Node feature construction method based on honey point intelligence and neighborhood weight adaptive updating

Abstract

The invention discloses a node feature construction method based on honey point intelligence and neighborhood weight adaptive updating. The method comprises the following steps: firstly, performing feature extraction on nodes and edges input into a traceability graph to generate an initial feature vector of each node; secondly, aggregating initial feature vectors of neighbor nodes in an L-order range of target nodes in the traceability graph by adopting a mean value aggregation method, and generating a neighbor feature matrix with a fixed dimension; and finally, combining the neighbor feature matrix with the initial feature vector of the target node by adopting a feature updating method based on an attention mechanism to update, and introducing a neighborhood adaptive weight to dynamically adjust the weight of each order of neighborhood feature in the attention score to obtain the feature of the updated target node. Therefore, the weight is dynamically adjusted in the feature aggregation process, and the real-time change of the nodes in the graph is fused into feature updating, so that the node features can reflect the dynamic change of a scene in time, and the differential expression capability of the node features is remarkably improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security and deep learning, and specifically relates to a node feature construction method based on honey point intelligence and neighborhood weight adaptive updating. Background Art

[0002] The core technology of graph neural network (GNN) lies in how to effectively construct node features so that the representation of each node not only contains its own information, but also reflects the feature information of its neighboring nodes; this feature construction depends on different aggregation mechanisms, which determine how to extract useful information from neighboring nodes and update the features of the target node. At present, the common feature aggregation strategies in GNN can be summarized into three categories: mean update mechanism, sampling update mechanism and attention update mechanism; each mechanism provides technical support for node feature construction in different ways. The mean update mechanism (MeanAggregation) is the most basic feature aggregation strategy in graph neural network. Its core idea is to average the features of neighboring nodes of each node to generate the feature representation of the node, which is suitable for relatively uniform graph structures; mean update assumes that all neighboring nodes have the same importance to the target node and the feature contributions are equally weighted. The representative model is graph convolutional network (GCN), which has the advantages of simple and efficient aggregation process. The core idea of ​​the sampling update mechanism is to reduce the computational complexity by reducing the number of neighbor nodes involved in each aggregation. This mechanism is suitable for processing large-scale graph data scenarios. The representative model is GraphSAGE (GraphSample and Aggregation). The attention update mechanism (Attention Aggregation) introduces the attention mechanism and assigns weights according to the different contributions of each neighbor node to the target node. It can dynamically model the complex relationships of the graph structure. The representative model is the Graph Attention Network (GAT).

[0003] However, each mechanism also has corresponding limitations, which are mainly reflected in three aspects: First, the mean update mechanism (such as GCN) ignores the difference in influence of different neighbor nodes on the target node by simply averaging the features of the neighborhood nodes; this linear message passing method easily leads to the homogenization of the target node features when dealing with similar neighbor nodes, and it is difficult to capture the subtle differences between nodes. Therefore, this method shows the problem of insufficient ability to express feature differences in complex networks. Second, although the sampling update mechanism (such as GraphSAGE) reduces the computational complexity by randomly sampling the neighborhood nodes, the randomness of the sampling process makes it impossible to guarantee that the sampled nodes can fully represent the structure and feature diversity of the entire neighborhood, and the information loss and noise introduced by sampling further aggravate the problem of feature homogeneity; in addition, random sampling fails to adjust the features according to the real-time graph structure, resulting in its insensitivity to changes in dynamic graph scenes, reducing the timeliness of feature expression, especially in real-time tasks such as traceability graphs. Third, the attention update mechanism (such as GAT) distinguishes the importance of different nodes to a certain extent by calculating the weights of neighborhood nodes, but its weight calculation depends on the initial node features; if the initial node features are similar, the attention mechanism may still assign similar weights to adjacent nodes, making it difficult to effectively distinguish the impact of heterogeneous neighborhoods; at the same time, the existing attention mechanism does not make real-time adjustments based on changes in node degree or neighborhood structure, resulting in the inability to adapt to real-time changes in node features in dynamic scenarios, thereby reducing the ability to express feature timeliness.

[0004] The root cause of these limitations is that most existing message passing mechanisms adopt linear or approximately linear aggregation strategies, which fail to fully model the complex nonlinear relationships between nodes. In addition, most existing technologies ignore the hierarchical and multi-scale information in the graph structure, as well as the real-time changes of the graph in dynamic scenarios, resulting in insufficient performance in capturing complex neighborhood relationships and adapting to dynamic graph changes during feature construction. Therefore, future research needs to explore more flexible nonlinear message passing mechanisms, enhance the differentiated expression and timeliness of node features, and improve their adaptability and generalization capabilities in tasks such as real-time traceability graphs. Summary of the invention

[0005] The main purpose of the present invention is to overcome the shortcomings and deficiencies of the prior art and to provide a node feature construction method based on honey spot intelligence and adaptive updating of neighborhood weights. By dynamically sensing the influence of neighbor nodes at different levels in real time and making adaptive adjustments based on graph structure information such as the degree and number of neighborhood nodes, the present invention can flexibly respond to dynamic changes in the provenance graph and make the node feature construction in the provenance graph more accurate and timely.

[0006] In order to achieve the above object, the present invention provides a node feature construction method based on honey spot intelligence and neighborhood weight adaptive update, comprising the following steps:

[0007] Perform initial feature extraction on the nodes and edges in the input traceability graph, assign label values ​​to them through a mapping function, and generate the initial feature vector of each node;

[0008] For the target node in the traceability graph, the initial feature vectors of the neighboring nodes within the L-order range of the target node are aggregated using the mean aggregation method to generate a neighbor feature matrix of fixed dimension;

[0009] A feature updating method based on the attention mechanism is used to combine the neighbor feature matrix with the initial feature vector of the target node for update, and the neighborhood adaptive weight is introduced to dynamically adjust the weight of each order of neighborhood features in the attention score to obtain the updated features of the target node.

[0010] As a preferred technical solution, the initial feature vector of each node is generated as follows:

[0011] Get the number of different node types and the number of different edge types from the traceability graph;

[0012] Define node mapping functions and edge mapping functions to assign integer label values ​​to each node and each edge;

[0013] Store the true label value of each node in the true label array;

[0014] Based on the number of in-edges and out-edges of the node, the initial feature vector of each node is extracted.

[0015] As a preferred technical solution, the polymerization process is described as follows:

[0016]

[0017] Among them, H l is the neighbor feature matrix of the target node at the lth order after aggregation, is the set of neighbor nodes of the target node v at the lth order, is the initial feature vector of the uth neighbor node of the lth order of the target node, and L is the maximum order between the target node and the neighbor node;

[0018] The fixed dimension of the neighbor feature matrix is ​​the number of true labels of all nodes in the provenance graph.

[0019] As a preferred technical solution, the characteristics of the updated target node are obtained as follows:

[0020] The adaptive weight coefficient is calculated based on the deviation between the average degree of the neighbor feature matrix of each order of the target node and the global average degree;

[0021] According to the adaptive weight coefficient, the initial feature representation of the target node and the neighbor feature matrix of each order of the target node, the adaptive weight of the neighbor feature matrix of each order of the target node is calculated through the attention mechanism;

[0022] According to the adaptive weights and the neighbor feature matrix of each order of the target node, a fusion update is performed through the multi-head attention mechanism to obtain the updated features of the target node.

[0023] As a preferred technical solution, the calculation of the adaptive weight coefficient is specifically as follows:

[0024] Calculate the average degree of the neighbor feature matrix of each order of the target node. The formula is:

[0025]

[0026] Among them, avg_degree l is the average degree of the target node’s l-th order neighbor feature matrix, d l is the sum of the degrees of the target node’s l-th order neighbor nodes, n l is the number of the target node’s l-th order neighbor nodes; d l and n l All are obtained from the honeypoint intelligence statistics of Shield Cube; L is the maximum order between the target node and the neighboring nodes;

[0027] Calculate the global average degree of all neighbor nodes of the target node. The formula is:

[0028]

[0029] Where μ is the global average degree of all neighbor nodes of the target node, V is the set of all neighbor nodes within the L-order range of the target node, |V| is the number of all neighbor nodes within the L-order range of the target node, and v i is the i-th neighbor node of the target node;

[0030] The adaptive weight coefficient is calculated based on the deviation between the average degree of each order neighbor node of the target node and the global average degree. The formula is:

[0031]

[0032] Among them, α l is the adaptive weight coefficient of the target node’s l-th order neighbor feature matrix, and β is a control hyperparameter, which is set according to the experience of security experts.

[0033] As a preferred technical solution, the calculation formula of the adaptive weight is:

[0034]

[0035] in, is the adaptive weight of the target node’s l-th order neighbor feature matrix, H l is the target node’s l-th order neighbor feature matrix, H i is the initial feature vector of the i-th target node, W Q , W K are the weight matrices of the query vector and key vector in the attention mechanism, α l is the adaptive weight coefficient of the target node's l-th order neighbor feature matrix, d is the scaling factor, and L is the maximum order between the target node and its neighbor nodes.

[0036] As a preferred technical solution, the multi-head attention mechanism performs fusion update as described below:

[0037]

[0038] in, is the feature of the i-th target node after update, concat is the concatenation operation, is the adaptive weight of the target node’s l-th order neighbor feature matrix, H l is the target node’s l-th order neighbor feature matrix, W o is the linear transformation matrix, and L is the maximum order between the target node and the neighboring nodes.

[0039] On the other hand, the present invention provides a node feature construction system based on honey spot intelligence and neighborhood weight adaptive update, including an initial feature extraction module, a neighborhood mean aggregation module and a feature update module;

[0040] The initial feature extraction module is used to extract initial features from nodes and edges in the input traceability graph, assign label values ​​to them through a mapping function, and generate an initial feature vector for each node;

[0041] The neighborhood mean aggregation module is used to aggregate the initial feature vectors of neighboring nodes within the L-order range of the target node using a mean aggregation method to generate a neighbor feature matrix of fixed dimension;

[0042] The feature update module is used to update the target node in the traceability graph by combining the neighbor feature matrix with the initial feature vector of the target node using a feature update method based on the attention mechanism, and introduces neighborhood adaptive weights to dynamically adjust the weight of each order of neighborhood features in the attention score to obtain the features of the updated target node.

[0043] Another aspect of the present invention provides an electronic device, comprising:

[0044] at least one processor; and a memory in communication with the at least one processor; wherein,

[0045] The memory stores computer program instructions that can be executed by the at least one processor, and the computer program instructions are executed by the at least one processor so that the at least one processor can execute the traceability graph node feature construction method as described above.

[0046] Another aspect of the present invention provides a computer-readable storage medium storing a program, which, when executed by a processor, implements the above-mentioned method for constructing node features of a traceability graph.

[0047] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0048] 1. Improve the ability to express differences in node features in the traceability graph:

[0049] The present invention introduces a neighborhood adaptive weight dynamic adjustment mechanism to dynamically perceive the impact of neighbor nodes of different levels on the target node features, ensuring that the differences in node features can be effectively distinguished in complex graph structures. Different from the fixed weight or mean aggregation strategy in the prior art, the present invention adopts a technical means of adjusting weights in real time according to node degree and neighborhood structure, so that subtle differences between nodes can be extracted more flexibly during the node feature construction process, thereby significantly improving the differentiated expression ability of node features.

[0050] 2. Improve the scene perception and timeliness of traceability graph node features:

[0051] The present invention not only dynamically adjusts weights during feature aggregation, but also incorporates real-time changes of nodes in the traceability graph (such as the number of nodes and degree, etc.) into feature updates, so that node features can timely reflect dynamic changes in the scene. This technical approach is different from the limitations of traditional GNN fixed input graphs. It adaptively adjusts feature expression based on real-time scene information based on honeypoint intelligence, greatly improving the timeliness of node features and sensitivity to scene changes, ensuring that the anomaly detection graph neural network model performs more accurately and efficiently in tasks such as real-time anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0053] Figure 1 It is an overall flow chart of the node feature construction method based on the adaptive update of honey spot intelligence and neighborhood weights in an embodiment of the present invention.

[0054] Figure 2 Schematic diagram of aggregation of first-order neighbor nodes of a target node in an embodiment of the present invention.

[0055] Figure 3 Schematic diagram of aggregation of second-order neighbor nodes of a target node in an embodiment of the present invention.

[0056] Figure 4 It is an overall block diagram of a node feature construction system based on adaptive updating of honey spot intelligence and neighborhood weights in an embodiment of the present invention.

[0057] Figure 5 Schematic diagram of the structure of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION

[0058] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present application.

[0059] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments.

[0060] The present invention aims to solve the problem that the existing graph neural network (GNN) has insufficient ability to express the differentiated features of node neighborhood and the timeliness of features when processing traceability graph scenarios, and realizes the feature construction of the target node for each target node in the input traceability graph and outputs the feature representation of the target node. Figure 1 As shown, the node feature construction method based on honey spot intelligence and neighborhood weight adaptive update in this embodiment includes the following steps:

[0061] Step 1: Initial feature extraction:

[0062] Initial feature extraction is performed on the nodes and edges in the input traceability graph, and label values ​​are assigned to them through a mapping function to generate the initial feature vector of each node.

[0063] Furthermore, all nodes in the input traceability graph are first subjected to simple feature preprocessing to extract the initial feature vector of each node, specifically:

[0064] 1.1. Obtain the number of different node types Nn and the number of different edge types Ne from the traceability graph;

[0065] 1.2. Define the node mapping function Mv and the edge mapping function Me to assign integer label values ​​to each node and each edge; the functions are expressed as:

[0066] L(v)=Mv(Xv(v))∈[0,Nn-1],v∈V,

[0067] T(e)=Me(Xe(e))∈[0,Ne-1],e∈E,

[0068] Among them, L(v) is the label value of node v, Xv(v) is the node type of node v, V is the node set in the benign provenance graph, T(e) is the label value of edge e, Xe(e) is the edge type of edge e, and E is the edge set in the benign provenance graph.

[0069] 1.3. Store the true label value of each node in the true label array TL(v);

[0070] 1.4. Based on the number of in-edges and out-edges of the node, extract the initial feature vector of each node, expressed as:

[0071] F(v)=[a0,a1,…,a Ne-1 ,a Ne ,a Ne+1 ,…,a 2×Ne-1 ],

[0072] For each element a in the node's behavior feature vector F(v) i , which represents the number of edges, and the calculation formula is:

[0073]

[0074] Among them, {e∈In(v)|i=T(e)} represents the number of edges when edge e is an incoming edge and its label value is i, {e∈Out(v)|i-Ne=T(e)} represents the number of edges when edge e is an outgoing edge and its label value is i-Ne, In(v) is the incoming edge set of node v, and Out(v) is the outgoing edge set of node v.

[0075] The initial feature vector of a node needs to reflect the behavior of the node. The behavior of the node is reflected in the interaction between nodes. Therefore, the initial feature vector of the node needs to contain the information of the attached edges. Among them, the attached edges include input edges and output edges. The input edge indicates the edge connecting the node as the destination node to the source node. The output edge refers to the edge connecting the node as the source node to the destination node. Therefore, the initial feature vector of the node consists of the number set of node input edge types and the number set of node output edge types. The number set of node input edge types and the number set of node output edge types are equal in size and are equal to the number of edge types. Each element in the number set of node input edge types and the number set of node output edge types corresponds to one edge type in order. The element value in the number set of node input edge types and the number set of node output edge types is the number of corresponding edge types. For example, the initial feature vector of a node is [0,0,2,1,2,0], which means that there are three types of edges, where the number of input edges of each edge type is 0, 0, and 2 respectively; the number of outgoing edges of each edge type is 1, 2, and 0.

[0076] Step 2: Neighborhood feature aggregation:

[0077] For the target node in the traceability graph, the mean aggregation method is used to aggregate the initial feature vectors of the neighboring nodes within the L-order range of the target node to generate a neighbor feature matrix of fixed dimension.

[0078] Furthermore, in the message passing mechanism (aggregation-update mechanism) of GNN, the aggregation part is very necessary because the aggregation part includes information transmission, which makes the characteristics of the target node include the behavior information of the neighboring nodes. However, unlike the step of GNN aggregating the characteristics of the neighboring nodes into the characteristics of the target node, the present invention uses neighborhood mean aggregation in the neighborhood feature aggregation stage to aggregate the initial feature vectors of the neighboring nodes of each order of the target node into a separate feature matrix. The aggregation process is described as:

[0079]

[0080] Among them, H l is the neighbor feature matrix of the target node at the lth order after aggregation; is the set of neighbor nodes of the target node v at the first order, usually expressed as an index set rather than a matrix, which means that it contains the numbers or indices of the neighbor nodes related to the target node v, indicating which nodes are in the set of neighbor nodes at the first order (for example, if the second-order neighbor nodes of the target node v are nodes 1, 3, and 5, then This set itself only stores the indices of neighbor nodes associated with the target node v, but does not contain feature values); is the initial feature vector of the uth neighbor node of the lth order of the target node, and L is the maximum order between the target node and its neighbor nodes.

[0081] like Figure 2 , Figure 3 As shown in the figure, the initial feature vectors of all neighbor nodes within the third order of the target node i after feature preprocessing are input, and the average aggregation is used to output the neighbor feature matrix of each order of the aggregated target node, where Figure 2 is the first-order neighbor feature matrix of target node i, Figure 3 is the second-order neighbor feature matrix of target node i. To ensure that the dimensions of the neighbor feature matrices of each order of the target node are the same, the dimension of the aggregated neighbor feature matrix is ​​the number of true labels of all nodes in the traceability graph.

[0082] Step 3: Feature adaptive update:

[0083] A feature updating method based on the attention mechanism is used to combine the neighbor feature matrix with the initial feature vector of the target node for update, and the neighborhood adaptive weight is introduced to dynamically adjust the weight of each order of neighborhood features in the attention score to obtain the updated features of the target node.

[0084] Furthermore, the present application proposes a feature updating method based on the attention mechanism, which combines the aggregated features of all neighboring nodes within the L-order range of the target node with the target node's own features for updating, and introduces a neighborhood adaptive weight dynamic adjustment mechanism to dynamically adjust the weight of each-order neighborhood feature in the attention score, ensuring that the influence of different-order neighborhood features on the target node feature update can be flexibly adjusted according to the specific structure of the graph. The specific steps are:

[0085] 3.1. Calculate the adaptive weight coefficient based on the deviation between the average degree of the neighbor feature matrix of each order of the target node and the global average degree.

[0086] Specifically, first calculate the average degree of the neighbor feature matrix of each order of the target node, the formula is:

[0087] Among them, avg_degree l is the average degree of the target node’s l-th order neighbor feature matrix, d l is the sum of the degrees of the target node’s l-th order neighbor nodes, n l is the number of the target node’s l-th order neighbor nodes; d l and n l They are all obtained from the honeypoint intelligence statistics of Shield Cube, and L is the maximum order between the target node and the neighboring nodes;

[0088] Next, calculate the global average degree of all neighbor nodes of the target node. The formula is:

[0089]

[0090] Where μ is the global average degree of all neighbor nodes of the target node, V is the set of all neighbor nodes within the L-order range of the target node, |V| is the number of all neighbor nodes within the L-order range of the target node, and v i is the i-th neighbor node of the target node. By calculating the global average degree μ of all neighbor nodes of the target node, it is helpful to globally evaluate the connectivity of nodes in the graph and the overall density of neighbor nodes, thereby providing powerful information for analyzing node characteristics and network structure characteristics.

[0091] Finally, the adaptive weight coefficient is calculated based on the deviation between the average degree of each order of neighbor nodes of the target node and the global average degree. The formula is:

[0092]

[0093] Among them, α l is the adaptive weight coefficient of the target node's l-th order neighbor feature matrix; β is a control hyperparameter, which is set according to the experience of security experts and determines the sensitivity of the adaptive weight coefficient to the average degree deviation. For example, a high initial value of β can be set when there are many scene alarms.

[0094] The adaptive weight coefficient is calculated using the Sigmoid function in order to flexibly adjust the weight according to the input distribution. Especially when dealing with complex graph structures, the Sigmoid function can provide smooth weight changes to ensure that the influence of high and low degree nodes is balanced under different degree distributions. In addition, this function form ensures that the weight range is between 0 and 1, ensuring the stability of subsequent GNN model training and modeling and avoiding numerical overflow problems.

[0095] 3.2. According to the adaptive weight coefficient, the initial feature representation of the target node and the neighbor feature matrix of each order of the target node, the adaptive weight of the neighbor feature matrix of each order of the target node is calculated through the attention mechanism.

[0096] The calculation of the adaptive weight coefficient introduces an adaptive adjustment mechanism for the number and degree of process nodes in the node neighborhood, so that the attention mechanism not only considers the similarity of features, but also can be adjusted according to the specific characteristics of the graph structure, thereby improving the adaptability and performance of node feature representation under different types of graph structures. The adaptive weight is calculated as follows:

[0097]

[0098] in, is the adaptive weight of the target node’s l-th order neighbor feature matrix, H lis the target node’s l-th order neighbor feature matrix, H i is the initial feature vector of the i-th target node, W Q , W K are the weight matrices of the query vector and key vector in the attention mechanism, respectively, used to calculate the similarity of the attention scores; α l is the adaptive weight coefficient of the target node's l-th order neighbor feature matrix, and d is a scaling factor, usually the square root of the feature dimension, which is used to normalize the attention score. Through this scaling, the size of the attention score will not become too large due to the increase in feature dimensions, making the softmax result more stable and easier to handle, and can effectively prevent the gradient from disappearing or exploding due to excessive values ​​during the calculation process. Its initial value is usually set by experts.

[0099] 3.3. Based on the adaptive weights and the neighbor feature matrix of each order of the target node, a fusion update is performed through the multi-head attention mechanism to obtain the updated features of the target node.

[0100] Specifically, the fusion update of the multi-head attention mechanism is described as follows:

[0101]

[0102] in, is the feature of the i-th target node after update, concat is the concatenation operation, H l is the neighbor feature matrix of the target node at the lth order, L is the maximum order between the target node and the neighbor node, W o is a linear transformation matrix. This fusion function weights and aggregates the features of multi-order neighborhoods and finally updates the features of the target node i.

[0103] Therefore, the present invention designs a dynamic adaptive weight update mechanism, and adjusts the weight distribution of neighbor nodes of each order in the feature aggregation process in real time according to information such as the degree of the node and the characteristics of the neighborhood structure, so as to more accurately capture the differentiated contribution of different neighborhood nodes to the target node features, and solve the problem of homogenization of feature expression caused by fixed or random sampling of neighborhood feature weights in traditional node feature aggregation methods. In addition, the present invention significantly enhances the timeliness expression of node features in the traceability graph scene by combining honey point intelligence, so that the constructed node features can timely reflect the real-time changes of nodes and edges in the traceability graph, which is particularly suitable for heterogeneous and complex graph structure environments. Therefore, the present invention not only overcomes the shortcomings of traditional GNN feature extraction and construction methods in terms of node feature homogeneity and timeliness, but also realizes more efficient node feature expression and aggregation in dynamic scenarios. Compared with the prior art, the present invention can more flexibly handle complex and real-time changing graph structures by combining honey point intelligence, improve the ability to model the relationship between nodes in detail, significantly improve the differentiated expression ability and timeliness of features, and provide a more accurate feature construction scheme for real-time tasks such as traceability analysis and anomaly detection.

[0104] It should be noted that, for the sake of convenience, the aforementioned method embodiments are all expressed as a series of action combinations, but those skilled in the art should know that the present invention is not limited to the described order of actions, because according to the present invention, certain steps can be performed in other orders or simultaneously.

[0105] Based on the same idea as the node feature construction method based on adaptive updating of honey spot intelligence and neighborhood weights in the above-mentioned embodiment, the present invention also provides a node feature construction system based on adaptive updating of honey spot intelligence and neighborhood weights, which can be used to execute the above-mentioned node feature construction method based on adaptive updating of honey spot intelligence and neighborhood weights. For ease of explanation, the structural diagram of the embodiment of the node feature construction system based on adaptive updating of honey spot intelligence and neighborhood weights only shows the parts related to the embodiment of the present invention, and those skilled in the art can understand that the illustrated structure does not constitute a limitation on the device, and may include more or fewer components than shown in the diagram, or combine certain components, or arrange the components differently.

[0106] like Figure 4 As shown, another embodiment of the present invention provides a node feature construction system based on honeypoint intelligence and neighborhood weight adaptive update, including an initial feature extraction module, a neighborhood mean aggregation module and a feature update module;

[0107] The initial feature extraction module is used to extract initial features from the nodes and edges in the input traceability graph, assign label values ​​to them through a mapping function, and generate the initial feature vector of each node;

[0108] The neighborhood mean aggregation module is used to aggregate the initial feature vectors of neighboring nodes within the L-order range of the target node in the traceability graph using the mean aggregation method to generate a neighborhood feature matrix of fixed dimension;

[0109] The feature update module is used to update the neighbor feature matrix and the initial feature vector of the target node by adopting a feature update method based on the attention mechanism, and introduce the neighborhood adaptive weight to dynamically adjust the weight of each order of neighborhood features in the attention score to obtain the features of the updated target node.

[0110] It should be noted that the node feature construction system based on adaptive updating of honey spot intelligence and neighborhood weights of the present invention corresponds one to one with the node feature construction method based on adaptive updating of honey spot intelligence and neighborhood weights of the present invention. The technical features and beneficial effects described in the embodiment of the node feature construction method based on adaptive updating of honey spot intelligence and neighborhood weights are applicable to the embodiment of the node feature construction system based on adaptive updating of honey spot intelligence and neighborhood weights. For specific contents, please refer to the description in the embodiment of the method of the present invention, which will not be repeated here. This is hereby declared.

[0111] In addition, in the implementation of the node feature construction system based on the adaptive update of honey spot intelligence and neighborhood weights in the above-mentioned embodiment, the logical division of each program module is only an example. In actual applications, the above-mentioned functions can be assigned to different program modules as needed, for example, for the configuration requirements of the corresponding hardware or the convenience of software implementation. That is, the internal structure of the node feature construction system based on the adaptive update of honey spot intelligence and neighborhood weights is divided into different program modules to complete all or part of the functions described above.

[0112] See also Figure 5 In one embodiment, an electronic device is provided for implementing a node feature construction method based on honey point intelligence and adaptive update of neighborhood weights. The electronic device may include a first processor, a first memory, and a bus, and may also include a computer program stored in the first memory and executable on the first processor, such as a provenance graph node feature construction program.

[0113] Among them, the first memory includes at least one type of readable storage medium, and the readable storage medium includes flash memory, mobile hard disk, multimedia card, card-type memory (for example: SD or DX memory, etc.), magnetic memory, disk, optical disk, etc. In some embodiments, the first memory can be an internal storage unit of an electronic device, such as a mobile hard disk of the electronic device. In other embodiments, the first memory can also be an external storage device of an electronic device, such as a plug-in mobile hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device. Further, the first memory can also include both an internal storage unit of the electronic device and an external storage device. The first memory can not only be used to store application software and various types of data installed in the electronic device, such as the code of the traceability graph node feature construction program, but also can be used to temporarily store data that has been output or is to be output.

[0114] In some embodiments, the first processor may be composed of an integrated circuit, for example, a single packaged integrated circuit, or a plurality of integrated circuits with the same or different functions, including one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and combinations of various control chips. The first processor is the control core (ControlUnit) of the electronic device, and uses various interfaces and lines to connect the various components of the entire electronic device, and executes or executes programs or modules stored in the first memory (such as a traceability graph node feature construction program, etc.), and calls the data stored in the first memory to perform various functions of the electronic device and process data.

[0115] Figure 5 Only an electronic device with components is shown, and those skilled in the art will understand that Figure 5 The structure shown does not constitute a limitation on the electronic device, and may include fewer or more components than shown in the figure, or combine certain components, or arrange the components differently.

[0116] The provenance graph node feature construction program stored in the first memory in the electronic device is a combination of multiple instructions, and when executed in the first processor, can achieve:

[0117] Perform initial feature extraction on the nodes and edges in the input traceability graph, assign label values ​​to them through a mapping function, and generate the initial feature vector of each node;

[0118] For the target node in the traceability graph, the initial feature vectors of the neighboring nodes within the L-order range of the target node are aggregated using the mean aggregation method to generate a neighbor feature matrix of fixed dimension;

[0119] A feature updating method based on the attention mechanism is used to combine the neighbor feature matrix with the initial feature vector of the target node for update, and the neighborhood adaptive weight is introduced to dynamically adjust the weight of each order of neighborhood features in the attention score to obtain the updated features of the target node.

[0120] Furthermore, if the module / unit integrated in the electronic device is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a non-volatile computer-readable storage medium. The computer-readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, and a read-only memory (ROM).

[0121] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0122] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0123] The above embodiments are preferred implementation modes of the present invention, but the implementation modes of the present invention are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present invention should be equivalent replacement methods and are included in the protection scope of the present invention.

Claims

1. A node feature construction method based on honey spot intelligence and neighborhood weight adaptive update, characterized in that: The steps include: Perform initial feature extraction on the nodes and edges in the input traceability graph, assign label values ​​to them through a mapping function, and generate the initial feature vector of each node; For the target node in the traceability graph, the initial feature vectors of the neighboring nodes within the L-order range of the target node are aggregated using the mean aggregation method to generate a neighbor feature matrix of fixed dimension; A feature updating method based on the attention mechanism is used to combine the neighbor feature matrix with the initial feature vector of the target node for update, and the neighborhood adaptive weight is introduced to dynamically adjust the weight of each order of neighborhood features in the attention score to obtain the updated features of the target node.

2. The method for constructing node features of a traceability graph according to claim 1, characterized in that: The initial feature vector of each node is generated as follows: Get the number of different node types and the number of different edge types from the traceability graph; Define node mapping functions and edge mapping functions to assign integer label values ​​to each node and each edge; Store the true label value of each node in the true label array; Based on the number of in-edges and out-edges of the node, the initial feature vector of each node is extracted.

3. The method for constructing node features of a traceability graph according to claim 1, characterized in that: The polymerization process is described as: Among them, H l is the neighbor feature matrix of the target node at the lth order after aggregation, is the set of neighbor nodes of the target node v at the lth order, is the initial feature vector of the uth neighbor node of the lth order of the target node, and L is the maximum order between the target node and the neighbor node; The fixed dimension of the neighbor feature matrix is ​​the number of true labels of all nodes in the provenance graph.

4. The method for constructing node features of a traceability graph according to claim 1, characterized in that: The characteristics of the updated target node are specifically: The adaptive weight coefficient is calculated based on the deviation between the average degree of the neighbor feature matrix of each order of the target node and the global average degree; According to the adaptive weight coefficient, the initial feature representation of the target node and the neighbor feature matrix of each order of the target node, the adaptive weight of the neighbor feature matrix of each order of the target node is calculated through the attention mechanism; According to the adaptive weights and the neighbor feature matrix of each order of the target node, a fusion update is performed through the multi-head attention mechanism to obtain the updated features of the target node.

5. The method for constructing node features of a traceability graph according to claim 4, characterized in that: The calculation of the adaptive weight coefficient is specifically as follows: Calculate the average degree of the neighbor feature matrix of each order of the target node. The formula is: Among them, avg_degree l is the average degree of the target node’s l-th order neighbor feature matrix, d l is the sum of the degrees of the target node’s l-th order neighbor nodes, n l is the number of the target node’s l-th order neighbor nodes; d l and n l All are obtained from the honeypoint intelligence statistics of Shield Cube; L is the maximum order between the target node and the neighboring nodes; Calculate the global average degree of all neighbor nodes of the target node. The formula is: Where μ is the global average degree of all neighbor nodes of the target node, V is the set of all neighbor nodes within the L-order range of the target node, and |V| is the number of all neighbor nodes within the L-order range of the target node; The adaptive weight coefficient is calculated based on the deviation between the average degree of each order neighbor node of the target node and the global average degree. The formula is: Among them, α l is the adaptive weight coefficient of the target node’s l-th order neighbor feature matrix, and β is a control hyperparameter, which is set according to the experience of security experts.

6. The method for constructing node features of a traceability graph according to claim 4, characterized in that: The calculation formula of the adaptive weight is: in, is the adaptive weight of the target node’s l-th order neighbor feature matrix, H l is the target node’s l-th order neighbor feature matrix, H i is the initial feature vector of the i-th target node, W Q , W K are the weight matrices of the query vector and key vector in the attention mechanism, α l is the adaptive weight coefficient of the target node's l-th order neighbor feature matrix, d is the scaling factor, and L is the maximum order between the target node and its neighbor nodes.

7. The method for constructing node features of a traceability graph according to claim 4, characterized in that: The multi-head attention mechanism performs fusion update as follows: in, is the feature of the i-th target node after update, concat is the concatenation operation, is the adaptive weight of the target node’s l-th order neighbor feature matrix, H l is the target node’s l-th order neighbor feature matrix, W o is the linear transformation matrix, and L is the maximum order between the target node and the neighboring nodes.

8. A node feature construction system based on honey spot intelligence and neighborhood weight adaptive update, characterized in that: It includes an initial feature extraction module, a neighborhood mean aggregation module and a feature update module; The initial feature extraction module is used to extract initial features from nodes and edges in the input traceability graph, assign label values ​​to them through a mapping function, and generate an initial feature vector for each node; The neighborhood mean aggregation module is used to aggregate the initial feature vectors of neighboring nodes within the L-order range of the target node using a mean aggregation method to generate a neighbor feature matrix of fixed dimension; The feature update module is used to update the target node in the traceability graph by combining the neighbor feature matrix with the initial feature vector of the target node using a feature update method based on the attention mechanism, and introduces neighborhood adaptive weights to dynamically adjust the weight of each order of neighborhood features in the attention score to obtain the features of the updated target node.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory in communication with the at least one processor; wherein, The memory stores computer program instructions that can be executed by the at least one processor, and the computer program instructions are executed by the at least one processor so that the at least one processor can execute the traceability graph node feature construction method as described in any one of claims 1-7.

10. A computer-readable storage medium storing a program, characterized in that: When the program is executed by a processor, the method for constructing node features of a provenance graph described in any one of claims 1 to 8 is implemented.

Images