Node feature construction method based on honey point information and neighborhood feature nonlinear interaction

Abstract

The invention discloses a node feature construction method based on honey point information and neighborhood feature nonlinear interaction. The method comprises the following steps: firstly, obtaining an original traceability graph, and performing data screening based on a shield cube to obtain a benign traceability graph; performing feature extraction training by using the benign traceability graph to obtain a trained feature extractor; extracting an initial feature vector of each node in the original traceability graph by using the feature extractor; constructing a multi-hop feature sub-graph of the target node according to the initial feature vectors of the target node and the neighbor nodes in the L-order range of the target node; and finally, fusing and updating the feature representation of the multi-hop feature sub-graph of the target node by using the graph neural network, wherein the updated feature representation is used as the feature of the target node. The method not only extracts neighborhood information of a longer distance, but also pays attention to hidden connection of nodes and edges in an ultra-large heterogeneous graph, improves feature expression ability and robustness of output features, and provides feature representation with more expressive force for learning of a complex graph structure.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security and deep learning, and specifically relates to a node feature construction method based on nonlinear interaction of honey point intelligence and neighborhood features. Background Art

[0002] When processing graph structured data, graph neural networks (GNNs) mainly learn the representation of nodes and the graph as a whole through feature transfer and aggregation between nodes. Therefore, feature construction and extraction are key factors in the performance of GNN models. In tasks such as anomaly detection and classification, the representation of features determines whether the model can effectively capture the complex relationship between nodes and their neighbors in the graph.

[0003] There are three main feature construction methods in the existing graph neural network (GNN) technology. The first is the feature construction method based on local neighborhoods: Most early GNN models, such as graph convolutional networks (GCNs), rely on feature aggregation based on local neighborhoods, focusing on the features of each node and its direct neighbors. The core idea of ​​this method is to simulate node interactions in graph data through convolution operations, which can effectively capture the local structure between nodes. The second is the feature construction method based on sampling: In order to solve the computational cost problem of node feature aggregation in large-scale graph structures, feature construction methods based on sampling have emerged; among them, GraphSAGE is one of the representative methods. It aggregates by randomly sampling some nodes from neighboring nodes, so that the features of the target node not only come from itself, but also integrate the features of the sampled neighbors. This method effectively reduces the computational burden brought by too many node neighbors and has higher computational efficiency when processing large-scale graphs. The third is the feature construction method based on attention: The graph attention network (GAT) aims to solve the problem of equal treatment of each neighbor node in the traditional feature aggregation method. By introducing the attention mechanism, GAT assigns different weights to different neighbor nodes during feature aggregation, which can flexibly capture the uneven importance features in the graph structure and improve the precision of feature expression.

[0004] Although existing graph neural network (GNN) technologies have shown strong capabilities in learning node features when dealing with anomaly detection in traceability graphs, they still have obvious limitations in feature construction. This is because existing technologies ignore some key factors when constructing node features, especially when dealing with semantic information in complex traceability graphs. The main defects include:

[0005] 1. Insufficient construction of long-distance dependency features: Existing GNN models (such as GCN and GraphSAGE) mainly rely on the aggregation of features of neighboring nodes when constructing node features. It is difficult to construct features that can reflect the interaction of long-distance nodes, resulting in insufficient expression of long-distance dependency features. The main reason is that the existing GNN can only aggregate the features of neighboring nodes at a shallow level through layer-by-layer convolution or linear aggregation operations, and mainly focuses on the interaction between local nodes. This feature construction method based on local neighborhoods cannot effectively capture the complex relationship between nodes under multiple hops, especially in traceability graphs with long-distance dependencies, resulting in incomplete expression of node features; and as the number of model layers increases, "over-smoothing" may also occur, making node features tend to be consistent, further reducing the ability to distinguish features.

[0006] 2. The impact of information loss on feature construction: When constructing node features, sampling-based GNNs (such as GraphSAGE) are at risk of losing key neighbor node information during the sampling process; in addition, the loss of node or edge information will further weaken the integrity of feature construction and affect the accuracy of feature expression. The reason is that random sampling methods may miss some key neighbors when constructing node features, especially sparse nodes. This information loss directly affects the feature construction of the target node, making the feature expression incomplete. In addition, since existing GNNs rely on the complete graph structure to construct node features, when nodes or edges in the traceability graph are often lost, the model lacks effective means to make up for the implicit connection clues, resulting in the constructed node features not being sufficiently robust, affecting detection performance.

[0007] 3. Noise in training data interferes with feature construction: Existing GNN models fail to effectively filter abnormal noise in training data during offline training, causing the noise data to interfere with the node feature construction process and affect subsequent anomaly detection. This is because in the traceability graph anomaly detection task, offline training usually requires benign data, but in reality, the input graph often contains abnormal behavior (noise), which will be mixed in during the feature construction process and affect the learning of benign node features. Existing GNNs lack sufficient noise processing mechanisms and fail to filter these abnormal data in the early stages of feature construction, resulting in impure node features being constructed, which in turn affects the generalization ability of the model and the subsequent anomaly detection accuracy.

[0008] Therefore, the performance of existing GNN models in complex traceability graph tasks is subject to certain limitations, especially in the feature construction process, when key factors such as long-distance dependency and information missing are not fully considered, which in turn affects the accuracy of traceability graph anomaly detection. Summary of the invention

[0009] The main purpose of the present invention is to overcome the shortcomings and deficiencies of the prior art and to provide a node feature construction method based on the nonlinear interaction of honey spot intelligence and neighborhood features, which can effectively extract neighbor features of multiple hops and construct more comprehensive and accurate node features, significantly improving the depth and robustness of feature expression, thereby improving the generalization ability of the model in downstream tasks and the accuracy of anomaly detection.

[0010] In order to achieve the above object, the present invention provides a node feature construction method based on nonlinear interaction of honey spot intelligence and neighborhood features, comprising the following steps:

[0011] The original traceability graph is obtained, and malicious nodes in the original traceability graph are removed based on the detection data of Shield Cube to obtain a benign traceability graph; the malicious nodes refer to the IP socket nodes in the original traceability graph that match the malicious IP detected by Shield Cube; the benign traceability graph is used for feature extraction training to obtain a trained feature extractor;

[0012] Input the original traceability graph into the trained feature extractor to extract the initial feature vector of each node;

[0013] For the target node in the original traceability graph, a multi-hop feature subgraph of the target node is constructed based on the initial feature vectors of the target node and its L-order range neighboring nodes; the nodes in the multi-hop feature subgraph represent the set matrix of each-order hop number features of the target node, and all nodes are connected to each other;

[0014] A graph neural network is used to fusion update the feature representation of the multi-hop feature subgraph of the target node, and the updated feature representation is used as the feature of the target node.

[0015] As a preferred technical solution, the steps of extracting the initial feature vector of each node are:

[0016] Get the number of different node types and the number of different edge types from the original traceability graph;

[0017] Based on the node mapping function and edge mapping function of the trained feature extractor, an integer label value is assigned to each node and each edge;

[0018] Store the true label value of each node in the true label array;

[0019] Based on the number of in-edges and out-edges of the node, the initial feature vector of each node is extracted.

[0020] As a preferred technical solution, the multi-hop feature subgraph of the target node is constructed as follows:

[0021] The initial feature vectors of each order neighboring node of the target node are extracted by adjacency matrix multiplication, and the hop count feature matrix of the target node is calculated;

[0022] The hop count feature matrix of the target node is encoded based on the semantic information of the hop count feature, and a multi-hop feature subgraph of the target node is constructed.

[0023] As a preferred technical solution, the hop count characteristic matrix of the target node is calculated as follows:

[0024] The hop count features of each order of the target node are extracted in turn through different powers of the adjacency matrix. The extraction method is:

[0025]

[0026] in, The target node X p The hop count feature of the lth order, A l is the lth power of the adjacency matrix of the target node, X is the initial feature matrix of the nodes in the original traceability graph, ^ is the aggregation operation, and L is the maximum order between the target node and the neighboring nodes;

[0027] Combine the hop count features of each order of the target node to obtain the hop count feature matrix of the target node:

[0028]

[0029] in, is the hop count feature matrix of the target node.

[0030] As a preferred technical solution, the hop count feature matrix of the target node is encoded based on the semantic information of the hop count feature, specifically:

[0031] All hop count features in the hop count feature matrix are encoded through a linear layer with shared parameters to obtain the embedding vectors of all hop count features;

[0032] Concatenate the embedding vectors of each hop count feature of the target node and add a one-dimensional hop order encoding vector:

[0033]

[0034] Among them, H is a multi-hop feature subgraph, f() is a linear layer, and Eorder is a one-dimensional jump order encoding vector.

[0035] As a preferred technical solution, the use of a graph neural network to perform a fusion update of feature representation on a multi-hop feature subgraph of a target node is specifically as follows:

[0036] Select an arbitrary graph neural network to model the node interactions in the multi-hop feature subgraph of the target node;

[0037] The hop count features in the multi-hop feature subgraph are fully connected and interacted through a stacked graph neural network to obtain the updated feature representation as the feature of the target node.

[0038] As a preferred technical solution, by stacking K layers of graph neural networks with residual connections, the L-order hop number features in the multi-hop feature subgraph are fully connected and interacted, which can be expressed as:

[0039]

[0040] in, is the feature representation obtained by passing the multi-hop feature subgraph of target node i through the k-th layer of graph neural network with residual connection, is the multi-hop feature subgraph of target node i, It is the feature representation obtained after the multi-hop feature subgraph of target node i passes through the k-1th layer of graph neural network with residual connection, and K is the number of layers of graph neural network.

[0041] On the other hand, a node feature construction system based on nonlinear interaction of honey spot intelligence and neighborhood features is provided, including a benign screening module, an initial feature extraction module, a feature subgraph construction module and a feature update module;

[0042] The benign screening module is used to obtain the original traceability graph, remove malicious nodes in the original traceability graph based on the detection data of the shield cube, and obtain a benign traceability graph; the malicious node refers to the IP socket node in the original traceability graph that matches the malicious IP detected by the shield cube; the benign traceability graph is used for feature extraction training to obtain a trained feature extractor;

[0043] The initial feature extraction module is used to input the original traceability graph into the trained feature extractor to extract the initial feature vector of each node;

[0044] The feature subgraph construction module is used to construct a multi-hop feature subgraph of the target node in the original traceability graph according to the initial feature vectors of the target node and its L-order range neighboring nodes; the nodes in the multi-hop feature subgraph represent the set matrix of each-order hop number features of the target node, and all nodes are connected to each other;

[0045] The feature update module is used to use a graph neural network to perform a fusion update on the feature representation of a multi-hop feature subgraph of a target node, and the updated feature representation is used as the feature of the target node.

[0046] Another aspect of the present invention provides an electronic device, comprising:

[0047] at least one processor; and a memory in communication with the at least one processor; wherein,

[0048] The memory stores computer program instructions executable by the at least one processor, the computer program

[0049] The instruction is executed by the at least one processor so that the at least one processor can execute the above-mentioned traceability graph node feature construction method.

[0050] On the other hand, a computer-readable storage medium is provided, which stores a program, and when the program is executed by a processor, the above-mentioned traceability graph node feature construction method is implemented.

[0051] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0052] 1. Nonlinear interaction mechanism of target node hop count characteristics:

[0053] The graph neural network (GNN) in the prior art mainly relies on the linear message passing mechanism, and updates the node features by aggregating the features of neighboring nodes. This method is limited to capturing local interaction relationships, resulting in the inability to fully express the interaction between long-distance dependencies and node internal features. The present invention adopts a nonlinear interaction design of hop count features, gets rid of the limitations of linear message passing, models the relationship between the target node and multi-order hop count features in a nonlinear way, and through the interaction of multi-hop feature matrices, enables the GNN model to effectively capture the dependencies of long-distance nodes, thereby improving the expression ability of node features. This design breaks through the limitations of linear transmission in the prior art and constructs a more robust feature representation.

[0054] 2. Construct a multi-hop feature subgraph using the fully connected hop count feature:

[0055] The traditional GNN model relies on the linear aggregation of layer-by-layer neighbor features, ignoring the potential associations between distant nodes, and performs poorly in the face of feature loss. The present invention constructs a multi-hop feature subgraph by performing a full connection operation on the hop count feature, so that the features between neighbor nodes of each order can interact with each other, ensuring that each neighbor feature interacts to ensure the globality and integrity of feature transfer. This method effectively makes up for the shortcomings of the existing technology in dealing with the problem of long-distance node relationships and feature loss, and ensures the comprehensiveness of feature expression.

[0056] 3. Use Shield Cube prior knowledge to screen benign traceability graphs:

[0057] The existing technologies mostly rely on manual or simple algorithms to screen input data before training, which cannot effectively filter noise, causing malicious nodes to interfere with model training. The present invention introduces the prior knowledge of shield cube, matches the malicious IP nodes in the traceability graph, automatically screens and removes these malicious nodes, and cleans the traceability graph before inputting training data, thereby ensuring the purity of training data. This method not only improves data quality, but also enhances the generalization ability of the model in training, overcoming the shortcomings of the existing technology in noise processing.

[0058] In summary, the present invention not only extracts longer-distance neighborhood information, but also pays attention to the implicit connections between nodes and edges in ultra-large heterogeneous graphs. By extracting longer-distance neighborhood information, the feature expression ability and robustness of the output features are improved. In addition, the present invention enables the integration of multi-hop features for complex graph structures in downstream model applications, achieves more accurate prediction and classification, significantly reduces the false alarm rate, and enhances overall stability. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0060] Figure 1 It is a flowchart of a node feature construction method based on nonlinear interaction of honey spot intelligence and neighborhood features in an embodiment of the present invention.

[0061] Figure 2 It is a relationship diagram between a multi-hop feature subgraph and a target node in an embodiment of the present invention.

[0062] Figure 3 The flowchart of constructing a multi-hop feature subgraph in an embodiment of the present invention is shown in FIG.

[0063] Figure 4 The figure is a flow chart of non-linear interaction of hop count characteristics in an embodiment of the present invention.

[0064] Figure 5 It is a framework diagram of a node feature construction system based on nonlinear interaction of honey spot intelligence and neighborhood features in an embodiment of the present invention.

[0065] Figure 6 Schematic diagram of the structure of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION

[0066] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present application.

[0067] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments.

[0068] like Figure 1 As shown, this embodiment discloses a node feature construction method based on nonlinear interaction of honey spot intelligence and neighborhood features, performs feature construction on each target node (node ​​to be extracted features) in the input original traceability graph, and outputs a feature representation of the target node, including the following steps:

[0069] Step 1: Data screening:

[0070] Get the original traceability graph, remove the malicious nodes in the original traceability graph based on the detection data of Shield Cube, and obtain a benign traceability graph; where the malicious node refers to the IP socket node in the original traceability graph that matches the malicious IP detected by Shield Cube. In actual work, Shield Cube will record and block the detected malicious IP addresses. By matching the malicious IP stored in Shield Cube with the IP socket node in the original traceability graph, the system removes the matched malicious IP nodes. After this step, it ensures that the subsequent traceability graph is pure benign graph data, providing a high-quality data foundation for subsequent feature construction. Then use the benign traceability graph for feature extraction training to obtain a trained feature extractor.

[0071] Step 2: Initial feature extraction:

[0072] The original traceability graph is input into the trained feature extractor to extract the initial feature vector of each node.

[0073] Furthermore, simple feature preprocessing is performed on all nodes in the input benign traceability graph to extract the initial feature vector of the node, specifically:

[0074] 2.1. Obtain the number of different node types Nn and the number of different edge types Ne from the original traceability graph;

[0075] 2.2. Based on the node mapping function Mv and edge mapping function Me of the trained feature extractor, an integer label value is assigned to each node and each edge; the functions are expressed as:

[0076] L(v)=Mv(Xv(v))∈[0,Nn-1],v∈V,

[0077] T(e)=Me(Xe(e))∈[0,Ne-1],e∈E,

[0078] Among them, L(v) is the label value of node v, Xv(v) is the node type of node v, V is the node set in the original traceability graph, T(e) is the label value of edge e, Xe(e) is the edge type of edge e, and E is the edge set in the original traceability graph.

[0079] 2.3. Store the true label value of each node in the true label array TL(v);

[0080] 2.4. Based on the number of in-edges and out-edges of the node, extract the initial feature vector of each node, expressed as:

[0081] F(v)=[a0,a1,…,a Ne-1 ,a Ne ,a Ne+1 ,…,a 2×Ne-1 ],

[0082] For each element a in the node's behavior feature vector F(v) i , which represents the number of edges, and the calculation formula is:

[0083]

[0084] Among them, {e∈In(v)|i=T(e)} represents the number of edges when edge e is an incoming edge and its label value is i, {e∈Out(v)|i-Ne=T(e)} represents the number of edges when edge e is an outgoing edge and its label value is i-Ne, In(v) is the incoming edge set of node v, and Out(v) is the outgoing edge set of node v.

[0085] The initial feature vector of a node needs to reflect the behavior of the node. The behavior of the node is reflected in the interaction between nodes. Therefore, the initial feature vector of the node needs to contain the information of the attached edges. Among them, the attached edges include input edges and output edges. The input edge indicates the edge connecting the node as the destination node to the source node. The output edge refers to the edge connecting the node as the source node to the destination node. Therefore, the initial feature vector of the node consists of the number set of node input edge types and the number set of node output edge types. The number set of node input edge types and the number set of node output edge types are equal in size and are equal to the number of edge types. Each element in the number set of node input edge types and the number set of node output edge types corresponds to one edge type in order. The element value in the number set of node input edge types and the number set of node output edge types is the number of corresponding edge types. For example, the initial feature vector of a node is [0,0,2,1,2,0], which means that there are three types of edges, where the number of input edges of each edge type is 0, 0, and 2 respectively; the number of outgoing edges of each edge type is 1, 2, and 0.

[0086] Step 3: Feature subgraph construction:

[0087] For the target node in the original traceability graph, a multi-hop feature subgraph of the target node is constructed based on the initial feature vectors of the target node and its L-order range neighboring nodes.

[0088] Specifically, Figure 2 As shown, in order to realize the nonlinear interaction of hop count features in step four, this application proposes the concept of "multi-hop feature subgraph (Ghopi)", and finally uses the graph neural network (GNN) to fully capture the information in the multi-hop feature subgraph and use it as the feature of the target node. The multi-hop feature subgraph contains the nonlinear causal relationship and potential implicit connection relationship between the target node and its neighbor nodes of each order. In the multi-hop feature subgraph, its nodes represent the set matrix of the hop count features of each order of the target node, and all nodes are interconnected, and their edges have no specific practical meaning. The relationship between the target node and the multi-hop feature subgraph is shown in Figure 2 As shown in , each target node has its L-order subgraph (representing neighbor nodes in the L-order range) and a multi-hop feature subgraph. The multi-hop feature subgraph is constructed by extracting the hop count matrix of each order of the target node as the node representation in the multi-hop feature subgraph and performing full connection operations on these nodes, as shown in Figure 3 As shown, the specific steps are:

[0089] 3.1. First, the initial feature vectors of each order neighboring node of the target node are extracted by adjacency matrix multiplication, the multi-hop node information is calculated from the initial feature vector of the target node, and the hop count feature matrix of the target node is extracted.

[0090] Furthermore, the hop count features of the target node's l-th order neighbor nodes are first extracted in turn through different powers of the adjacency matrix:

[0091]

[0092] in, The target node X p The hop count characteristic of the lth order; A l is the l-th power of the target node adjacency matrix, indicating the relationship between the target node and its l-th neighbor node; X is the initial feature matrix of the node in the original traceability graph, is an aggregation operation, and L is the maximum order between the target node and its neighbor nodes.

[0093] Then combine the hop count features of each order of the target node to obtain the hop count feature matrix of the target node:

[0094]

[0095] in, is the hop count feature matrix of the target node, which contains the matrix set of hop count matrices of each order. Since this method only needs to be calculated through simple matrix multiplication, feature extraction can be completed by performing only one operation on the nodes in the traceability graph.

[0096] 3.2. Encode the hop count feature matrix of the target node based on the semantic information of the hop count feature and construct a multi-hop feature subgraph of the target node.

[0097] To further enhance the expressiveness of features, after extracting the hop count feature matrix, each hop feature of the target node needs to be encoded. To facilitate the nonlinear interaction process in step 4, the semantic information of the hop count feature is added during the encoding process. This encoding method enables the graph neural network to fully capture the location information of each hop feature in the subsequent feature learning stage. Specifically:

[0098] All hop count features in the hop count feature matrix are encoded through a linear layer with shared parameters to obtain the embedding vectors of all hop count features. At the same time, the embedding vectors of each hop count feature of the target node are concatenated and a one-dimensional jump order encoding vector is added:

[0099]

[0100] Among them, H is a multi-hop feature subgraph, that is, it contains the feature representation of the target node and its neighbor nodes from the 1st order to the Lth order; f() is a linear layer used for linear transformation; Eorder is a one-dimensional jump order encoding vector used to enhance the distinguishability of features at different levels.

[0101] Finally, the feature representation of the constructed multi-hop feature subgraph contains the set of L-order neighbor feature matrices required for the next task; the sequential encoding vector helps the GNN in step four capture the sequential information between hop features; by performing full connection operations on all multi-hop feature matrices, the connectivity between matrices is guaranteed, thereby completing the construction of the multi-hop feature subgraph.

[0102] Step 4: Nonlinear interaction of hop count features:

[0103] A graph neural network is used to fusion update the feature representation of the multi-hop feature subgraph of the target node, and the updated feature representation is used as the feature of the target node.

[0104] Furthermore, the interaction and causal relationship between different hop count features of the target node within the L-order range contains important clues to distinguish nodes; therefore, the present application designs a nonlinear interaction method for hop count features, which, without relying on the linear message passing framework between nodes, uses GNN to model the nonlinear interaction between hop count features to enhance the effectiveness of node feature expression and shift the focus of interaction from the relationship between nodes and neighbors to the multi-hop features within each node; Figure 4 As shown, the specific steps are:

[0105] 4.1. Select any graph neural network to model the node interactions in the multi-hop feature subgraph of the target node.

[0106] Since the nodes in the multi-hop feature subgraph actually represent the features of each order of hops, these features are connected by full connection. Therefore, the propagation of this feature is not completed through the linear transmission of directed edges, but through the fully connected structure between the features of each order of hops to achieve feature interaction.

[0107] In this embodiment, the graph neural network selects the graph attention network (GAT) for node interaction modeling. Of course, it is not limited to GAT, and any GNN model can be selected. Through the GNN model, the interaction information and implicit connection relationship between multi-hop features of the target node can be effectively captured.

[0108] 4.2. Through the stacked graph neural network, the hop count features in the multi-hop feature subgraph are fully connected and interacted to obtain the updated feature representation as the feature of the target node.

[0109] Specifically, by stacking K layers of graph neural networks with residual connections, the L-order hop features in the multi-hop feature subgraph are fully connected and interacted, which can be expressed as:

[0110]

[0111] in, is the feature representation obtained by passing the multi-hop feature subgraph of target node i through the k-th layer of graph neural network with residual connection, is the multi-hop feature subgraph of target node i, is the feature representation obtained after the multi-hop feature subgraph of target node i passes through the k-1th layer of graph neural network with residual connections, and K is the number of layers of the graph neural network. Feature representation It not only reflects the nonlinear interaction information between features of different order hops, but also captures the rich contextual dependencies between features of each order, thus providing a more detailed feature description for the target node. The complex relationships between neighbors of various orders in the multi-hop feature subgraph are integrated so that the final feature representation can effectively characterize the characteristics of the target node; under the framework of GNN, this representation method effectively improves the ability to model nonlinear relationships between nodes through nonlinear transformation and neighborhood feature aggregation, providing a more expressive feature representation for the learning of complex graph structures.

[0112] Finally, this application effectively captures the multi-level feature interactions between multi-order neighbor nodes of the target node through the graph neural network, not only extracting longer-distance neighborhood information, but also paying attention to the implicit connections between nodes and edges in super-large heterogeneous graphs, and improving the feature expression ability and robustness of the output features by extracting longer-distance neighborhood information. In addition, this application enables the integration of multi-hop features for complex graph structures in downstream model applications, achieving more accurate prediction and classification, significantly reducing the false alarm rate, and enhancing overall stability.

[0113] It should be noted that, for the sake of convenience, the aforementioned method embodiments are all expressed as a series of action combinations, but those skilled in the art should know that the present invention is not limited to the described order of actions, because according to the present invention, certain steps can be performed in other orders or simultaneously.

[0114] Based on the same idea as the node feature construction method based on nonlinear interaction of honey spot intelligence and neighborhood features in the above-mentioned embodiment, the present invention also provides a node feature construction system based on nonlinear interaction of honey spot intelligence and neighborhood features, which can be used to execute the above-mentioned node feature construction method based on nonlinear interaction of honey spot intelligence and neighborhood features. For ease of explanation, the structural schematic diagram of the embodiment of the node feature construction system based on nonlinear interaction of honey spot intelligence and neighborhood features only shows the parts related to the embodiment of the present invention, and those skilled in the art can understand that the illustrated structure does not constitute a limitation on the device, and may include more or fewer components than shown in the diagram, or combine certain components, or arrange the components differently.

[0115] like Figure 5As shown, another embodiment of the present invention provides a node feature construction system based on nonlinear interaction of honey spot intelligence and neighborhood features, including a benign screening module, an initial feature extraction module, a feature subgraph construction module and a feature update module;

[0116] Among them, the benign screening module is used to obtain the original traceability graph, and remove the malicious nodes in the original traceability graph based on the detection data of the Shield Cube to obtain a benign traceability graph; the malicious node refers to the IP socket node in the original traceability graph that matches the malicious IP detected by the Shield Cube; the benign traceability graph is used for feature extraction training to obtain a trained feature extractor;

[0117] The initial feature extraction module is used to input the original traceability graph into the trained feature extractor to extract the initial feature vector of each node;

[0118] The feature subgraph construction module is used to construct a multi-hop feature subgraph of the target node in the original traceability graph based on the initial feature vectors of the target node and its L-order range neighboring nodes; the nodes in the multi-hop feature subgraph represent the set matrix of the per-order hop number features of the target node, and all nodes are connected to each other;

[0119] The feature update module is used to use the graph neural network to perform a fusion update on the feature representation of the multi-hop feature subgraph of the target node, and the updated feature representation is used as the feature of the target node.

[0120] It should be noted that the node feature construction system based on nonlinear interaction of honey spot intelligence and neighborhood features of the present invention corresponds one to one with the node feature construction method based on nonlinear interaction of honey spot intelligence and neighborhood features of the present invention. The technical features and beneficial effects described in the embodiment of the node feature construction method based on nonlinear interaction of honey spot intelligence and neighborhood features are applicable to the embodiment of the node feature construction system based on nonlinear interaction of honey spot intelligence and neighborhood features. For specific contents, please refer to the description in the embodiment of the method of the present invention, which will not be repeated here. This is hereby declared.

[0121] In addition, in the implementation of the node feature construction system based on the nonlinear interaction of honey spot intelligence and neighborhood features in the above-mentioned embodiment, the logical division of each program module is only an example. In actual applications, the above-mentioned functions can be assigned to different program modules as needed, for example, for the configuration requirements of the corresponding hardware or the convenience of software implementation. That is, the internal structure of the node feature construction system based on the nonlinear interaction of honey spot intelligence and neighborhood features is divided into different program modules to complete all or part of the functions described above.

[0122] See also Figure 6In one embodiment, an electronic device is provided for implementing a node feature construction method based on nonlinear interaction between honey point intelligence and neighborhood features. The electronic device may include a first processor, a first memory, and a bus, and may also include a computer program stored in the first memory and executable on the first processor, such as a provenance graph node feature construction program.

[0123] Among them, the first memory includes at least one type of readable storage medium, and the readable storage medium includes flash memory, mobile hard disk, multimedia card, card-type memory (for example: SD or DX memory, etc.), magnetic memory, disk, optical disk, etc. In some embodiments, the first memory can be an internal storage unit of an electronic device, such as a mobile hard disk of the electronic device. In other embodiments, the first memory can also be an external storage device of an electronic device, such as a plug-in mobile hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device. Further, the first memory can also include both an internal storage unit of the electronic device and an external storage device. The first memory can not only be used to store application software and various types of data installed in the electronic device, such as the code of the traceability graph node feature construction program, but also can be used to temporarily store data that has been output or is to be output.

[0124] In some embodiments, the first processor may be composed of an integrated circuit, for example, a single packaged integrated circuit, or a plurality of integrated circuits with the same or different functions, including one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and combinations of various control chips. The first processor is the control core (ControlUnit) of the electronic device, and uses various interfaces and lines to connect the various components of the entire electronic device, and executes or executes programs or modules stored in the first memory (such as a traceability graph node feature construction program, etc.), and calls the data stored in the first memory to perform various functions of the electronic device and process data.

[0125] Figure 6 Only an electronic device with components is shown, and those skilled in the art will understand that Figure 6 The structure shown does not constitute a limitation on the electronic device, and may include fewer or more components than shown in the figure, or combine certain components, or arrange the components differently.

[0126] The provenance graph node feature construction program stored in the first memory in the electronic device is a combination of multiple instructions, and when executed in the first processor, can achieve:

[0127] The original traceability graph is obtained, and malicious nodes in the original traceability graph are removed based on the detection data of Shield Cube to obtain a benign traceability graph; the malicious nodes refer to the IP socket nodes in the original traceability graph that match the malicious IP detected by Shield Cube; the benign traceability graph is used for feature extraction training to obtain a trained feature extractor;

[0128] Input the original traceability graph into the trained feature extractor to extract the initial feature vector of each node;

[0129] For the target node in the original traceability graph, a multi-hop feature subgraph of the target node is constructed based on the initial feature vectors of the target node and its L-order range neighboring nodes; the nodes in the multi-hop feature subgraph represent the set matrix of each-order hop number features of the target node, and all nodes are connected to each other;

[0130] A graph neural network is used to fusion update the feature representation of the multi-hop feature subgraph of the target node, and the updated feature representation is used as the feature of the target node.

[0131] Furthermore, if the module / unit integrated in the electronic device is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a non-volatile computer-readable storage medium. The computer-readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, and a read-only memory (ROM).

[0132] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0133] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0134] The above embodiments are preferred implementation modes of the present invention, but the implementation modes of the present invention are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present invention should be equivalent replacement methods and are included in the protection scope of the present invention.

Claims

1. A node feature construction method based on nonlinear interaction between honey spot intelligence and neighborhood features, characterized in that: The steps include: The original traceability graph is obtained, and malicious nodes in the original traceability graph are removed based on the detection data of Shield Cube to obtain a benign traceability graph; the malicious nodes refer to the IP socket nodes in the original traceability graph that match the malicious IP detected by Shield Cube; the benign traceability graph is used for feature extraction training to obtain a trained feature extractor; Input the original traceability graph into the trained feature extractor to extract the initial feature vector of each node; For the target node in the original traceability graph, a multi-hop feature subgraph of the target node is constructed based on the initial feature vectors of the target node and its L-order range neighboring nodes; the nodes in the multi-hop feature subgraph represent the set matrix of each-order hop number features of the target node, and all nodes are connected to each other; A graph neural network is used to fusion update the feature representation of the multi-hop feature subgraph of the target node, and the updated feature representation is used as the feature of the target node.

2. The method for constructing node features of a traceability graph according to claim 1, characterized in that: The steps for extracting the initial feature vector of each node are: Get the number of different node types and the number of different edge types from the original traceability graph; Based on the node mapping function and edge mapping function of the trained feature extractor, an integer label value is assigned to each node and each edge; Store the true label value of each node in the true label array; Based on the number of in-edges and out-edges of the node, the initial feature vector of each node is extracted.

3. The method for constructing node features of a traceability graph according to claim 1, characterized in that: The multi-hop feature subgraph of the target node is constructed as follows: The initial feature vectors of each order of neighbor nodes of the target node are extracted by adjacency matrix multiplication, and the hop count feature matrix of the target node is calculated; The hop count feature matrix of the target node is encoded based on the semantic information of the hop count feature, and a multi-hop feature subgraph of the target node is constructed.

4. The method for constructing node features of a traceability graph according to claim 3, characterized in that: The hop count characteristic matrix of the target node is calculated as follows: The hop count features of each order of the target node are extracted in turn through different powers of the adjacency matrix. The extraction method is: in, The target node X p The hop count feature of the lth order, A l is the lth power of the adjacency matrix of the target node, X is the initial feature matrix of the nodes in the original traceability graph, ^ is the aggregation operation, and L is the maximum order between the target node and the neighboring nodes; Combine the hop count features of each order of the target node to obtain the hop count feature matrix of the target node: in, is the hop count feature matrix of the target node.

5. The method for constructing node features of a traceability graph according to claim 4, characterized in that: The hop count feature matrix of the target node is encoded based on the semantic information of the hop count feature, specifically: All hop count features in the hop count feature matrix are encoded through a linear layer with shared parameters to obtain the embedding vectors of all hop count features; Concatenate the embedding vectors of each hop count feature of the target node and add a one-dimensional hop order encoding vector: Among them, H is a multi-hop feature subgraph, f() is a linear layer, and Eorder is a one-dimensional jump order encoding vector.

6. The method for constructing node features of a traceability graph according to claim 1, characterized in that: The use of the graph neural network to perform a fusion update of the feature representation of the multi-hop feature subgraph of the target node is specifically as follows: Select an arbitrary graph neural network to model the node interactions in the multi-hop feature subgraph of the target node; The hop count features in the multi-hop feature subgraph are fully connected and interacted through a stacked graph neural network to obtain the updated feature representation as the feature of the target node.

7. The method for constructing node features of a traceability graph according to claim 6, characterized in that: By stacking K layers of graph neural networks with residual connections, the L-order hop features in the multi-hop feature subgraph are fully connected and interacted, which can be expressed as: in, is the feature representation obtained by passing the multi-hop feature subgraph of target node i through the k-th layer of graph neural network with residual connection, is the multi-hop feature subgraph of target node i, It is the feature representation obtained after the multi-hop feature subgraph of target node i passes through the k-1th layer of graph neural network with residual connection, and K is the number of layers of graph neural network.

8. A node feature construction system based on nonlinear interaction between honey spot intelligence and neighborhood features, characterized in that: It includes a benign screening module, an initial feature extraction module, a feature subgraph construction module and a feature update module; The benign screening module is used to obtain the original traceability graph, remove malicious nodes in the original traceability graph based on the detection data of the shield cube, and obtain a benign traceability graph; the malicious node refers to the IP socket node in the original traceability graph that matches the malicious IP detected by the shield cube; the benign traceability graph is used for feature extraction training to obtain a trained feature extractor; The initial feature extraction module is used to input the original traceability graph into the trained feature extractor to extract the initial feature vector of each node; The feature subgraph construction module is used to construct a multi-hop feature subgraph of the target node in the original traceability graph according to the initial feature vectors of the target node and its L-order range neighboring nodes; the nodes in the multi-hop feature subgraph represent the set matrix of each-order hop number features of the target node, and all nodes are connected to each other; The feature update module is used to use a graph neural network to perform a fusion update on the feature representation of a multi-hop feature subgraph of a target node, and the updated feature representation is used as the feature of the target node.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory in communication with the at least one processor; wherein, The memory stores computer program instructions executable by the at least one processor, the computer program The instruction is executed by the at least one processor so that the at least one processor can execute the traceability graph node feature construction method as described in any one of claims 1-7.

10. A computer-readable storage medium storing a program, characterized in that: When the program is executed by a processor, the method for constructing node features of a provenance graph described in any one of claims 1 to 8 is implemented.

Images