An APT abnormal behavior detection method based on multi-dimensional feature fusion

Abstract

The application belongs to the technical field of network security, and discloses an APT abnormal behavior detection method based on multi-dimensional feature fusion. A system operation log collected is used to construct a traceability graph, and system call sequence information is separated from the collected data. Point embedding of the traceability graph and sequence embedding of function calls are respectively calculated, and the two feature embeddings are fused. An abnormal behavior is found through a detection model based on the fused features, so that the generalization ability of the abnormal detection model is significantly improved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to an APT abnormal behavior detection method based on multi-dimensional feature fusion, which effectively improves the generalization ability of an abnormal detection model. BACKGROUND

[0002] At present, abnormal detection technology has become a key research field for guaranteeing information system security. Traditional abnormal detection methods, such as rule-based and statistical methods, have obvious deficiencies. Rule-based detection relies on predefined rules or signature libraries, and can only identify known attack patterns, and is difficult to adapt to changing network conditions and attack means. Statistical-based detection can discover unknown abnormalities, but has limited modeling capability for complex system behavior, and is prone to high false positive rates when the system fluctuates normally.

[0003] Machine learning technology is increasingly widely used in abnormal detection, and data feature representation is particularly important. A provenance graph has emerged in network security analysis, which records data sources and transmission paths from a macro perspective by representing system entities and causal relationships through nodes and edges, and can be used for abnormal detection to mine potential abnormal transmission paths. However, detection based only on the provenance graph focuses on node connections and topological structures, and is insufficient in mining details such as node internal process execution logic.

[0004] A function call tree depicts process behavior from a micro perspective, and function calls in sequence and hierarchy form a call tree when a process is executed, which can reflect process logic structure, functional module call relationship and data transmission process. Extracting its features can discover abnormal function call patterns, such as sequence abnormalities or illegal calls. However, relying only on function call tree features to detect abnormalities will ignore system-level data interaction relationships, making it difficult to comprehensively assess system security status.

[0005] In summary, in the field of abnormal detection, neither traditional methods nor machine learning methods based on a single type of feature (such as only provenance graphs or only function call trees) can meet the needs of complex information systems for high-precision and high-generalization-capability abnormal detection. SUMMARY

[0006] The purpose of the present application is to provide an APT abnormal behavior detection method based on multi-dimensional feature fusion, which uses collected system operation logs to construct a provenance graph, separates system call sequence information from the collected data, calculates point embedding of the provenance graph and sequence embedding of function calls respectively, and fuses the two feature embeddings, to perform abnormal behavior discovery through a detection model based on the fused features, thereby significantly improving the generalization ability of the abnormal detection model and improving the abnormal behavior detection precision.

[0007] To achieve the above purpose, the technical solution adopted by the present application is as follows:

[0008] An APT abnormal behavior detection method based on multi-dimensional feature fusion, comprising:

[0009] Collecting system kernel log data, constructing a trace graph according to the system kernel log data, and extracting function call sequence information from the system kernel log data;

[0010] Using an adaptive neighborhood sampling method to sample a neighborhood subgraph of a process node from the trace graph;

[0011] According to the triplets in the neighborhood subgraph, a description sentence with semantics is constructed, and the semantic attribute embedding of the process node is obtained by feature extraction on the description sentence;

[0012] The neighborhood subgraph and semantic attribute embedding of the process node are input into a graph neural network to obtain the structural information embedding of the process node output by the graph neural network, and the semantic attribute embedding and the structural information embedding are combined as the semantic structure feature vector of the process node;

[0013] Based on the extracted function call sequence information, a call tree of the process node is constructed, the vertex labels of the call tree are iteratively generated to generate all sub-trees of the call tree, the execution time of the root node of the sub-tree is set as the weight of the sub-tree, and a sub-tree set is obtained, the sub-tree set contains all sub-trees and the weights of the sub-trees, and the call tree feature vector of the process node is obtained by feature extraction on the sub-tree set;

[0014] Using a multi-dimensional feature fusion method based on attention, multi-dimensional fusion features are obtained according to the semantic structure feature vector and the call tree feature vector of the same process node, and a classifier is used to output APT abnormal behavior detection results according to the multi-dimensional fusion features.

[0015] The following also provides several optional modes, but not as an additional limitation of the above overall scheme, just a further supplement or preferred, without technical or logical contradiction, each optional mode can be combined with the above overall scheme, and can also be combined between multiple optional modes.

[0016] As a preferred, the neighborhood subgraph of the process node is sampled from the trace graph using an adaptive neighborhood sampling method, comprising:

[0017] The behavior density index of the node is calculated:

[0018]

[0019] In the formula, D(v) represents the behavior density index of node v, E v is the number of outgoing edges of node v, represents the average number of outgoing edges of the adjacent nodes of node v;

[0020] If D(v) ≥ θ, node v is considered to be a behavior-dense point, and a breadth-first search strategy is used to sample the neighborhood of node v. If D(v) < θ, node v is considered to be a behavior-sparse point, and a depth-first search strategy is used to sample the neighborhood of node v, where θ is the density threshold.

[0021] Preferably, the step of constructing a semantically descriptive statement based on the triples in the neighborhood subgraph and extracting features from the description statement to obtain semantic attribute embedding of the process node includes:

[0022] Take the triple in the neighborhood subgraph as <source node, event, target node>;

[0023] Combine the source node attributes, event type, and target node attributes in a triple into a semantic sentence;

[0024] Sort the sentences corresponding to all triples of process nodes containing the features to be extracted in the neighborhood subgraph according to the timestamps of the events to obtain semantically descriptive sentences;

[0025] The word2vec model trained on benign system kernel log data is used to encode the description sentences and obtain the semantic attribute embedding of the process node.

[0026] Preferably, the iterative call tree node labels generate all subtrees of the call tree, including:

[0027] Initial label assignment: Assign an initial label to each vertex in the call tree. The initial label is the function call name represented by the vertex.

[0028] Label expansion: In each iteration, for each vertex, the label of each vertex is appended with the label of its child vertices to form a signature structure;

[0029] Tag compression: After tag expansion is completed, a virtual new tag is used to represent the signature structure;

[0030] Termination condition: If the current number of iterations reaches the set maximum number of iterations, the iteration ends and a label is used as a subtree; otherwise, the iteration continues to perform label expansion and label compression. The maximum number of iterations is set to d-1 times according to the maximum depth d of the call tree.

[0031] Preferably, setting the execution time of the subtree root node as the weight of the subtree includes:

[0032] Determine the timestamp of the system call corresponding to the leaf node of the call tree;

[0033] Calculate the relative time interval between two adjacent timestamps and set the relative time interval as the weight of the leaf node;

[0034] For non-leaf nodes, the sum of the weights of all child nodes of the non-leaf node is used as the weight of the non-leaf node;

[0035] Therefore, the weights of all nodes in all subtrees in the call tree are obtained, and the weight of the root node of the subtree is set as the weight of the subtree.

[0036] Preferably, the multi-dimensional feature fusion method based on attention is used to obtain the multi-dimensional fusion feature according to the semantic structure feature vector and the call tree feature vector of the same process node, including:

[0037] Multi-dimensional feature extraction: semantic structure feature vector E of process node v And the call tree feature vector E of the process node t , perform convolution operation through n convolution kernels of different sizes to obtain the semantic structure feature vector E v and the call tree feature vector E t Feature information F under different convolution kernels vj and F tj , j=1,2,…,n;

[0038] Attention mechanism calculation: Use average pooling operation to process feature information F vj and F tj , get the fixed length feature vector G vj and G tj , and then the attention score A is obtained through the full connection layer mapping vj and A tj ;

[0039] Multi-dimensional feature fusion: using attention score A vj For feature information F vj Perform weighted fusion to obtain semantic structure fusion features Using attention score A tj For feature information F tj Perform weighted fusion to obtain semantic structure fusion features Finally, we get the multi-dimensional fusion features

[0040] The application provides an APT abnormal behavior detection method based on multi-dimensional feature fusion, and has the following beneficial effects compared with the prior art: 1, the traceability graph node features are combined with the process function call tree features, which not only covers the traceability correlation information between entities in the system, but also contains the logical details of the process internal function calls. 2, the fused features can mine the complex interaction behavior patterns between system processes based on traceability relationship and function call logic, breaking through the limitations of the prior art of analyzing only from a single behavior level (such as only traceability or only function call). 3, the model constructed by virtue of multi-dimensional feature fusion and deep behavior analysis has stronger adaptability and generalization ability, and has higher detection accuracy. BRIEF DESCRIPTION OF DRAWINGS

[0041] Figure 1 A flowchart of the APT abnormal behavior detection method based on multi-dimensional feature fusion of the application;

[0042] Figure 2 A description sentence construction process schematic diagram of the application;

[0043] Figure 3 A call tree iteration to obtain a subtree schematic diagram of the application;

[0044] Figure 4 A subtree weight calculation schematic diagram of the application. DETAILED DESCRIPTION

[0045] The technical solutions in the embodiments of the application will be clearly and completely described below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, not all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the application.

[0046] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the application belongs. The terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the application.

[0047] In order to effectively improve the performance of the abnormal detection model, the traceability graph node features are combined with the process function call tree features in the application, the advantages of the two in describing system behavior at different levels are fully utilized through feature fusion technology, the model can learn system normal and abnormal behavior patterns more comprehensively and accurately, so as to improve the detection ability and generalization ability of unknown abnormalities, and better cope with complex and variable network security threats.

[0048] As Figure 1As shown, the embodiment provides an APT abnormal behavior detection method based on multi-dimensional feature fusion, including the following steps:

[0049] (1) Collect system kernel log data, construct a trace graph according to the system kernel log data, and extract function call sequence information from the system kernel log data.

[0050] (1-1) System running data collection. Use the published log collection tool to collect system kernel log data (such as the log collection tool disclosed in Patent No. 2022110610516), comprehensively capture the operation in the running process, including function call sequence, process creation and termination, file read-write access, network connection establishment and disconnection, etc.

[0051] (1-2) Construct a trace graph. Analyze and compress the collected system kernel log data, identify processes, files, network connections, etc. as nodes of the trace graph, and construct directed edges according to the operation causal relationship between them. At the same time, rich attribute information is attached to each node and edge, such as the type identification of the node, the timestamp of the operation, the event type of the edge, etc. A complete and information-rich compact trace graph is constructed through compression rules. The compression operation is as follows: 1. Merge repeated events: only one edge of the same type of event between nodes is calculated; 2. Delete low-priority events: delete low-priority events that do not affect behavior analysis, such as deleting file registry opening, closing file cache cleaning, etc. (where low-priority events can be pre-set through black and white lists).

[0052] (1-3) Function call sequence information extraction. From the collected system kernel log data, filter out the function call sequence information. For example, in the Windows system, the stackinfo log data of the tool ETW (Event Tracing for Windows) can be used to restore the callstack (call stack). The extracted function call sequence is stored in a special sequence database, and the process id is used as the identification of the function call sequence of the process.

[0053] (2) Node feature extraction: For the process nodes of the trace graph, first sample the node subgraph using the set neighborhood sampling strategy, and then calculate the node features to form a feature vector.

[0054] (2-1) Adaptively select a subgraph sampling strategy based on the sparsity of the neighborhood behavior of the node in the traceability graph, and use the adaptive neighborhood sampling method to sample the neighborhood subgraph of the process node from the traceability graph: Design adaptive neighborhood sampling to sample the neighborhood subgraph of the node to be detected from the traceability graph. Adaptive specifically refers to selecting different subgraph sampling strategies based on whether the node neighborhood behavior is sparse. In order to determine whether the behavior of the node in the traceability graph is dense or sparse, a behavior density index D(v) is introduced for evaluation. The behavior density index formula of node v is as follows:

[0055]

[0056] Where D(v) represents the behavior density index of node v, E v is the number of outgoing edges of node v, Represents the average number of outgoing edges from neighboring nodes of node v. If D(v) ≥ θ, the node is considered to be a dense node, and a breadth-first search strategy is used for neighborhood sampling (setting the number of sampling layers, for example, 3 based on experience). If D(v) < θ, the node is considered to be a sparse node, and a depth-first search strategy is used for neighborhood sampling (setting the sampling depth, for example, 5 based on experience), where θ is the preset density threshold.

[0057] For example, in a file server's provenance graph, a core process node that frequently handles a large number of file read and write requests has a large number of read and write operation edges with multiple file nodes, while the average number of outgoing edges of its adjacent auxiliary process nodes is relatively small. The D(v) of this core process node is greater than the threshold, making it a behavior-intensive node. On the other hand, a background process node that occasionally performs system update checks has only a small number of interaction edges with network connection nodes, system configuration file nodes, etc., and the calculated D(v) is less than the threshold, making it a behavior-sparse node.

[0058] (2-2) Embed the node attributes through the learning model to obtain the feature vector of the node attribute dimension: Based on the neighborhood subgraph of the node v to be calculated obtained by sampling in step (2-1), encode the attributes of each node, and finally form a feature matrix composed of feature vectors. The representation is obtained through the learning model, and finally the semantic attribute features of the node and the graph structure features are combined as the semantic attribute of the node to be embedded E v The main process is as follows:

[0059] (2-2-1) Construct a semantically descriptive statement using node attributes and generate an embedded representation vector: Different node types have different attributes, including the process name and command line arguments for process nodes, the file path for file nodes, and the network IP address and port for socket nodes. By combining the semantic attributes of nodes, such as process name and command line arguments, with the event types between nodes and their one-hop neighbors, a sentence describing the node can be constructed. Events are then sorted according to their timestamps to maintain temporal order, resulting in a semantically descriptive statement.

[0060] For ease of understanding, this embodiment explains the formation of a description statement from the perspective of triples as follows: take the triple in the neighborhood subgraph as <source node, event, target node>; combine the attributes of the source node, the type of event, and the attributes of the target node in a triple into a semantic sentence; sort the sentences corresponding to all triples of the process nodes in the neighborhood subgraph that contain the features to be extracted according to the timestamp of the event to obtain a semantic description statement.

[0061] Then, the word2vec model trained on benign system kernel log data is used to encode the description sentences and encode the sentences into fixed-length vectors, thereby converting the semantic attributes of the nodes into low-dimensional dense vector representations and obtaining the semantic attribute embeddings of the process nodes.

[0062] For a process of describing the construction of a statement, specifically Figure 2 As shown, Figure 2 (a) is part of a traceability graph. Rectangles are process nodes, ovals are file nodes, and diamonds are networks. The edges are <event, timestamp>, and the timestamps are in the order of t1, t2, ..., t7. Taking process node P1 as an example, we can get a sentence with semantic meaning, such as Figure 2 As shown in (b), all sentences are sorted according to the timestamps as shown in Figure 2 (c), and the description statement of process node P1 is finally obtained as follows Figure 2 As shown in (d), P0 starts P1, P1 writes F1, P1 starts P2, P1 sends S1, and P1 writes F2.

[0063] (2-2-2) Use the trained machine learning model to obtain the structural feature vector of the node. Specifically, the neighborhood subgraph and semantic attributes of the process node are embedded into the input graph neural network to obtain the structural information embedding of the process node output by the graph neural network. This embodiment uses a semi-supervised node classification method to train a GNN (Graph Neural Network) model (such as the GraphSage model), and uses the semantic attribute embedding obtained in (2-2-1) and the node v sampling domain subgraph in step (2-1) as structural information input to obtain the multi-dimensional feature vector of the node as the structural information embedding.

[0064] Then the semantic attribute embedding of step (2-2-1) and the structural information embedding of step (2-2-2) are combined (such as splicing) as the semantic structure feature vector E of the process node v .

[0065] (3) Function call embedding calculation. Based on the function call sequence information extracted in step (1), a call tree of the corresponding process node is constructed in units of processes. The vertex labels of the call tree are iterated to generate all subtrees of the call tree. The execution time of the root node of the subtree is set as the weight of this subtree, thereby obtaining a subtree set of the call tree. The subtree set contains all subtrees and the weights of the subtrees. The subtree set embedding is learned using the model to generate the call tree feature vector of the process node.

[0066] (3-1) Constructing a function call tree: Based on the function call sequence information extracted in step (1), a call tree is constructed for each process node as an independent unit. With process startup as the root node, when the system executes a function call, the corresponding node is added to the call tree, and the parent-child node relationship is constructed based on the execution order and nested relationship.

[0067] (3-2) Iterate vertex labels: Use the improved graph core algorithm to generate all subtrees of the call tree in step (3-1). The main process of the improved graph core algorithm is as follows:

[0068] (3-2-1) Initial label assignment: Assign an initial label to each vertex in the call tree, that is, the name of the function call represented by the vertex. For example, if the vertex represents system call A, then its initial label is set to A.

[0069] (3-2-2) Label expansion: In each iteration, for each vertex, its label is appended with the labels of its children to form a signature structure. Suppose vertex v has children v1 (labeled B) and v2 (labeled C), then the signature structure of vertex v is (A, BC), which explores the relationship structure between the vertex and its children.

[0070] (3-2-3) Label Compression: After label expansion, the newly generated virtual labels are compressed and used to represent specific signature structures. If multiple vertices have the same signature structure, they are assigned a unified new label to reduce data redundancy and facilitate subsequent subtree structure identification and processing.

[0071] (3-2-4) Termination condition: If the current number of iterations reaches the set maximum number of iterations, the iteration ends and a label is used as a subtree; otherwise, the iteration continues to perform label expansion and label compression. The maximum number of iterations is set to d-1 times according to the maximum depth d of the call tree.

[0072] This embodiment provides an iterative specific process such as Figure 3 As shown, Figure 3 (a) in the figure is assigned an initial label. For example, if the root function is A, its label is A. Figure 3 The call tree depth is 3, and the maximum number of iterations is 2; take the node labeled A as an example to iterate the vertex label for the first time, label A is first expanded, and the labels of the child nodes are B, C and D respectively. Then the signature structure of label A after expansion exploration is (A, BCD). In order to facilitate subsequent processing, label compression is set to set label H to be equivalent to the signature structure (A, BCD), that is, H = (A, BCD), H is also Figure 3 The rectangle represents, Figure 3 (b) in the figure is the result of the first iteration; similarly, the result of the second iteration can be obtained, that is, Figure 3 As shown in (c), the new tags H, I, J, K, L and M are finally expanded and proposed, and their equivalent signature structures are H = (A, BCD), I = (B, D), J = (C, E), K = (D, FG), L = (H, IJK) and M = (I, K), respectively.

[0073] (3-3) The extracted subtrees are treated as text, and the subtree execution time as the weight, thus obtaining a set of call subtrees. To encode time information, the process runtime represented by the subtree root node is used as the subtree weight. Due to the inability to obtain the exact function runtime, the relative runtime of the timestamp is used to represent the runtime of the process represented by the subtree root node. The leaf nodes of the call tree T are system calls. A fixed base time unit is set (based on preliminary analysis of system behavior, the equivalent time unit can be assumed to be 1 millisecond). The timestamp of each system call is recorded. By calculating the relative time interval between two adjacent timestamps, if the last system call has appeared before, it is set to the existing time unit. If it appears for the first time, the relative time interval is the base time unit. Therefore, the weight of the leaf node is the relative time interval. The weight of the non-leaf node is the sum of the weights of its child nodes. Therefore, the weight of each node in all subtrees in the call tree is obtained, and the weight of the subtree root node is set as the weight of the subtree.

[0074] All subtrees generated by the iterative marking of the call tree T in step (3-2) are added to the set S. The weight of a subtree is the weight of its root node. Finally, the same subtrees are aggregated and their weights are added together. Different subtrees are saved to form the final subtree set.

[0075] This embodiment provides a specific process of generating a subtree set. Figure 4 As shown, after step (3-2), the call tree obtains the subtree set S = {A, B, C, D, D, F, G, E, F, G, H, I, J, K, L, M}. After merging the same subtrees, the updated subtree set is S = {A, B, C, D, E, F, G, H, I, J, K, L, M}, where F, G, E, F, G are system calls, and their occurrence timestamps are t1, t2, t3, t4, and t5 respectively. The weights obtained by the timestamp difference are 10, 5, 15, 10, and 5 respectively. We can get the following: Figure 4 (a) shows the initialization of node weights. For the system call corresponding to timestamp t1, since there is no relative time interval, its execution time is first set as the basic time unit. Then, after the relative time interval is calculated for the system call at time t4, it is synchronously updated to the corresponding relative time interval.

[0076] like Figure 4 As shown in (b), after step (3-2) and merging the same subtrees, the subtree set obtained can obtain its corresponding weights. The weights of the same subtrees are added and merged, and finally the subtree set {A, B, C, D, F, G, E, H, I, J, K, L, M} is obtained, and its corresponding weights are {15, 10, 15, 20, 20, 10, 15, 45, 15, 15, 15, 45, 15}.

[0077] (3-4) Call tree feature vector generation: Using the call subtree set obtained in step (3-3) above as input data, a general model is trained using a natural language processing model (such as doc2vec) to obtain the call tree feature vector E. t .

[0078] (4) Anomaly detection based on feature fusion: By combining the semantic structure feature vector E obtained in step (2) v And the call tree feature vector E for the process node obtained in step (3) t , the fusion feature E is obtained by using the multi-dimensional feature fusion method based on attention guidance f , and use common patterns to build anomaly detection models for detection.

[0079] (4-1) Multi-dimensional feature extraction: For the semantic structure feature vector E of the process node vAnd the call tree feature vector E of the process node t , perform convolution operation through n convolution kernels of different sizes to obtain the semantic structure feature vector E v and the call tree feature vector E t Feature information F under different convolution kernels vj and F tj , j = 1, 2, ..., n. Assuming that this embodiment uses two convolution kernels, that is, n = 2, the specific formula is as follows:

[0080]

[0081] Among them, s vj It is E v The convolution kernel size, n vj is the number of convolution kernels, and the feature F can be obtained v1 and F v2 Similarly, the call tree is convolved to obtain the feature F t1 and F t2 For example, the convolution kernel dimensions are set to 3 and 5, and the number is set to 16 and 32 respectively.

[0082] (4-2) Attention mechanism calculation: Use average pooling operation to process feature information F vj and F tj , get the fixed length feature vector G vj and G tj , and then the attention score A is obtained through the full connection layer mapping vj and A tj The specific formula of this embodiment is as follows:

[0083] G vj =GAP(F vj )(j=1,2)

[0084] G tj =GAP(F vj )(j=1,2)

[0085] A vj =softmax(W v2 (ReLU(W v1 G vj +b v1 ))+b v2 )(j=1,2)

[0086] A tj =softmax(W t2 (ReLU(W t1 G tj +b t1 ))+b t2 )(j=1,2)

[0087] Where GAP represents the global average pooling operation, ReLU is the activation function, and softmax is the softmax function. v The features of the fully connected layer are W v1 and W v2 , the bias term is b v1 and b v2 , the sum of the attention weights of each scale feature is 1. t The features of the fully connected layer are W t1 and W t2 , the bias term is b t1 and b t2 , the sum of the attention weights of each scale feature is 1.

[0088] (4-3) Multi-dimensional feature fusion: using attention score A vj For feature information F vj Perform weighted fusion to obtain semantic structure fusion features Using attention score A tj For feature information F tj Perform weighted fusion to obtain semantic structure fusion features Finally, we get the multi-dimensional fusion features The specific formula of this embodiment is as follows:

[0089]

[0090] where € represents element-wise multiplication.

[0091] (4-4) Use the classifier to build an anomaly detection model: f As feature vectors, common classifiers, such as support vector machine (SVM) and K nearest neighbor (KNN) models, are used to train anomaly detection models on benign system kernel log data, and the anomaly detection model is used to target the multi-dimensional fusion feature E f Output APT abnormal behavior detection results.

[0092] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0093] The above-described embodiments merely illustrate several implementations of the present invention, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that a person skilled in the art would be able to make numerous modifications and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be determined by the appended claims.

Claims

1. A method for detecting APT abnormal behavior based on multi-dimensional feature fusion, characterized in that: The APT abnormal behavior detection method based on multi-dimensional feature fusion includes: Collect system kernel log data, build a traceability graph based on the system kernel log data, and extract function call sequence information from the system kernel log data; Adopting the adaptive neighborhood sampling method to sample the neighborhood subgraph of the process node from the provenance graph; Construct a semantic description statement based on the triples in the neighborhood subgraph, and extract features from the description statement to obtain the semantic attribute embedding of the process node; The neighborhood subgraph and semantic attributes of the process node are embedded into the input graph neural network to obtain the structural information embedding of the process node output by the graph neural network. The semantic attribute embedding and structural information embedding are combined as the semantic structure feature vector of the process node. Based on the extracted function call sequence information, a call tree of the process node is constructed in units of processes. The vertex labels of the call tree are iterated to generate all subtrees of the call tree. The execution time of the subtree root node is set as the weight of the subtree to obtain a subtree set. The subtree set contains all subtrees and their weights. Feature extraction is performed on the subtree set to obtain the call tree feature vector of the process node. Using the attention-based multi-dimensional feature fusion method, multi-dimensional fusion features are obtained according to the semantic structure feature vector and call tree feature vector of the same process node. A classifier is used to output APT abnormal behavior detection results based on the multi-dimensional fusion features.

2. The APT abnormal behavior detection method based on multi-dimensional feature fusion according to claim 1 is characterized in that: The method of obtaining a neighborhood subgraph of a process node by sampling from a traceability graph using an adaptive neighborhood sampling method includes: Calculate the behavior density index of the node: ； Where, Representation node The behavioral density index, For nodes The number of outgoing edges, Representation node The average number of outgoing edges of adjacent nodes; like , then the node is considered It is a behavior-intensive point, and the breadth-first search strategy is used to search for nodes. Neighborhood sampling; if , then the node is considered It is a sparse behavior point, and the depth-first search strategy is used to search for nodes. Neighborhood sampling of is the density threshold.

3. The APT abnormal behavior detection method based on multi-dimensional feature fusion according to claim 1 is characterized in that: The step of constructing a semantically descriptive statement based on the triples in the neighborhood subgraph and extracting features from the description statement to obtain semantic attribute embedding of the process node includes: Take the triple in the neighborhood subgraph as <source node, event, target node>; Combine the source node attributes, event type, and target node attributes in a triple into a semantic sentence; Sort the sentences corresponding to all triples of process nodes containing the features to be extracted in the neighborhood subgraph according to the timestamps of the events to obtain semantically descriptive sentences; The word2vec model trained on benign system kernel log data is used to encode the description sentences and obtain the semantic attribute embedding of the process node.

4. The APT abnormal behavior detection method based on multi-dimensional feature fusion according to claim 1 is characterized in that: The iterative call tree vertex labels generate all subtrees of the call tree, including: Initial label assignment: Assign an initial label to each vertex in the call tree. The initial label is the function call name represented by the vertex. Label expansion: In each iteration, for each vertex, the label of each vertex is appended with the label of its child vertices to form a signature structure; Tag compression: After tag expansion is completed, a virtual new tag is used to represent the signature structure; Termination condition: If the current number of iterations reaches the set maximum number of iterations, the iteration ends and a label is used as a subtree; otherwise, the iteration continues to perform label expansion and label compression. The maximum number of iterations is based on the maximum depth of the call tree. Set to Second-rate.

5. The APT abnormal behavior detection method based on multi-dimensional feature fusion according to claim 1 is characterized in that: The step of setting the execution time of the root node of the subtree as the weight of the subtree includes: Determine the timestamp of the system call corresponding to the leaf node of the call tree; Calculate the relative time interval between two adjacent timestamps and set the relative time interval as the weight of the leaf node; For non-leaf nodes, the sum of the weights of all child nodes of the non-leaf node is used as the weight of the non-leaf node; Therefore, the weights of each node in all subtrees in the call tree are obtained, and the weight of the root node of the subtree is set as the weight of the subtree.

6. The APT abnormal behavior detection method based on multi-dimensional feature fusion according to claim 1 is characterized in that: The multi-dimensional feature fusion method based on attention is used to obtain multi-dimensional fusion features according to the semantic structure feature vector and call tree feature vector of the same process node, including: Multi-dimensional feature extraction: semantic structure feature vector for process nodes and the call tree feature vector of the process node ,pass Convolution kernels of different sizes are used to perform convolution operations to obtain the semantic structure feature vector and call tree feature vector Feature information under different convolution kernels and , ; Attention mechanism calculation: using average pooling operation to process feature information and , get a fixed-length feature vector and , and then the attention score is obtained through the full connection layer mapping and ; Multi-dimensional feature fusion: using attention scores Feature information Perform weighted fusion to obtain semantic structure fusion features , using attention score Feature information Perform weighted fusion to obtain semantic structure fusion features , and finally obtain the multi-dimensional fusion features .

Images