Node feature construction method based on honey point intelligence and neighborhood weight adaptive update

Abstract

This invention discloses a node feature construction method based on honeypot intelligence and adaptive neighborhood weight update. First, features are extracted from the nodes and edges in the input source graph to generate an initial feature vector for each node. Then, for the target nodes in the source graph, the mean aggregation method is used to... L The initial feature vectors of neighboring nodes within a certain order are aggregated to generate a fixed-dimensional neighbor feature matrix. Finally, an attention-based feature update method is used to combine the neighbor feature matrix with the initial feature vector of the target node for updating. Adaptive neighborhood weights are introduced to dynamically adjust the weight of each order of neighboring features in the attention score, resulting in the updated features of the target node. Therefore, this invention not only dynamically adjusts the weights during feature aggregation but also incorporates real-time changes in the nodes in the graph into the feature update process, enabling node features to reflect dynamic changes in the scene in a timely manner, thereby significantly improving the differentiated expressive power of node features.

Description

Technical Field

[0001] This invention belongs to the technical fields of network security and deep learning, specifically involving a node feature construction method based on honeypot intelligence and adaptive update of neighborhood weights. Background Technology

[0002] The core technology of Graph Neural Networks (GNNs) lies in how to effectively construct node features so that the representation of each node not only contains its own information but also reflects the feature information of its neighboring nodes. This feature construction relies on different aggregation mechanisms, which determine how to extract useful information from neighboring nodes and update the features of the target node. Currently, common feature aggregation strategies in GNNs can be summarized into three categories: mean update mechanism, sampling update mechanism, and attention update mechanism. Each mechanism provides technical support for node feature construction in different ways. The mean update mechanism is the most basic feature aggregation strategy in graph neural networks. Its core idea is to average the features of each node's neighboring nodes to generate the feature representation of that node. It is suitable for relatively uniform graph structures. Mean update assumes that all neighboring nodes have the same importance to the target node, and the feature contributions are equally weighted. The representative model is the Graph Convolutional Network (GCN), which has the advantages of simple and efficient aggregation process. The core idea of ​​Sampling Aggregation is to reduce computational complexity by decreasing the number of neighboring nodes involved in each aggregation. This mechanism is suitable for handling large-scale graph data scenarios, and a representative model is GraphSAGE (GraphSample and Aggregation). Attention Aggregation, on the other hand, introduces an attention mechanism, assigning weights based on the different contributions of each neighboring node to the target node. This enables dynamic modeling of complex relationships in the graph structure, and a representative model is the Graph Attention Network (GAT).

[0003] However, each mechanism also has its limitations, mainly in three aspects: First, the mean update mechanism (such as GCN) simply averages the features of neighboring nodes, ignoring the differences in influence of different neighboring nodes on the target node. This linear message passing method easily leads to homogenization of target node features when dealing with similar neighboring nodes, making it difficult to capture subtle differences between nodes. Therefore, this method shows insufficient ability to express feature differences in complex networks. Second, although the sampling update mechanism (such as GraphSAGE) reduces computational complexity by randomly sampling neighboring nodes, the randomness of the sampling process makes it impossible to guarantee that the sampled nodes can fully represent the structure and feature diversity of the entire neighborhood. Furthermore, the information loss and noise introduced by sampling further exacerbate the problem of feature homogenization. In addition, random sampling fails to adjust features according to the real-time graph structure, making it insensitive to changes in dynamic graph scenarios and reducing the timeliness of feature expression, especially showing significant shortcomings in real-time tasks such as source graphs. Third, attention update mechanisms (such as GAT) distinguish the importance of different nodes to some extent by calculating the weights of neighboring nodes, but their weight calculation depends on the initial node features. If the initial node features are similar, the attention mechanism may still assign similar weights to adjacent nodes, making it difficult to effectively distinguish the influence of heterogeneous neighborhoods. At the same time, existing attention mechanisms do not adjust in real time according to changes in node degree or neighborhood structure, which makes them unable to adapt to real-time changes in node features in dynamic scenarios, thereby reducing their ability to express the timeliness of features.

[0004] The root cause of these limitations lies in the fact that most existing message passing mechanisms employ linear or near-linear aggregation strategies, failing to adequately model the complex nonlinear relationships between nodes. Furthermore, existing techniques largely neglect the hierarchical and multi-scale information within graph structures, as well as the real-time changes of graphs in dynamic scenarios, resulting in insufficient performance in capturing complex neighborhood relationships and adapting to dynamic graph changes during feature construction. Therefore, future research needs to explore more flexible nonlinear message passing mechanisms, enhance the differentiated expression and timeliness of node features, and improve their adaptability and generalization capabilities in tasks such as real-time source graph tracing. Summary of the Invention

[0005] The main objective of this invention is to overcome the shortcomings and deficiencies of the prior art and provide a node feature construction method based on honey point intelligence and adaptive update of neighborhood weights. By dynamically sensing the influence of neighboring nodes at different levels in real time and adaptively adjusting according to graph structure information such as the degree and number of neighboring nodes, it can flexibly cope with the dynamic changes of the source graph, making the node feature construction in the source graph more accurate and timely.

[0006] To achieve the above objectives, the present invention provides a node feature construction method based on honeypot intelligence and adaptive neighborhood weight update, comprising the following steps:

[0007] Initial features are extracted from the nodes and edges in the input source graph, and label values ​​are assigned to them through a mapping function to generate an initial feature vector for each node.

[0008] For the target node in the source graph, the mean aggregation method is used to aggregate the initial feature vectors of the neighboring nodes within the L-order range of the target node to generate a fixed-dimensional neighbor feature matrix.

[0009] An attention-based feature update method is adopted to combine the neighbor feature matrix with the initial feature vector of the target node for updating, and a neighborhood adaptive weight is introduced to dynamically adjust the weight of each order of neighborhood features in the attention score, so as to obtain the updated features of the target node.

[0010] As a preferred technical solution, the generation of the initial feature vector for each node is specifically as follows:

[0011] Obtain the number of different node types and the number of different edge types from the source graph;

[0012] Define node mapping functions and edge mapping functions, and assign integer label values ​​to each node and each edge;

[0013] Store the actual label value of each node in an array of actual labels;

[0014] Based on the number of incoming and outgoing edges of a node, extract the initial feature vector of each node.

[0015] As a preferred technical solution, the polymerization process is described as follows:

[0016]

[0017] Among them, H l Let l be the neighbor feature matrix of the target node after aggregation. Let be the set of neighboring nodes of the target node v at order l. Let L be the initial feature vector of the u-th neighbor node of the l-th order of the target node, and L be the maximum order between the target node and its neighbor nodes.

[0018] The fixed dimension of the neighbor feature matrix is ​​the number of true labels of all nodes in the source graph.

[0019] As a preferred technical solution, the characteristics of the updated target node are specifically as follows:

[0020] The adaptive weighting coefficient is calculated based on the deviation between the average degree of each neighbor feature matrix of the target node and the global average degree.

[0021] Based on the adaptive weight coefficients, the initial feature representation of the target node, and the neighbor feature matrix of the target node at each order, the adaptive weights of the neighbor feature matrix of the target node at each order are calculated through the attention mechanism.

[0022] Based on the adaptive weights and the neighbor feature matrices of the target node at each order, the features of the target node are updated by fusing and updating them through a multi-head attention mechanism.

[0023] As a preferred technical solution, the calculation of the adaptive weighting coefficients specifically involves:

[0024] The formula for calculating the average degree of each neighbor feature matrix of the target node is as follows:

[0025]

[0026] Among them, avg_degree l Let d be the average degree of the feature matrix of the l-th order neighbors of the target node. l The sum of the degrees of the l-th order neighbors of the target node, n l d represents the number of the l-th order neighbor nodes of the target node; l and n l All data were obtained from honeypot intelligence statistics from ShieldCube; L represents the maximum order between the target node and its neighboring nodes.

[0027] The formula for calculating the global average degree of all neighboring nodes of the target node is:

[0028]

[0029] Where μ is the global average degree of all neighboring nodes of the target node, V is the set of all neighboring nodes within the L-order range of the target node, |V| is the number of all neighboring nodes within the L-order range of the target node, and v i The i-th neighbor node of the target node;

[0030] The adaptive weighting coefficient is calculated based on the deviation between the average degree of each neighbor node of the target node and the global average degree. The formula is as follows:

[0031]

[0032] Where, α l β is the adaptive weighting coefficient of the l-th order neighbor feature matrix of the target node, and β is the control hyperparameter, which is set according to the experience of security experts.

[0033] As a preferred technical solution, the formula for calculating the adaptive weight is:

[0034]

[0035] in, H represents the adaptive weights of the l-th order neighbor feature matrix of the target node. l Let H be the neighbor feature matrix of the target node of order l. i Let W be the initial feature vector of the i-th target node. Q W K These are the weight matrices for the query vector and key vector in the attention mechanism, α and β, respectively. l d is the adaptive weight coefficient of the l-th order neighbor feature matrix of the target node, d is the scaling factor, and L is the maximum order between the target node and its neighbor nodes.

[0036] As a preferred technical solution, the multi-head attention mechanism for fusion and updating is described as follows:

[0037]

[0038] in, To update the features of the i-th target node, `concat` is a concatenation operation. H is the adaptive weight of the feature matrix of the l-th order neighbor of the target node. l Let W be the neighbor feature matrix of the target node of order l. o Let L be the linear transformation matrix, and let L be the maximum order between the target node and its neighboring nodes.

[0039] Another aspect of the present invention provides a node feature construction system based on honey spot intelligence and adaptive update of neighborhood weights, including an initial feature extraction module, a neighborhood mean aggregation module and a feature update module;

[0040] The initial feature extraction module is used to extract initial features from the nodes and edges in the input source graph, and assign label values ​​to them through a mapping function to generate an initial feature vector for each node.

[0041] The neighborhood mean aggregation module is used to aggregate the initial feature vectors of neighboring nodes within the L-order range of the target node using the mean aggregation method, and generate a fixed-dimensional neighbor feature matrix.

[0042] The feature update module is used to update the target node in the source graph by combining the neighbor feature matrix with the initial feature vector of the target node using an attention-based feature update method. It also introduces neighborhood adaptive weights to dynamically adjust the weight of each order of neighborhood features in the attention score, thereby obtaining the updated features of the target node.

[0043] In another aspect, the present invention provides an electronic device comprising:

[0044] At least one processor; and a memory communicatively connected to said at least one processor; wherein,

[0045] The memory stores computer program instructions that can be executed by the at least one processor, which enable the at least one processor to perform the source graph node feature construction method as described above.

[0046] In another aspect, the present invention provides a computer-readable storage medium storing a program that, when executed by a processor, implements the above-described method for constructing traceability graph node features.

[0047] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0048] 1. Enhance the ability to express the differences in node features in the source map:

[0049] This invention introduces a neighborhood-adaptive weight dynamic adjustment mechanism to dynamically perceive the influence of neighboring nodes at different levels on the features of the target node, ensuring effective differentiation of node features in complex graph structures. Unlike the fixed weight or mean aggregation strategies in existing technologies, this invention employs a technique that adjusts weights in real time based on node degree and neighborhood structure. This allows for more flexible extraction of subtle differences between nodes during the node feature construction process, thereby significantly improving the ability to express the differences in node features.

[0050] 2. Enhance the scene perception capability and timeliness of source tracing graph node features:

[0051] This invention not only dynamically adjusts weights during feature aggregation, but also incorporates real-time changes in nodes in the source graph (such as the number and degree of nodes) into feature updates, enabling node features to reflect dynamic changes in the scene in a timely manner. This technique differs from the limitations of traditional GNNs with fixed input graphs. Based on honeypot intelligence, it adaptively adjusts feature representation according to real-time scene information, greatly improving the timeliness of node features and their sensitivity to scene changes. This ensures that the anomaly detection graph neural network model performs more accurately and efficiently in tasks such as real-time anomaly detection. Attached Figure Description

[0052] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0053] Figure 1 This is an overall flowchart of the node feature construction method based on honey spot intelligence and neighborhood weight adaptive update in an embodiment of the present invention.

[0054] Figure 2 This is a schematic diagram of the aggregation of first-order neighbor nodes of the target node in an embodiment of the present invention.

[0055] Figure 3 This is a schematic diagram of the aggregation of second-order neighbor nodes of the target node in an embodiment of the present invention.

[0056] Figure 4 This is an overall block diagram of the node feature construction system based on honey spot intelligence and adaptive update of neighborhood weights in an embodiment of the present invention.

[0057] Figure 5 This is a schematic diagram of the structure of an electronic device in an embodiment of the present invention. Detailed Implementation

[0058] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present application without creative effort are within the scope of protection of the present application.

[0059] In this application, the reference to "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described in this application can be combined with other embodiments.

[0060] This invention aims to address the shortcomings of existing Graph Neural Networks (GNNs) in processing source tracing graph scenarios, namely insufficient ability to represent the differential features of node neighborhoods and inadequate timeliness of feature representation. It achieves feature construction for each target node in the input source tracing graph and outputs the feature representation of the target node. For example... Figure 1 As shown, this embodiment describes a node feature construction method based on honeypot intelligence and adaptive neighborhood weight updates, which includes the following steps:

[0061] Step 1: Initial Feature Extraction

[0062] Initial features are extracted from the nodes and edges in the input source graph, and label values ​​are assigned to them through a mapping function to generate an initial feature vector for each node.

[0063] Furthermore, we first perform simple feature preprocessing on all nodes in the input source graph to extract the initial feature vector for each node, specifically:

[0064] 1.1 Obtain the number of different node types Nn and the number of different edge types Ne from the source graph;

[0065] 1.2 Define a node mapping function Mv and an edge mapping function Me, assigning an integer label value to each node and each edge; the functions are expressed as follows:

[0066] L(v)=Mv(Xv(v))∈[0,Nn-1],v∈V,

[0067] T(e)=Me(Xe(e))∈[0,Ne-1],e∈E,

[0068] Where L(v) is the label value of node v, Xv(v) is the node type of node v, V is the set of nodes in the benign sourcing graph, T(e) is the label value of edge e, Xe(e) is the edge type of edge e, and E is the set of edges in the benign sourcing graph.

[0069] 1.3 Store the actual label value of each node in the actual label array TL(v);

[0070] 1.4. Based on the number of incoming and outgoing edges of a node, extract the initial feature vector of each node, represented as:

[0071] F(v) = [a0, a1, ..., a Ne-1 ,a Ne ,a Ne+1 ,…,a 2×Ne-1 ],

[0072] For each element a in the behavioral feature vector F(v) of a node i It represents the number of edges, and the calculation formula is:

[0073]

[0074] Where {e∈In(v)|i=T(e)} represents the number of edges when edge e is an incoming edge and its label value is i, {e∈Out(v)|i-Ne=T(e)} represents the number of edges when edge e is an outgoing edge and its label value is i-Ne, In(v) is the set of incoming edges of node v, and Out(v) is the set of outgoing edges of node v.

[0075] The initial feature vector of a node needs to reflect the node's behavior, which is manifested in the interactions between nodes. Therefore, the initial feature vector of a node must contain information about its associated edges. These associated edges include incoming and outgoing edges. Incoming edges represent edges connecting a node as a destination node to a source node; outgoing edges are edges connecting a node as a source node to a destination node. Thus, the initial feature vector of a node consists of the set of the number of incoming edge types and the set of the number of outgoing edge types. The size of the set of incoming edge types and the set of outgoing edge types are equal, both equal to the number of edge types. Each element in the set of incoming edge types and the set of outgoing edge types corresponds one-to-one in sequence. Each element in the set of incoming edge types and the set of outgoing edge types corresponds to one edge type. The element value in the set of incoming edge types and the set of outgoing edge types represents the quantity of the corresponding edge type. For example, if the initial feature vector of a node is [0,0,2,1,2,0], it means there are three edge types, with 0, 0, and 2 incoming edges for each edge type, and 1, 2, and 0 outgoing edges for each edge type.

[0076] Step 2: Neighborhood Feature Aggregation

[0077] For the target node in the source graph, the mean aggregation method is used to aggregate the initial feature vectors of the neighboring nodes within the L-order range of the target node to generate a fixed-dimensional neighbor feature matrix.

[0078] Furthermore, in the message passing mechanism (aggregation-update mechanism) of GNN, the aggregation part is essential because it involves information passing. This information passing allows the features of the target node to contain behavioral information of its neighboring nodes. However, unlike the step in GNN that aggregates the features of neighboring nodes into the features of the target node, this invention uses neighborhood mean aggregation in the neighborhood feature aggregation stage. This aggregates the initial feature vectors of each order of neighboring nodes of the target node into a single feature matrix. The aggregation process is described as follows:

[0079]

[0080] Among them, H l Let l be the neighbor feature matrix of the target node after aggregation; Let be the set of l-th order neighbors of the target node v. This is typically represented as an index set rather than a matrix, meaning it contains the numbers or indices of the neighbors associated with the target node v, indicating which nodes are in the l-th order neighbor set (e.g., if the target node v's second-order neighbors are nodes 1, 3, and 5, then...). This set itself only stores the indices of the neighboring nodes associated with the target node v, and does not contain feature values. Let L be the initial feature vector of the u-th neighbor node of the l-th order of the target node, and let L be the maximum order between the target node and its neighbor nodes.

[0081] like Figure 2 , Figure 3 As shown, the initial feature vectors of all neighboring nodes within the third-order range of the target node i are input after feature preprocessing. Mean aggregation is used to output the aggregated neighbor feature matrix of the target node at each order. Figure 2 Let i be the first-order neighbor feature matrix of the target node i. Figure 3 Let be the second-order neighbor feature matrix of the target node i. To ensure that the dimensions of the neighbor feature matrices of each order of the target node are the same, the dimension of the aggregated neighbor feature matrix is ​​the number of true labels of all nodes in the source graph.

[0082] Step 3: Feature Adaptive Update

[0083] An attention-based feature update method is adopted to combine the neighbor feature matrix with the initial feature vector of the target node for updating, and a neighborhood adaptive weight is introduced to dynamically adjust the weight of each order of neighborhood features in the attention score, so as to obtain the updated features of the target node.

[0084] Furthermore, this application proposes a feature update method based on an attention mechanism, which combines the aggregated features of all neighboring nodes within the L-order range of the target node with the target node's own features for update. Simultaneously, a neighborhood adaptive weight dynamic adjustment mechanism is introduced to dynamically adjust the weight of each order of neighborhood features in the attention score, ensuring that the influence of different order neighborhood features on the target node's feature update can be flexibly adjusted according to the specific structure of the graph. The specific steps are as follows:

[0085] 3.1 Calculate the adaptive weight coefficient based on the deviation between the average degree of each neighbor feature matrix of the target node and the global average degree.

[0086] Specifically, first, calculate the average degree of the feature matrix of each order of neighbors of the target node, using the following formula:

[0087] Among them, avg_degree l Let d be the average degree of the feature matrix of the l-th order neighbors of the target node. l The sum of the degrees of the l-th order neighbors of the target node, n l d represents the number of the l-th order neighbor nodes of the target node; l and n l All data were obtained from honey spot intelligence statistics from ShieldCube, where L is the maximum order between the target node and its neighboring nodes.

[0088] Next, calculate the global average degree of all neighboring nodes of the target node, using the following formula:

[0089]

[0090] Where μ is the global average degree of all neighboring nodes of the target node, V is the set of all neighboring nodes within the L-order range of the target node, |V| is the number of all neighboring nodes within the L-order range of the target node, and v i Let be the i-th neighbor node of the target node. By calculating the global average degree μ of all neighbor nodes of the target node, it is helpful to make a global assessment of the connectivity of nodes in the graph and the overall density of neighbor nodes, thus providing powerful information for analyzing node characteristics and network structure characteristics.

[0091] Finally, the adaptive weighting coefficient is calculated based on the deviation between the average degree of each neighbor node of the target node and the global average degree. The formula is as follows:

[0092]

[0093] Where, α l β is the adaptive weighting coefficient of the l-th order neighbor feature matrix of the target node; β is the control hyperparameter, which is set according to the experience of security experts. It determines the sensitivity of the adaptive weighting coefficient to the average degree deviation. For example, when there are many scene alarms, a high initial value of β can be set.

[0094] The adaptive weight coefficients are calculated using the Sigmoid function to flexibly adjust the weights according to the input distribution. This is especially beneficial when dealing with complex graph structures, as the Sigmoid function provides smooth weight changes, ensuring a balance between the influence of high-degree and low-degree nodes across different degree distributions. Furthermore, this function form ensures that the weights are within the range of 0 to 1, guaranteeing the stability of subsequent GNN model training and preventing numerical overflow issues.

[0095] 3.2. Based on the adaptive weight coefficients, the initial feature representation of the target node, and the neighbor feature matrix of each order of the target node, the adaptive weights of the neighbor feature matrix of each order of the target node are calculated through the attention mechanism.

[0096] The calculation of adaptive weight coefficients introduces an adaptive adjustment mechanism for the number and degree of process nodes in the node's neighborhood. This allows the attention mechanism to not only consider feature similarity but also adjust according to the specific characteristics of the graph structure, thereby improving the adaptability and performance of node feature representation under different types of graph structures. The adaptive weights are calculated using the following formula:

[0097]

[0098] in, H represents the adaptive weights of the l-th order neighbor feature matrix of the target node. l Let H be the neighbor feature matrix of the target node of order l. i Let W be the initial feature vector of the i-th target node. Q W K These are the weight matrices for the query vector and key vector in the attention mechanism, respectively, used to calculate the similarity of the attention scores; α l denoted as the adaptive weight coefficient of the l-th order neighbor feature matrix of the target node, and d as the scaling factor, typically the square root of the feature dimension, used to normalize the attention score. This scaling prevents the attention score from becoming excessively large due to the increase in feature dimension, making the softmax result more stable and easier to process. It effectively prevents gradient vanishing or exploding caused by excessively large values ​​during computation. Its initial value is usually set by experts.

[0099] 3.3 Based on the adaptive weights and the neighbor feature matrices of each order of the target node, the features of the target node are updated by fusion through a multi-head attention mechanism.

[0100] Specifically, the multi-head attention mechanism for fusion updates is described as follows:

[0101]

[0102] in, To update the features of the i-th target node, concat is the concatenation operation, H l Let W be the neighbor feature matrix of the target node of order l, where L is the maximum order between the target node and its neighbors, and W is the neighbor feature matrix of order l. o Let be the linear transformation matrix. This fusion function weights and aggregates the features of multi-order neighborhoods, ultimately updating the features of the target node i.

[0103] Therefore, this invention designs a dynamic adaptive weight update mechanism that adjusts the weight distribution of neighboring nodes of different orders in the feature aggregation process in real time based on information such as the degree of a node and the characteristics of its neighborhood structure. This enables more accurate capture of the differentiated contributions of different neighboring nodes to the features of the target node, solving the problem of homogenized feature expression caused by fixed or random sampling of neighborhood feature weights in traditional node feature aggregation methods. Furthermore, this invention significantly enhances the timeliness of node feature expression in source graph scenarios by combining honeypot intelligence, allowing the constructed node features to reflect the real-time changes of nodes and edges in the source graph, making it particularly suitable for heterogeneous and complex graph structures. Therefore, this invention not only overcomes the shortcomings of traditional GNN feature extraction and construction methods in terms of node feature homogenization and timeliness, but also achieves more efficient node feature expression and aggregation in dynamic scenarios. Compared to existing technologies, this invention, by combining honeypot intelligence, can more flexibly handle complex and real-time changing graph structures, improve the detailed modeling ability of relationships between nodes, significantly enhance the differentiated expression ability and timeliness of features, and provide a more accurate feature construction scheme for real-time tasks such as source analysis and anomaly detection.

[0104] It should be noted that, for the sake of simplicity, the aforementioned method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously.

[0105] Based on the same idea as the node feature construction method based on honeypot intelligence and adaptive neighborhood weight update in the above embodiments, this invention also provides a node feature construction system based on honeypot intelligence and adaptive neighborhood weight update. This system can be used to execute the above-described node feature construction method based on honeypot intelligence and adaptive neighborhood weight update. For ease of explanation, the structural diagram of the embodiment of the node feature construction system based on honeypot intelligence and adaptive neighborhood weight update only shows the parts related to the embodiments of this invention. Those skilled in the art will understand that the illustrated structure does not constitute a limitation on the device, and may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0106] like Figure 4 As shown, another embodiment of the present invention provides a node feature construction system based on honey spot intelligence and adaptive update of neighborhood weights, including an initial feature extraction module, a neighborhood mean aggregation module and a feature update module;

[0107] The initial feature extraction module is used to extract initial features from the nodes and edges in the input source graph and assign label values ​​to them through a mapping function to generate an initial feature vector for each node.

[0108] The neighborhood mean aggregation module is used to aggregate the initial feature vectors of the neighboring nodes within the L-order range of the target node in the source graph using the mean aggregation method, and generate a fixed-dimensional neighbor feature matrix.

[0109] The feature update module is used to update the target node by combining the neighbor feature matrix with the initial feature vector of the target node using an attention-based feature update method. It also introduces neighborhood adaptive weights to dynamically adjust the weight of each order of neighborhood features in the attention score, thereby obtaining the updated features of the target node.

[0110] It should be noted that the node feature construction system based on honey spot intelligence and adaptive update of neighborhood weights of the present invention corresponds one-to-one with the node feature construction method based on honey spot intelligence and adaptive update of neighborhood weights of the present invention. The technical features and beneficial effects described in the embodiments of the node feature construction method based on honey spot intelligence and adaptive update of neighborhood weights described above are applicable to the embodiments of the node feature construction system based on honey spot intelligence and adaptive update of neighborhood weights. For details, please refer to the description in the embodiments of the method of the present invention, which will not be repeated here.

[0111] Furthermore, in the above embodiments of the node feature construction system based on honey spot intelligence and adaptive update of neighborhood weight, the logical division of each program module is only an example. In actual applications, the above functions can be assigned to different program modules as needed, for example, for the sake of corresponding hardware configuration requirements or the convenience of software implementation. That is, the internal structure of the node feature construction system based on honey spot intelligence and adaptive update of neighborhood weight is divided into different program modules to complete all or part of the functions described above.

[0112] Please see Figure 5 In one embodiment, an electronic device is provided for constructing a node feature based on honey point intelligence and adaptive update of neighborhood weights. The electronic device may include a first processor, a first memory and a bus, and may also include a computer program stored in the first memory and executable on the first processor, such as a source graph node feature construction program.

[0113] The first memory includes at least one type of readable storage medium, such as flash memory, portable hard drive, multimedia card, card-type memory (e.g., SD or DX memory), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the first memory can be an internal storage unit of an electronic device, such as a portable hard drive. In other embodiments, the first memory can be an external storage device of the electronic device, such as a plug-in portable hard drive, Smart Media Card (SMC), Secure Digital (SD) card, Flash Card, etc. Furthermore, the first memory can include both internal and external storage units of the electronic device. The first memory can be used not only to store application software and various types of data installed on the electronic device, such as the code of a traceability graph node feature construction program, but also to temporarily store data that has been output or will be output.

[0114] In some embodiments, the first processor may be composed of integrated circuits, such as a single packaged integrated circuit or multiple integrated circuits with the same or different functions, including combinations of one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and various control chips. The first processor is the control unit of the electronic device, connecting various components of the entire electronic device through various interfaces and lines. It executes programs or modules stored in the first memory (e.g., traceability graph node feature construction programs) and calls data stored in the first memory to perform various functions of the electronic device and process data.

[0115] Figure 5 Only electronic devices with components are shown; it will be understood by those skilled in the art that... Figure 5 The structure shown does not constitute a limitation on the electronic device and may include fewer or more components than shown, or combine certain components, or have different component arrangements.

[0116] The traceability graph node feature construction program stored in the first memory of the electronic device is a combination of multiple instructions, which, when run in the first processor, can achieve the following:

[0117] Initial features are extracted from the nodes and edges in the input source graph, and label values ​​are assigned to them through a mapping function to generate an initial feature vector for each node.

[0118] For the target node in the source graph, the mean aggregation method is used to aggregate the initial feature vectors of the neighboring nodes within the L-order range of the target node to generate a fixed-dimensional neighbor feature matrix.

[0119] An attention-based feature update method is adopted to combine the neighbor feature matrix with the initial feature vector of the target node for updating, and a neighborhood adaptive weight is introduced to dynamically adjust the weight of each order of neighborhood features in the attention score, so as to obtain the updated features of the target node.

[0120] Furthermore, if the modules / units integrated in the electronic device are implemented as software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium. The computer-readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, or a read-only memory (ROM).

[0121] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM), etc.

[0122] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0123] The above embodiments are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above embodiments. Any changes, modifications, substitutions, combinations, or simplifications made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the protection scope of the present invention.

Claims

1. A node feature construction method based on honeypot intelligence and adaptive neighborhood weight update, characterized in that, Includes the following steps: Initial features are extracted from the nodes and edges in the input source graph, and label values ​​are assigned to them through a mapping function to generate an initial feature vector for each node. For the target node in the source graph, the mean aggregation method is used to group the target nodes. L The initial feature vectors of neighboring nodes within the order range are aggregated to generate a fixed-dimensional neighbor feature matrix; An attention-based feature update method is adopted to combine the neighbor feature matrix with the initial feature vector of the target node for updating, and a neighborhood adaptive weight is introduced to dynamically adjust the weight of each order of neighborhood features in the attention score, so as to obtain the updated features of the target node. The features of the updated target node are specifically as follows: The adaptive weighting coefficient is calculated based on the deviation between the average degree of each neighbor feature matrix of the target node and the global average degree. Based on the adaptive weight coefficients, the initial feature representation of the target node, and the neighbor feature matrix of the target node at each order, the adaptive weights of the neighbor feature matrix of the target node at each order are calculated through the attention mechanism. Based on the adaptive weights and the neighbor feature matrices of the target node at each order, the features of the target node are fused and updated through a multi-head attention mechanism to obtain the updated features of the target node. The calculation of the adaptive weight coefficients is specifically as follows: The formula for calculating the average degree of each neighbor feature matrix of the target node is as follows: ， in, avg _ degree l For the target node l The average degree of the neighbor feature matrix of order 1. d l For the target node l The sum of the degrees of the neighboring nodes. n l For the target node l The number of neighboring nodes; d l and n l All data were obtained from the honey spot intelligence statistics of ShieldCube; L This represents the maximum order between the target node and its neighboring nodes. The formula for calculating the global average degree of all neighboring nodes of the target node is: ， in, μ This represents the global average degree of all neighboring nodes of the target node. V For the target node L The set of all neighboring nodes within the order range, | V |Target node L The number of all neighboring nodes within the order range; The adaptive weighting coefficient is calculated based on the deviation between the average degree of each neighbor node of the target node and the global average degree. The formula is as follows: ， in, α l For the target node l Adaptive weight coefficients of the neighbor feature matrix of order 1. β To control hyperparameters, settings are made based on the experience of safety experts; The formula for calculating the adaptive weight is: ， in, For the target node l Adaptive weights of the neighbor feature matrix of order 1; H l For the target node l The neighbor feature matrix of order, H i For the first i The initial feature vectors of the target nodes, W Q , W K These are the weight matrices for the query vector and key vector, respectively, in the attention mechanism. α l For the target node l Adaptive weight coefficients of the neighbor feature matrix of order 1. d Scaling factor L This is the maximum order between the target node and its neighboring nodes.

2. The node feature construction method according to claim 1, characterized in that, The generation of the initial feature vector for each node is specifically as follows: Obtain the number of different node types and the number of different edge types from the source graph; Define node mapping functions and edge mapping functions, and assign integer label values ​​to each node and each edge; Store the actual label value of each node in an array of actual labels; Based on the number of incoming and outgoing edges of a node, extract the initial feature vector of each node.

3. The node feature construction method according to claim 1, characterized in that, The aggregation process is described as follows: ， in, H l For the aggregated target node l The neighbor feature matrix of order, For the target node v No. l The set of neighboring nodes of order, For the target node l The first order u The initial feature vectors of the neighboring nodes, L This represents the maximum order between the target node and its neighboring nodes. The fixed dimension of the neighbor feature matrix is ​​the number of true labels of all nodes in the source graph.

4. The node feature construction method according to claim 1, characterized in that, The multi-head attention mechanism is described as follows: ， in, For the updated version i The characteristics of each target node concat For splicing operations, Let be the adaptive weights of the feature matrix of the l-th order neighbor of the target node. H l For the target node l The neighbor feature matrix of order, W o It is a linear transformation matrix. L This is the maximum order between the target node and its neighboring nodes.

5. A node feature construction system based on honeypot intelligence and adaptive neighborhood weight update, characterized in that, It includes an initial feature extraction module, a neighborhood mean aggregation module, and a feature update module; The initial feature extraction module is used to extract initial features from the nodes and edges in the input source graph, and assign label values ​​to them through a mapping function to generate an initial feature vector for each node. The neighborhood mean aggregation module is used to aggregate the target node using the mean aggregation method. L The initial feature vectors of neighboring nodes within the order range are aggregated to generate a fixed-dimensional neighbor feature matrix; The feature update module is used to update the target node in the source graph by combining the neighbor feature matrix with the initial feature vector of the target node using an attention-based feature update method. It also introduces neighborhood adaptive weights to dynamically adjust the weight of each order of neighborhood features in the attention score, thereby obtaining the updated features of the target node. The features of the updated target node are specifically as follows: The adaptive weighting coefficient is calculated based on the deviation between the average degree of each neighbor feature matrix of the target node and the global average degree. Based on the adaptive weight coefficients, the initial feature representation of the target node, and the neighbor feature matrix of the target node at each order, the adaptive weights of the neighbor feature matrix of the target node at each order are calculated through the attention mechanism. Based on the adaptive weights and the neighbor feature matrices of the target node at each order, the features of the target node are fused and updated through a multi-head attention mechanism to obtain the updated features of the target node. The calculation of the adaptive weight coefficients is specifically as follows: The formula for calculating the average degree of each neighbor feature matrix of the target node is as follows: ， in, avg _ degree l For the target node l The average degree of the neighbor feature matrix of order 1. d l For the target node l The sum of the degrees of the neighboring nodes. n l For the target node l The number of neighboring nodes; d l and n l All data were obtained from the honey spot intelligence statistics of ShieldCube; L This represents the maximum order between the target node and its neighboring nodes. The formula for calculating the global average degree of all neighboring nodes of the target node is: ， in, μ This represents the global average degree of all neighboring nodes of the target node. V For the target node L The set of all neighboring nodes within the order range, | V |Target node L The number of all neighboring nodes within the order range; The adaptive weighting coefficient is calculated based on the deviation between the average degree of each neighbor node of the target node and the global average degree. The formula is as follows: ， in, α l For the target node l Adaptive weight coefficients of the neighbor feature matrix of order 1. β To control hyperparameters, settings are made based on the experience of safety experts; The formula for calculating the adaptive weight is: ， in, For the target node l Adaptive weights of the neighbor feature matrix of order 1; H l For the target node l The neighbor feature matrix of order, H i For the first i The initial feature vectors of the target nodes, W Q , W K These are the weight matrices for the query vector and key vector, respectively, in the attention mechanism. α l For the target node l Adaptive weight coefficients of the neighbor feature matrix of order 1. d Scaling factor L This is the maximum order between the target node and its neighboring nodes.

6. An electronic device, characterized in that, The electronic device includes: At least one processor; and a memory communicatively connected to said at least one processor; wherein, The memory stores computer program instructions that can be executed by the at least one processor to enable the at least one processor to perform the node feature construction method as described in any one of claims 1-4.

7. A computer-readable storage medium storing a program, characterized in that, When the program is executed by the processor, it implements the node feature construction method according to any one of claims 1-4.

Images