Node feature construction method based on nonlinear interaction of honey point information and neighborhood features

Abstract

The application discloses a node feature construction method based on honey point intelligence and neighborhood feature nonlinear interaction, first acquires an original traceability graph and carries out data screening based on a shield cube to obtain a benign traceability graph; uses the benign traceability graph to carry out feature extraction training to obtain a trained feature extractor; uses the feature extractor to extract an initial feature vector of each node in the original traceability graph; then according to the initial feature vector of a target node and L-order range neighbor nodes of the target node, a multi-hop feature subgraph of the target node is constructed; finally, a graph neural network is used to carry out fusion update of feature representation of the multi-hop feature subgraph of the target node, and the updated feature representation is used as the feature of the target node. The method not only extracts longer distance neighborhood information, but also pays attention to the hidden connection of nodes and edges in a super-large heterogeneous graph, improves the feature expression ability and robustness of the output feature, and provides a more expressive feature representation for learning of a complex graph structure.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security and deep learning, and particularly relates to a node feature construction method based on honey point intelligence and nonlinear interaction of neighborhood features. BACKGROUND

[0002] In processing graph structure data, graph neural network (GNN) mainly learns the representation of nodes and the whole graph through feature transmission and aggregation between nodes, and therefore, the construction and extraction of features are key factors for the performance of GNN models. In abnormality detection, classification and other tasks, the representation of features determines whether the model can effectively capture the complex relationship between nodes and their neighbors in the graph.

[0003] There are three feature construction methods in existing graph neural network (GNN) technologies. The first one is a feature construction method based on local neighborhood: most early GNN models, such as graph convolutional network (GCN), rely on feature aggregation based on local neighborhood, and mainly focus on the features of each node and its direct neighbors; the core idea of this method is to simulate the node interaction in graph data through convolution operation, which can effectively capture the local structure between nodes. The second one is a feature construction method based on sampling: to solve the problem of the calculation cost of node feature aggregation in large-scale graph structure, a feature construction method based on sampling emerges as the times require; among them, GraphSAGE is one of the representative methods, which aggregates part of the nodes sampled from the neighbor nodes, so that the features of the target node not only come from itself, but also integrate the features of the sampled neighbors; this method effectively reduces the calculation burden caused by too many node neighbors, and has higher calculation efficiency in processing large-scale graphs. The third one is a feature construction method based on attention: graph attention network (GAT) aims to solve the problem that each neighbor node is treated equally in the traditional feature aggregation method; by introducing an attention mechanism, GAT assigns different weights to different neighbor nodes in feature aggregation, which can flexibly capture the importance of uneven features in the graph structure and improve the precision of feature expression.

[0004] Although the existing graph neural network (GNN) technology shows strong ability in learning node features when processing abnormality detection of traceability graphs, it still has obvious limitations in feature construction, which is due to the fact that the existing technology ignores some key factors in node feature construction, especially when processing semantic information in complex traceability graphs. The main defects include:

[0005] 1. Insufficient construction of long-distance dependency features: Existing GNN models (such as GCN, GraphSAGE) mainly rely on the aggregation of features of neighboring nodes when constructing node features, making it difficult to construct features that can reflect the interaction of nodes at a long distance, resulting in insufficient expression of long-distance dependency features. The main reason is that existing GNNs can only aggregate the features of neighboring nodes in shallow layers through layer-by-layer convolution or linear aggregation operations, mainly focusing on the interaction between local nodes. This local neighborhood-based feature construction method cannot effectively capture the complex relationships between nodes at multiple hop distances, especially in traceability graphs with long-distance dependencies, resulting in incomplete node feature expression; and with the increase of model layers, the phenomenon of "over-smoothing" may occur, making the node features tend to be consistent, further reducing the discrimination ability of the features.

[0006] 2. Influence of information loss on feature construction: GNNs based on sampling (such as GraphSAGE) have the risk of losing key neighbor node information during the sampling process when constructing node features; in addition, the loss of node or edge information further weakens the completeness of feature construction and affects the accuracy of feature expression. The reason is that the random sampling method may miss some key neighbors when constructing node features, especially sparse nodes. This loss of information directly affects the construction of the target node's features, making the feature expression incomplete. In addition, since existing GNNs rely on complete graph structures to construct node features, when nodes or edges in the traceability graph are often missing, the model lacks effective means to make up for the implicit connection clues, resulting in node features that are not robust enough and affecting detection performance.

[0007] 3. Noise interference in training data feature construction: Existing GNN models fail to effectively filter abnormal noise in training data during offline training, which interferes with the construction of node features and affects subsequent anomaly detection. This is because in the task of traceability graph anomaly detection, offline training usually requires benign data, but in reality, the input graph often contains abnormal behavior (noise), which can be mixed in during feature construction, affecting the learning of benign node features. Existing GNNs lack sufficient noise handling mechanisms and fail to filter these abnormal data in the early stages of feature construction, resulting in impure node features and affecting the model's generalization ability and subsequent anomaly detection accuracy.

[0008] Therefore, the performance of existing GNN models in complex traceability graph tasks is limited, especially in the feature construction process, where key factors such as long-distance dependence and information loss are not fully considered, which affects the accuracy of traceability graph anomaly detection. SUMMARY

[0009] The main purpose of the present application is to overcome the shortcomings and deficiencies of the prior art, provide a node feature construction method based on honey point intelligence and neighborhood feature nonlinear interaction, which can effectively extract multi-hop neighbor features, construct more comprehensive and accurate node features, significantly improve the depth and robustness of feature expression, and improve the generalization ability of the model in the downstream task and the accuracy of anomaly detection.

[0010] In order to achieve the above purpose, the present application provides a node feature construction method based on honey point intelligence and neighborhood feature nonlinear interaction, comprising the following steps:

[0011] Obtain the original trace graph, and remove the malicious nodes in the original trace graph based on the detection data of the shield cube to obtain a benign trace graph; the malicious node refers to an IP socket node in the original trace graph matched with the malicious IP detected by the shield cube; and the feature extractor after training is obtained by using the benign trace graph for feature extraction training;

[0012] The original trace graph is input into the trained feature extractor to extract the initial feature vector of each node;

[0013] For a target node in the original trace graph, a multi-hop feature subgraph of the target node is constructed according to the initial feature vectors of the target node and its L-order range neighbor nodes; the nodes in the multi-hop feature subgraph represent the collection matrix of each order hop feature of the target node, and all nodes are connected to each other;

[0014] The multi-hop feature subgraph of the target node is updated by using the graph neural network for feature representation fusion, and the updated feature representation is used as the feature of the target node.

[0015] As a preferred technical solution, the extraction step of the initial feature vector of each node is:

[0016] The number of different node types and the number of different edge types are obtained from the original trace graph;

[0017] Based on the node mapping function and the edge mapping function of the trained feature extractor, an integer label value is assigned to each node and each edge;

[0018] The real label value of each node is stored in the real label array;

[0019] Based on the number of in-edges and out-edges of the node, the initial feature vector of each node is extracted.

[0020] As a preferred technical solution, the multi-hop feature subgraph of the target node is constructed, specifically:

[0021] The initial feature vector of each order neighbor node of the target node is extracted by adjacency matrix multiplication, and the hop feature matrix of the target node is calculated.

[0022] The semantic information based on the hop number feature is used to encode a hop number feature matrix of the target node, and a multi-hop feature subgraph of the target node is constructed.

[0023] As a preferred technical solution, the hop number feature matrix of the target node is calculated, specifically:

[0024] The hop number feature of each order of the target node is extracted in turn through different orders of powers of the adjacency matrix, and the extraction mode is:

[0025]

[0026] wherein, is the hop number feature of the target node X p is the hop number feature of the target node X l is the hop number feature of the target node X is the initial feature matrix of the node of the original traceability graph, ^ is an aggregation operation, and L is the maximum order number set between the target node and the neighbor node;

[0027] The hop number features of each order of the target node are combined to obtain the hop number feature matrix of the target node:

[0028]

[0029] wherein, is the hop number feature matrix of the target node.

[0030] As a preferred technical solution, the semantic information based on the hop number feature is used to encode the hop number feature matrix of the target node, specifically:

[0031] All hop number features in the hop number feature matrix are encoded through a linear layer of shared parameters to obtain embedding vectors of all hop number features;

[0032] The embedding vectors of each hop number feature of the target node are spliced and a one-dimensional hop order encoding vector is added:

[0033]

[0034] wherein, H is the multi-hop feature subgraph, f() is the linear layer, and Eorder is the one-dimensional hop order encoding vector.

[0035] As a preferred technical solution, the fusion update of the feature representation of the multi-hop feature subgraph of the target node is performed using a graph neural network, specifically:

[0036] Any graph neural network is selected to model the node interaction in the multi-hop feature subgraph of the target node;

[0037] The number of hops features in the multi-hop feature subgraph are fully connected and interacted by the stacked graph neural network, and updated feature representations are obtained as the features of the target node.

[0038] As a preferred technical solution, the L-order number of hops features in the multi-hop feature subgraph are fully connected and interacted by the stacked K-layer graph neural network with residual connection, and are represented as:

[0039]

[0040] Among them, is the feature representation of the multi-hop feature subgraph of the target node i after passing through the k-th layer of the graph neural network with residual connection, is the multi-hop feature subgraph of the target node i, is the feature representation of the multi-hop feature subgraph of the target node i after passing through the k-1-th layer of the graph neural network with residual connection, and K is the number of layers of the graph neural network.

[0041] In another aspect, a node feature construction system based on honey point intelligence and neighborhood feature nonlinear interaction is provided, which includes a benign screening module, an initial feature extraction module, a feature subgraph construction module, and a feature updating module.

[0042] The benign screening module is used to obtain an original traceability graph, and based on the detection data of the shield cube, the malicious nodes in the original traceability graph are removed to obtain a benign traceability graph; the malicious node refers to an IP socket node in the original traceability graph matched with the malicious IP detected by the shield cube; the feature extractor after training is obtained by using the benign traceability graph for feature extraction training;

[0043] The initial feature extraction module is used to input the original traceability graph into the trained feature extractor to extract the initial feature vector of each node;

[0044] The feature subgraph construction module is used to construct a multi-hop feature subgraph of a target node in the original traceability graph according to the initial feature vectors of the target node and L-order range neighbor nodes of the target node; the nodes in the multi-hop feature subgraph represent the collection matrix of each order of hop number features of the target node, and all nodes are connected to each other.

[0045] The feature updating module is used to fuse and update the feature representation of the multi-hop feature subgraph of the target node using the graph neural network, and the updated feature representation is used as the feature of the target node.

[0046] The present application also provides an electronic device, which comprises:

[0047] at least one processor; and a memory connected in communication with the at least one processor; wherein,

[0048] The memory stores computer program instructions executable by the at least one processor, and the computer program instructions

[0049] The instructions are executed by the at least one processor to enable the at least one processor to perform the above-mentioned traceability graph node feature construction method.

[0050] In another aspect, a computer-readable storage medium is provided, which stores a program, and the program is executed by a processor to implement the above-mentioned traceability graph node feature construction method.

[0051] Compared with the prior art, the present application has the following advantages and beneficial effects:

[0052] 1. Nonlinear interaction mechanism of target node hop count feature:

[0053] The graph neural network (GNN) in the prior art mainly relies on a linear message passing mechanism, and the updating of node features is achieved through the aggregation of neighbor node features. This method is limited to capturing local interaction relationships, resulting in insufficient expression of long-distance dependencies and interaction of node internal features. The present application adopts a nonlinear interaction design of hop count features, which breaks away from the limitations of linear message passing. The relationship between the target node and the multi-hop hop count features is modeled in a nonlinear way, and the interaction of the multi-hop feature matrix enables the GNN model to effectively capture the dependencies of long-distance nodes, thereby improving the expression ability of node features. This design breaks through the limitations of linear transmission in the prior art and constructs a more robust feature representation.

[0054] 2. Full-connection hop count feature construction multi-hop feature subgraph:

[0055] Traditional GNN models rely on linear aggregation of layer-by-layer neighbor features, ignoring the potential association between long-distance nodes, especially in the case of feature loss. The present application constructs a multi-hop feature subgraph by performing full-connection operation on the hop count features, so that the features between each order of neighbor nodes can interact with each other, ensuring that each neighbor feature interacts to ensure the globality and integrity of feature transmission. This means effectively compensates for the shortcomings of the prior art in handling long-distance node relationships and feature loss problems, ensuring the comprehensiveness of feature expression.

[0056] 3. Using shield cube prior knowledge to filter benign traceability graph:

[0057] The prior art relies on manual or simple algorithm to screen input data before training, which cannot effectively filter noise, resulting in malicious node interference in model training. The present application introduces the prior knowledge of shield cube, matches the malicious IP node in the traceability graph, automatically screens and removes these malicious nodes, and cleans the traceability graph before inputting the training data, thereby ensuring the purity of the training data. This method not only improves the data quality, but also enhances the generalization ability of the model in training, overcoming the shortcomings of the prior art in noise processing.

[0058] In summary, the present application not only extracts longer distance neighborhood information, but also pays attention to the hidden connection of nodes and edges in super-large heterogeneous graphs. By extracting longer distance neighborhood information, the feature expression ability and robustness of the output features are improved. In addition, the present application enables the integration of multi-hop features for complex graph structures in downstream model applications, enabling more accurate prediction and classification, significantly reducing the false positive rate, and enhancing overall stability. BRIEF DESCRIPTION OF DRAWINGS

[0059] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0060] Figure 1 The flowchart of the node feature construction method based on the nonlinear interaction of the honeypot intelligence and the neighborhood features in the embodiment of the present application.

[0061] Figure 2 The relationship diagram of the multi-hop feature subgraph and the target node in the embodiment of the present application.

[0062] Figure 3 The construction flowchart of the multi-hop feature subgraph in the embodiment of the present application.

[0063] Figure 4 The flowchart of the hop number feature nonlinear interaction in the embodiment of the present application.

[0064] Figure 5 The framework diagram of the node feature construction system based on the nonlinear interaction of the honeypot intelligence and the neighborhood features in the embodiment of the present application.

[0065] Figure 6 The structural schematic diagram of the electronic device in the embodiment of the present application. DETAILED DESCRIPTION

[0066] In the interest of an enabling disclosure of the application, the detailed description will usually be presented in terms of exemplary embodiments thereof. In doing so, no limitation on the scope of the application is intended or will be inferred, for example, from the use of the term "may" in the description. Furthermore, the particular features, structures, or characteristics can be combined in any suitable manner on the understanding that each combination results in a new embodiment. Those skilled in the art will recognize, or be able to ascertain using no more than routine experimentation, many equivalents to the specific embodiments described herein. It is, therefore, to be understood that the application is not to be limited to the specific embodiments that are presented by way of example. Where necessary, the drawings are not to scale and the descriptions are not to be interpreted as a definition of limits of the application.

[0067] Reference to an "embodiment" in this application means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the application. The appearances of the phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily mutually exclusive or alternative embodiments. It is expressly understood that the described embodiments of the application are merely example embodiments and that a person skilled in the art would readily recognize, or be able to ascertain using no more than routine experimentation, numerous other embodiments that are equivalent in spirit and / or function to the described embodiments.

[0068] As shown in Figure 1 The embodiment discloses a node feature construction method based on honey point intelligence and neighborhood feature nonlinear interaction, performs feature construction on each target node (a node to be extracted feature) in an input original traceability graph, and outputs a feature representation of the target node, including the following steps:

[0069] Step one, data screening:

[0070] An original traceability graph is acquired, and malicious nodes in the original traceability graph are removed based on shield cube detection data, to obtain a benign traceability graph; wherein the malicious nodes refer to IP socket nodes in the original traceability graph that match malicious IP detected by the shield cube. The shield cube records and bans the detected malicious IP address in actual work, and by matching the malicious IP stored in the shield cube with the IP socket nodes in the original traceability graph, the system removes the matched malicious IP nodes. After this step, it is ensured that the subsequent traceability graph is a pure benign graph data, and a high-quality data basis is provided for subsequent feature construction. Then, the benign traceability graph is used for feature extraction training to obtain a trained feature extractor.

[0071] Step two, initial feature extraction:

[0072] The original traceability graph is input into the trained feature extractor to extract an initial feature vector of each node.

[0073] Further, all nodes in the input benign traceability graph are subjected to simple feature preprocessing, and a node initial feature vector is extracted, specifically:

[0074] 2.1, obtaining the number of different node types Nn and the number of different edge types Ne from the original traceability graph;

[0075] 2.2, based on the trained feature extractor, the node mapping function Mv and the edge mapping function Me, assign an integer label value to each node and each edge; the functions are represented as:

[0076] L(v) = Mv(Xv(v)) ∈ [0, Nn-1], v ∈ V,

[0077] T(e) = Me(Xe(e)) ∈ [0, Ne-1], e ∈ E,

[0078] where L(v) is the label value of node v, Xv(v) is the node type of node v, V is the node set in the original provenance graph, T(e) is the label value of edge e, Xe(e) is the edge type of edge e, and E is the edge set in the original provenance graph.

[0079] 2.3, store the real label value of each node in the real label array TL(v);

[0080] 2.4, based on the number of incoming and outgoing edges of the node, extract the initial feature vector of each node, represented as:

[0081] F(v) = [a0, a1, …, a Ne-1 , a Ne , a Ne+1 , …, a 2×Ne-1 ],

[0082] For each element a i in the behavior feature vector F(v) of the node, which represents the number of edges, the calculation formula is:

[0083]

[0084] where {e ∈ In(v) | i = T(e)} represents the number of edges e as an incoming edge and the label value is i, {e ∈ Out(v) | i-Ne = T(e)} represents the number of edges e as an outgoing edge and the label value is i-Ne, In(v) is the incoming edge set of node v, and Out(v) is the outgoing edge set of node v.

[0085] For the initial feature vector of the node, it needs to reflect the behavior of the node, the behavior of the node is reflected in the interaction between nodes, so the initial feature vector of the node needs to contain the information of the affiliated edge; wherein the affiliated edge includes the in-edge and the out-edge; the in-edge represents the edge connected with the source node as the destination node; the out-edge refers to the edge connected with the destination node as the source node. Therefore, the initial feature vector of the node is composed of the number set of node in-edge types and the number set of node out-edge types; the number set of node in-edge types and the number set of node out-edge types are equal in size, both equal to the number of edge types; the number set of node in-edge types and the number set of node out-edge types are one-to-one corresponding in order; each element in the number set of node in-edge types and the number set of node out-edge types respectively corresponds to an edge type; the element value in the number set of node in-edge types and the number set of node out-edge types is the number of the corresponding edge type. For example, the initial feature vector of a certain node is [0, 0, 2, 1, 2, 0], which means that there are three types of edges, and the number of in-edges of each type is 0, 0, and 2 respectively; the number of out-edges of each type is 1, 2, and 0 respectively.

[0086] Step three, feature subgraph construction:

[0087] For the target node in the original traceability graph, according to the initial feature vectors of the target node and its L-order range neighbor nodes, a multi-hop feature subgraph of the target node is constructed.

[0088] Specifically, as shown in Figure 2 In order to realize the non-linear interaction of the number of hops in step four, the present application proposes the concept of "multi-hop feature subgraph (Ghopi)", and finally uses graph neural network (GNN) to fully capture the information in the multi-hop feature subgraph as the feature of the target node. The multi-hop feature subgraph contains the non-linear causal relationship and potential implicit connection relationship between the target node and each order of neighbor nodes. In the multi-hop feature subgraph, the nodes represent the collection matrix of each order of hop number features of the target node, and all nodes are connected with each other, and the edges have no specific actual meaning. The relationship between the target node and the multi-hop feature subgraph is shown in Figure 2 Each target node has its L-order range subgraph (representing L-order range neighbor nodes) and multi-hop feature subgraph, by extracting each order of hop number matrix of the target node as the node representation in the multi-hop feature subgraph, and performing full connection operation on these nodes, thereby completing the construction of the multi-hop feature subgraph, as shown in Figure 3 The specific steps are as follows:

[0089] 3.1, first, the initial feature vector of each order of neighbor node of the target node is extracted by adjacency matrix multiplication, the multi-hop node information is calculated from the initial feature vector of the target node, and the hop number feature matrix of the target node is extracted.

[0090] Further, the hop number features of the lth order neighbor nodes of the target node are extracted in turn by different powers of the adjacency matrix:

[0091]

[0092] wherein, is the target node X p is the hop number feature of the lth order; A l is the lth power of the adjacency matrix of the target node, indicating the relationship between the target node and the lth order neighbor nodes; X is the initial feature matrix of the nodes of the original traceability graph, is an aggregation operation, and L is the maximum order set between the target node and the neighbor nodes.

[0093] Then, the hop number features of each order of the target node are combined to obtain the hop number feature matrix of the target node:

[0094]

[0095] wherein, is the hop number feature matrix of the target node, containing a matrix set of each hop number matrix. Since this method only needs to be calculated by simple matrix multiplication, only one operation on the nodes in the traceability graph is needed to complete the feature extraction.

[0096] 3.2, the semantic information of the hop number feature matrix of the target node is encoded based on the hop number feature, and a multi-hop feature subgraph of the target node is constructed.

[0097] To further enhance the expression ability of the features, after the hop number feature matrix is extracted, each hop feature of the target node needs to be encoded. In order to facilitate the nonlinear interaction process in step four, semantic information of the hop number feature is added in the encoding process. This encoding method enables the graph neural network to fully capture the position information of each hop feature in the subsequent feature learning stage. Specifically:

[0098] All hop number features in the hop number feature matrix are encoded by a linear layer sharing parameters to obtain the embedding vectors of all hop number features; meanwhile, the embedding vectors of each hop number feature of the target node are spliced, and a one-dimensional hop order encoding vector is added:

[0099]

[0100] wherein, H is a multi-hop feature subgraph, i.e. containing the feature representation of the target node and its neighbor nodes from the 1st order to the Lth order; f() is a linear layer for linear transformation; Eorder is a one-dimensional hop order encoding vector for enhancing the distinguishability of different order features.

[0101] Finally, the feature representation of the constructed multi-hop feature subgraph contains the set of L-order neighbor feature matrices required for the next task; the sequential encoding vector helps the GNN in step four to capture the sequential information between the hop number features; by performing a full connection operation on all multi-hop feature matrices, the matrix connectivity is guaranteed, and the construction of the multi-hop feature subgraph is completed.

[0102] Step four, nonlinear interaction of hop number features:

[0103] The updated feature representation is used as the feature of the target node.

[0104] Further, the interaction and causal relationship between different hop number features of the target node within the L-order range contain important clues for distinguishing nodes; therefore, the application designs a nonlinear interaction mode of hop number features, which models the nonlinear interaction between hop number features through GNN without relying on the linear message passing framework between nodes, to enhance the effective expression of node features, and shifts the focus of interaction from the relationship between nodes and neighbors to the multi-hop features inside each node; as shown in Figure 4 The specific steps are as follows:

[0105] 4.1, select any graph neural network to model the node interaction in the multi-hop feature subgraph of the target node.

[0106] Since the nodes in the multi-hop feature subgraph actually represent each order of hop number features, these features are connected through full connection. Therefore, this feature propagation is not completed through linear transmission of directed edges, but through full connection structure between each order of hop number features to realize feature interaction.

[0107] In this embodiment, the graph neural network selects the graph attention network (GAT) to model node interaction, of course, it is not limited to GAT, and any GNN model can be selected; through the GNN model, the interaction information and implicit connection relationship between the multi-hop features of the target node can be effectively captured.

[0108] 4.2, perform full connection interaction on the hop number features in the multi-hop feature subgraph through the stacked graph neural network to obtain the updated feature representation as the feature of the target node.

[0109] Specifically, the L-order hop number features in the multi-hop feature subgraph are full-connection interacted through the stacked K-layer graph neural network with residual connection, represented as:

[0110]

[0111] wherein, is a feature representation of the multi-hop feature subgraph of the target node i after passing through the k-th layer of the graph neural network with residual connection, is a multi-hop feature subgraph of the target node i, is a feature representation of the multi-hop feature subgraph of the target node i after passing through the k-1-th layer of the graph neural network with residual connection, and K is the number of layers of the graph neural network. The feature representation not only reflects the nonlinear interaction information between different order hop features, but also captures the rich context dependency between the features of each order, thereby providing a more detailed feature description for the target node. In this way, the complex relationships between the neighborhood of each order in the multi-hop feature subgraph are integrated, so that the final feature representation can effectively represent the characteristics of the target node; under the framework of the GNN, the modeling ability of the nonlinear relationship between nodes is effectively improved through nonlinear transformation and neighborhood feature aggregation, and a more expressive feature representation is provided for the learning of complex graph structures.

[0112] Finally, the present application effectively captures the multi-level feature interaction between the multi-order neighbor nodes of the target node through the graph neural network, not only extracts longer distance neighborhood information, but also focuses on the implicit connection between the nodes and edges in the super-large heterogeneous graph. By extracting longer distance neighborhood information, the feature representation ability and robustness of the output feature are improved. In addition, the present application enables the integration of multi-hop features for complex graph structures in downstream model applications, enabling more accurate prediction and classification, significantly reducing the false positive rate, and enhancing overall stability.

[0113] It should be noted that, for the foregoing method embodiments, in order to facilitate description, they are all described as a series of action combinations, but those skilled in the art should know that the present application is not limited by the order of the described actions, because according to the present application, certain steps can be performed in other orders or simultaneously.

[0114] Based on the same idea as the node feature construction method based on nonlinear interaction of honeypot intelligence and neighborhood features in the above embodiments, the present application also provides a node feature construction system based on nonlinear interaction of honeypot intelligence and neighborhood features. The system can be used to execute the above-mentioned node feature construction method based on nonlinear interaction of honeypot intelligence and neighborhood features. For the convenience of description, in the structural schematic diagram of the node feature construction system embodiment based on nonlinear interaction of honeypot intelligence and neighborhood features, only the part related to the embodiment of the present application is shown, and those skilled in the art can understand that the illustrated structure does not constitute a limitation on the device, and can include more or fewer components than the illustrated, or combine certain components, or different component arrangements.

[0115] As Figure 5As shown, another embodiment of the present application provides a node feature construction system based on nonlinear interaction of honeypot intelligence and neighborhood features, comprising a benign screening module, an initial feature extraction module, a feature subgraph construction module, and a feature updating module.

[0116] The benign screening module is configured to obtain an original traceability graph, remove malicious nodes in the original traceability graph based on shield cube detection data, and obtain a benign traceability graph. The malicious node refers to an IP socket node in the original traceability graph that matches a malicious IP detected by the shield cube. The benign traceability graph is used for feature extraction training to obtain a trained feature extractor.

[0117] The initial feature extraction module is configured to input the original traceability graph into the trained feature extractor to extract an initial feature vector of each node.

[0118] The feature subgraph construction module is configured to construct a multi-hop feature subgraph of a target node in the original traceability graph according to the initial feature vectors of the target node and L-order range neighbor nodes of the target node. The nodes in the multi-hop feature subgraph represent a collection matrix of each-order hop feature of the target node, and all the nodes are connected to each other.

[0119] The feature updating module is configured to use a graph neural network to perform fusion updating on feature representation of the multi-hop feature subgraph of the target node, and the updated feature representation is used as the feature of the target node.

[0120] It should be noted that the node feature construction system based on nonlinear interaction of honeypot intelligence and neighborhood features of the present application corresponds to the node feature construction method based on nonlinear interaction of honeypot intelligence and neighborhood features of the present application. The technical features and advantages described in the embodiment of the node feature construction method based on nonlinear interaction of honeypot intelligence and neighborhood features are applicable to the embodiment of the node feature construction system based on nonlinear interaction of honeypot intelligence and neighborhood features. For specific content, please refer to the description in the method embodiment of the present application. Here, it is declared that it will not be described again.

[0121] In addition, in the embodiment of the node feature construction system based on nonlinear interaction of honeypot intelligence and neighborhood features of the above-mentioned embodiment, the logical division of each program module is only an example. In actual application, the above-mentioned functions can be completed by different program modules according to needs, for example, considering the configuration requirements of the corresponding hardware or the convenience of software implementation, that is, the internal structure of the node feature construction system based on nonlinear interaction of honeypot intelligence and neighborhood features is divided into different program modules to complete all or part of the functions described above.

[0122] Please refer to Figure 6In one embodiment, an electronic device implementing a node feature construction method based on nonlinear interaction of honeypot intelligence and neighborhood features is provided. The electronic device can include a first processor, a first memory, and a bus. The electronic device can also include a computer program, such as a provenance graph node feature construction program, stored in the first memory and executable on the first processor.

[0123] The first memory includes at least one type of readable storage medium, such as flash memory, a mobile hard disk, a multimedia card, a card-type memory (e.g., SD or DX memory, etc.), a magnetic memory, a disk, an optical disk, etc. In some embodiments, the first memory can be an internal storage unit of the electronic device, such as a mobile hard disk of the electronic device. In other embodiments, the first memory can also be an external storage device of the electronic device, such as a plug-in mobile hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. Further, the first memory can include both an internal storage unit and an external storage device of the electronic device. The first memory can be used to store application software installed on the electronic device and various data, such as the code of the provenance graph node feature construction program, and can also be used to temporarily store data that has been output or will be output.

[0124] The first processor can include an integrated circuit in some embodiments, such as a single packaged integrated circuit or a plurality of packaged integrated circuits with the same or different functions. The first processor can include one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, combinations thereof, etc. The first processor is a control unit of the electronic device, and is connected to various components of the electronic device via various interfaces and lines. The first processor executes or runs programs or modules stored in the first memory, such as the provenance graph node feature construction program, and calls data stored in the first memory, to perform various functions of the electronic device and process data.

[0125] Figure 6 Only the electronic device with components is shown, and those skilled in the art can understand that the electronic device can include fewer or more components than shown, or combine certain components, or have different component arrangements. Figure 6 The structure shown does not limit the electronic device, and the electronic device can include fewer or more components than shown, or combine certain components, or have different component arrangements.

[0126] The first memory in the electronic device stores a traceability graph node feature construction program which is a combination of a plurality of instructions and can realize the following when running in the first processor:

[0127] Obtain an original traceability graph, remove malicious nodes in the original traceability graph based on shield cube detection data to obtain a benign traceability graph; the malicious node refers to an IP socket node in the original traceability graph that matches a malicious IP detected by the shield cube; use the benign traceability graph for feature extraction training to obtain a trained feature extractor;

[0128] Input the original traceability graph into the trained feature extractor to extract an initial feature vector of each node;

[0129] For a target node in the original traceability graph, construct a multi-hop feature subgraph of the target node according to the initial feature vectors of the target node and L-order range neighbor nodes; the nodes in the multi-hop feature subgraph represent a collection matrix of each-order hop number features of the target node, and all nodes are connected to each other;

[0130] Use a graph neural network to perform fusion update on the feature representation of the multi-hop feature subgraph of the target node, and use the updated feature representation as the feature of the target node.

[0131] Further, the modules / units of the electronic device, if realized in the form of a software function unit and sold or used as an independent product, can be stored in a nonvolatile computer readable storage medium. The computer readable medium can include any entity or device capable of carrying the computer program code, a recording medium, a U disk, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM).

[0132] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by a computer program instructing relevant hardware. The program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiment methods. Any reference to memory, storage, database or other medium used in the embodiments provided by the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0133] Any combination of the technical features of the above embodiments can be made. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, however, as long as the combination of the technical features does not exist, it should be considered as the scope of the present application.

[0134] The above embodiments are the preferred embodiments of the present application, but the embodiments of the present application are not limited to the above embodiments, and any changes, modifications, substitutions, combinations and simplifications made without departing from the spirit and principles of the present application should be equivalent replacement methods and should be included in the protection scope of the present application.

Claims

1. A node feature construction method based on nonlinear interaction between honey point intelligence and neighborhood features, characterized in that, The method comprises the following steps: Obtaining an original trace graph, removing malicious nodes in the original trace graph based on detection data of a shield cube to obtain a benign trace graph, wherein the malicious nodes refer to IP socket nodes in the original trace graph that match malicious IPs detected by the shield cube; and performing feature extraction training on the benign trace graph to obtain a trained feature extractor; Inputting the original trace graph into the trained feature extractor to extract an initial feature vector of each node; For a target node in the original trace graph, a multi-hop feature subgraph of the target node is constructed according to the initial feature vectors of the target node and L-order range neighbor nodes of the target node, wherein the nodes in the multi-hop feature subgraph represent a collection matrix of each-order hop number features of the target node, and all the nodes are connected to each other; Performing fusion update on the multi-hop feature subgraph of the target node by using a graph neural network, and using the updated feature representation as the feature of the target node.

2. The node feature construction method of claim 1, wherein, The extraction step of the initial feature vector of each node is as follows: Obtaining the number of different node types and the number of different edge types from the original trace graph; Assigning an integer label value to each node and each edge based on the node mapping function and the edge mapping function of the trained feature extractor; Storing the real label value of each node in a real label array; Extracting the initial feature vector of each node based on the number of incoming edges and outgoing edges of the node.

3. The node feature construction method of claim 1, wherein, The construction of the multi-hop feature subgraph of the target node is specifically as follows: Extracting the initial feature vector of each-order neighbor node of the target node by adjacency matrix multiplication, and calculating the hop number feature matrix of the target node; Encoding the hop number feature matrix of the target node based on the semantic information of the hop number features, and constructing the multi-hop feature subgraph of the target node.

4. The node feature construction method of claim 3, wherein, The calculation of the hop number feature matrix of the target node is specifically as follows: Extracting the hop number features of each order of the target node in turn by different powers of the adjacency matrix, and the extraction mode is as follows: ， wherein, is a target node X p a first l order hop count feature, A l is a first l power of a target node adjacency matrix, X is a node initial feature matrix of an original provenance graph, is an aggregation operation, L is a set maximum order between a target node and neighbor nodes; Combining the hop number features of each order of the target node to obtain the hop number feature matrix of the target node: ， wherein, is the hop count feature matrix of the target node.

5. The node feature construction method of claim 4, wherein, The encoding of the hop number feature matrix of the target node based on the semantic information of the hop number features is specifically as follows: Encoding all the hop number features in the hop number feature matrix by a linear layer of shared parameters to obtain an embedding vector of all the hop number features; Splicing the embedding vector of each hop number feature of the target node and adding a one-dimensional hop order encoding vector: ， wherein, H is a multi-hop feature subgraph, f () is a linear layer, Eorder is a one-dimensional skip order encoding vector.

6. The node feature construction method of claim 1, wherein, The fusion update of the feature representation of the multi-hop feature subgraph of the target node by using the graph neural network is specifically as follows: Selecting an arbitrary graph neural network to model the node interaction in the multi-hop feature subgraph of the target node; Performing full-connection interaction on the hop number features in the multi-hop feature subgraph by stacking the graph neural network to obtain the updated feature representation as the feature of the target node.

7. The node feature construction method of claim 6, wherein, Performing full-connection interaction on the L-order hop number features in the multi-hop feature subgraph by stacking K layers of graph neural networks with residual connections, which is represented as: ， wherein, is a multi-hop feature subgraph of the target node i is a feature representation of the multi-hop feature subgraph of the target node k after passing through a graph neural network with residual connections at the first -1 layer, i is a multi-hop feature subgraph of the target node is a feature representation of the multi-hop feature subgraph of the target node i after passing through a graph neural network with residual connections at the first k -1 layer, K is the number of layers of the graph neural network.

8. A node feature construction system based on nonlinear interaction of honeypot intelligence and neighborhood features, characterized in that, The method comprises a benign screening module, an initial feature extraction module, a feature subgraph construction module, and a feature update module. The benign screening module is used to obtain an original traceability graph, remove malicious nodes in the original traceability graph based on detection data of the shield cube, and obtain a benign traceability graph; the malicious node refers to an IP socket node in the original traceability graph matched with a malicious IP detected by the shield cube; a trained feature extractor is obtained by using the benign traceability graph for feature extraction training; The initial feature extraction module is used to input the original traceability graph into the trained feature extractor to extract an initial feature vector of each node; The feature subgraph construction module is used to construct a multi-hop feature subgraph of a target node according to initial feature vectors of the target node and L-order range neighbor nodes of the target node; nodes in the multi-hop feature subgraph represent a set matrix of each-order hop number features of the target node, and all nodes are connected to each other. The feature updating module is used to perform fusion updating of feature representation of the multi-hop feature subgraph of the target node by using a graph neural network, and the updated feature representation is used as a feature of the target node.

9. An electronic device, comprising: The electronic device comprises: at least one processor; and a memory connected to the at least one processor in communication; wherein The memory stores computer program instructions executable by the at least one processor, and the computer program The computer program instructions are executed by the at least one processor to enable the at least one processor to perform the node feature construction method of any one of claims 1-7.

10. A computer-readable storage medium storing a program, characterized in that, The program is executed by the processor to implement the node feature construction method of any one of claims 1-8.

Images