Intelligent semantic analysis network attack identification method

Abstract

The invention belongs to the technical field of network security, and discloses an intelligent semantic analysis network attack identification method, which comprises the following steps of: acquiring operation data of an operation system, and preprocessing the operation data to form a comprehensive data set; constructing a graph structure based on the comprehensive data set, and aggregating the features of all adjacent nodes and edges by using a maximum pooling aggregation algorithm to generate an aggregation feature of each node; integrating the aggregation features of all the nodes into a feature vector data set, and inputting the feature vector data set into a pre-trained auto-encoder to obtain a reconstruction feature corresponding to each node; the method comprises the following steps: setting a reconstruction error threshold according to reconstruction characteristics, obtaining abnormal nodes, identifying the same attack chain through the abnormal nodes, and taking entities corresponding to all nodes in the same attack chain as one network attack behavior, thereby improving the detection precision of a novel or unknown attack mode, and reducing the false alarm rate. The whole process from original data to attack behavior recognition is automatically achieved, and the detection precision and the robustness and adaptability of the system are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network attack identification, and more specifically, to a method for intelligent semantic analysis and identification of network attacks. Background Art

[0002] With the development of information technology, network security threats are becoming increasingly complex. In recent years, machine learning and deep learning methods have gradually been applied to the field of abnormal behavior detection. Although they have improved the detection capabilities to a certain extent, they also face problems such as the need for a large amount of labeled data, high computational costs, and difficulty in interpretation.

[0003] At present, most existing solutions focus on analyzing a single type of data (such as log information or network traffic), while ignoring the correlation between data from different sources. In a dynamically changing working environment, there is a lack of comprehensive analysis of multiple data types and a lack of full understanding of the interconnections between various types of data, resulting in insufficient ability to identify attack behaviors in the same attack chain when facing new types of attacks. Summary of the invention

[0004] In order to overcome the above-mentioned defects of the prior art and to achieve the above-mentioned purpose, the present invention provides the following technical solution: a method for identifying network attacks by intelligent semantic analysis, comprising: S1: Obtain the operating data of the operating system and preprocess it to form a comprehensive data set; S2: Based on the comprehensive dataset, a graph structure is constructed, and the features of all adjacent nodes and edges are aggregated using the maximum pooling aggregation algorithm to generate the aggregated features of each node in the graph structure; S3: Integrate the aggregated features of all nodes into a feature vector dataset and input it into the pre-trained autoencoder to obtain the reconstructed features corresponding to each node; S4: A reconstruction error threshold is set according to the reconstruction feature, abnormal nodes are obtained according to the reconstruction error threshold, the same attack chain is obtained through abnormal node identification, and entities corresponding to all nodes in the same attack chain are regarded as a network attack behavior.

[0005] Furthermore, the method for forming the comprehensive data set includes: Operational data includes system logs, network traffic, and user activity records; System logs include operation logs and security logs; operation logs include startup and shutdown timestamps and service status changes; security logs include user login behavior, permission changes, and file access requests; Network traffic includes transport layer information and metadata; transport layer information includes the status of TCP / UDP connections; metadata includes timestamps and packet sizes; User activity records include command line history, file operations, and remote access records; command line history includes commands and their parameters; file operations include file creation / modification / deletion events and file size changes; remote access records include SSH sessions and RDP connections; The preprocessing methods of comprehensive data sets include data cleaning, coding, data standardization, and removing noise and redundant information to form a comprehensive data set; The encoding method includes using a hash function to map each user, file, command, and IP address to a numerical feature.

[0006] Furthermore, the method of constructing a graph structure based on a comprehensive data set and aggregating the features of all adjacent nodes and edges using a maximum pooling aggregation algorithm to generate aggregate features of each node in the graph structure includes: Based on the comprehensive data set, all entities in the WT period in the comprehensive data set are counted, each entity is regarded as a node, and the events or operations between entities are defined as edges, and the nodes are connected through the edges to form a graph structure; The types of entities include users, files, commands, and IP addresses, and the types of edges include user-command edges, user-file edges, user-IP address edges, file-IP address edges, and IP address-IP address edges. Add attributes to each node and edge in the graph structure, and use the random matrix decomposition algorithm to calculate and assign an initial feature vector to each node based on the graph structure after adding attributes; Based on the initial feature vector of each node, edge features are introduced, and the features of all adjacent nodes and edges are aggregated using the maximum pooling aggregation algorithm. The initial feature vector of the current node is combined with the aggregated features to update and generate the aggregated features of the node; Among them, for any node, the node directly connected to it is regarded as an adjacent node.

[0007] Furthermore, the method of adding attributes to each node and edge in the graph structure includes: Adding inherent attributes to each node, wherein the inherent attributes added to the user type node include the user unique ID, number of logins, and number of permission changes; the inherent attributes added to the file type node include the file unique ID, file path, file size, number of accesses, and number of modifications; the inherent attributes added to the command type node include the command unique ID, command text, number of executions, and whether it is a high-authority command; the inherent attributes added to the IP address type node include the IP address, number of HTTP requests, number of new connections, and average packet size; Add interaction attributes to each edge, including timestamp, command execution result, file read / write mode, and network link status.

[0008] Furthermore, the method of using a random matrix decomposition algorithm to calculate and assign an initial feature vector to each node according to the graph structure after adding attributes includes: A1: Extract interaction frequency. During the WT period, count the number of events or operations that occur between the nodes at both ends of each edge in the graph structure, and use this as the interaction frequency of the edge. A2: Create an interaction frequency matrix. For each type of edge in the graph structure, classify the two different types of entities involved at both ends of the edge into sets U and C respectively, and create a matrix with a dimension of The interaction frequency matrix YA, set A qw is any position in the matrix, used to represent entity u in set U q and entity c in set C w The frequency of interaction between Among them, U represents a type of entity set, u q represents an entity in set U, q represents the index of the number of entities in set U, C represents another type of entity set, c w represents an entity in set C, w represents the index of the number of entities in set C, and the set contains the unique ID or IP address of all entities of the corresponding type. represents the number of entities in the set U, Represents the number of entities in set C; A3: Define and construct a random matrix, set the target dimension of matrix decomposition to k, and construct a ×l random Gaussian matrix Ω, the value of each position in the matrix is ​​randomly drawn from the standard normal distribution BZ(0,1), where l represents a preset constant; A4: Multiply the interaction frequency matrix YA by the random Gaussian matrix Ω to obtain the projection matrix YT; A5: Perform QR decomposition on the projection matrix YT, decomposing the projection matrix YT into YT=Q×R, and obtaining ×l-dimensional orthogonal matrix Q and l×l-dimensional upper triangular matrix R; A5: Select the first k columns from the orthogonal matrix Q to form a new matrix Q k , for the matrix Q k Compress and decompose to obtain the low-dimensional feature vectors of the corresponding entity u and the corresponding entity c in the interaction frequency matrix YA, and obtain the initial feature vector of the node.

[0009] Furthermore, the pair matrix Q k Compress and decompose to obtain low-dimensional feature vectors corresponding to entity u and entity c in the interaction frequency matrix YA. The method for obtaining the initial feature vector of the node includes: According to the matrix Q k , the matrix Q kApplied to the interaction frequency matrix YA, the intermediate matrix YB=Q is calculated k T ×YA, where YB represents the intermediate matrix, Q k T Denotes the matrix Q k The transpose of Use the singular value decomposition method to decompose the intermediate matrix YB to obtain three matrices. The decomposition formula is YB= ,in, is a k×k orthogonal matrix, is a k× A diagonal matrix of containing singular values, is a × The orthogonal matrix of By transforming the matrix Q k With the matrix Multiply them together to construct the characteristic matrix TJ of set U. Transpose to get the characteristic matrix of set C ; Among them, each column in the feature matrix TJ of set U represents the corresponding entity u in matrix YA q The low-dimensional feature vector of the set C; the feature matrix of the set C Each column in the matrix YA represents the corresponding entity c w The low-dimensional feature vector of The entity u q and entity c w The low-dimensional feature vector is added as a new attribute to the respective node to form the initial feature vector of the node.

[0010] Furthermore, the method of updating and generating node aggregation features includes: B1: For each edge in the graph structure, add the number of interactions of the edge into the edge attribute, and use the added edge attribute as the initial feature vector of the edge; B2: For each node, collect the feature vectors of its adjacent nodes and edge feature vectors, use the maximum pooling aggregation algorithm, and introduce the linear transformation parameter matrix for the node's own features and the linear transformation parameter matrix for the maximum value of the combination of adjacent node and edge features To integrate the feature vectors of multiple adjacent nodes; Algorithm formula after introducing parameter matrix ,in, represents the feature vector of node v at the l+1th time, represents the feature vector of node v at the lth time, N(v) represents the set of adjacent nodes of node v, represents the feature vector of the adjacent node j at the lth time, represents the eigenvector of the edge (v→j), Represents the feature vector for all adjacent nodes j and edge features The sum of takes the maximum value, Represents the ReLU activation function; the parameter matrix is ​​obtained through reinforcement learning optimization and ; B3: Repeat step S2 until l reaches the preset maximum number of times, and obtain the aggregated features after the node v is updated.

[0011] Furthermore, the method of obtaining the parameter matrix through reinforcement learning optimization is: C1: Define the environment, agent, strategy, state, action, and reward of reinforcement learning; the environment is defined as the graph structure itself and its features, the agent is defined as the action of updating the parameter matrix using the Actor-Critic method, the strategy is defined as the method based on policy gradient, the state is defined as the state of the current graph structure, including node features, edge features, and adjacency relationships, and the action is defined as the update of the parameter matrix and The update operation, the reward is defined as the reward function that evaluates the effect of the action; C2: Initialize hyperparameters and initialize the parameter matrix using the He initialization method and , and initialize the parameters θ and ϕ of the Actor network and Critic network in the Actor-Critic method; C3: Sample CY nodes and their adjacent nodes from the graph structure to construct the current state zt, including node features , edge features and adjacency relation N(v); Combine the collected node and edge features into a vector as the state input of the agent; C4: Use the Actor network in the Actor-Critic method according to the current policy function Select action dz, update action dz using the Critic network, and calculate the advantage function , where the advantage function is defined as , represents the state-action value function, represents the state value function, sjb represents the time step, sjb=0,1,2,...,SJ; C5: Update the parameter matrix according to the selected action dz and , and use the updated parameter matrix to calculate the new eigenvector of the node , use the F1 score as the reward function to calculate the current reward jl, and update the Actor network parameters θ and Critic network parameters ϕ in the Actor-Critic method; The update rule for the parameters θ of the Actor network is defined as: ,in, Representation parameters The gradient of Indicates that the current strategy Generated trajectories; The update rule of the Critic network parameters is defined as: ϕ ,in, represents the cumulative reward starting from time step t, represents the mean square error loss function; C6: Repeat B4 and B5 until the difference between the performance index in the current iteration and the performance index in the previous iteration is less than the preset iteration difference threshold or reaches the preset maximum number of updates, then stop the iteration and obtain the optimized parameter matrix and .

[0012] Furthermore, the method of integrating the aggregated features of all nodes into a feature vector dataset and inputting it into a pre-trained autoencoder to obtain the reconstructed features corresponding to each node includes: D1: Collect training sample sets, including pi groups of training samples. Each group of training samples contains a node's updated feature vector and the corresponding true reconstruction feature. D2: Build an autoencoder model, including an encoder part and a decoder part. The encoder part compresses the high-dimensional input data into a low-dimensional latent space representation, and the decoder part reconstructs the original input from the low-dimensional latent space representation to obtain reconstructed features. D3: Initialize the weight matrix and bias term; D4: Input the training sample set into the autoencoder model for forward propagation, including encoding and compressing the training data and decoding and reconstructing it; The forward propagation formula of the encoder is: ,in, is the low-dimensional latent space representation, r represents the number of hidden layers of the encoder, represents the local graph representation of the input, represents the weight matrix, represents the bias term, ReLU activation function. The forward pass of the decoder is: , where y represents the number of hidden layers of the decoder, represents the expansion of the dimension of the low-dimensional latent space representation to the output of the y-th layer, represents the output of the last layer of low-dimensional latent space representation, and denote the weight matrix and bias term respectively, represents a linear activation function; D5: Calculate the loss function, take the feature vector output by the last layer of the decoder as the reconstructed feature of the current output of the model, use the mean square error as the loss function, and calculate the loss value between the current reconstructed feature and the true input; D6: Back propagation, based on the loss value obtained by the loss function, the weight matrix and bias term of the encoder and decoder are adjusted by the gradient descent method; D7: Repeat the forward propagation, loss calculation and back propagation process until the preset maximum number of iterations is reached or the loss value no longer changes, then stop the iteration.

[0013] Furthermore, the method of setting a reconstruction error threshold according to the reconstruction feature, obtaining abnormal nodes according to the reconstruction error threshold, and obtaining the same attack chain through abnormal node identification includes: For each training sample, the square of the Euclidean distance between the feature vector in the training sample and the corresponding reconstructed feature is calculated as the reconstruction error of the training sample; Integrate the reconstruction errors of all training samples and arrange them in ascending order to obtain the reconstruction error sequence. According to the required ratio P, calculate the corresponding index position Y= ,in Indicates rounding up; Set the reconstruction error threshold to the reconstruction error value corresponding to the Yth position in the reconstruction error sequence; Compare the reconstruction error of each node in the graph structure with the reconstruction error threshold. If the reconstruction error of the node is greater than the reconstruction error threshold, the node is determined to be an abnormal node. The abnormal nodes are marked in the graph structure. For each marked abnormal node, the similarity with any other abnormal node is calculated using the cosine similarity method. Traverse the graph structure and group all abnormal nodes whose similarity is greater than the preset similarity threshold into clusters; If the number of abnormal nodes in the cluster is greater than the maximum number threshold, all abnormal nodes in the cluster are determined to be a same attack chain, and all corresponding entities are marked as a network attack behavior within the WT period.

[0014] The technical effects and advantages of the intelligent semantic analysis method for identifying network attacks of the present invention are as follows: The present invention aims to collect system logs, network traffic and user activity records, perform data cleaning, encoding and standardization, form a high-quality comprehensive data set, cover various types of operation data, ensure information integrity, improve data quality through preprocessing, and reduce noise interference; construct a graph structure based on the comprehensive data set, define entities (such as users, files, commands, IP addresses) as nodes, and add attributes, use random matrix decomposition to calculate the initial feature vector, combine edge features, and use the maximum pooling algorithm to integrate adjacent node features, effectively capture the complex relationship and potential connection between entities, reduce redundant information, and enhance the simplicity and efficiency of the model; input the aggregated features into the autoencoder, optimize the weights through forward propagation, loss calculation and back propagation, and generate reconstruction features. The autoencoder can learn the intrinsic structure of the data, efficiently compress high-dimensional data, and realize accurate anomaly detection through reconstruction error; set a threshold according to the reconstruction error, identify abnormal nodes, and cluster them into clusters through similarity calculation, determine them as the same attack chain, accurately identify abnormal nodes, and further cluster them to form an attack chain, providing a deeper security analysis. This method can capture complex interaction patterns, efficiently condense key information, accurately identify abnormal behaviors and track complete attack paths, and is suitable for high-precision and high-efficiency network security analysis scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 A schematic diagram of a method for identifying network attacks through intelligent semantic analysis according to the present invention; Figure 2 A schematic diagram of an intelligent semantic analysis and identification network attack system of the present invention. DETAILED DESCRIPTION

[0016] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0017] Embodiment 1 See also Figure 1 As shown, the method for identifying network attacks by intelligent semantic analysis described in this embodiment includes: S1: Obtain the operating data of the operating system and preprocess it to form a comprehensive data set; S2: Based on the comprehensive dataset, a graph structure is constructed, and the features of all adjacent nodes and edges are aggregated using the maximum pooling aggregation algorithm to generate the aggregated features of each node in the graph structure; S3: Integrate the aggregated features of all nodes into a feature vector dataset and input it into the pre-trained autoencoder to obtain the reconstructed features corresponding to each node; S4: A reconstruction error threshold is set according to the reconstruction feature, abnormal nodes are obtained according to the reconstruction error threshold, the same attack chain is obtained through abnormal node identification, and entities corresponding to all nodes in the same attack chain are regarded as a network attack behavior.

[0018] The method for forming the comprehensive data set includes: Operational data includes system logs, network traffic, and user activity records; System logs (log files generated by the operating system or application, recording events that occur during system operation) include operation logs (log files generated by the operating system (such as Linux's / var / log / syslog or Windows's event viewer)) and security logs (security logs of the operating system or application (such as Linux's / var / log / auth.log or Windows' security events)); Operation logs (used to identify user interactions with the system) include timestamps for operating system startup and shutdown and service status changes (including service startup, stop, restart, and other events); Security logs (provide information about interactions between users and files) include user login behavior (including time and results), permission changes (changes in user permissions, such as adding administrator permissions), and file access requests (access requests to sensitive files or directories); Network traffic (refers to all data packets transmitted on the network, including information such as source IP address, destination IP address, port number, protocol type, etc.) includes transport layer information (data packets captured by network sniffing tools (such as Wireshark, tcpdump)) and metadata; Transport layer information (revealing the communication pattern between IP addresses) including the status of TCP / UDP connections (referring to connection establishment, disconnection, and reset); Metadata (which reveals communication patterns between IP addresses) includes data timestamps (the time each packet arrived) and packet sizes (the size in bytes of each packet); User activity records (referring to the history of various operations performed by users on a computer or network) include command line history (such as history files of command line interpreters (such as ~ / .bash_history in Linux) or terminal session records), file operations (file system logs or audit records), and remote access records (such as log files of remote access tools such as SSH and RDP); Command line history (showing the user's operation intention) includes commands and their parameters (including all commands entered by the user and their parameters); File operations (reflecting the user's use of the file system) include file creation / modification / deletion events (including the specific time and path of these operations) and file size changes (referring to the change in the size of the created or modified file); Remote access (showing remote control behavior patterns) records include SSH sessions (including the time, source IP, and username of SSH connections) and RDP connections (including the time, source IP, and username of RDP connections); The preprocessing methods of comprehensive data sets include data cleaning, coding, data standardization, and removing noise and redundant information to form a comprehensive data set; The encoding method includes using a hash function to map each user, file, command, and IP address to a numerical feature; It should be noted that in order to effectively analyze potential attack behaviors, comprehensive and accurate data is required. Preprocessing includes data cleaning, encoding (such as hash functions) and standardization to ensure data consistency and quality, while removing noise and redundant information and reducing computing resource consumption. These data cover multi-dimensional data such as system logs, network traffic and user activity records, reducing the amount of unnecessary data and improving the speed of subsequent processing. Through encoding and standardization, it is ensured that data from different sources can be processed uniformly. Furthermore, these data are crucial to building a comprehensive security monitoring system because they provide different levels of information that can reveal various types of attack behaviors, such as: Lateral movement: After gaining an initial foothold, attackers expand laterally within the network to find more valuable targets; Data leakage: unusual data outbound activity may be the result of sensitive information being stolen and sent to an external server; Internal threat: internal personnel abuse their authority to perform unauthorized operations; The method of constructing a graph structure based on a comprehensive data set and using an improved graph neural network for message passing to generate a local graph representation of the graph structure includes: Based on the comprehensive data set, all entities in the WT period in the comprehensive data set are counted, each entity is regarded as a node, and the events or operations between entities are defined as edges. The nodes are connected through the edges to form a graph structure (by constructing such a graph structure, we can visualize the complex multi-dimensional data relationship, making the analysis of the dynamic connection between entities more intuitive and systematic); Among them, the types of entities include users, files, commands and IP addresses, and the types of edges include user-command edges (when a user executes a command, a directed edge is created from the user to the command. For example, if user 1 executes command 1, a relationship edge from user 1 to command 1 is created), user-file edges (when a user accesses or modifies a file, a directed edge is created from the user to the file), user-IP address edges (when a user connects to other IP addresses through SSH or RDP, a directed edge is created from the user to the IP address), file-IP address edges (if a file is transferred through a specific IP address, a directed edge is created from the file to the IP address), and IP address-IP address edges (when communication occurs between two IP addresses, a directed edge is created according to the direction of the data flow); Add attributes to each node and edge in the graph structure, and use the random matrix decomposition algorithm (originally used to extract potential feature patterns from complex data sets, here it is used to calculate the initial feature vector of each node based on the attributes of nodes and edges) to calculate and assign initial feature vectors to each node based on the graph structure after adding attributes (in the constructed graph structure, each node and edge is given corresponding attributes to enrich the information description of entities and their relationships. Then, based on these nodes and edges with attributes, the random matrix decomposition algorithm is used to calculate and assign initial feature vectors to each node. This step helps to use node features for more in-depth analysis or predictive modeling in the future) Based on the initial feature vector of each node, edge features are introduced, and the features of all adjacent nodes and edges are aggregated using maximum pooling. The initial feature vector of the current node is combined with the aggregated features to update and generate the aggregated features of the node (this method can not only capture the complex interaction patterns between nodes, but also effectively highlight extreme values ​​or important information, which is particularly suitable for application scenarios that need to identify significant features or abnormal behaviors); Among them, for any node, the nodes directly connected to it are regarded as adjacent nodes; The method of adding attributes to each node and edge in the graph structure includes: Adding inherent attributes to each node, wherein the inherent attributes added to user-type nodes include user unique ID, number of logins, and number of permission changes; the inherent attributes added to file-type nodes include file unique ID, file path, file size, number of accesses, and number of modifications; the inherent attributes added to command-type nodes include command unique ID, command text, number of executions, and whether it is a high-authority command; the inherent attributes added to IP address-type nodes include IP address, number of HTTP requests, number of new connections, and average packet size; Add interaction attributes to each edge, including timestamp, command execution result, file read / write mode, and network link status; It should be noted that these attributes provide basic information about nodes, reflect the specific interaction details between nodes, and enhance the information richness of the graph structure. These attributes not only help improve the accuracy of the detection model, but also provide a solid foundation for subsequent network attack detection; The method of calculating and assigning an initial feature vector to each node using a random matrix decomposition algorithm according to the graph structure after adding attributes includes: A1: Extract interaction frequency. During the WT period, count the number of events or operations that occur between the nodes at both ends of each edge in the graph structure, and use this as the interaction frequency of the edge. A2: Create an interaction frequency matrix. For each type of edge in the graph structure, classify the two different types of entities involved at both ends of the edge into sets U and C respectively, and create a matrix with a dimension of The interaction frequency matrix YA of the matrix, the position Aqw in the matrix represents the interaction frequency between the entity uq in the set U and the entity cw in the set C (in an example, the WT period of a data set contains two users and two commands and the corresponding timestamps. For convenience, the command 1 executed by user 1 at time 1 is converted into the form of [u1,c1,1]. There are a total of 4 records [u1,c1,1][u1,c2,2][u1,c1,3][u1,c2,2]. Through these 4 records, it can be determined that the entity set is the user set U={u1 ,u2}, command set C={c1,c2}, based on the records, create the interaction frequency matrix YA, during the WT period, user u1 executed command C1 twice, that is, A11=2, user u1 executed command c1 once, that is, A12=1, user u2 executed command c1 once, that is, A22=1, the final user-command matrix YA is: YA=[2,1;0,1], in this example, the matrix YA contains the interaction frequencies between all users and commands, and each position Aqw represents the number of times user uq executes command cw); Among them, U represents a type of entity set, u q represents the entities in the set U, q represents the index of the number of entities in the set U, C represents another type of entity set, c w represents an entity in set C, w represents the index of the number of entities in set C, and the set contains the unique ID or IP address of all entities of the corresponding type. represents the number of entities in the set U, represents the number of entities in the set C (in this way, we can systematically quantify the frequency of interactions between different types of entities and organize this information in a matrix form for subsequent analysis); A3: Define and construct a random matrix, set the target dimension of matrix decomposition to k, and construct a ×l random Gaussian matrix Ω, the value of each position in the matrix is ​​randomly drawn from the standard normal distribution BZ(0,1) (this matrix will be used to project the original matrix A into a lower dimensional space), where l represents a preset constant, usually set to l=k+p, and p is a positive integer (such as 1, 3, 5) used to control the dimension of the projection space; A4: Project the original matrix to a lower dimensional space, multiply the interaction frequency matrix YA by the random Gaussian matrix Ω to obtain the projection matrix YT (this operation effectively projects the original matrix YA to a lower dimensional space, i.e., l-dimensional space, thereby reducing the complexity of the data); A5: Decompose the projection matrix, perform QR decomposition on the projection matrix YT, and decompose the projection matrix YT into YT=Q×R, and get ×l-dimensional orthogonal matrix Q and l×l-dimensional upper triangular matrix R (QR decomposition is a commonly used numerical linear algebra technique that decomposes a matrix into the product of an orthogonal matrix Q and an upper triangular matrix R); A5: Extract low-dimensional feature vectors. Select the first k columns from the orthogonal matrix Q to form a new matrix Qk. (This step actually extracts the main components from Q, which represent the main information of the nodes in the original matrix YA, but compresses them into the k-dimensional space. Therefore, each column in the matrix Qk can be regarded as a low-dimensional feature vector of the corresponding node. These feature vectors retain the key features of the original data while reducing the dimension for subsequent analysis.) Compress and decompose the matrix Qk to obtain the low-dimensional feature vectors of the corresponding entity u and the corresponding entity c in the interaction frequency matrix YA, and obtain the initial feature vector of the node. The pair matrix Q k Compress and decompose to obtain low-dimensional feature vectors corresponding to entity u and entity c in the interaction frequency matrix YA. The method for obtaining the initial feature vector of the node includes: According to the matrix Q k , the matrix Q k Applied to the interaction frequency matrix YA, the intermediate matrix YB=Q is calculated k T ×YA, where YB represents the intermediate matrix, Q k T Denotes the matrix Q k The transpose of Use the singular value decomposition method to decompose the intermediate matrix YB to obtain three matrices. The decomposition formula is YB= ,in, is a k×k orthogonal matrix, is a k× A diagonal matrix of containing singular values, is a × The orthogonal matrix of By transforming the matrix Q k With the matrix Multiply them together to construct the characteristic matrix TJ of set U. Transpose to get the characteristic matrix of set C Among them, each column in the feature matrix TJ of set U represents the corresponding entity u in matrix YA q The low-dimensional feature vector of the set C; the feature matrix of the set C Each column in the matrix YA represents the corresponding entity c w The low-dimensional feature vector of The entity u q and entity c w The low-dimensional feature vector is added as a new attribute to each node to form the initial feature vector of the node; It should be noted that this method decomposes the graph structure into multiple matrices according to the edge type, in which the interaction frequency between nodes is used as the edge weight. Since the graph structure may be very large and sparse, directly using the interaction frequency as the feature vector of the node will lead to high-dimensional problems, increase computational complexity, and make it difficult to capture global patterns. By constructing matrices and reducing dimensionality, the graph structure is decomposed into several interaction frequency matrices, and the interaction frequency matrix is ​​decomposed into several smaller matrices. These matrices contain the main information of the original interaction frequency matrix, but with lower dimensions, which helps to reduce honor information and improve the generalization ability of subsequent analysis and recognition. In the singular value decomposition process, orthogonal matrices and diagonal matrices are obtained. The orthogonal matrix provides better numerical stability and ensures the independence of the eigenvectors. The diagonal matrix contains a measure of importance (i.e., singular values) to help identify which features are the most critical. The low-dimensional feature vectors finally obtained not only retain the core information of the original data, but also can effectively express the relationship between nodes and the characteristics of the nodes themselves. These feature vectors can be used as input for subsequent tasks, including classification, clustering, and anomaly detection. By using this method, instead of using the interaction frequency between nodes as the feature vector of the node, it is because this can: capture global patterns. Directly using the interaction frequency as a feature vector can only reflect local information, that is, the direct relationship between specific nodes. Through matrix decomposition, we can capture the global pattern of the entire network, including the influence of indirect connections, which helps to more accurately describe the role of the node in the entire system; reduce dimension and improve efficiency: high-dimensional data is prone to "dimensionality disaster", making calculations very expensive, and also increasing the risk of overfitting. By reducing dimensionality, we can significantly improve computational efficiency while maintaining or even improving model performance; remove noise and redundancy: real-world data often contains a lot of noise and redundant information. The matrix decomposition process itself has a certain denoising effect, which can filter out unimportant details and focus on the key features that best represent the behavior of the system; enhance interpretability: low-dimensional feature vectors are usually easier to understand and explain. They can help reveal the real structure and trends hidden behind complex data, which is crucial for data analysis and decision support; This method not only effectively extracts the main components that best represent the behaviors between entities from the original high-dimensional data (the original various operating data of the operating system) (the main components extracted by matrix decomposition and dimensionality reduction not only reflect the interaction frequency between entities, but also the periodic behavior. For example, there may be regular interaction patterns between certain entities, and it can also reflect unusual interactions between entities, which may be a sign of potential security threats or system failures), but also generates compact and representative new low-dimensional feature vectors for each entity. Therefore, when this method is applied to the analysis of operating system operation data, it is not only simplifying the data, but also mining the truly valuable information hidden behind a large amount of data - that is, the interaction frequency and other key features between entities, which are important bases for understanding and predicting system behavior, helping to simplify subsequent data analysis tasks and improve the efficiency of network attack identification); The method of updating and generating node aggregation features includes: B1: For each edge in the graph structure, add the number of interactions of the edge into the edge attribute, and use the added edge attribute as the initial feature vector of the edge; B2: For each node, collect the feature vectors of its adjacent nodes and edge feature vectors, use the maximum pooling aggregation algorithm, and introduce the linear transformation parameter matrix for the node's own features and the linear transformation parameter matrix for the maximum value of the combination of adjacent node and edge features To integrate the feature vectors of multiple adjacent nodes; Algorithm formula after introducing parameter matrix ,in, represents the feature vector of node v at the l+1th time, represents the feature vector of node v at the lth time, N(v) represents the set of adjacent nodes of node v, represents the feature vector of the adjacent node j at the lth time, represents the eigenvector of the edge (v→j), Represents the feature vector for all adjacent nodes j and edge features The sum of takes the maximum value, Represents the ReLU activation function; the parameter matrix is ​​obtained through reinforcement learning optimization and ; B3: Repeat step S2 until l reaches the preset maximum number of times, and obtain the aggregated features after the node v is updated; It should be noted that the introduction and The node v's own features and adjacent node features are linearly transformed so that the node's own features and adjacent node features can be optimized independently, which enhances the flexibility of the maximum pooling aggregation algorithm. In addition, by introducing independent linear change matrices for the node's own features and adjacent node features, the weights of the node's own features and adjacent node features can be adjusted more flexibly to enhance the expressiveness. Through the maximum pooling operation, the maximum value of the adjacent node and edge feature combination is selected to highlight extreme values ​​or important information, which helps to capture abnormal behaviors or extreme events, and is particularly suitable for scenarios where abnormal activities need to be detected. The linearly transformed node's own features are combined with the adjacent node and edge features that have been max-pooled, and a new node embedding representation is generated through the activation function, which comprehensively considers the node's own features and adjacent node features, and improves the overall expressiveness and robustness of the model. The method of obtaining the parameter matrix through reinforcement learning optimization is: C1: Define the environment, agent, strategy, state, action, and reward of reinforcement learning; the environment is defined as the graph structure itself and its features, the agent is defined as the action of updating the parameter matrix using the Actor-Critic method, the strategy is defined as the method based on policy gradient, the state is defined as the state of the current graph structure, including node features, edge features, and adjacency relationships, and the action is defined as the update of the parameter matrix and The update operation, the reward is defined as the reward function that evaluates the effect of the action; C2: Initialize hyperparameters and initialize the parameter matrix using the He initialization method and , and initialize the parameters θ and ϕ of the Actor network and Critic network in the Actor-Critic method; C3: Sample CY nodes and their adjacent nodes from the graph structure to construct the current state zt, including node features , edge features and adjacency relation N(v); Combine the collected node and edge features into a vector as the state input of the agent; C4: Use the Actor network in the Actor-Critic method according to the current policy function choose Use the Critic network to update the action dz and calculate the advantage function , where the advantage function is defined as , represents the state-action value function, represents the state value function, sjb represents the time step, sjb=0,1,2,...,SJ; C5: Update the parameter matrix according to the selected action dz and , and use the updated parameter matrix to calculate the new eigenvector of the node , use the F1 score as the reward function to calculate the current reward jl, and update the Actor network parameters θ and Critic network parameters ϕ in the Actor-Critic method; The update rule for the parameters θ of the Actor network is defined as: ,in, Representation parameters The gradient of Indicates that the current strategy Generated trajectories; The update rule of the Critic network parameters is defined as: ϕ ,in, represents the cumulative reward starting from time step t, represents the mean square error loss function; C6: Repeat B4 and B5 until the difference between the performance index in the current iteration and the performance index in the previous iteration is less than the preset iteration difference threshold or reaches the preset maximum number of updates, then stop the iteration and obtain the optimized parameter matrix and ; It should be noted that the graph structure is constructed based on the comprehensive dataset, and the maximum pooling aggregation algorithm is used to generate the aggregate features of each node to capture the relationship and contextual information between nodes; Entities are used as nodes and interactions between entities as edges to construct a graph structure that reflects the actual system state. The maximum pooling aggregation algorithm can be used to update the aggregation features of nodes while considering the influence of adjacent nodes, thereby more accurately describing the behavior patterns of nodes. It can effectively capture the complex relationships between entities, which helps to discover hidden attack chains. It considers the influence of adjacent nodes when updating the aggregate features of nodes, enhances the sensitivity to environmental changes, and allows the introduction of edge features, so that more information about interactions can be obtained. The method of integrating the feature vectors of all nodes into a feature vector dataset and inputting the pre-trained autoencoder to obtain the reconstructed features corresponding to each node includes: D1: Collect training sample sets, including pi groups of training samples. Each group of training samples contains a node's updated feature vector and the corresponding true reconstruction feature. D2: Build an autoencoder model, including an encoder part and a decoder part. The encoder part compresses the high-dimensional input data into a low-dimensional latent space representation, and the decoder part reconstructs the original input from the low-dimensional latent space representation to obtain reconstructed features. D3: Initialize the weight matrix and bias term; D4: Input the training sample set into the autoencoder model for forward propagation, including encoding and compressing the training data and decoding and reconstructing it; The forward propagation formula of the encoder is: ,in, is the low-dimensional latent space representation, r represents the number of hidden layers of the encoder, represents the local graph representation of the input, represents the weight matrix, represents the bias term, ReLU activation function. The forward pass of the decoder is: , where y represents the number of hidden layers of the decoder, represents the expansion of the dimension of the low-dimensional latent space representation to the output of the y-th layer, represents the output of the last layer of low-dimensional latent space representation, and denote the weight matrix and bias term respectively, represents a linear activation function; D5: Calculate the loss function, take the feature vector output by the last layer of the decoder as the reconstructed feature of the current output of the model, use the mean square error as the loss function, and calculate the loss value between the current reconstructed feature and the true input; D6: Back propagation, based on the loss value obtained by the loss function, the weight matrix and bias term of the encoder and decoder are adjusted by the gradient descent method; D7: Repeat the forward propagation, loss calculation and back propagation process until the preset maximum number of iterations is reached or the loss value does not change, then stop iterating; It should be noted that the autoencoder is trained to compress and reconstruct the input data, and then the threshold is set according to the reconstruction error to identify abnormal nodes; Normal behavior usually follows a certain pattern, while abnormal behavior may lead to higher reconstruction errors. By setting a reasonable threshold, normal and abnormal node behaviors can be distinguished; The autoencoder can automatically learn features from data, reducing the need for manually defined rules, can adapt to different data distributions, has good generalization ability, and can maintain high accuracy even in the face of a small number of abnormal samples through reconstruction error measurement. The reconstruction error threshold is set according to the reconstruction feature, and the abnormal node is obtained according to the reconstruction error threshold. For each training sample, the square of the Euclidean distance between the feature vector in the training sample and the corresponding reconstructed feature is calculated as the reconstruction error of the training sample; Integrate the reconstruction errors of all training samples and arrange them in ascending order to obtain the reconstruction error sequence. According to the required ratio P, calculate the corresponding index position Y= ,in Indicates rounding up; Set the reconstruction error threshold to the reconstruction error value corresponding to the Yth position in the reconstruction error sequence; Compare the reconstruction error of each node in the graph structure with the reconstruction error threshold. If the reconstruction error of the node is greater than the reconstruction error threshold, the node is determined to be an abnormal node. The method for obtaining the same attack chain by identifying abnormal nodes includes: The abnormal nodes are marked in the graph structure. For each marked abnormal node, the similarity with any other abnormal node is calculated using the cosine similarity method. Traverse the graph structure and group all abnormal nodes whose similarity is greater than the preset similarity threshold into clusters; If the number of abnormal nodes in the cluster is greater than the maximum number threshold, all abnormal nodes in the cluster are determined to be a same attack chain, and all corresponding entities are marked as a network attack behavior within the WT period; Generate early warning signals and integrate all relevant data to generate abnormal reports, which are sent to management personnel at the same time as early warning signals It should be noted that similarity algorithms (such as cosine similarity) are used to cluster abnormal nodes into clusters to further confirm the set of nodes belonging to the same attack chain; Attack behaviors often involve multiple associated abnormal nodes. By calculating the similarity between nodes and combining nodes with high similarity, the complete attack path or attack chain can be identified; Compared with analyzing a single node separately, this method can more accurately depict the entire attack process and provide all relevant entities within the attack chain, making it easier for security personnel to understand the method and purpose of the attack. Once the attack chain is identified, measures can be taken immediately for defense and remediation.

[0019] This embodiment collects system logs, network traffic and user activity records, performs data cleaning, encoding and standardization, and forms a high-quality comprehensive data set, covering various types of operation data, ensuring information integrity, improving data quality through preprocessing, and reducing noise interference; constructs a graph structure based on the comprehensive data set, defines entities (such as users, files, commands, IP addresses) as nodes, and adds attributes, uses random matrix decomposition to calculate the initial feature vector, combines edge features, and uses the maximum pooling algorithm to integrate adjacent node features, effectively captures the complex relationship and potential connection between entities, reduces redundant information, and enhances the simplicity and efficiency of the model; inputs the aggregated features into the autoencoder, optimizes the weights through forward propagation, loss calculation and back propagation, and generates reconstruction features. The autoencoder can learn the intrinsic structure of the data, efficiently compress high-dimensional data, and realize accurate anomaly detection through reconstruction error; sets a threshold according to the reconstruction error, identifies abnormal nodes, and clusters them into clusters through similarity calculation, determines them as the same attack chain, accurately identifies abnormal nodes, and further clusters them to form an attack chain, providing a deeper security analysis. This method can capture complex interaction patterns, efficiently condense key information, accurately identify abnormal behaviors and track complete attack paths, and is suitable for high-precision and high-efficiency network security analysis scenarios.

[0020] Embodiment 2 See also Figure 2 As shown, the part not described in detail in this embodiment is described in Example 1, which provides an intelligent semantic analysis and identification network attack system, including: Data acquisition module: used to obtain the operating data of the operating system and perform preprocessing to form a comprehensive data set; Feature extraction module: used to build a graph structure based on a comprehensive data set, and use the maximum pooling aggregation algorithm to aggregate the features of all adjacent nodes and edges to generate aggregate features for each node in the graph structure; Feature optimization module: used to integrate the aggregated features of all nodes into a feature vector dataset, input it into the pre-trained autoencoder, and obtain the reconstructed features corresponding to each node; Network attack identification module: Set the reconstruction error threshold according to the reconstruction features, obtain the abnormal nodes according to the reconstruction error threshold, obtain the same attack chain through abnormal node identification, and regard the entities corresponding to all nodes in the same attack chain as a network attack behavior.

[0021] Embodiment 3 This embodiment discloses an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the operation mode of the above-mentioned intelligent semantic analysis method for identifying network attacks is implemented.

[0022] Since the electronic device introduced in this embodiment is an electronic device used to implement a method for identifying network attacks through intelligent semantic analysis in the embodiment of this application, based on the method for identifying network attacks through intelligent semantic analysis introduced in the embodiment of this application, a person skilled in the art can understand the specific implementation of the electronic device of this embodiment and its various variations, so how the electronic device implements the method in the embodiment of this application will not be described in detail here. As long as a person skilled in the art implements an electronic device used by a method for identifying network attacks through intelligent semantic analysis in the embodiment of this application, it belongs to the scope of protection of this application.

[0023] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters and thresholds in the formula are set by technicians in this field according to actual conditions.

[0024] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technical users in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A method for identifying network attacks by intelligent semantic analysis, characterized in that: include: S1: Obtain the operating data of the operating system and preprocess it to form a comprehensive data set; S2: Based on the comprehensive dataset, a graph structure is constructed, and the features of all adjacent nodes and edges are aggregated using the maximum pooling aggregation algorithm to generate the aggregated features of each node in the graph structure; S3: Integrate the aggregated features of all nodes into a feature vector dataset and input it into the pre-trained autoencoder to obtain the reconstructed features corresponding to each node; S4: A reconstruction error threshold is set according to the reconstruction feature, abnormal nodes are obtained according to the reconstruction error threshold, the same attack chain is obtained through abnormal node identification, and entities corresponding to all nodes in the same attack chain are regarded as a network attack behavior.

2. According to claim 1, the method for identifying network attacks by intelligent semantic analysis is characterized in that: The method for forming the comprehensive data set includes: Operational data includes system logs, network traffic, and user activity records; System logs include operation logs and security logs; operation logs include startup and shutdown timestamps and service status changes; security logs include user login behavior, permission changes, and file access requests; Network traffic includes transport layer information and metadata; transport layer information includes the status of TCP / UDP connections; metadata includes timestamps and packet sizes; User activity records include command line history, file operations, and remote access records; command line history includes commands and their parameters; file operations include file creation / modification / deletion events and file size changes; remote access records include SSH sessions and RDP connections; The preprocessing methods of comprehensive data sets include data cleaning, coding, data standardization, and removing noise and redundant information to form a comprehensive data set; The encoding method includes using a hash function to map each user, file, command, and IP address to a numerical feature.

3. According to claim 2, a method for identifying network attacks by intelligent semantic analysis is characterized in that: The method of constructing a graph structure based on a comprehensive data set, and using a maximum pooling aggregation algorithm to aggregate features of all adjacent nodes and edges to generate aggregate features of each node in the graph structure includes: Based on the comprehensive data set, all entities in the WT period in the comprehensive data set are counted, each entity is regarded as a node, and the events or operations between entities are defined as edges, and the nodes are connected through the edges to form a graph structure; The types of entities include users, files, commands, and IP addresses, and the types of edges include user-command edges, user-file edges, user-IP address edges, file-IP address edges, and IP address-IP address edges. Add attributes to each node and edge in the graph structure, and use the random matrix decomposition algorithm to calculate and assign an initial feature vector to each node based on the graph structure after adding attributes; Based on the initial feature vector of each node, edge features are introduced, and the features of all adjacent nodes and edges are aggregated using the maximum pooling aggregation algorithm. The initial feature vector of the current node is combined with the aggregated features to update and generate the aggregated features of the node; Among them, for any node, the node directly connected to it is regarded as an adjacent node.

4. According to claim 3, the method for identifying network attacks by intelligent semantic analysis is characterized in that: The method of adding attributes to each node and edge in the graph structure includes: Adding inherent attributes to each node, wherein the inherent attributes added to the user type node include the user unique ID, number of logins, and number of permission changes; the inherent attributes added to the file type node include the file unique ID, file path, file size, number of accesses, and number of modifications; the inherent attributes added to the command type node include the command unique ID, command text, number of executions, and whether it is a high-authority command; the inherent attributes added to the IP address type node include the IP address, number of HTTP requests, number of new connections, and average packet size; Add interaction attributes to each edge, including timestamp, command execution result, file read / write mode, and network link status.

5. According to claim 4, the method for identifying network attacks by intelligent semantic analysis is characterized in that: The method of calculating and assigning an initial feature vector to each node using a random matrix decomposition algorithm according to the graph structure after adding attributes includes: A1: Extract interaction frequency. During the WT period, count the number of events or operations that occur between the nodes at both ends of each edge in the graph structure, and use this as the interaction frequency of the edge. A2: Create an interaction frequency matrix. For each type of edge in the graph structure, classify the two different types of entities involved at both ends of the edge into sets U and C respectively, and create a matrix with a dimension of The interaction frequency matrix YA, set A qw is any position in the matrix, used to represent entity u in set U q and entity c in set C w The frequency of interaction between Among them, U represents a type of entity set, u q represents an entity in set U, q represents the index of the number of entities in set U, C represents another type of entity set, c w represents an entity in set C, w represents the index of the number of entities in set C, and the set contains the unique ID or IP address of all entities of the corresponding type. represents the number of entities in the set U, Represents the number of entities in set C; A3: Define and construct a random matrix, set the target dimension of matrix decomposition to k, and construct a ×l random Gaussian matrix Ω, the value of each position in the matrix is ​​randomly drawn from the standard normal distribution BZ(0,1), where l represents a preset constant; A4: Multiply the interaction frequency matrix YA by the random Gaussian matrix Ω to obtain the projection matrix YT; A5: Perform QR decomposition on the projection matrix YT, decomposing the projection matrix YT into YT=Q×R, and obtaining ×l-dimensional orthogonal matrix Q and l×l-dimensional upper triangular matrix R; A5: Select the first k columns from the orthogonal matrix Q to form a new matrix Q k , for the matrix Q k Compress and decompose to obtain the low-dimensional feature vectors of the corresponding entity u and the corresponding entity c in the interaction frequency matrix YA, and obtain the initial feature vector of the node.

6. The method for identifying network attacks by intelligent semantic analysis according to claim 5 is characterized in that: The pair matrix Q k Compress and decompose to obtain low-dimensional feature vectors corresponding to entity u and entity c in the interaction frequency matrix YA. The method for obtaining the initial feature vector of the node includes: According to the matrix Q k , the matrix Q k Applied to the interaction frequency matrix YA, the intermediate matrix YB=Q is calculated k T ×YA, where YB represents the intermediate matrix, Q k T Denotes the matrix Q k The transpose of Use the singular value decomposition method to decompose the intermediate matrix YB to obtain three matrices. The decomposition formula is YB= ,in, is a k×k orthogonal matrix, is a k× A diagonal matrix of containing singular values, is a × The orthogonal matrix of By transforming the matrix Q k With the matrix Multiply them together to construct the characteristic matrix TJ of set U. Transpose to get the characteristic matrix of set C ; Among them, each column in the feature matrix TJ of set U represents the corresponding entity u in matrix YA q The low-dimensional feature vector of the set C; the feature matrix of the set C Each column in the matrix YA represents the corresponding entity c w The low-dimensional feature vector of The entity u q and entity c w The low-dimensional feature vector is added as a new attribute to the respective node to form the initial feature vector of the node.

7. The method for identifying network attacks by intelligent semantic analysis according to claim 6 is characterized in that: The method of updating and generating node aggregation features includes: B1: For each edge in the graph structure, add the number of interactions of the edge into the edge attribute, and use the added edge attribute as the initial feature vector of the edge; B2: For each node, collect the feature vectors of its adjacent nodes and edge feature vectors, use the maximum pooling aggregation algorithm, and introduce the linear transformation parameter matrix for the node's own features and the linear transformation parameter matrix for the maximum value of the combination of adjacent node and edge features To integrate the feature vectors of multiple adjacent nodes; Algorithm formula after introducing parameter matrix ,in, represents the feature vector of node v at the l+1th time, represents the feature vector of node v at the lth time, N(v) represents the set of adjacent nodes of node v, represents the feature vector of the adjacent node j at the lth time, represents the eigenvector of the edge (v→j), Represents the feature vector for all adjacent nodes j and edge features The sum of takes the maximum value, Represents the ReLU activation function; the parameter matrix is ​​obtained through reinforcement learning optimization and ; B3: Repeat step S2 until l reaches the preset maximum number of times, and obtain the aggregated features after the node v is updated.

8. The method for identifying network attacks by intelligent semantic analysis according to claim 7 is characterized in that: The method of obtaining the parameter matrix through reinforcement learning optimization is: C1: Define the environment, agent, strategy, state, action, and reward of reinforcement learning; the environment is defined as the graph structure itself and its features, the agent is defined as the action of updating the parameter matrix using the Actor-Critic method, the strategy is defined as the method based on policy gradient, the state is defined as the state of the current graph structure, including node features, edge features, and adjacency relationships, and the action is defined as the update of the parameter matrix and The update operation, the reward is defined as the reward function that evaluates the effect of the action; C2: Initialize hyperparameters and initialize the parameter matrix using the He initialization method and , and initialize the parameters θ and ϕ of the Actor network and Critic network in the Actor-Critic method; C3: Sample CY nodes and their adjacent nodes from the graph structure to construct the current state zt, including node features , edge features and adjacency relation N(v); Combine the collected node and edge features into a vector as the state input of the agent; C4: Use the Actor network in the Actor-Critic method according to the current policy function Select action dz, update action dz using the Critic network, and calculate the advantage function , where the advantage function is defined as , represents the state-action value function, represents the state value function, sjb represents the time step, sjb=0,1,2,...,SJ; C5: Update the parameter matrix according to the selected action dz and , and use the updated parameter matrix to calculate the new eigenvector of the node , use the F1 score as the reward function to calculate the current reward jl, and update the Actor network parameters θ and Critic network parameters ϕ in the Actor-Critic method; The update rule for the parameters θ of the Actor network is defined as: ,in, Representation parameters The gradient of Indicates that the current strategy Generated trajectories; The update rule of the Critic network parameters is defined as: ϕ ,in, represents the cumulative reward starting from time step t, represents the mean square error loss function; C6: Repeat B4 and B5 until the difference between the performance index in the current iteration and the performance index in the previous iteration is less than the preset iteration difference threshold or reaches the preset maximum number of updates, then stop the iteration and obtain the optimized parameter matrix and .

9. The method for identifying network attacks by intelligent semantic analysis according to claim 8, characterized in that: The method of integrating the aggregated features of all nodes into a feature vector dataset and inputting it into a pre-trained autoencoder to obtain the reconstructed features corresponding to each node includes: D1: Collect training sample sets, including pi groups of training samples. Each group of training samples contains a node's updated feature vector and the corresponding true reconstruction feature. D2: Build an autoencoder model, including an encoder part and a decoder part. The encoder part compresses the high-dimensional input data into a low-dimensional latent space representation, and the decoder part reconstructs the original input from the low-dimensional latent space representation to obtain reconstructed features. D3: Initialize the weight matrix and bias term; D4: Input the training sample set into the autoencoder model for forward propagation, including encoding and compressing the training data and decoding and reconstructing it; The forward propagation formula of the encoder is: ,in, is the low-dimensional latent space representation, r represents the number of hidden layers of the encoder, represents the local graph representation of the input, represents the weight matrix, represents the bias term, ReLU activation function. The forward pass of the decoder is: , where y represents the number of hidden layers of the decoder, represents the expansion of the dimension of the low-dimensional latent space representation to the output of the y-th layer, represents the output of the last layer of low-dimensional latent space representation, and denote the weight matrix and bias term respectively, represents a linear activation function; D5: Calculate the loss function, take the feature vector output by the last layer of the decoder as the reconstructed feature of the current output of the model, use the mean square error as the loss function, and calculate the loss value between the current reconstructed feature and the true input; D6: Back propagation, based on the loss value obtained by the loss function, the weight matrix and bias term of the encoder and decoder are adjusted by the gradient descent method; D7: Repeat the forward propagation, loss calculation and back propagation process until the preset maximum number of iterations is reached or the loss value no longer changes, then stop the iteration.

10. The method for identifying network attacks by intelligent semantic analysis according to claim 9, characterized in that: The method of setting a reconstruction error threshold according to the reconstruction feature, obtaining an abnormal node according to the reconstruction error threshold, and obtaining the same attack chain through abnormal node identification includes: For each training sample, the square of the Euclidean distance between the feature vector in the training sample and the corresponding reconstructed feature is calculated as the reconstruction error of the training sample; Integrate the reconstruction errors of all training samples and arrange them in ascending order to obtain the reconstruction error sequence. According to the required ratio P, calculate the corresponding index position Y= ,in Indicates rounding up; Set the reconstruction error threshold to the reconstruction error value corresponding to the Yth position in the reconstruction error sequence; Compare the reconstruction error of each node in the graph structure with the reconstruction error threshold. If the reconstruction error of the node is greater than the reconstruction error threshold, the node is determined to be an abnormal node. The abnormal nodes are marked in the graph structure. For each marked abnormal node, the similarity with any other abnormal node is calculated using the cosine similarity method. Traverse the graph structure and group all abnormal nodes whose similarity is greater than the preset similarity threshold into clusters; If the number of abnormal nodes in the cluster is greater than the maximum number threshold, all abnormal nodes in the cluster are determined to be a same attack chain, and all corresponding entities are marked as a network attack behavior within the WT period.

Images