

[0201] S1712: Mask one or more first node types, corresponding edges and attributes in the abnormal super node.

[0202] It should be noted that masking the first node and the corresponding edge means masking the type and attribute of the first node as well as the type and attribute of the edge.

[0203] S1713: Predicting the behavior feature vector of the masked first node based on the behavior feature vectors of the first nodes around the masked first node through the graph neural network model.

[0204] Determining the abnormal supernode is equivalent to completing the rough positioning of the abnormal node, and then the abnormal node needs to be accurately positioned. The graph neural network model can accurately predict the behavior feature vectors of normal nodes. The graph neural network model predicts the behavior feature vector of the masked first node based on the behavior feature vectors of the first nodes around the masked first node, and then compares the feature vector and structural feature vector of the predicted first node with the feature vector and structural feature vector of the actual first node, and determines the first node with a large deviation as an abnormal node.

[0205] As another optional implementation, S170: determining an abnormal node from the first subgraph corresponding to the abnormal supernode, specifically includes S173-S177.

[0206] S173: Extract the feature vector of each first node in the abnormal super node and the feature vector of the edge through the graph neural network model.

[0207] S174: Mask one or more first nodes, corresponding edges and attributes in the abnormal super node.

[0208] S175: Predicting the feature vector of the masked first node and the feature vector of the edge based on the feature vectors of the first nodes and the feature vectors of the edge around the masked first node through the graph neural network model.

[0209] S176: Determine the behavior feature vector of each first node in the abnormal supernode and the behavior feature vector of the abnormal supernode according to the feature vector of the first node in the abnormal supernode, the feature vector of the edge, and the attribute.

[0210] S177: Determine the abnormal node based on the error between the feature vector of the predicted edge and the feature vector of the actual edge, the error between the feature vector of the predicted first node and the feature vector of the actual first node, and the similarity between the behavior feature vector of the predicted masked first node and the behavior feature vector of the abnormal super node.

[0211] Exemplarily, for each detected abnormal supernode, the first node is masked (the same method as in the model training phase), and the outlier score of the first nodes around it is calculated. The outlier score is based on the first node reconstruction error, the edge reconstruction error, and the similarity error between the subgraph and the masked first node. These errors are sorted and summarized, and the first node with the highest comprehensive score is identified as the most abnormal node.

[0212] The anomaly score of the first node i is calculated as follows:

[0213] AS i =(r(loss nodes )+ r(loss edge )+ r(loss subgraph )) (6)

[0214] Among them, r() represents the sorting function, loss nodes Represents the reconstruction error of the first masked node, loss edge represents the reconstruction error of the edge of the first masked node, loss subgraph It represents the similarity error between the subgraph and the first masked node. It is worth noting that the smaller the score value, the higher the abnormal probability of the node.

[0215] The reconstruction error of the first node refers to the error between the predicted feature vector of the first node and the actual feature vector of the first node.

[0216] Edge reconstruction error refers to the error between the feature vector of the predicted edge and the feature vector of the actual edge.

[0217] After the first nodes and edges are reconstructed (ie predicted), the structural feature vectors of the masked first nodes or nodes are obtained. The structural feature vector plus the attribute vector is the behavioral feature vector.

[0218] The similarity error between the subgraph and the masked first node refers to the similarity between the predicted behavior feature vector of the masked first node and the behavior feature vector of the first subgraph (ie, the abnormal supernode) corresponding to the masked first node.

[0219] It is easy to understand that the device for constructing the first two-layer traceability graph (corresponding to S150 and its sub-steps) and the device for detecting abnormal nodes (corresponding to S160, S170 and their sub-steps) can be the same device or different devices. For example, device A constructs the first two-layer traceability graph based on the first behavior log, and then device B detects whether there are abnormal nodes in the first two-layer traceability graph.

[0220] Optionally, after S180, S190 is also included.

[0221] S190: Connect the abnormal nodes to obtain an attack activity graph.

[0222] In order to further accurately represent abnormal behaviors and facilitate in-depth investigations by security analysts, this embodiment connects abnormal nodes in potential abnormal supernodes through their edges to form an attack activity graph representing network threats (such as advanced persistent threats). The attack activity graph provides a complete link of attacker behavior, which helps to restore and trace network threats in a fine-grained manner. As a result, analysts can quickly identify the attacker's activities without having to fully check the abnormal supernodes, significantly reducing the need for manual intervention.

[0223] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0224] Corresponding to the network threat detection method described in the above embodiment, Figure 6 A structural block diagram of a network threat detection device provided in an embodiment of the present application is shown. For ease of explanation, only the parts related to the embodiment of the present application are shown.

[0225] Reference Figure 6 , the device comprises:

[0226] Acquisition module 210 is used to acquire a first two-layer traceability graph determined by multiple first behavior logs of the target system; the first two-layer traceability graph includes a first layer and a second layer, wherein the first layer includes multiple first subgraphs, the first subgraph includes multiple first nodes, the first node is the entity corresponding to the first behavior log in the target system, and the edge between the first nodes corresponds to the operation / behavior of the first behavior log; the second layer includes multiple first super nodes, each first super node corresponds to a first subgraph, and the edge between the first subgraphs is the hyperedge of the second layer.

[0227] The first determination module 220 is configured to determine an abnormal super node among the plurality of first super nodes included in the second layer according to the first double-layer traceability graph.

[0228] The second determining module 230 is configured to determine an abnormal node from the first subgraph corresponding to the abnormal supernode.

[0229] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0230] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0231] An embodiment of the present application also provides an electronic device, which includes: at least one processor, a memory, and a computer program stored in the memory and executable on the at least one processor, wherein the processor implements the steps of any of the above-mentioned method embodiments when executing the computer program.

[0232] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0233] An embodiment of the present application provides a computer program product. When the computer program product runs on an electronic device, the electronic device can implement the steps in the above-mentioned method embodiments when executing the computer program product.

[0234] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device capable of carrying the computer program code to an electronic device, a recording medium, a computer memory, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), an electric carrier signal, a telecommunication signal, and a software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0235] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0236] The computer program code for performing the operation of the embodiment of the application can be written with one or more programming languages ​​or their combination, and the programming language includes object-oriented programming languages, such as python, Java, Smalltalk, C++, and also includes conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed completely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer and partially on the remote computer, or executed completely on the remote computer or server. In the case of a remote computer, the remote computer can include a local area network (LAN) or a wide area network (WAN)--connected to the user's computer through any type of network, or, can be connected to an external computer (for example, utilizing an Internet service provider to connect through the Internet).

[0237] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0238] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0239] In the embodiments provided in the present application, it should be understood that the disclosed devices / electronic devices and methods can be implemented in other ways. For example, the device / electronic device embodiments described above are merely schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0240] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0241] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A network threat detection method, characterized in that: include: Obtain a first two-layer traceability graph determined by multiple first behavior logs of the target system; the first two-layer traceability graph includes a first layer and a second layer, wherein the first layer includes multiple first subgraphs, the first subgraph includes multiple first nodes, the first nodes are entities corresponding to the first behavior logs in the target system, and the edges between the first nodes correspond to operations / behaviors of the first behavior logs; the second layer includes multiple first super nodes, each of the first super nodes corresponds to one first subgraph, and the edges between the first subgraphs are super edges of the second layer; Determine, according to the first double-layer traceability graph, an abnormal super node among the plurality of first super nodes included in the second layer; An abnormal node is determined from the first subgraph corresponding to the abnormal supernode.

2. The network threat detection method according to claim 1, characterized in that: The obtaining of a first two-layer traceability graph determined by a plurality of first behavior logs of the target system includes: Obtaining a plurality of first behavior logs in the target system; According to the plurality of first behavior logs, a plurality of first nodes connected with edges are obtained; According to the plurality of first nodes connected with edges, a first layer of the first double-layer traceability graph is constructed, wherein the first layer includes a plurality of first subgraphs, and the plurality of first behavior logs are all added to the first subgraphs; Each of the first subgraphs corresponds to a first supernode, and the edges between the first subgraphs are used as superedges to construct the second layer of the first double-layer traceability graph, thereby obtaining the first double-layer traceability graph.

3. The network threat detection method according to claim 2, characterized in that: The method further comprises: If the first supernode exceeds one or more of the preset number, a new first double-layer traceability graph is jointly constructed based on the one or more first supernodes that exceed and the multiple first supernodes that are connected to the one or more first supernodes that exceed through hyperedges; the sum of the number of the one or more first supernodes that exceed and the multiple first supernodes that are connected to the one or more first supernodes that exceed through hyperedges is less than or equal to the preset number; Alternatively, if the first supernodes reach the preset number, a third layer of the first two-layer traceability graph is constructed, wherein the supernodes of the third layer include a plurality of the first supernodes, and the hyperedges of the third layer are the hyperedges between the supernodes in the third layer; until the number of supernodes in the top layer is less than or equal to the preset number; Alternatively, if the first super nodes reach the preset number, one or more first super nodes that are constructed earliest or are the farthest away and the corresponding first nodes are discarded.

4. The network threat detection method according to claim 2, characterized in that: The step of obtaining a plurality of first nodes connected with edges according to the first behavior log includes: Preprocessing the first behavior log into a unified format; the preprocessed first behavior log includes one or more of the following: timestamp, source UUID, target UUID, source system entity type, target system entity type and behavior type; The source UUID and the target UUID are used as the first nodes of the first layer of the first two-layer traceability graph, and the source system entity type and the target system entity type are used as the node types of the first layer of the first two-layer traceability graph. An edge is established between the UUID and the target UUID according to the timestamp and the behavior type to obtain multiple first nodes connected with edges.

5. The network threat detection method according to claim 1, characterized in that: The method further comprises: Determining a predicted behavior feature vector of the first supernode through a graph neural network model; If a deviation between the predicted behavior feature vector of the first super node and the actual behavior feature vector of the first super node is greater than or equal to a first threshold, the first super node is determined to be an abnormal super node.

6. The network threat detection method according to claim 5, characterized in that: The determining the predicted behavior feature vector of the first super node by using the graph neural network model includes: Extracting a behavior feature vector of each of the first super nodes through the graph neural network model; Masking one or more of the first supernode types, corresponding hyperedges, and attributes; The graph neural network model is used to predict the behavior feature vector of the masked first super node based on the behavior feature vectors of the first super nodes around the masked first super node.

7. The network threat detection method according to any one of claims 1 to 6, characterized in that: The determining of an abnormal node from the first subgraph corresponding to the abnormal supernode includes: Predicting, by means of a graph neural network model, a predicted behavior feature vector of any first node in the first subgraph corresponding to the abnormal supernode; If a deviation between the predicted behavior feature vector of the first node and the actual behavior feature vector of the first node is greater than or equal to a second threshold, the first node is determined to be an abnormal node.

8. The network threat detection method according to any one of claims 1 to 6, characterized in that: The determining of an abnormal node from the first subgraph corresponding to the abnormal supernode includes: Extracting the feature vector of each first node and the feature vector of the edge in the abnormal super node through a graph neural network model; Determine, according to the feature vector of the first node in the abnormal supernode, the feature vector of the edge and the attribute, the behavior feature vector of each of the first nodes in the abnormal supernode and the behavior feature vector of the abnormal supernode; Masking one or more of the first nodes, corresponding edges and attributes within the abnormal supernode; Predicting, by the graph neural network model, a feature vector of the masked first node and a feature vector of the edge based on feature vectors of the first nodes and feature vectors of the edges around the masked first node; The abnormal node is determined based on the error between the predicted feature vector of the first node and the actual feature vector of the first node, the error between the predicted feature vector of the edge and the actual feature vector of the edge, and the similarity between the predicted behavior feature vector of the masked first node and the behavior feature vector of the abnormal super node.

9. The network threat detection method according to any one of claims 1 to 6, characterized in that: After determining the abnormal node from the first subgraph corresponding to the abnormal supernode, the method further includes: The abnormal nodes are connected to obtain an attack activity graph.

10. The network threat detection method according to any one of claims 1 to 6, characterized in that: The method further comprises: Obtain multiple security behavior logs in the target system; According to the plurality of the security behavior logs, a second two-layer traceability graph is obtained; the first layer of the second two-layer traceability graph includes a plurality of second subgraphs, the second subgraph includes a plurality of second nodes, the second nodes are entities corresponding to the security behavior logs in the target system, and the edges between the second nodes correspond to the operations / behaviors of the security behavior logs; each second supernode of the second layer of the second two-layer traceability graph corresponds to one second subgraph, and the edges between the second subgraphs are superedges of the second layer of the second two-layer traceability graph; Training an initial graph neural network model based on the first layer of the second two-layer traceability graph, so that the initial graph neural network model learns the behavior characteristics between the second nodes in the second subgraph; The initial graph neural network model is trained based on the second layer of the second two-layer traceability graph, so that the initial graph neural network model learns the behavioral characteristics between the second super nodes to obtain the graph neural network model.

11. The network threat detection method according to claim 10, characterized in that: The training of the initial graph neural network model based on the first layer of the second two-layer traceability graph so that the initial graph neural network model learns the behavior characteristics between the second nodes in the second subgraph includes: Extracting a behavior feature vector of the second node in the second subgraph by using the initial graph neural network model; Masking one or more of the second node types, corresponding edges, and attributes in the second subgraph; Recovering the behavior feature vector of the masked second node according to the behavior feature vector of the second node around the masked second node through the initial graph neural network model; Based on the restored behavior feature vector of the masked second node and the actual behavior feature vector of the masked second node, the loss function of the initial graph neural network model is trained to enable the initial graph neural network model to learn the behavior characteristics between the second nodes in the second subgraph.

12. The network threat detection method according to claim 11, characterized in that: The step of training the initial graph neural network model based on the second layer of the second two-layer traceability graph so that the initial graph neural network model learns the behavior characteristics between the second super nodes to obtain the graph neural network model includes: Mapping the behavior feature vector of the second node in the second subgraph to the corresponding second supernode; Extracting a behavior feature vector of the second super node through the initial graph neural network model; Masking one or more of the second supernode types, corresponding hyperedges and attributes; Recovering the behavior feature vector of the masked second super node according to the behavior feature vectors of the second super nodes around the masked second super node through the initial graph neural network model; The initial graph neural network model is trained according to the restored masked behavior feature vector of the second super node and the actual masked behavior feature vector of the second super node, so that the initial graph neural network model learns the behavior characteristics between the second super nodes to obtain the graph neural network model.

13. A network threat detection device, characterized in that: include: An acquisition module is used to acquire a first two-layer traceability graph determined by multiple first behavior logs of a target system; the first two-layer traceability graph includes a first layer and a second layer, wherein the first layer includes multiple first subgraphs, the first subgraph includes multiple first nodes, the first nodes are entities corresponding to the first behavior logs in the target system, and the edges between the first nodes correspond to operations / behaviors of the first behavior logs; the second layer includes multiple first super nodes, each of the first super nodes corresponds to one first subgraph, and the edges between the first subgraphs are super edges of the second layer; A first determining module, configured to determine an abnormal super node among a plurality of first super nodes included in the second layer according to the first double-layer traceability graph; The second determining module is used to determine an abnormal node from the first subgraph corresponding to the abnormal supernode.

14. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 12 is implemented.

15. A computer program product, characterized in that When the computer program product runs on an electronic device, the electronic device is enabled to execute the method according to any one of claims 1 to 12.

Images