APT attack detection method based on heterogeneous graph representation learning

Abstract

The invention discloses an APT attack detection method based on heterogeneous graph representation learning. The method comprises a traceability graph construction stage, a heterogeneous graph representation learning stage, an attack detection stage and an attack traceability stage. In the traceability graph construction stage, entity interaction relations are extracted from system audit logs to obtain entity interaction features; in the heterogeneous graph representation learning stage, node embedding representation is learned from the perspective of homomorphism and heterogeneity of a traceability graph structure, information between nodes of the same type is aggregated to obtain homomorphic representation, and information between nodes of different types is aggregated to obtain heterogeneous representation. Node-level and graph-level malicious detection is realized in the attack detection stage; in the attack tracing stage, malicious subgraphs are constructed by connecting malicious nodes, and the attack process is restored. According to the method, the traceability graph structural features are captured more effectively to learn the system behavior pattern, predefined rules are avoided, and the dependence of the model on semantic data is reduced.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to an APT attack detection method based on heterogeneous graph representation learning. Background Art

[0002] APT (Advanced Persistent Threats) is a covert, complex, and long-term network attack activity that often lurks in important internal networks, which may cause serious consequences such as secret leakage and facility paralysis. Therefore, efficient detection and protection of APT attacks are of great significance to protecting network security.

[0003] Existing APT attack tracing methods based on provenance graphs are divided into rule-based methods, anomaly-based methods, and sequence-based methods. (1) Rule-based methods construct rules based on typical APT attack patterns and prior knowledge to detect potential threats. This method relies on expert knowledge and requires a lot of manpower and material resources to build rules. (2) Anomaly-based methods require a large amount of benign historical data to learn conscientious system behavior patterns and strengthen the model effect by analyzing semantic data, which leads to its dependence on high-quality data and is not applicable in actual detection scenarios. (3) Sequence-based methods extract event sequences from the provenance graph and then classify each sequence as malicious or benign. This method cannot capture the contextual information of the entire attack and has difficulty capturing complex attack patterns. Because these methods are difficult to capture the complete structural features in the provenance graph, they require external knowledge and high-quality semantic data to learn the behavior patterns in the system, which greatly limits their application in complex detection environments.

[0004] Therefore, existing technologies still have many shortcomings in detecting APT attacks, and new, efficient and accurate APT detection technologies are urgently needed to meet the needs of network security protection. Summary of the invention

[0005] The purpose of the present invention is to provide an APT attack detection method based on heterogeneous graph representation learning, which breaks the disadvantage that the traditional APT detection method based on tracing graph cannot learn rich graph structure features, and solves the defect that the traditional detection method relies on specific rules and additional semantic data, thereby achieving high-accuracy APT attack detection.

[0006] The technical solution adopted by the present invention is:

[0007] A method for detecting APT attacks based on heterogeneous graph representation learning comprises the following steps:

[0008] Provenance graph construction phase: Collect system audit logs and build a provenance graph based on the entity interaction relationship and event flow of the audit logs;

[0009] Specifically, in the traceability graph construction phase, the original system call event data is extracted from the kernel audit log of the operating system. According to the interaction relationship between entities in the audit log, the entities are linked to each other in the order of event occurrence to form a directed acyclic graph, with entities as nodes and events as edges. Each node is traversed to obtain the type and number of its neighbor nodes for one-hot encoding, which is used as the feature vector of the node. The directed acyclic graph is then subjected to denoising and sub-graph division.

[0010] Heterogeneous graph representation learning stage: heterogeneous graph representation learning is used to learn the homomorphism and heterogeneity of traceability graph nodes and to capture and fuse the homomorphic and heterogeneous information of the traceability graph structure to obtain a low-embedded representation;

[0011] Specifically, the heterogeneous graph representation learning phase is divided into two parts: homomorphic representation learning and heterogeneous representation learning. Homomorphic representation learning uses multi-layer perception to calculate the feature vector of the node. (l+1) , and construct a self-expression matrix S∈R N×N Then, calculate the characteristic distance matrix D∈R of all nodes in the subspace. N ×N , according to the formula (α and β are non-negative parameters) to calculate the closed solution S of the self-expression matrix * , from Z = S * H (l+1) Get homomorphic representation. Heterogeneous representation learning targets the target node v i A heterogeneous encoder is used to aggregate the information of its related one-hop neighbors and then obtain an edge-based representation. Further fusion of all edge-based representations to obtain heterogeneous representations Finally, the homomorphic representation and heterogeneous representation are concatenated in the horizontal dimension to obtain the final embedded representation of the traceability graph node.

[0012] Attack detection stage: low-dimensional embedding representation of the traceability graph nodes is input into lightweight classification for binary classification detection;

[0013] Specifically, in the attack detection phase, the node embedding representation obtained in the heterogeneous graph representation learning phase is used to train the lightweight classifier XGBoost. Then, the node embedding representation of the node to be detected is input into the classifier for detection, and the detector classifies the node to be detected as a benign node or a malicious node;

[0014] Attack tracing stage: Use the community detection algorithm to divide the tracing graph into communities, map the malicious nodes to the corresponding communities based on the interaction relationship and time relationship, and restore the malicious subgraph.

[0015] Specifically, in the attack tracing stage, the community detection algorithm is used in the tracing graph to obtain interconnected local spaces. For the malicious nodes obtained in the attack detection stage, a mapping from malicious nodes to local spaces is established based on their interaction relationships and time relationships to restore the malicious subgraph and achieve attack tracing.

[0016] The present invention adopts the above technical solution, which has the following beneficial effects: 1. The use of heterogeneous graph representation learning and lightweight classifiers realizes granularly adjustable malicious detection and attack tracing, which can achieve high-precision detection effects and low event overhead in a detection environment with limited information. 2. Learn node embedding representation from the perspective of the homomorphism and heterogeneity of the traceability graph structure, aggregate the information between nodes of the same type to obtain a homomorphic representation, and aggregate the information between nodes of different types to obtain a heterogeneous representation. This method more effectively captures the structural features of the traceability graph to learn system behavior patterns, avoids predefined rules, and reduces the model's dependence on semantic data. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments;

[0018] Figure 1 The framework diagram of an APT attack detection method based on heterogeneous graph representation learning. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0020] like Figure 1 As shown, the present invention discloses an APT attack detection method based on heterogeneous graph representation learning, comprising the following steps:

[0021] Step S1, source traceability graph construction phase: collect system audit logs, and construct a source traceability graph based on the entity interaction relationship and event flow of the audit logs;

[0022] Step S2, heterogeneous graph representation learning stage: using heterogeneous graph representation learning to learn the homomorphism and heterogeneity of the traceability graph nodes and to fuse the homomorphic and heterogeneous information of the traceability graph structure to obtain a low-embedded representation;

[0023] Step S3, attack detection phase: input the low-dimensional embedding representation of the traceability graph nodes into lightweight classification for binary classification detection;

[0024] Step S4, attack tracing phase: Use community detection algorithm to divide the tracing graph into communities, map malicious nodes to corresponding communities based on interaction relationships and time relationships, and restore malicious subgraphs.

[0025] Furthermore, the traceability graph construction phase specifically includes the following steps:

[0026] Step S11: extracting original system call event data from the kernel audit log of the operating system,

[0027] Step S12: Identify entities, events and interaction relationships between entities in the audit log, and associate the entities with each other in the order of event occurrence to form a directed acyclic graph based on the interaction relationships between the entities, with entities as nodes and events as edges;

[0028] Step S13: extract the interaction features of each node, traverse each node to obtain the type and number of its neighbor nodes, perform one-hot encoding on the type, and use the accumulated result and the interaction type as the feature vector of the node;

[0029] Step S14: performing noise reduction processing on the directed acyclic graph, when there are multiple edges with the same label between a pair of nodes, the redundant edges are deleted and one of them is retained;

[0030] Step S15: Divide the directed acyclic graph into subgraphs, and divide the original graph into subgraphs according to the connectivity between nodes to obtain the final traceability graph.

[0031] Furthermore, the original system call event data includes event occurrence time, process ID, thread ID, operation type, operation object and operation result.

[0032] Furthermore, the heterogeneous graph representation learning phase specifically includes the following steps:

[0033] Step S21: Use multi-layer perception to calculate the feature vector of the node and obtain the representation H of the (l+1)th layer node (l+1) ;

[0034] Step S22: Construct a self-expression matrix S∈R N×N , N represents the number of nodes in the traceability graph, R represents the set of edges; each node is linearly described by this matrix, H (l+1) =SH (l+1) +O (l+1) , O (l+1) Represents the noise matrix; calculates the characteristic distance matrix D∈R of all nodes in the subspace N×N , where the elements of the feature distance matrix D are x i ,x j Represents the characteristics of the relevant nodes; i and j represent the i-th and j-th nodes respectively; d ij represents the characteristic distance between the i-th and j-th nodes;

[0035] Step S23: According to the formula α and β are non-negative parameters; the closed solution S of the self-expression matrix is ​​calculated * , then Z=S * H (l+1) Get a homomorphic representation;

[0036] Step S25: For the target node v i A heterogeneous encoder is used to aggregate the information of its related one-hop neighbors and then obtain an edge-based representation. Among them, edge type r∈R;

[0037] Step S26: Further fuse all edge-based representations to obtain heterogeneous representations

[0038] Step S27: Concatenate the homomorphic representation and the heterogeneous representation in the horizontal dimension to obtain the final embedded representation of the traceability graph node

[0039] Furthermore, the attack detection phase specifically includes the following steps:

[0040] Step S31: using the node embedding representation obtained in the heterogeneous graph representation learning phase to be divided into a training set and a test set, the training set is used to train the lightweight classifier XGBoost;

[0041] Step S32: input the embedded representation of the node to be detected into the classifier for detection, and the detector classifies the node to be detected or the traceability graph as benign or malicious according to different detection granularities;

[0042] Furthermore, the attack tracing stage specifically includes the following steps:

[0043] Step S41: using a community detection algorithm (Louvain algorithm) in the traceability graph to obtain interconnected local subspaces;

[0044] Step S42: For the malicious nodes obtained in the attack detection phase, a mapping from the malicious nodes to the local subspace is established according to their interaction relationship and time relationship to restore the malicious subgraph and realize attack tracing.

[0045] Furthermore, in the traceability graph construction stage, the local interaction features of the target node are obtained by traversing the neighboring nodes of the target node, counting the types and numbers of its adjacent nodes and performing one-hot encoding.

[0046] Furthermore, the heterogeneous graph representation learning stage is divided into two parts, namely homomorphic representation learning and heterogeneous representation learning; homomorphic representation learning captures node homomorphic representations from the neighborhood space of the target node by constructing a self-expression matrix; heterogeneous representation learning uses heterogeneous encoders to obtain edge-based heterogeneous representations of nodes.

[0047] The present invention adopts the above technical solution, which has the following beneficial effects: 1. The use of heterogeneous graph representation learning and lightweight classifiers realizes granularly adjustable malicious detection and attack tracing, which can achieve high-precision detection effects and low event overhead in a detection environment with limited information. 2. Learn node embedding representation from the perspective of the homomorphism and heterogeneity of the traceability graph structure, aggregate the information between nodes of the same type to obtain a homomorphic representation, and aggregate the information between nodes of different types to obtain a heterogeneous representation. This method more effectively captures the structural features of the traceability graph to learn system behavior patterns, avoids predefined rules, and reduces the model's dependence on semantic data.

[0048] Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other. The components of the embodiments of the present application generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the detailed description of the embodiments of the present application is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians of the art without making creative work are within the scope of protection of the present application.

Claims

1. A method for detecting APT attacks based on heterogeneous graph representation learning, characterized by: It includes the following steps: Step S1, source traceability graph construction phase: collect system audit logs, and construct a source traceability graph based on the entity interaction relationship and event flow of the audit logs; Step S2, heterogeneous graph representation learning stage: using heterogeneous graph representation learning to learn the homomorphism and heterogeneity of the traceability graph nodes and to fuse the homomorphic and heterogeneous information of the traceability graph structure to obtain a low-embedded representation; Step S3, attack detection phase: input the low-dimensional embedding representation of the traceability graph nodes into lightweight classification for binary classification detection; Step S4, attack tracing phase: Use community detection algorithm to divide the tracing graph into communities, map malicious nodes to corresponding communities based on interaction relationships and time relationships, and restore malicious subgraphs.

2. According to claim 1, the APT attack detection method based on heterogeneous graph representation learning is characterized by: The traceability graph construction phase specifically includes the following steps: Step S11: extracting original system call event data from the kernel audit log of the operating system, Step S12: Identify entities, events and interaction relationships between entities in the audit log, and associate the entities with each other in the order of event occurrence to form a directed acyclic graph based on the interaction relationships between the entities, with entities as nodes and events as edges; Step S13: extract the interaction features of each node, traverse each node to obtain the type and number of its neighbor nodes, perform one-hot encoding on the type, and use the accumulated result and the interaction type as the feature vector of the node; Step S14: performing noise reduction processing on the directed acyclic graph, when there are multiple edges with the same label between a pair of nodes, the redundant edges are deleted and one of them is retained; Step S15: Divide the directed acyclic graph into subgraphs, and divide the original graph into subgraphs according to the connectivity between nodes to obtain the final traceability graph.

3. The APT attack detection method based on heterogeneous graph representation learning according to claim 2 is characterized in that: The raw system call event data includes the event occurrence time, process ID, thread ID, operation type, operation object, and operation result.

4. The APT attack detection method based on heterogeneous graph representation learning according to claim 1 is characterized in that: The heterogeneous graph representation learning phase specifically includes the following steps: Step S21: Use multi-layer perception to calculate the feature vector of the node and obtain the representation H of the (l+1)th layer node (l+1) ; Step S22: Construct a self-expression matrix S∈R N×N , N represents the number of nodes in the traceability graph, R represents the set of edges; each node is linearly described by this matrix, H (l+1) =SH (l+1) +O (l+1) , O (l+1) Represents the noise matrix; calculates the characteristic distance matrix D∈R of all nodes in the subspace N×N , where the elements of the feature distance matrix D are x i ,x j Represents the characteristics of the relevant nodes; i and j represent the i-th and j-th nodes respectively; d ij represents the characteristic distance between the i-th and j-th nodes; Step S23: According to the formula α and β are non-negative parameters; Calculate the closed solution S of the self-expression matrix * , then Z=S*H (l+1) Get a homomorphic representation; Step S25: For the target node v i A heterogeneous encoder is used to aggregate the information of its related one-hop neighbors and then obtain an edge-based representation. Among them, edge type r∈R; Step S26: Further fuse all edge-based representations to obtain heterogeneous representations Step S27: Concatenate the homomorphic representation and the heterogeneous representation in the horizontal dimension to obtain the final embedded representation of the traceability graph node 5. The APT attack detection method based on heterogeneous graph representation learning according to claim 1 is characterized in that: The attack detection phase specifically includes the following steps: Step S31: using the node embedding representation obtained in the heterogeneous graph representation learning phase to train the lightweight classifier XGBoost; Step S32: embedding the node representation of the node to be detected into the classifier for detection, and the detector classifies the node to be detected or the traceability graph as benign or malicious according to different detection granularities.

6. The APT attack detection method based on heterogeneous graph representation learning according to claim 1 is characterized in that: The attack source tracing phase includes the following steps: Step S41: using a community detection algorithm in the traceability graph to obtain interconnected local subspaces; Step S42: For malicious nodes obtained in the attack detection phase, a mapping from malicious nodes to local subspaces is established according to their interaction relationships and time relationships to restore malicious subgraphs and achieve attack tracing.

7. The APT attack detection method based on heterogeneous graph representation learning according to claim 1 is characterized in that: In the traceability graph construction phase, the local interaction features of the target node are obtained by traversing the neighbor nodes of the target node, counting the types and numbers of its adjacent nodes and performing one-hot encoding.

8. The APT attack detection method based on heterogeneous graph representation learning according to claim 1 is characterized in that: The heterogeneous graph representation learning phase is divided into two parts: homomorphic representation learning and heterogeneous representation learning; Homomorphic representation learning captures node homomorphic representations from the neighborhood space of the target node by constructing a self-expressive matrix; Heterogeneous representation learning uses heterogeneous encoders to obtain edge-based heterogeneous representations of nodes.

Images