APT intrusion detection method and system facing edge computing device

Abstract

The invention discloses an APT intrusion detection method and system facing an edge computing device, and relates to the technical field of computer network security, and the method comprises the steps: converting a log file in the edge computing device into nodes and edges, and building a traceability graph; performing vectorization processing on the traceability graph to obtain a node feature vector and an edge feature vector; establishing a heterogeneous graph neural network model; embedding the node feature vector by using a node-level heterogeneous mutual attention mechanism to obtain a node embedding result, and embedding the node embedding result and the edge feature vector by using a semantic-level heterogeneous mutual attention mechanism to obtain a semantic embedding result; and performing intrusion type detection on the semantic embedding result to obtain the distribution probability of intrusion types. According to the invention, intrusion detection is carried out by using the heterogeneous graph neural network in combination with the traceability graph, and the accuracy and efficiency of APT detection are greatly enhanced by using the complex mode recognition and prediction capability of the heterogeneous graph neural network.

Description

Technical Field

[0001] The present application relates to the field of computer network security technology, and in particular to an APT intrusion detection method and system for edge computing devices. Background Art

[0002] Edge computing is a distributed computing architecture that places data processing and computing resources on edge devices, sensors, or user devices close to the source of data generation to provide faster, real-time computing and data analysis capabilities. Blockchain is a distributed database whose key is decentralization. By maintaining an ever-increasing, tamper-proof list of data records, blockchain allows secure data exchange without a centralized trust agency. With the rapid development of the Internet of Things (IoT), the security and efficiency of data transmission are becoming increasingly important. Edge devices and networks in the IoT are increasingly vulnerable to security threats such as hacker attacks, data leaks, and privacy violations, which can lead to significant consequences.

[0003] In recent years, in order to overcome the limitations of the Internet of Things, many studies have applied blockchain technology to Internet of Things scenarios using edge computing. Edge computing can provide real-time data processing and response, while blockchain can ensure the credibility and security of data. The devices on the edge computing nodes run and collect data and upload the data to the blockchain. Then these nodes can use the blockchain for secure data exchange and verification. Through the blockchain, various devices can safely share and exchange data without worrying about data tampering or loss.

[0004] However, there is also a huge challenge in this process. With the increasing importance of edge devices, edge network devices are more likely to be attacked by some network threats, especially some advanced threats such as Advanced Persistent Threat (APT). These attacks will cause data to be tampered before being uploaded to the chain. The concealment, complexity and diversity of APT attacks have brought great challenges to APT attack detection. Existing attack detection methods deployed on edge devices under blockchain, such as IDS (Intrusion Detection Systems), are mainly based on rule engines and virus attack libraries. These attack detection methods have some defects, such as over-reliance on attack features and expert experience, resulting in insufficient ability to discover unknown attacks, and excessive system resource usage, making it difficult to provide effective warnings of APT attacks in a timely manner. Moreover, these detection methods all ignore the relevance of threat intelligence context, which leads to the system being attacked by APT, affecting the timeliness and effectiveness of APT detection strategies, making it difficult to effectively guarantee the expected benefits of strategies. Summary of the invention

[0005] The embodiments of the present application provide an APT intrusion detection method and system for edge computing devices, which are used to solve the problems of timeliness and effectiveness of APT detection methods in the prior art.

[0006] On the one hand, an embodiment of the present application provides an APT intrusion detection method for edge computing devices, including: Get the log files in the edge computing device; Convert the information in the log file into nodes and edges, and build a traceability graph based on the nodes and edges; Vectorize the nodes and edges in the traceability graph to obtain node feature vectors and edge feature vectors respectively; A heterogeneous graph neural network model is established, which includes a heterogeneous graph convolution layer, a heterogeneous graph pooling layer, and a graph readout layer connected in sequence; The node feature vector and the edge feature vector are input into the heterogeneous graph convolution layer. The node feature vector is first embedded using the node-level heterogeneous mutual attention mechanism to obtain the node embedding result. Then, the node embedding result and the edge feature vector are embedded using the semantic-level heterogeneous mutual attention mechanism to obtain the semantic embedding result. The semantic embedding result is input into the heterogeneous graph pooling layer, and the semantic embedding result is downsampled to obtain the heterogeneous graph feature information; The feature information of the heterogeneous graph is input into the graph reading layer to obtain the distribution probability of the intrusion type, where the intrusion type includes APT intrusion.

[0007] In a possible implementation, the log file includes a subject log, an object log, and an event log.

[0008] In a possible implementation, when converting the information in the log file into nodes and edges, the subject in the subject log and the object in the object log are converted into nodes, and the actions in the event log are converted into edges.

[0009] In a possible implementation, the attributes of a node include text and numbers. For text-type nodes, one-hot encoding is used to convert the node into a node feature vector. For number-type nodes, the node values ​​are first standardized and normalized, and then one-hot encoding is used to convert the standardized and normalized nodes into node feature vectors.

[0010] In a possible implementation, when the edges are vectorized, the number of various edge types is counted, the number is used as an attribute of the edge, and all the attributes of the edge are merged to form an edge vector feature.

[0011] In a possible implementation, a method for performing node embedding on a node feature vector using a node-level heterogeneous mutual attention mechanism includes: determining the correlation between each node and its neighboring nodes; assigning a weight to each neighboring node according to the correlation; and concatenating or averaging the neighboring nodes based on the weight of each neighboring node to obtain a node embedding result after the node is embedded.

[0012] In one possible implementation, a single-layer feedforward neural network and a nonlinear activation function LeakyReLU are used to determine the correlation.

[0013] In a possible implementation, multiple node embedding processes are performed on the node and the neighboring nodes, and the results of the multiple node embedding processes are concatenated or averaged to obtain a final node embedding result.

[0014] In a possible implementation, a method for edge embedding of node embedding results and edge feature vectors using a semantic-level heterogeneous mutual attention mechanism includes: determining the similarity between the node embedding result and a set semantic-level attention vector, and determining the importance of each node embedding result based on the similarity; determining the weight of each edge feature vector based on the importance; and fusing the edge feature vectors according to the weights to obtain a semantic embedding result.

[0015] On the other hand, the embodiment of the present application also provides an APT intrusion detection system for edge computing devices, including: The log acquisition module is used to obtain log files in the edge computing device; A traceability graph building module is used to convert the information in the log file into nodes and edges, and build a traceability graph based on the nodes and edges; A vectorization processing module is used to perform vectorization processing on the nodes and edges in the traceability graph to obtain node feature vectors and edge feature vectors respectively; A model building module is used to build a heterogeneous graph neural network model, which includes a heterogeneous graph convolution layer, a heterogeneous graph pooling layer, and a graph readout layer connected in sequence; The heterogeneous graph convolution module is used to input the node feature vector and the edge feature vector into the heterogeneous graph convolution layer, first perform node embedding on the node feature vector using the node-level heterogeneous mutual attention mechanism to obtain the node embedding result, and then perform edge embedding on the node embedding result and the edge feature vector using the semantic-level heterogeneous mutual attention mechanism to obtain the semantic embedding result; The heterogeneous graph pooling module is used to input the semantic embedding results into the heterogeneous graph pooling layer, downsample the semantic embedding results, and obtain the heterogeneous graph feature information; The intrusion detection module is used to input the heterogeneous graph feature information into the graph reading layer to obtain the distribution probability of the intrusion type, where the intrusion type includes APT intrusion.

[0016] The APT intrusion detection method and system for edge computing devices in this application have the following advantages: 1. Aiming at the problem that it is difficult to detect APT threats in edge devices under blockchain, the traceability graph is used for intrusion detection, and a heterogeneous graph neural network threat detection model with traceability graph as input is designed. The model uses the traceability graph to model complex and dynamic host activities, embeds the traceability graph through node-level heterogeneous mutual attention and semantic-level heterogeneous mutual attention, and then uses the heterogeneous graph pooling layer to compress and reduce the extracted features, and finally uses the graph representation layer to complete the prediction. Experiments were conducted using the Streamspot dataset and the NSL-KDD (Network Security Library-Knowledge Discovery and Data Mining) dataset. The experimental results show that the detection model can effectively detect APT attack behaviors in the dataset.

[0017] 2. In order to address the low accuracy and efficiency of APT threat detection, heterogeneous graph neural networks are used in combination with traceability graphs for intrusion detection. The complex pattern recognition and prediction capabilities of heterogeneous graph neural networks are utilized to greatly enhance the accuracy and efficiency of advanced threat detection. At the same time, as an inductive learning model, heterogeneous graph neural networks reduce reliance on prior knowledge such as labels and policy frameworks during the detection process, demonstrating flexible adaptability and high practicality that is not limited to fixed rules in complex, changeable and highly uncertain environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 A flowchart of an APT intrusion detection method for edge computing devices provided in an embodiment of the present application.

[0020] Figure 2 is the Loss curve during the experiment.

[0021] Figure 3 It is the AUC curve of the experimental process.

[0022] Figure 4 is the AP curve of the experimental process.

[0023] Figure 5 is the FPR curve of the experimental process. DETAILED DESCRIPTION

[0024] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0025] Figure 1 A flowchart of an APT intrusion detection method for edge computing devices provided in an embodiment of the present application. An embodiment of the present application provides an APT intrusion detection method for edge computing devices, including: S100, obtaining a log file in an edge computing device.

[0026] For example, log files include three categories: first, the subject log of active behavior, such as processes, etc.; second, the object log of receiving behavior, such as files, network data flows, etc.; and finally, the event log that connects the subject and the object. The information in these log files is converted into nodes and edges in the traceability graph, making the complex interactive behaviors in the system clear at a glance, which is convenient for detecting and identifying APT attacks.

[0027] S110, converting the information in the log file into nodes and edges, and establishing a traceability graph based on the nodes and edges.

[0028] Exemplarily, when converting the information in the log file into nodes and edges, the subject in the subject log and the object in the object log are converted into nodes, and the actions in the event log are converted into edges.

[0029] The traceability graph constructed in this application is actually a graph with directional and heterogeneous properties. The traceability graph represents the subject, object and the information flow between them. In the traceability graph, the subject and object represent the initiator of the system activity, and are accompanied by rich information, such as creation time, command line parameters, etc., so the subject and object are called nodes. The edge of the traceability graph represents the information flow between the subject and the object. For example, if process A opens file B, then the open is the edge between nodes A and B. At the same time, this application also considers multiple elements such as file objects, network flow objects, memory objects, and records their properties and behaviors in detail.

[0030] Since the interactions between components in the operating system are extremely complex, this application subdivides 56 types of interaction relationships to more accurately depict these interactions. Although there may be multiple interaction relationships between certain nodes, there is usually one relationship that dominates. In addition, the advantage of the traceability graph in APT detection is that the traceability graph not only captures the characteristics of system activities, but also retains the causal relationship between interactions between nodes, which provides more information for APT detection. For example, each edge is attached with information such as the time when the event occurred, the location of the affected data, and the size of the data. This also provides more semantic and structural information for the graph neural network model, which is more conducive to the model to obtain contextual information.

[0031] S120, vectorizing the nodes and edges in the traceability graph to obtain node feature vectors and edge feature vectors respectively.

[0032] Exemplarily, the attributes of a node include text and numbers. For text type nodes, one-hot encoding is used to convert the node into a node feature vector. For number type nodes, the node values ​​are first standardized and normalized, and then one-hot encoding is used to convert the standardized and normalized nodes into node feature vectors.

[0033] Specifically, for text-type nodes, this application focuses on nodes with clear categories. In order to convert the information of these categories into a numerical form that can be used by the model, this application processes it through one-hot encoding, converting each category into a unique binary vector. However, when faced with nodes with a large number of categories, simple one-hot encoding may result in an overly sparse matrix, which is not conducive to model learning. Therefore, in this case, this application chooses to use a target encoding method to first map each category to a compact numerical space, and then perform one-hot encoding processing.

[0034] When processing digital nodes, targeted preprocessing is performed according to their value ranges. For most digital nodes, one-hot encoding is still used to retain their original category information. However, for those nodes with a large value range, such as memory addresses, IP (Internet Protocol) attributes, etc., this application adopts a different strategy. Since the values ​​of these nodes are large and wide-ranging, if they are directly input into the model, the model may ignore other relatively small features. Therefore, in order to avoid this situation, this application first standardizes and normalizes these nodes, limits them to a reasonable value range, and then performs one-hot encoding. In addition, in order to retain the execution order information of system activities, the time attributes and timestamps in the traceability graph will also be processed. This time information is crucial to understanding system behavior. However, the original timestamp accuracy reaches the nanosecond level, which is too fine for subsequent data processing. In order to facilitate subsequent data processing and reduce the computational burden, this application reduces the accuracy of the timestamp from nanoseconds to seconds. Such processing not only retains the core elements of time information, but also simplifies the complexity of data processing.

[0035] Furthermore, when the edges are vectorized, the number of various types of edges is counted, the number is used as the attribute of the edge, and all the attributes of the edge are merged to form the edge vector feature.

[0036] Specifically, in the provenance graph, there may be multiple types of edges between nodes, which represent different events or relationships. In order to more comprehensively describe the strength or importance of the relationship between nodes, this application also counts the number of types of each edge and uses it as an attribute of the edge. Finally, this application merges all the attributes of the edge to obtain the edge feature vector.

[0037] S130, establishing a heterogeneous graph neural network model, the heterogeneous graph neural network model includes a heterogeneous graph convolution layer, a heterogeneous graph pooling layer and a graph readout layer connected in sequence.

[0038] For example, in the heterogeneous graph convolution layer, through specific convolution operations, the model can effectively aggregate the neighboring information of the nodes to update the representation of each node and deeply capture the various complex association patterns in the graph. Subsequently, the heterogeneous graph pooling layer comes into play, which finely screens and reduces the dimensionality of the features extracted by the convolution layer, aiming to reduce the number of variables in the feature graph while ensuring the retention of key feature information. This step is crucial to reducing the computational burden and improving the wide applicability of the model. Finally, the graph readout layer acts as a global pooling function, which can regularize the information of different quantities of nodes to a unified dimensional standard and complete the final classification prediction.

[0039] S140, input the node feature vector and the edge feature vector into the heterogeneous graph convolution layer, first perform node embedding on the node feature vector using the node-level heterogeneous mutual attention mechanism to obtain the node embedding result, and then perform edge embedding on the node embedding result and the edge feature vector using the semantic-level heterogeneous mutual attention mechanism to obtain the semantic embedding result.

[0040] Exemplarily, the method of embedding a node feature vector using a node-level heterogeneous mutual attention mechanism includes: Determine the correlation between each node and its neighboring nodes; Assign weights to each neighboring node based on relevance; Based on the weight of each neighboring node, the neighboring nodes are concatenated or averaged to obtain the node embedding result after the node is embedded.

[0041] Specifically, assuming that a traceability graph has N nodes, the F-dimensional node feature vector set of all nodes can be expressed as The purpose of the heterogeneous graph convolution layer is to output a new node vector feature set In this process, the dimension of the node feature vector may change, i.e. , and denote the real number space of F dimension and F' dimension respectively. In order to retain sufficient expressive power, at least one learnable linear transformation is required to transform the input node feature vector into a high-order feature. For example, for the node , for their node feature vectors Apply a linear transformation ,from Dimension conversion The characteristics of the reform are , where a is the attention calculation module and W is the weight matrix.

[0042] The above formula first maps the input node feature vector to a high-order feature space through a linear transformation, and then uses the self-attention mechanism to assign corresponding attention to each node feature vector. In this process, there is a general attention calculation module , the module passes Calculate the influence coefficient of each node on other neighboring nodes, that is, the correlation , where R is a real number space. When calculating attention, this method will comprehensively consider every pair of nodes in the graph, which means that the influence of each node in the graph on its neighboring nodes will be taken into account, but this may ignore the overall structural information of the graph. In order to more accurately evaluate the relationship between a node and its neighboring nodes, this application only focuses on the nodes in the node neighborhood. ,in Represents the node neighborhood, and then calculates the relevance of the nodes in the neighborhood to the target node In order to ensure that weights are reasonably distributed among different nodes, this application needs to perform uniform standardization on the correlation between nodes and neighboring nodes. Here, this application chooses to use the softmax function to implement the standardization process:

[0043] in, For Node The result after normalization of the correlation with neighboring nodes, N i represents the set of neighboring nodes of the ith node, e ik Represents the correlation between the i-th node and the k-th neighboring node. There are two methods for calculating the correlation. The first is to use the inner product of the vector to perform a simple parameter-free correlation calculation. This method directly calculates the inner product of the node feature vector To obtain the similarity between the two vectors, we use this as their correlation. Another method is to select a parameterized neural network layer as the attention calculation module a. This neural network layer can be flexibly adjusted according to the specific task and data characteristics, but its core requirement is that it must output a scalar value that satisfies , which is used to quantify the correlation between two inputs. express dimensional real number space.

[0044] Specifically, this application selects a single-layer feedforward neural network with a relatively simple structure to calculate the correlation. It is particularly worth mentioning that this application uses LeakyReLU as a nonlinear activation function in this neural network, and sets its slope on the negative half axis to 0.2. This design not only increases the expressive power of the network, but also enables the network to maintain a certain activity when processing negative inputs, thereby more effectively learning and adapting to nonlinear relationships in the data. The LeakyReLU nonlinear activation function is as follows:

[0045] in represents the concatenation operation, and T represents the transposition. The complete weight calculation formula is:

[0046] in, Represents the node feature vector of the kth neighboring node. After obtaining the normalized weights, the linear combination of the corresponding node feature vectors is calculated. After the nonlinear activation function, the final output feature vector of each node is:

[0047] in, is a nonlinear activation function. In addition, this application uses a multi-head attention mechanism to stabilize the learning process of self-attention, that is, calling the above formula Group independent attention mechanisms and then concatenate the output results:

[0048] in, It is The weights calculated by the group attention mechanism, is the corresponding input linear transformation matrix, and the final output node feature vector Included In order to reduce the dimension of the output feature vector, the concatenation operation can also be replaced by an average operation.

[0049]

[0050] Furthermore, multiple node embedding processes may be performed on the node and its neighboring nodes, and the results of the multiple node embedding processes may be concatenated or averaged to obtain a final node embedding result.

[0051] Furthermore, the method of edge embedding the node embedding result and the edge feature vector using the semantic-level heterogeneous mutual attention mechanism includes: Determine the similarity between the node embedding result and the set semantic-level attention vector, and determine the importance of each node embedding result based on the similarity; Determine the weight of each edge feature vector according to its importance; The edge feature vectors are fused according to the weights to obtain the semantic embedding result.

[0052] Specifically, the embedding of the nodes is completed through the above operations, but the traceability graph is a heterogeneous graph, and the information of the incoming edges needs to be considered. In order to more comprehensively capture the rich features of the nodes, this application integrates a variety of different semantic information. These diversified semantic information can be effectively revealed with the help of meta-paths, that is, edge feature vectors. When processing heterogeneous graphs, it is a challenging task to select appropriate meta-paths and effectively fuse these different semantic information. In order to meet this challenge, this application adopts the heterogeneous graph semantic-level attention mechanism proposed by the heterogeneous graph neural network (Heterogeneous Graph Attention Network, HAN) based on hierarchical attention. This mechanism can intelligently identify the importance of different meta-paths and fuse the information of these meta-paths according to the needs of specific tasks.

[0053] When implementing this method, the present application uses the node embedding results with specific semantics obtained from the node-level heterogeneous mutual attention mechanism as input data. Specifically, the present application uses the N node embedding results with specific semantics learned from the node-level heterogeneous mutual attention mechanism as the input of the mechanism. , its weight It can be expressed by a deep neural network that performs the computation of semantic-level attention, where is the node embedding result of the i-th node, i.e., the meta-path, is the weight of the meta-path. This mechanism demonstrates the powerful ability of the semantic-level heterogeneous mutual attention mechanism in capturing the complex and changing semantic information behind heterogeneous graphs, and provides a powerful tool for this application in processing complex networks. The weight can be expressed as:

[0054] in, represents a deep neural network that implements semantic-level heterogeneous mutual attention mechanism, Weiyuan Road The feature vector of .

[0055] In order to deeply explore and learn the importance of each meta-path, this application first performs a nonlinear transformation on the node embedding results with specific semantics. This process can be achieved through a neural network structure such as a multi-layer perceptron, which can effectively map the original node embedding results to a new feature space. Next, this application calculates the similarity between the node embedding results after nonlinear transformation and the pre-defined semantic-level attention vector q. This similarity essentially reflects the importance of each node embedding result.

[0056] In addition, in order to obtain a global perspective, this application further averages the importance of all node embedding results. In this way, the contribution of different meta-paths to the final task performance can be more accurately quantified and compared.

[0057] Importance of each meta-path It can be represented by the following average importance:

[0058] Among them, W is the weight matrix, b is the bias vector, V is the node set, is the number of nodes in the set. After that, by comparing with the weight matrix and the bias vector Perform a linear transformation, then pass through the nonlinear activation function tanh, and finally add it to the vector Do the dot product and average it over all nodes to get the importance of each meta-path .

[0059] After obtaining the importance of each meta-path, they are normalized by the softmax function. Weight It can be obtained by normalizing the above importance of all meta-paths using the softmax function:

[0060] The above formula represents the meta-path Contribution to a specific task. Obviously, The higher the meta path Note that for different tasks, the meta path There may be different weights. Using the learned weights as coefficients, we can fuse these semantically specific node embedding results to get the final embedding result Z as follows:

[0061] S150, inputting the semantic embedding result into the heterogeneous graph pooling layer, downsampling the semantic embedding result, and obtaining the heterogeneous graph feature information.

[0062] For example, the main function of the heterogeneous graph pooling layer is to downsample the output of the heterogeneous graph convolution layer, reduce the size of the data and the number of parameters, and thus reduce the amount of computation. In this application, the heterogeneous graph pooling layer uses average pooling. The pooling layer sets a pooling rate r∈(0,1) for each layer to gradually reduce the number of nodes in the next layer. Specifically, after L layers of pooling, the number of nodes in a traceability graph containing N nodes will be reduced to r. 1 , r 2 ,…, r L×N Subsequently, the node feature vectors and adjacency matrices of these remaining nodes are used to characterize the characteristics of the provenance graph.

[0063] However, in the face of traceability graphs with variable sizes and unstable number of nodes, a single layered pooling may not be able to fully capture all the information of the graph. To solve this problem, this application performs average pooling on the node feature vectors of all remaining nodes on the basis of layered pooling. Thus, a feature vector that can fully reflect the information of the entire graph is obtained.

[0064] In the pooling process of the present application, the nodes of each layer are not simply reduced, but selected and optimized based on the clustering results of the nodes in the previous layer. This clustering method not only takes into account the node feature vectors of the nodes, but also fully integrates the topological structure of the traceability graph, thereby ensuring that the pooled nodes are more representative. After obtaining the feature vector X of the node, the present application further combines the adjacency matrix A to perform refined pooling operations. This step not only takes into account the characteristics of the node itself, but also makes full use of the relationship information between the nodes, making the pooling results more accurate and comprehensive.

[0065] Finally, the forward propagation process of the heterogeneous graph pooling layer realizes the transformation from the original traceability graph input to the highly refined feature output. The forward propagation process of the heterogeneous graph pooling layer can be simply described as the transformation from input (X, A) to output (X', A'), where X' is the node feature vector after pooling, and its dimension is determined by the original number of nodes N, the feature dimension d, and the pooling rate r.

[0066] In this way, the heterogeneous graph pooling layer can simplify the provenance graph while retaining the key feature information of the provenance graph, providing strong support for subsequent graph classification tasks.

[0067] S160, inputting the heterogeneous graph feature information into the graph reading layer to obtain the distribution probability of the intrusion type, wherein the intrusion type includes APT intrusion.

[0068] Exemplarily, the classification prediction of the traceability graph is implemented through the graph readout layer, which uses the feature vector representing the entire graph to complete this task. The core of the graph readout layer is the multi-layer perceptron. When the output data of the heterogeneous graph pooling layer is passed to the graph readout layer, the multi-layer perceptron will process the data and then predict the graph type. Inside the multi-layer perceptron, this application uses specific parameters, namely the weight matrix w l and the bias matrix b l , to process the data of the hidden layer. The feature vector of the entire image After being processed by the hidden layer, it is converted into a new vector representation , this process is achieved through the following formula:

[0069] In getting the vector After that, the application further uses the softmax function, i.e. the normalized exponential function, to calculate the probability distribution of the graph belonging to each category, i.e. the intrusion type. In this process, x represents the graph feature vector, and C represents the number of all possible intrusion types. Finally, the classification probability distribution of the intrusion type can be obtained by the following formula:

[0070] in, Is the same as the real invasion type The corresponding weight vector. It describes the graph feature vector Each dimension is important for predicting the invasion type importance. Represents all possible intrusion types The corresponding weight vector, C, represents the number of possible intrusion types. When calculating the classification probability distribution, for each possible intrusion type c, there is a corresponding weight vector , which is also used to measure the graph feature vector With this intrusion type of relevance.

[0071] In this way, the graph readout layer can effectively utilize the multi-layer perceptron and softmax function to accurately predict the intrusion type.

[0072] The embodiment of the present application also provides an APT intrusion detection system for edge computing devices, the system comprising: The log acquisition module is used to obtain log files in the edge computing device; A traceability graph building module is used to convert the information in the log file into nodes and edges, and build a traceability graph based on the nodes and edges; A vectorization processing module is used to perform vectorization processing on the nodes and edges in the traceability graph to obtain node feature vectors and edge feature vectors respectively; A model building module is used to build a heterogeneous graph neural network model, which includes a heterogeneous graph convolution layer, a heterogeneous graph pooling layer, and a graph readout layer connected in sequence; The heterogeneous graph convolution module is used to input the node feature vector and the edge feature vector into the heterogeneous graph convolution layer, first perform node embedding on the node feature vector using the node-level heterogeneous mutual attention mechanism to obtain the node embedding result, and then perform edge embedding on the node embedding result and the edge feature vector using the semantic-level heterogeneous mutual attention mechanism to obtain the semantic embedding result; The heterogeneous graph pooling module is used to input the semantic embedding results into the heterogeneous graph pooling layer, downsample the semantic embedding results, and obtain the heterogeneous graph feature information; The intrusion detection module is used to input the heterogeneous graph feature information into the graph reading layer to obtain the distribution probability of the intrusion type, where the intrusion type includes APT intrusion.

[0073] Experimental verification In the experiment, the performance of the model was evaluated through some data sets that fit the real scenarios of edge devices under the blockchain. First, the model was tested on a relatively small Streamspot data set. In order to further test the detection ability of the model, the model was tested on the NSL-KDD data set. In order to further simulate the real situation of edge devices under the chain, the experiment was only conducted under the CPU, and the CPU was Intel i7-10700k. In terms of evaluating the performance of the model, the experiment used a variety of widely used deep learning evaluation criteria to evaluate the performance of the model, namely AUC (area under the curve) curve, false alarm rate (FPR), average precision (AP), ROC (receiver operating characteristic) curve, recall rate and F1 value.

[0074] Experimental results on Streamspot dataset Compared with the NSL-KDD dataset, the Streamspot dataset is an experimental data set designed specifically for network anomaly detection in edge streams, which means that it fully considers the characteristics of edge devices and the types of attacks that may be suffered in the data collection, annotation, and preprocessing stages. Using the Streamspot dataset to test the intrusion detection system can more accurately reflect the performance of the system in the edge device environment. Moreover, the attack scenario of the Streamspot dataset is to download a program from a malicious URL (Uniform Resource Locator) and exploit a flash vulnerability to obtain system administrator privileges. This scenario design is closer to the types of attacks that actual edge devices may suffer, which helps to more realistically evaluate the detection capability and adaptability of the intrusion detection system.

[0075] In the experimental setting, 400 samples of the 500 samples in the normal data set are used for training and 100 samples are used for testing. All 100 malicious samples in the data set will be used for testing. At the same time, all 1000 generated samples will be used for training. The number of training rounds of data is set to 20, the learning rate is set to 0.0001, and the dropout is set to 0.4.

[0076] The loss curve is as follows Figure 2 As shown, the AUC curve and AP curve are respectively Figure 3 and Figure 4 shown.

[0077] As can be seen from the figure, in the process of training the heterogeneous graph neural network model, the Loss value is generally on a downward trend. This means that the model is constantly learning and optimizing in order to more accurately classify the traceability graph. At the beginning of the training, the Loss value of the model was relatively high. After one round of training, the Loss value dropped significantly, indicating that the model began to learn some effective classification features. By the fourth round, the Loss value dropped again, indicating that the model continued to learn and optimize. In the next few Epochs, the Loss value continued to drop slowly, from 0.416 to 0.399, especially between Epoch 9 and Epoch 10, the drop in the Loss value became very small (from 0.399 to 0.399), which means that the model has approached its performance limit.

[0078] AUC and AP (average precision) are both important indicators for evaluating the performance of binary classification models, especially when dealing with unbalanced data sets. AUC can give the comprehensive performance of the model under different thresholds. The closer the AUC and AP values ​​are to 1, the better the performance of the model is generally considered. As can be seen from the figure, the AUC value starts from 1.0000 in Epoch 1, experiences a series of slight declines, and finally stabilizes at 0.9800 in Epoch 10. In the early stage of model training (Epoch 1), the average accuracy of the model is about 0.986. This shows that the model has a certain classification ability at the beginning, but there is still room for improvement. As training continues, the AUC value gradually decreases, which may indicate that the model is gradually generalizing to the test set. The model gradually learns a wider range of features during training, which may not be completely applicable to the training set. This is a good sign because it shows that the model begins to have better generalization ability. And as training continues (the increase in Epochs), the average accuracy of the model begins to gradually increase, reaching a maximum of 0.998. This shows that the model is gradually learning more effective features and is able to better adapt to the training data. However, when the training reached a certain stage, the average accuracy of the model began to decline, and finally returned to around 0.986. This is due to the occurrence of overfitting, that is, the performance of the model on the training set is too optimized, and the performance will decline on unseen data.

[0079] The FPR curve is as follows Figure 5As shown in the figure, from Epoch 1 to 3, the FPR is 0, which means that the model is very cautious in classifying benign provenance graphs in the early stage of training, and almost no false positives are generated. This is because the model has not fully learned the characteristics of APT attack activities at this stage, so it is more inclined to judge uncertain provenance graphs as benign. From Epoch 4 to 6, the FPR fluctuates, rising first, then falling, and then rising again. The model begins to gradually learn the characteristics of APT attacks at this stage, but at the same time it is also trying to distinguish between benign and malicious provenance graphs, resulting in fluctuations in the false positive rate. From Epoch 6, the FPR gradually stabilizes. Although there are still some fluctuations, the overall trend is downward. This shows that the model gradually optimizes the classification performance and reduces false positives in continuous training. At Epoch 10, the FPR is 0.0820. Although this value has increased compared with the previous one, it is still at a relatively low level. Considering that the classification of provenance graphs is itself a complex binary classification problem and the detection of APT attack activities is itself a challenge, this FPR value is acceptable.

[0080] Experimental results on NSL-KDD dataset Compared with the Streamspot dataset, the NSL-KDD dataset covers a variety of network attacks, such as DoS (denial of service) attacks, R2L (remote to local) attacks, U2R (user to root) attacks, and Probe attacks. This diversity of attack types enables the dataset to fully simulate various security threats that edge devices may encounter, thereby more accurately evaluating the detection capabilities and generalization performance of intrusion detection systems. Due to the large amount of data and diverse attack types of the NSL-KDD dataset, it is an ideal platform for testing the extreme performance of edge device intrusion detection systems under blockchain. By testing on this dataset, the system's capabilities and limitations in processing large-scale data and identifying complex attack patterns can be tested, which is of great significance for ensuring the data security of edge devices in blockchain applications.

[0081] In order to test the extreme performance of the edge device intrusion detection system under blockchain, the experiment selected KDDTest+ and KDDTrain+ as the test set and training set respectively. In the experimental setting, 125,973 samples of KDDTrain+ were used for training, and 22,544 samples of KDDTest+ were used for testing. The number of training rounds of data was set to 20, the learning rate was set to 0.01, and the momentum was set to 0.9. Every 10 epochs, the learning rate was multiplied by 0.5, and the dropout was set to 0.4. The performance of the model was evaluated by the total accuracy predicted on the test set, the precision, recall rate, and F1 score on each sub-dataset. The results are shown in Table 1.

[0082] Table 1 Experimental results

[0083] The experimental results show that the overall accuracy of the system is 94.20%, indicating that the system can effectively distinguish normal traffic from abnormal attack traffic. Specifically, for Dos attacks, the system shows extremely high precision (99.18%) and high recall (87.06%), with an F1 score of 92.72%, showing the excellent performance of the system in Dos attack detection. In terms of normal traffic identification, the system also performs well, with precision and recall reaching 98.10% and 99.98% respectively, and an F1 score of 99.03%, almost achieving zero false positives and false negatives. For Probe attacks, the system also maintains high precision (99.05%) and reasonable recall (86.82%), with an F1 score of 92.53%. In the detection of R2L and U2R attacks, although the recall rate is high (97.85% and 78.50% respectively), the precision is relatively low (76.91% and 85.79%), resulting in F1 scores of 86.13% and 81.98% respectively. This shows that the intrusion detection system performs well in detecting multiple types of attacks, but there is still room for improvement in specific types of attacks (such as R2L and U2R).

[0084] Comprehensively considering various indicators, the heterogeneous graph neural network model showed significant performance improvement during the training process. The AP value shows that the model can accurately distinguish the traceability graph containing APT attack activities from the benign traceability graph. Although the accuracy of R2L and U2R attacks is relatively low, it is still within an acceptable range, and the overall effectiveness of the model is still shown. In addition, since the traceability graph can well reflect the behavioral logic of the system over a period of time, the system performs very well in normal traffic identification, with an accuracy and recall rate of 98.10% and 99.98% respectively, and an F1 score of 99.03%, which is almost zero false positives and false negatives. Overall, the model shows strong classification capabilities and good learning trends.

[0085] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0086] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. An APT intrusion detection method for edge computing devices, characterized in that: include: Get the log files in the edge computing device; Convert the information in the log file into nodes and edges, and establish a traceability graph based on the nodes and edges; Vectorizing the nodes and edges in the traceability graph to obtain node feature vectors and edge feature vectors respectively; Establishing a heterogeneous graph neural network model, wherein the heterogeneous graph neural network model includes a heterogeneous graph convolution layer, a heterogeneous graph pooling layer, and a graph readout layer connected in sequence; Inputting the node feature vector and the edge feature vector into the heterogeneous graph convolution layer, first performing node embedding on the node feature vector using a node-level heterogeneous mutual attention mechanism to obtain a node embedding result, and then performing edge embedding on the node embedding result and the edge feature vector using a semantic-level heterogeneous mutual attention mechanism to obtain a semantic embedding result; Inputting the semantic embedding result into the heterogeneous graph pooling layer, downsampling the semantic embedding result, and obtaining heterogeneous graph feature information; Inputting the heterogeneous graph feature information into the graph reading layer to obtain a distribution probability of an intrusion type, wherein the intrusion type includes an APT intrusion; The method of embedding the node feature vector using a node-level heterogeneous mutual attention mechanism includes: Determine the correlation between each of the nodes and neighboring nodes; Assigning a weight to each of the neighboring nodes according to the relevance; Based on the weight of each of the neighboring nodes, the neighboring nodes are concatenated or averaged to obtain a node embedding result after the node is embedded; The method of edge embedding the node embedding result and the edge feature vector using a semantic-level heterogeneous mutual attention mechanism includes: Determine the similarity between the node embedding result and the set semantic-level attention vector, and determine the importance of each node embedding result according to the similarity; Determine the weight of each edge feature vector according to the importance; The edge feature vectors are fused according to the weights to obtain the semantic embedding result.

2. The APT intrusion detection method for edge computing devices according to claim 1, characterized in that: The log files include subject logs, object logs and event logs.

3. The APT intrusion detection method for edge computing devices according to claim 2, characterized in that: When converting the information in the log file into nodes and edges, the subject in the subject log and the object in the object log are converted into the nodes, and the actions in the event log are converted into the edges.

4. The APT intrusion detection method for edge computing devices according to claim 1, characterized in that: The attributes of the node include text and numbers. For the text type nodes, one-hot encoding is used to convert the nodes into the node feature vectors. For the number type nodes, the values ​​of the nodes are first standardized and normalized, and then one-hot encoding is used to convert the standardized and normalized nodes into the node feature vectors.

5. The APT intrusion detection method for edge computing devices according to claim 1, characterized in that: When vectorizing the edge, the number of various types of the edge is counted, the number is used as the attribute of the edge, and all the attributes of the edge are combined to form the edge vector feature.

6. The APT intrusion detection method for edge computing devices according to claim 1, characterized in that: The correlation is determined using a single-layer feedforward neural network and a non-linear activation function LeakyReLU.

7. The APT intrusion detection method for edge computing devices according to claim 1, characterized in that: The node and the neighboring nodes are subjected to multiple node embedding processes, and the results of the multiple node embedding processes are concatenated or averaged to obtain a final node embedding result.

8. A system using the APT intrusion detection method for edge computing devices according to any one of claims 1 to 7, characterized in that: include: The log acquisition module is used to obtain log files in the edge computing device; A traceability graph building module, used to convert the information in the log file into nodes and edges, and build a traceability graph based on the nodes and edges; A vectorization processing module, used for performing vectorization processing on the nodes and the edges in the traceability graph to obtain node feature vectors and edge feature vectors respectively; A model building module, used to build a heterogeneous graph neural network model, wherein the heterogeneous graph neural network model includes a heterogeneous graph convolution layer, a heterogeneous graph pooling layer and a graph readout layer connected in sequence; A heterogeneous graph convolution module, used for inputting the node feature vector and the edge feature vector into the heterogeneous graph convolution layer, firstly performing node embedding on the node feature vector using a node-level heterogeneous mutual attention mechanism to obtain a node embedding result, and then performing edge embedding on the node embedding result and the edge feature vector using a semantic-level heterogeneous mutual attention mechanism to obtain a semantic embedding result; A heterogeneous graph pooling module, used for inputting the semantic embedding result into the heterogeneous graph pooling layer, downsampling the semantic embedding result, and obtaining heterogeneous graph feature information; The intrusion detection module is used to input the heterogeneous graph feature information into the graph reading layer to obtain the distribution probability of the intrusion type, wherein the intrusion type includes APT intrusion.

Images