Dynamic edge and super-node heterogeneous graph construction method and device based on large model

Abstract

The invention relates to the field of network data analysis and graph construction based on a large model, in particular to a dynamic edge and super-node heterogeneous graph construction method and device based on the large model. The method comprises the following steps: extracting a network entity and relational data from preprocessed network flow data based on a first large model; based on the second large model, extracting semantic, behavior and context features of each network entity in the current time window, and generating a feature embedding vector of each network entity; using an improved DBSCAN algorithm to perform cross-time window incremental clustering on the network entity according to the feature embedding vector to obtain super nodes and noise points in the current time window; constructing a heterogeneous graph by using the super nodes in the current time window; the semantic similarity, the time sequence correlation degree and the causal reasoning score are calculated for the super nodes in the current time window, and then the weight of the dynamic edge in the heterogeneous graph is updated. According to the method, the timeliness and the accuracy of the heterogeneous graph and the quick response capability to network attacks are improved.

Description

Technical Field

[0001] The present invention relates to the field of network data analysis and graph construction based on a large model, and in particular to a method and device for constructing a dynamic edge and super-node heterogeneous graph based on a large model. Background Art

[0002] The field of network traffic analysis and network security has made significant progress in recent years, especially in complex network behavior modeling and anomaly detection. By building a relationship model between network entities, potential threats and attack behaviors can be effectively identified, which is of great significance for ensuring network security. Currently, heterogeneous graphs are widely used in network traffic analysis as an effective data structure to represent different types of network entities and their complex relationships.

[0003] However, traditional heterogeneous graph generation methods often rely on static rules and are difficult to adapt to the dynamic changes in network traffic. In the face of increasing network data, existing technologies lack effective mechanisms to dynamically update the representation of network entities, resulting in insufficient timeliness and accuracy of heterogeneous graphs. This problem seriously affects the ability to respond quickly to dynamic events such as network attacks. Summary of the invention

[0004] In order to solve the above problems in the prior art, the present invention proposes a method and device for constructing a dynamic edge and super-node heterogeneous graph based on a large model, which improves the timeliness and accuracy of the heterogeneous graph.

[0005] In a first aspect of the present invention, a method for constructing a dynamic edge and supernode heterogeneous graph based on a large model is proposed, the method comprising: Collect network traffic data in real time and perform pre-processing; Extracting network entities and relationship data between network entities from preprocessed network traffic data based on the first model; Extract the semantic, behavioral, and contextual features of each network entity in the current time window based on the second largest model, and generate a feature embedding vector for each network entity; Using the improved DBSCAN algorithm, the network entities are incrementally clustered across time windows according to the feature embedding vectors to obtain super nodes and noise points within the current time window; Taking the super nodes in the current time window as nodes of a heterogeneous graph, constructing dynamic edges between super nodes according to the relationship data, and forming the heterogeneous graph; For the supernodes in the current time window, the semantic similarity, temporal correlation and causal reasoning score are calculated, and then the weights of the dynamic edges in the heterogeneous graph are updated; Wherein, the current time window is divided according to a preset time length.

[0006] This application adopts an improved DBSCAN algorithm, which introduces a sliding time window mechanism and performs incremental clustering. Through the above method, the time dimension limitation of the traditional static graph model is broken, the dynamic evolution tracking of network entity relationships is realized, the timeliness and accuracy of heterogeneous graphs are improved, and the network security department is helped to improve the ability to respond quickly to dynamic events such as network attacks; feature embedding vectors are generated based on semantic, behavioral and contextual features, which improves the detection accuracy of complex threats such as APT attacks compared to the single traffic feature analysis method; the super node structure generated by incremental DBSCAN clustering effectively compresses the node scale of heterogeneous graphs while ensuring the retention of key information.

[0007] Preferably, the step of "using the improved DBSCAN algorithm to perform incremental clustering of network entities across time windows according to feature embedding vectors to obtain supernodes and noise points within the current time window" includes: Adjusting DBSCAN clustering parameters according to the average distance and total number of feature embedding vectors in the current time window; If the current time window is an initial time window, the network entities in the current time window are clustered by DBSCAN according to the feature embedding vector to obtain a number of initial clusters and initial noise points, and the initial clusters and initial noise points are used as historical super nodes and historical noise points for subsequent clustering respectively; If a historical noise point has not been merged into any supernode and has not been upgraded to an independent supernode, and does not exist in the current time window, then delete the historical noise point; If the current time window is a non-initial time window, performing DBSCAN clustering on the network entities in the current time window, the historical super nodes, and the historical noise points according to the feature embedding vector to obtain the super nodes and noise points in the current time window; If a noise point in the current time window satisfies the requirement that it has existed in K time windows continuously, the noise point is upgraded to an independent supernode; wherein K is a preset value; The historical supernodes and the historical noise points are updated with the supernodes and noise points in the current time window, and the average value of the feature embedding vectors of all network entities contained in each historical supernode is calculated as the feature embedding vector of the historical supernode.

[0008] In this application, the noise points that exist continuously in K time windows are upgraded to independent super nodes, and the historical noise points that fail to survive in K time windows are deleted. This allows temporary device access on the network (such as one-time scanning tools, which usually only exist in 1-2 windows) to be filtered, while long-term hidden attackers (such as latent malicious nodes) are retained due to their continued existence.

[0009] Preferably, the step of “adjusting DBSCAN clustering parameters according to the average distance and the total number of feature embedding vectors in the current time window” comprises: In the current time window, calculating the average distance between all feature embedding vectors; Dynamically adjust the EPS value according to the average distance: ; Count the total number of feature embedding vectors in the current time window; Dynamically adjust the MinPts value based on the total number: ; in, is the neighborhood radius, is the preset coefficient, is the average distance, is the minimum number of samples, is the preset coefficient, is the total quantity stated.

[0010] This application introduces an average distance-driven EPS adjustment mechanism to make the neighborhood radius positively correlated with the current data density, effectively avoiding the problems of over-segmentation of sparse areas and under-segmentation of dense areas; dynamically adjusting the MinPts value helps to reduce the misjudgment rate of noise points.

[0011] Preferably, the step of "taking the super nodes in the current time window as nodes of a heterogeneous graph, constructing dynamic edges between super nodes according to the relationship data, and forming the heterogeneous graph" includes: For any two supernodes X and Y in the current time window, traverse the network entities contained in X and the network entities contained in Y ; If the entity With entity If there is explicit relationship data in the preprocessed network traffic data, the entity With entity Mark as a valid entity relationship pair , and establish a dynamic edge between supernodes X and Y; where ; ; Classify each of the valid entity relationship pairs into a safe connection, a suspicious connection or a data dependency relationship according to the attribute fields of the relationship data; Counting the number of the valid entity relationship pairs between the supernode X and the supernode Y by type, obtaining P1, P2 and P3; wherein P1, P2 and P3 represent the number of the secure connection, the suspicious connection and the data dependency relationship respectively; The initial weight of the dynamic edge between supernodes X and Y is calculated based on the number of valid entity-relationship pairs: ; Among them, the values ​​of α, β, and γ are determined by fitting the historical training data and satisfy the normalization condition: α + β + γ = 1.

[0012] Preferably, the step of "calculating semantic similarity, temporal association and causal reasoning score for super nodes in the current time window, and then updating the weight of the dynamic edge in the heterogeneous graph" includes: The semantic similarity between each pair of interconnected supernodes is calculated using a similarity measure; Arrange the feature embedding vectors of each supernode in all time windows in chronological order to form time series data; Calculate the time series correlation between the time series data of each pair of interconnected super nodes using a time series analysis method; Inferring the causal relationship between each pair of interconnected super nodes from the time series data using a causal discovery algorithm, and representing the causal reasoning score by the edge weight of the causal graph; For each pair of interconnected supernodes, the weight of the dynamic edge is updated according to the initial weight, the semantic similarity, the temporal association and the causal reasoning score: ; in, is the updated dynamic edge weight; is the preset weight coefficient and satisfies ,and , retaining the baseline impact of the initial weights; They are interconnected super nodes i and supernode j The initial weight, the semantic similarity, the temporal association and the causal reasoning score between them.

[0013] This application dynamically updates the weights between supernodes by combining semantic similarity, temporal correlation and causal relationships, which can more comprehensively capture the complex relationships between nodes, improve the accuracy and explanatory power of network analysis, and retain the influence of initial weights to ensure stability.

[0014] Preferably, the method further comprises: like <0.5, the dynamic edge is determined to be a weak connection and is marked as a dotted line in the heterogeneous graph; If 0.5<= <=0.8, marked as ordinary solid line; like >0.8, marked as a bold solid line and triggers anomaly detection.

[0015] This application uses the weight range of dynamic edges to visually distinguish the connection strength (dashed line, ordinary solid line, bold solid line), which can intuitively identify key connections and potential anomalies, improve the understanding of network structure and the ability to quickly respond to abnormal situations.

[0016] Preferably, after “using the improved DBSCAN algorithm to perform incremental clustering of network entities across time windows according to feature embedding vectors to obtain supernodes and noise points within the current time window”, and before “using the supernodes within the current time window as nodes of a heterogeneous graph, constructing dynamic edges between supernodes according to the relationship data to form the heterogeneous graph”, the method further includes: If the average distance of feature embedding vectors of network entities in a supernode in the current time window exceeds a preset split threshold, the supernode is split into network entities and clustered into several subclusters using the improved DBSCAN algorithm again; A new supernode is generated by each sub-cluster, and the split supernode is marked as invalid; Each new supernode inherits all dynamic edges of the split supernode and allocates weights in proportion to the number of inherited network entities; The network entities included in each pair of new super nodes are traversed, and new dynamic edges between super nodes are established according to the relationship data and assigned initial weights.

[0017] In this application, by dynamically splitting super nodes and re-clustering, the changes and distribution of network entities can be more accurately reflected, and the accuracy of clustering can be improved; at the same time, inheriting and allocating dynamic edge weights and establishing new connections ensure the continuity and consistency of heterogeneous graphs and enhance the dynamic adaptability of the network structure.

[0018] Preferably, the method further comprises: Based on the heterogeneous graph, the graph neural network and time series analysis technology are used to analyze the correlation between events in real time and identify potential attack chains and attacker groups. According to the association relationship, the attack chain and the attacker group, the community discovery and graph embedding technology are used to identify the group of closely connected super nodes in the heterogeneous graph, and the third model is combined to perform semantic analysis on the group behavior to identify the attack cluster and attack mode; According to the attack cluster and the attack chain, the fourth model is used to generate a natural language description, interpret the semantic information of the super nodes, the dynamic edges and the attack chain in the heterogeneous graph, and combine with visualization technology to generate a threat map.

[0019] By combining graph neural networks, time series analysis and semantic technology, this application can identify complex attack chains and attacker groups in real time and reveal potential threat patterns; at the same time, it generates natural language descriptions and visual threat maps, enhances the interpretability and decision-making support capabilities of threat intelligence, and facilitates efficient security protection.

[0020] According to a second aspect of the present invention, an electronic device is provided, comprising a processor and a memory, wherein the memory stores a computer program that can be loaded by the processor and execute the method described above.

[0021] According to a third aspect of the present invention, a computer-readable storage device is provided, wherein the device stores a computer program that can be loaded by a processor and execute the method described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a schematic diagram of the main steps of an embodiment of a method for constructing a dynamic edge and super-node heterogeneous graph based on a large model in the present application. DETAILED DESCRIPTION

[0023] The preferred embodiments of the present application are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present application and are not intended to limit the protection scope of the present application.

[0024] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments of the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0025] It should be noted that, in the description of the present application, the terms "first" and "second" are only for the convenience of description, and do not indicate or imply the relative importance of the devices, elements or parameters, and therefore cannot be understood as a limitation of the present application. In addition, the term "and / or" in the present application is only a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article, unless otherwise specified, generally indicates that the associated objects before and after are in an "or" relationship.

[0026] Figure 1 Schematic diagram of the main steps of the embodiment of the method for constructing a dynamic edge and supernode heterogeneous graph based on a large model in this application. Figure 1 As shown, the construction method of this embodiment includes steps A1-A7: Step A1: collect network traffic data in real time and perform preprocessing.

[0027] Preprocessing includes data cleaning (removing noise and redundant information), format standardization (unifying data format), etc.

[0028] Step A2: extracting network entities and relationship data between network entities from the preprocessed network traffic data based on the first large model.

[0029] The first model can be a rule-based engine or a machine learning model that has been trained; network entities can include devices, users, applications, IP addresses and ports, domain names and URLs, etc.; relational data such as communication connections, data flows, etc.

[0030] Step A3: Extract the semantic, behavioral and contextual features of each network entity in the current time window based on the second largest model, and generate a feature embedding vector for each network entity.

[0031] The current time window is divided according to the preset time length; the second largest model can be a deep learning model (such as Transformer or GNN) and has been trained. Semantic features include roles, functions, etc., behavioral features include access frequency, data volume, etc., and context features include time, geographic location, etc.

[0032] Step A4: Using the improved DBSCAN algorithm, perform incremental clustering of network entities across time windows according to feature embedding vectors to obtain super nodes and noise points within the current time window.

[0033] Specifically, this step may include steps A41-A46: Step A41: adjust the DBSCAN clustering parameters according to the average distance and total number of feature embedding vectors in the current time window.

[0034] Specifically, step A41 includes steps A411-A414: Step A411: Calculate the average distance between all feature embedding vectors within the current time window.

[0035] Step A412: dynamically adjust the EPS value according to the average distance, as shown in formula (1): (1) Because the average distance can reflect the distribution density of network entities in the current time window, and the eps parameter determines the neighborhood radius between data points. When the average distance is large, it means that the network entities are sparsely distributed, and the eps should be appropriately increased to expand the neighborhood range, so as to find a larger range of clusters; conversely, when the average distance is small, it means that the network entities are densely distributed, and the eps should be appropriately reduced to narrow the neighborhood range, so as to find more refined clusters.

[0036] Step A413: Count the total number of feature embedding vectors in the current time window.

[0037] Step A414: dynamically adjust the MinPts value according to the total number, as shown in formula (2): (2) in, is the neighborhood radius, a1 is the preset coefficient, is the average distance, is the minimum number of samples, a2 is the preset coefficient, is the total quantity stated.

[0038] This total number can reflect the activity level of network entities in the current time window and dynamically adjust the MinPts value, which helps reduce the misjudgment rate of noise points.

[0039] Step A42: If the current time window is the initial time window, perform DBSCAN clustering on the network entities in the current time window according to the feature embedding vector to obtain a number of initial clusters and initial noise points, and use the initial clusters and initial noise points as historical super nodes and historical noise points for subsequent clustering, respectively.

[0040] Step A43: If a historical noise point has not been merged into any supernode and has not been upgraded to an independent supernode, and does not exist in the current time window, then delete the historical noise point.

[0041] This step reduces the redundancy of historical data and ensures the effectiveness of noise point management.

[0042] Step A44: If the current time window is a non-initial time window, the network entities in the current time window are clustered with the historical super nodes and the historical noise points according to the feature embedding vector to obtain the super nodes and noise points in the current time window.

[0043] In this step, the historical supernode may absorb new network entities, and the historical noise points may be clustered into a certain supernode. During clustering, the embedding feature vector of the historical supernode takes the average of the feature embedding vectors of all the network entities it contains.

[0044] Step A45: If a noise point in the current time window satisfies the condition that it has existed in K time windows continuously, the noise point is upgraded to an independent supernode; wherein K is a preset value.

[0045] Step A46: Use the supernodes and noise points in the current time window to update the historical supernodes and historical noise points, and calculate the average value of the feature embedding vectors of all network entities contained in each historical supernode as the feature embedding vector of the historical supernode.

[0046] Step A5: Use the super nodes in the current time window as nodes of the heterogeneous graph, and construct dynamic edges between the super nodes according to the relationship data to form a heterogeneous graph.

[0047] Specifically, this step may include steps A51-A55: Step A51: For any two supernodes X and Y in the current time window, traverse the network entities contained in X and the network entities contained in Y .

[0048] Step A52: If the entity With entity If there is explicit relationship data (such as communication connection, data dependency) in the pre-processed network traffic data, the entity With entity Mark as a valid entity relationship pair , and establish a dynamic edge between supernodes X and Y; in, ; ; Display relationship data may include: communication connections (such as TCP / UDP connections, HTTP requests), data dependencies (such as database queries, file transfers), etc.

[0049] Step A53: Classify each valid entity relationship pair into a safe connection, a suspicious connection or a data dependency relationship according to the attribute fields of the relationship data.

[0050] The classification criteria may include: communication protocol (such as HTTPS is secure, unknown protocols are suspicious), access rights (such as legitimate users are secure, unauthorized users are suspicious), behavior patterns (such as high-frequency communication is suspicious, low-frequency communication is secure), etc.

[0051] A secure connection is a relationship that conforms to normal behavior patterns, such as authenticated communications and legal data access; a suspicious connection is a relationship that may have potential risks, such as communications with abnormal frequencies and unauthorized access attempts; a data dependency relationship represents the flow or dependency of data between entities, such as database queries and file read and write operations.

[0052] Step A54: Count the number of valid entity relationship pairs between supernode X and supernode Y by type to obtain P1, P2 and P3; wherein P1, P2 and P3 represent the number of secure connections, suspicious connections and data dependency relationships respectively; Step A55: Calculate the initial weight of the dynamic edge between supernodes X and Y according to the number of valid entity relationship pairs, as shown in formula (3): (3) Among them, the values ​​of α, β, and γ are determined by fitting the historical training data and meet the normalization condition: α+β+γ =1.

[0053] Step A6: For the supernodes in the current time window, the semantic similarity, temporal correlation and causal reasoning score are calculated, and then the weights of the dynamic edges in the heterogeneous graph are updated.

[0054] Specifically, this step may include steps A61-A65: Step A61: Calculate the semantic similarity between each pair of interconnected super nodes using a similarity measurement method.

[0055] Similarity measurement methods can be used, such as cosine similarity, Euclidean distance, Jaccard similarity coefficient, etc.

[0056] Step A62: Arrange the feature embedding vectors of each supernode in all time windows in chronological order to form time series data.

[0057] Step A63: Use a time series analysis method to calculate the time series correlation between the time series data of each pair of interconnected super nodes.

[0058] Time series analysis methods can include Pearson correlation coefficient, dynamic time warping (DTW), and Ranger causality test.

[0059] Step A64: Use a causal discovery algorithm to infer the causal relationship between each pair of interconnected super nodes from the time series data, and represent the causal reasoning score through the edge weight of the causal graph.

[0060] Causal discovery algorithms can include PC algorithm, LiNGAM, Granger causality test, etc.

[0061] Step A65: for each pair of interconnected supernodes, update the weight of the dynamic edge according to the initial weight, semantic similarity, temporal association and causal reasoning score, as shown in formula (4): (4) in, is the updated dynamic edge weight; is the preset weight coefficient and satisfies ,and , retaining the baseline impact of the initial weights; They are interconnected super nodes i and supernode j The initial weights, semantic similarity, temporal correlation, and causal reasoning scores of the dynamic edges between them.

[0062] Step A7: Draw the corresponding dynamic edge as a dotted line, a solid line or a thick solid line according to the updated dynamic edge weight.

[0063] Specifically as follows: like <0.5, the dynamic edge is determined to be a weak connection and is marked as a dotted line in the heterogeneous graph; If 0.5<= <=0.8, marked as ordinary solid line; like >0.8, marked as a bold solid line and triggers anomaly detection.

[0064] In an optional embodiment, after step A46 and between step A5, the method may further include: Step A47: If a super node meets the splitting condition, it is split.

[0065] Specifically, steps A471-A474 may be included: Step A471: If the average distance of the feature embedding vectors of network entities in a supernode in the current time window exceeds a preset split threshold (such as Euclidean distance>2.0), the supernode is split into network entities and re-clustered into several sub-clusters using the improved DBSCAN algorithm.

[0066] Step A472: Each sub-cluster generates a new super node, and marks the split super node as invalid.

[0067] Step A473: Each new supernode inherits all dynamic edges of the split supernode and allocates weights in proportion to the number of inherited network entities.

[0068] For example, if a supernode A is split and re-clustered into supernode A1 and supernode A2, and A1 and A2 inherit 70% and 30% of the network entities respectively, then A1 and A2 will inherit all dynamic edges of A, and the weight of each dynamic edge inherited by A1 is set to 70% of the original weight, and the weight of each dynamic edge inherited by A2 is set to 30% of the original weight. The weights assigned here will serve as the initial weights of each dynamic edge after inheritance.

[0069] Step A474: traverse the network entities included in each pair of new supernodes, establish new dynamic edges between supernodes according to the relationship data and assign initial weights.

[0070] What is inherited in the above step A473 are the dynamic edges between supernode A and other external supernodes. What is obtained in this step are the dynamic edges between several new supernodes split from A.

[0071] In another optional embodiment, after step A7, the following steps may be further included: Step A8: Analyze network attack events and potential threats based on the heterogeneous graph.

[0072] Specifically, step A8 may include steps A81-A83: Step A81: Based on heterogeneous graphs, use graph neural networks and time series analysis technology to analyze the correlation between events in real time and identify potential attack chains and attacker groups.

[0073] Step A82: Based on the association relationship, attack chain and attacker group, community discovery and graph embedding technology are used to identify the group of closely connected super nodes in the heterogeneous graph, and the third model is combined to perform semantic analysis on the group behavior to identify attack clusters and attack patterns.

[0074] Step A83: Based on the attack clusters and attack chains, the fourth model is used to generate a natural language description, interpret the semantic information of super nodes, dynamic edges, and attack chains in the heterogeneous graph, and generate a threat map in combination with visualization technology.

[0075] Although the various steps in the above embodiment are described in the above-mentioned order, those skilled in the art can understand that in order to achieve the effect of this embodiment, different steps do not have to be executed in such an order. They can be executed simultaneously (in parallel) or in a reverse order. These simple changes are within the scope of protection of the present invention.

[0076] Based on the above method embodiment, the present application also provides an embodiment of an electronic device. The electronic device of this embodiment includes a processor and a memory, and the memory stores a computer program that can be loaded by the processor and execute the above method.

[0077] Furthermore, based on the above method embodiment, the present application also provides an embodiment of a computer-readable storage device, in which the storage device of this embodiment stores a computer program that can be loaded by a processor and execute the method described above.

[0078] The computer-readable storage device may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0079] Those skilled in the art should be able to appreciate that the method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of electronic hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in electronic hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0080] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

Claims

1. A method for constructing a dynamic edge and super-node heterogeneous graph based on a large model, characterized in that: The method comprises: Collect network traffic data in real time and perform pre-processing; Extracting network entities and relationship data between network entities from preprocessed network traffic data based on the first model; Extract the semantic, behavioral, and contextual features of each network entity in the current time window based on the second largest model, and generate a feature embedding vector for each network entity; Using the improved DBSCAN algorithm, the network entities are incrementally clustered across time windows according to the feature embedding vectors to obtain super nodes and noise points within the current time window; Taking the super nodes in the current time window as nodes of a heterogeneous graph, constructing dynamic edges between super nodes according to the relationship data, and forming the heterogeneous graph; For the supernodes in the current time window, the semantic similarity, temporal correlation and causal reasoning score are calculated, and then the weights of the dynamic edges in the heterogeneous graph are updated; Wherein, the current time window is divided according to a preset time length.

2. The method for constructing a dynamic edge and supernode heterogeneous graph based on a large model according to claim 1, characterized in that: The step of "using the improved DBSCAN algorithm to perform incremental clustering of network entities across time windows according to feature embedding vectors to obtain super nodes and noise points within the current time window" includes: Adjusting DBSCAN clustering parameters according to the average distance and total number of feature embedding vectors in the current time window; If the current time window is an initial time window, the network entities in the current time window are clustered by DBSCAN according to the feature embedding vector to obtain a number of initial clusters and initial noise points, and the initial clusters and initial noise points are used as historical super nodes and historical noise points for subsequent clustering respectively; If a historical noise point has not been merged into any supernode and has not been upgraded to an independent supernode, and does not exist in the current time window, then delete the historical noise point; If the current time window is a non-initial time window, performing DBSCAN clustering on the network entities in the current time window, the historical super nodes, and the historical noise points according to the feature embedding vector to obtain the super nodes and noise points in the current time window; If a noise point in the current time window satisfies the requirement that it has existed in K time windows continuously, the noise point is upgraded to an independent supernode; wherein K is a preset value; The historical supernodes and the historical noise points are updated with the supernodes and noise points in the current time window, and the average value of the feature embedding vectors of all network entities contained in each historical supernode is calculated as the feature embedding vector of the historical supernode.

3. The method for constructing a dynamic edge and supernode heterogeneous graph based on a large model according to claim 2, characterized in that: The step of "adjusting DBSCAN clustering parameters according to the average distance and total number of feature embedding vectors in the current time window" includes: In the current time window, calculating the average distance between all feature embedding vectors; Dynamically adjust the EPS value according to the average distance: ； Count the total number of feature embedding vectors in the current time window; Dynamically adjust the MinPts value based on the total number: ； in, is the neighborhood radius, is the preset coefficient, is the average distance, is the minimum number of samples, is the preset coefficient, is the total quantity stated.

4. The method for constructing a dynamic edge and supernode heterogeneous graph based on a large model according to claim 1, characterized in that: The step of "taking the super nodes in the current time window as nodes of the heterogeneous graph, constructing dynamic edges between the super nodes according to the relationship data, and forming the heterogeneous graph" includes: For any two supernodes X and Y in the current time window, traverse the network entities contained in X and the network entities contained in Y ; If the entity With entity If there is explicit relationship data in the preprocessed network traffic data, the entity With entity Mark as a valid entity relationship pair , and establish a dynamic edge between supernodes X and Y; where ; ; Classify each of the valid entity relationship pairs into a safe connection, a suspicious connection or a data dependency relationship according to the attribute fields of the relationship data; Counting the number of the valid entity relationship pairs between the supernode X and the supernode Y by type, obtaining P1, P2 and P3; wherein P1, P2 and P3 represent the number of the secure connection, the suspicious connection and the data dependency relationship respectively; The initial weight of the dynamic edge between supernodes X and Y is calculated based on the number of valid entity-relationship pairs: ； Among them, the values ​​of α, β, and γ are determined by fitting the historical training data and meet the normalization condition: α + β + γ =1.

5. The method for constructing a dynamic edge and supernode heterogeneous graph based on a large model according to claim 4, characterized in that: The step of "calculating semantic similarity, temporal association and causal reasoning score for the super nodes in the current time window, and then updating the weight of the dynamic edge in the heterogeneous graph" includes: The semantic similarity between each pair of interconnected supernodes is calculated using a similarity measure; Arrange the feature embedding vectors of each supernode in all time windows in chronological order to form time series data; Calculate the time series correlation between the time series data of each pair of interconnected super nodes using a time series analysis method; Inferring the causal relationship between each pair of interconnected super nodes from the time series data using a causal discovery algorithm, and representing the causal reasoning score by the edge weight of the causal graph; For each pair of interconnected supernodes, the weight of the dynamic edge is updated according to the initial weight, the semantic similarity, the temporal association and the causal reasoning score: ； in, is the updated dynamic edge weight; is the preset weight coefficient and satisfies ,and , retaining the baseline impact of the initial weights; They are interconnected super nodes i and supernode j The initial weight, the semantic similarity, the temporal correlation and the causal reasoning score of the dynamic edge between them.

6. The method for constructing a dynamic edge and supernode heterogeneous graph based on a large model according to claim 5, characterized in that: The method further comprises: like < 0.5, the dynamic edge is determined to be a weak connection and is marked as a dotted line in the heterogeneous graph; If 0.5 <= < =0.8, marked as solid line; like > 0.8, marked as a bold solid line and triggers anomaly detection.

7. The method for constructing a dynamic edge and supernode heterogeneous graph based on a large model according to claim 1, characterized in that: After "using the improved DBSCAN algorithm to perform incremental clustering of network entities across time windows according to feature embedding vectors to obtain supernodes and noise points within the current time window", and before "using the supernodes within the current time window as nodes of a heterogeneous graph, constructing dynamic edges between supernodes according to the relationship data to form the heterogeneous graph", the method further includes: If the average distance of feature embedding vectors of network entities in a supernode in the current time window exceeds a preset split threshold, the supernode is split into network entities and clustered into several subclusters using the improved DBSCAN algorithm again; A new supernode is generated by each sub-cluster, and the split supernode is marked as invalid; Each new supernode inherits all dynamic edges of the split supernode and allocates weights in proportion to the number of inherited network entities; The network entities included in each pair of new super nodes are traversed, and new dynamic edges between super nodes are established according to the relationship data and assigned initial weights.

8. The method for constructing a dynamic edge and supernode heterogeneous graph based on a large model according to claim 1, characterized in that: The method further comprises: Based on the heterogeneous graph, the graph neural network and time series analysis technology are used to analyze the correlation between events in real time and identify potential attack chains and attacker groups. According to the association relationship, the attack chain and the attacker group, the community discovery and graph embedding technology are used to identify the group of closely connected super nodes in the heterogeneous graph, and the third model is combined to perform semantic analysis on the group behavior to identify the attack cluster and attack mode; According to the attack cluster and the attack chain, the fourth model is used to generate a natural language description, interpret the semantic information of the super nodes, the dynamic edges and the attack chain in the heterogeneous graph, and combine with visualization technology to generate a threat map.

9. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program that can be loaded by the processor and execute the method according to any one of claims 1 to 8.

10. A computer-readable storage device, characterized in that: A computer program is stored which can be loaded by a processor and execute the method according to any one of claims 1 to 8.

Images