A malicious attack behavior detection method based on a transformer and a GNN

Abstract

This invention provides a method for detecting malicious attacks based on Transformer and GNN, comprising: acquiring system log data to be detected, and constructing a source graph based on the system log data to obtain a source graph; performing word embedding generation processing on the source graph to obtain word embeddings; and inputting the source graph and the word embeddings into a pre-trained malicious attack detection model to obtain detection results; wherein the malicious attack detection model is a Transformer and GNN-based model. This invention can capture local and global graph features in the source graph, effectively improving the accuracy and real-time performance of APT attack detection, enhancing the adaptability and scalability of the system, and has significant practical value.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method for detecting malicious attack behavior based on Transformer and GNN. Background Technology

[0002] APT (Advanced Persistent Threat) attacks are complex and persistent cyberattacks, typically launched by organized groups with the aim of infiltrating network systems undetected for extended periods. Currently, APT attack detection utilizes graph neural networks and Transformer-based graph models; however, the following problems still exist in this process:

[0003] Difficulty in handling large-scale dynamic graphs: Traditional GNN and GAT models typically assume that the graph is static and of moderate size. In real-world applications, the networks involved in APT attacks are dynamically changing, and the graph size can be extremely large. Existing graph models are inefficient at handling dynamic, large-scale graphs, making real-time detection difficult.

[0004] Inability to effectively capture long-range dependencies: APT attacks typically involve multiple steps and long periods of incubation, with complex global dependencies between nodes. Traditional graph neural network models primarily focus on node information within local neighborhoods, making it difficult to effectively capture dependencies between distant nodes in the graph, potentially missing crucial attack behaviors.

[0005] Lack of a global perspective: APT attacks can occur simultaneously in multiple parts of a network. Existing graph neural network models rely primarily on local features when aggregating node information, lacking a global perspective of the entire graph. This can lead to insufficient overall understanding of attack behavior and difficulty in accurately detecting attack activities distributed across different regions.

[0006] Therefore, there is an urgent need for an APT attack detection method that can handle large-scale dynamic graphs, capture long-range dependencies, and provide a global perspective. Summary of the Invention

[0007] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method for detecting malicious attack behavior based on Transformer and GNN.

[0008] To achieve the above objectives, the present invention adopts the following technical solution.

[0009] In a first aspect, the present invention provides a method for detecting malicious attack behavior based on Transformer and GNN, comprising:

[0010] Obtain the system log data to be detected, and construct a source map based on the system log data to obtain the source map;

[0011] The source graph is subjected to word embedding generation processing to obtain word embeddings;

[0012] The source map and the word embedding are input into a pre-trained malicious attack behavior detection model to obtain detection results;

[0013] The malicious attack detection model is based on Transformer and GNN.

[0014] Furthermore, the malicious attack behavior detection model includes a GNN network, a Transformer encoder, and a classification layer;

[0015] The step of inputting the source map and the word embedding into a pre-trained malicious attack behavior detection model to obtain detection results includes:

[0016] The local dependencies of the graph are captured from the source graph and the word embedding using a GNN network;

[0017] The local dependencies of the graph, the source graph, and the word embeddings are input into the Transformer encoder to capture the global dependencies of the graph;

[0018] The local dependencies and global dependencies of the graph are input into the classification layer to obtain the classification score of each node in the graph. The node type is determined based on the classification score, and the detection result includes the node type of each node.

[0019] Furthermore, the step of using a GNN network to capture local dependencies of the graph from the source graph and the word embeddings includes:

[0020] Based on a multi-head attention mechanism, and utilizing a GNN network, local dependencies of the graph are captured from the source graph and the word embeddings.

[0021]

[0022] In the formula, h i and h j Let be the feature vectors of node i and its neighbor node j, respectively, extracted using a GNN network. W is a learnable weight matrix applied to each feature vector, a is the attention vector determining the importance of each neighbor, and α is the feature vector. ij It is the attention coefficient between node i and its neighbor node j, || represents the join operation, and k represents each neighbor node of node i, i.e. Let h' be the set of neighboring nodes of node i, and LeakyReLU be a non-linear activation function. i It is the eigenvector h i The corresponding local dependencies are m∈M, where M is the total number of attention heads and σ(·) is a non-linear activation function;

[0023] The step of inputting the local dependencies of the graph, the source graph, and the word embeddings into the Transformer encoder to capture the global dependencies of the graph includes:

[0024]

[0025] Where, h″ i It is a global dependency, W v It is a learnable weight matrix used for value projection, β ij It is the attention weight, N is the total number of neighbor nodes in the neighbor node set, and e ij W is the attention score between node i and node j. q and W k These are the learnable projection matrices used for query and key vectors, respectively, d k It is the dimension of the key vector.

[0026] Furthermore, the step of constructing a source map based on the system log data to obtain a source map includes:

[0027] Nodes are created based at least on the executed commands and paths in the system log data, and edges between nodes are determined based at least on the data flows and network connections in the system log data, thereby obtaining a source graph including nodes and edges.

[0028] Further, the word embedding generation process performed on the source graph to obtain word embeddings includes:

[0029] The Word2Vec model is used to generate word embeddings on the source graph in order to capture the semantic and contextual information of node interactions in the source graph.

[0030] Furthermore, after determining the node type based on the classification score, the method further includes:

[0031] The Get_Adjacent function analyzes the current node based on its neighbor relationships and optimizes the detection results based on the node analysis results of all nodes.

[0032] Furthermore, the malicious attack behavior detection model is trained based on training log data and corresponding label information using the FocalLoss function, which is:

[0033]

[0034] Where α is a scaling factor used to balance the categories, p i It is the predicted probability of the true category label, and γ is a focusing parameter.

[0035] In a second aspect, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described above.

[0036] Thirdly, the present invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described above.

[0037] Fourthly, the present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the method described above.

[0038] The beneficial effects of this invention are as follows: The malicious attack behavior detection method based on Transformer and GNN provided by this invention utilizes GNN to extract local features in the graph structure, such as node neighbor information and local topology, while using Transformer to capture global dependencies in the graph. This method can effectively fuse local and global feature information, ensuring that key graph features are not missed when detecting APT attacks. Through this combination, this invention can not only accurately identify local attack behaviors, but also discover complex attack patterns distributed throughout the network from a global graph perspective. In addition, the malicious attack behavior detection model proposed in this invention can learn and model complex global dependencies, thereby detecting APT attacks more accurately. By using the Word2Vec semantic encoder to capture basic semantic attributes (such as process names and file paths) and combining them with the temporal information of the graph structure, the model can identify subtle signs of attackers lurking and moving in the network. This significantly improves the accuracy of APT attack detection and reduces the risk of false positives and false negatives. Finally, the APT attack detection method based on graph neural networks and Transformers of this invention effectively improves the accuracy and real-time performance of APT attack detection by combining local and global graph features, and enhances the adaptability and scalability of the system, thus having significant practical value.

[0039] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and will become apparent from the description or may be learned by practice of the invention. Attached Figure Description

[0040] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 This is one of the flowcharts illustrating a malicious attack behavior detection method based on Transformer and GNN provided in an embodiment of the present invention;

[0042] Figure 2 This is the second flowchart illustrating the malicious attack behavior detection method based on Transformer and GNN provided in this embodiment of the invention. Detailed Implementation

[0043] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0044] Those skilled in the art will understand that, unless specifically stated otherwise, the singular forms “a,” “an,” and “the” used herein may also include the plural forms. It should be further understood that the term “comprising” as used in this specification means the presence of features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof. It should be understood that when we say an element is “connected” or “coupled” to another element, it can be directly connected or coupled to the other element, or there may be intermediate elements. Furthermore, “connected” or “coupled” as used herein can include wireless connections or couplings. The term “and / or” as used herein includes any and all combinations of one or more of the associated listed items.

[0045] It will be understood by those skilled in the art that, unless otherwise defined, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. It should also be understood that terms such as those defined in general dictionaries should be understood to have the same meaning as in the context of the prior art, and should not be interpreted in an idealized or overly formal sense unless defined as herein.

[0046] Source-based intrusion detection systems (IDSes) primarily function by learning benign behavior models from source graphs. Any deviation from these established models is detected as anomalies. For example, ProGrapher utilizes Graph2Vec and TextRCNN embeddings to identify graph-level anomalies. Similarly, StreamSpot extracts graph features to build benign models and uses clustering techniques to identify anomalous graphs. Unicorn, on the other hand, employs graph similarity matching to locate anomalous graphs. It simplifies source graph features into histograms, forms fixed-size graph sketches, and then clusters them to detect anomalies. ProvDetector employs a path-based malware detection strategy. It identifies uncommon paths in the graph, generates them using path embeddings, and uses a local outlier factor approach for anomaly detection. ThreaTrace uses GNNs to perform node-level anomaly detection, learning structural information about nodes in benign datasets and identifying anomalies based on deviations from the learned behavior. Finally, ShadeWatcher uses GNNs to describe the preferences of system entities for interacting entities, providing edge-level anomaly detection to indicate adversarial interactions. Despite these advancements, current source-based IDS still has some limitations that affect its practical application in the real world.

[0047] Source-based intrusion detection systems (IDSes) are gaining popularity due to their potential in detecting sophisticated advanced persistent threat (APT) attacks. These IDSes use source graphs created from system logs to identify potential malicious activity. Despite their potential, they still face challenges in terms of accuracy, usability, and scalability, especially when dealing with large source graphs.

[0048] To address the problems existing in current APT attack detection methods, this invention proposes a TransGNN model by combining the local feature extraction capability of GNNs and the global dependency modeling capability of Transformers. This model has the following advantages:

[0049] Handling large-scale dynamic graphs: Through improved data loading and processing mechanisms, such as the use of Neighbor Loader, TransGNN can efficiently handle large-scale dynamic graphs and achieve real-time APT attack detection.

[0050] Capturing long-range dependencies: By leveraging the self-attention mechanism of Transformer, TransGNN can capture global dependencies between nodes on a global scale, thereby more accurately identifying complex APT attack patterns.

[0051] Providing a global perspective: The TransGNN model combines local feature extraction and global relationship modeling capabilities, enabling it to gain a more comprehensive perspective on complex networks, thereby improving the accuracy and reliability of APT attack detection.

[0052] To facilitate understanding of the embodiments of the present invention, several specific embodiments will be further explained below with reference to the accompanying drawings, and these embodiments do not constitute a limitation on the embodiments of the present invention.

[0053] Example 1

[0054] See Figure 1 and Figure 2 A method for detecting malicious attack behavior based on Transformer and GNN includes the following steps:

[0055] S101, Obtain the system log data to be detected, and construct a source map based on the system log data to obtain the source map.

[0056] In this step, nodes are created based at least on the executed commands and paths in the system log data, and edges between nodes are determined based at least on the data flows and network connections in the system log data, thereby obtaining a source graph including nodes and edges.

[0057] This step converts the raw system log data into node features, edges, and corresponding labels to obtain the source graph.

[0058] S102, perform word embedding generation processing on the source graph to obtain word embeddings.

[0059] Specifically, the Word2Vec model is used to perform word embedding generation on the source graph in order to capture the semantic and contextual information of node interactions in the source graph to obtain word embeddings.

[0060] S103, input the source map and the word embedding into a pre-trained malicious attack behavior detection model to obtain detection results; wherein, the malicious attack behavior detection model is a model based on Transformer and GNN.

[0061] Specifically, the malicious attack behavior detection model includes a GNN network, a Transformer encoder, and a classification layer. Further, S103 includes the following sub-steps:

[0062] The local dependencies of the graph are captured from the source graph and the word embedding using a GNN network;

[0063] The local dependencies of the graph, the source graph, and the word embeddings are input into the Transformer encoder to capture the global dependencies of the graph;

[0064] The local and global dependencies of the graph are input into the classification layer to obtain a classification score for each node in the graph. The node type is determined based on the classification score, and the detection result includes the node type for each node. Node types are categorized as normal or abnormal. When a misclassified node is identified, the predicted result is compared with the true label, and the state flag of each node is updated.

[0065] More specifically, the GNN network consists of multiple graph attention layers (GATConv), each receiving input node features and edge indices to generate new node representations. The GNN network includes an adjustable-layer module (default 4 layers), each implemented via GATConv to generate new node embeddings. Through this multi-head attention mechanism, these layers effectively capture both local and global information within the graph structure.

[0066] The GNN network also includes activation layers and dropout layers. Specifically, after each graph convolutional layer, the ELU activation function is used, and dropout is applied to prevent overfitting.

[0067] After computation through the GNN network, the local dependencies of the generated graph, the source graph, and the word embedding input are passed to the Transformer encoder. The main purpose of the Transformer encoder is to further learn the sequence dependencies between node embeddings. Especially when dealing with large-scale graph data, the Transformer can capture long-range dependencies.

[0068] The Transformer encoder consists of several EncoderLayers, each with a multi-head attention mechanism and a feedforward neural network. These layers can capture complex patterns in node features.

[0069] In some embodiments of the present invention, the step of using a GNN network to capture local dependencies of the graph from the source graph and the word embedding includes:

[0070] Based on a multi-head attention mechanism, and utilizing a GNN network, local dependencies of the graph are captured from the source graph and the word embeddings.

[0071]

[0072] In the formula, h i and h j Let be the feature vectors of node i and its neighbor node j, respectively, extracted using a GNN network. W is a learnable weight matrix applied to each feature vector, a is the attention vector determining the importance of each neighbor, and α is the feature vector. ijIt is the attention coefficient between node i and its neighbor node j, || represents the join operation, and k represents each neighbor node of node i, i.e. Let h' be the set of neighboring nodes of node i, and LeakyReLU be a non-linear activation function. i It is the eigenvector h i The corresponding local dependencies are m∈M, where M is the total number of attention heads and σ(·) is a non-linear activation function.

[0073] The step of inputting the local dependencies of the graph, the source graph, and the word embeddings into the Transformer encoder to capture the global dependencies of the graph includes:

[0074] h″ i =∑j=1 N β ij (W v h′ j )

[0075]

[0076] Where, h″ i It is a global dependency, W v It is a learnable weight matrix used for value projection, β ij It is the attention weight, N is the total number of neighbor nodes in the neighbor node set, and e ij W is the attention score between node i and node j. q and W k These are the learnable projection matrices used for query and key vectors, respectively, d k It represents the dimension of the key vector, used for scaling.

[0077] Specifically, this application identifies advanced persistent threats (APTs) by combining graph neural networks (GNNs) with Transformer layers to capture local interactions and long-term dependencies between nodes. The method provided in this application overcomes the limitations of traditional GNNs, which are typically effective for local message passing but struggle to capture global dependencies in large, interconnected graphs. The following details each stage of the learning process:

[0078] 1. Locally Dependent Graph Neural Network (GNN) Layers

[0079] The first stage of graph representation learning involves applying graph neural network (GNN) layers, particularly graph attention networks (GAT), to model local dependencies within each node's neighborhood. In the GAT layer, nodes aggregate information from their neighbors and determine the importance of each neighbor through a weighted attention mechanism.

[0080] For a feature vector h i The set of node i and its neighboring nodes Attention coefficient α between node i and its neighbor node j ij The calculation is as follows:

[0081]

[0082] Among them, h i and h j Let be the feature vectors of node i and its neighbor node j, respectively, extracted using a GNN network. W is a learnable weight matrix applied to each feature vector, a is the attention vector determining the importance of each neighbor, and α is the feature vector. ij It is the attention coefficient between node i and its neighbor node j, || represents the join operation, and k represents each neighbor node of node i, i.e. The denominator of the above equation is... Summing all neighboring nodes k in α, thus summing the results for α. ij Normalization is performed so that the attention coefficients of all neighbors form a probability distribution. Let i be the set of neighboring nodes of node i, and LeakyReLU is a non-linear activation function.

[0083] Attention coefficient α ij This reflects the relevance of node j to node i. The final representation of node i is calculated as a weighted sum of the features of its neighbors:

[0084]

[0085] Here, σ is a non-linear activation function such as ReLU. This aggregation allows each node to integrate information from its neighbors in a weighted manner based on its relevance, thus aiding in the task of identifying suspicious activity. Through this localized attention mechanism, GNNFormer is able to focus on important interactions within each node's neighborhood, capturing local patterns that may indicate attacks or anomalous behavior.

[0086] 2. Multi-headed attention mechanisms to enhance expressiveness

[0087] To enhance the expressiveness of the GAT layer, a multi-head attention mechanism is employed. In this setup, multiple attention heads operate in parallel, with each head learning different aspects of local interactions. For each attention head m, the coefficients... and node features h′ i Calculate independently, then concatenate the outputs of all heads:

[0088]

[0089] Here, M represents the number of attention heads, and || denotes a connection operation. Multi-head attention enhances the model's ability to capture complex dependencies by having different parts of the network focus on different aspects of the local graph structure. The aggregation of multiple heads ensures that GNNs can capture diverse signals, making them more robust to changes in node behavior and interactions.

[0090] 3. Globally dependent Transformer layer

[0091] While GNNs excel at capturing local dependencies, they are less effective at modeling long-range dependencies across the entire graph. To address this, we introduce a Transformer layer after the GNN layer to capture the global context. The self-attention mechanism in the Transformer allows each node to directly attend to all other nodes, regardless of their distance in the graph, which is crucial for understanding distributed and multi-stage attack patterns.

[0092] The Transformer layer calculates the attention score e between node i and node j using the following formula. ij :

[0093]

[0094] Among them, W q and W k It is a learnable projection matrix used for querying and key vectors, d k It represents the dimension of the key vector, used for scaling.

[0095] Use the softmax function to calculate the score e. ij Normalization is performed to generate attention weights β ij :

[0096]

[0097] The output of each node i is a weighted sum of the features of all nodes:

[0098]

[0099] Among them, W v This is a learnable weight matrix used for value projection. This operation enables GNNFormer to integrate information from both nearby and distant nodes, providing a global view of the graph.

[0100] 4. Combination of local and global representations

[0101] By combining GNN layers with Transformer layers, GNNFormer gains both local and global perspectives from the graph. The GNN layers provide a localized representation, highlighting immediate neighborhoods and capturing structural details. The Transformer layers, on the other hand, capture long-range dependencies and context, crucial for understanding multi-stage attacks across different parts of the graph. This hybrid approach enables GNNFormer to effectively model fine-grained and high-level dependencies, making it particularly suitable for detecting complex and subtle APT patterns.

[0102] 5. Hierarchical attention mechanism

[0103] To further refine the representation, GNNFormer employs a hierarchical attention mechanism, prioritizing critical nodes and edges. At the node level, attention scores highlight highly relevant nodes that may be associated with attacks, such as nodes linked to suspicious processes or anomalous network activity. At the graph level, the attention mechanism focuses on specific subgraphs exhibiting anomalous patterns, emphasizing interactions indicating coordinated malicious behavior. This hierarchical structure allows GNNFormer to filter out irrelevant information, concentrating computational resources on high-risk areas of the graph.

[0104] 6. Final Representation and Classification

[0105] After processing through multiple GNN and Transformer layers, each node is represented by a feature vector that encodes local and global dependencies. These final node representations are used for classification, assigning a probability to each node or subgraph via a scoring function, indicating the likelihood of malicious activity. This final classification step leverages the context-aware representations learned by the model to accurately distinguish between benign and malicious behavior.

[0106] In some embodiments of the invention, the attack detection phase in GNNFormer focuses on node-level classification within the source graph. This phase evaluates each node individually to determine its likelihood of involvement in malicious activity. This detection phase combines confidence-based screening and anomaly scoring to enhance the model's focus on high-risk nodes.

[0107] 1. Node-level classification

[0108] The embedding h of each node obtained through GNN and Transformer layers i The system categorizes cases as benign or malicious based on a softmax probability score. This is achieved by embedding the input into a fully connected layer with softmax activation.

[0109] P(malicious|h i )=σ(W 分 *h i +b)

[0110] Among them, W 分 Here, b is the weight matrix of the classification layer, b is the bias term, σ is the softmax function, and the output is the probability between 0 and 1, P(malicious|h i ) is the probability that node i is classified as malicious.

[0111] Nodes exceeding a defined threshold are marked as potentially malicious. Threshold-based classification helps filter out benign nodes and focuses the analysis on nodes with a higher probability of malicious behavior.

[0112] 2. Use FocalLoss to address class imbalance

[0113] To manage the inherent class imbalance between benign and malicious nodes, Focal Loss is employed. This loss function mitigates the influence of a large number of benign nodes, allowing the model to focus on the minority of malicious nodes. This is achieved by increasing the weight of hard-to-classify samples. Focal Loss is calculated as follows:

[0114]

[0115] Where α is a scaling factor used to balance the categories, p i It is the predicted probability of the true class label, and γ is the focusing parameter, which is used to reduce the weight of easily classified samples and highlight the nodes that are misclassified.

[0116] Focal Loss helps GNNFormer prioritize the detection of malicious nodes, thereby improving accuracy and reducing the false negative rate in APT detection.

[0117] 3. Confidence-based screening

[0118] Each node is assigned a confidence score to assess the certainty of its classification. This confidence score is calculated by comparing the softmax scores of the two highest-scoring classes:

[0119]

[0120] Among them, P top1 and P top2 These are the highest and second-highest probabilities. This normalized confidence level ranges from 0 to 1, reflecting the model's certainty in predicting the outcome.

[0121] Nodes with confidence scores above a certain threshold are retained as potential malicious activity candidates, which allows the model to filter out low-confidence predictions, thereby reducing the likelihood of false positives.

[0122] 4. Anomaly scoring based on node centrality

[0123] In addition to classification confidence, GNNFormer assigns anomaly scores to each node based on classification probability and the importance of nodes in the graph. These scores reflect not only the likelihood of malicious behavior but also the node's role in the source graph, which is crucial for identifying key or central nodes with high risk.

[0124] Anomaly score S of node i i The calculation is as follows:

[0125] Si=P(malicious|h i )×NodeImportance(i)

[0126] Among them, P(malicious|h i ) is the probability that node i is classified as malicious, and NodeImportance(i) is the centrality measure of node i in the graph (e.g., PageRank or eigenvector centrality).

[0127] Nodes with high anomaly scores are given priority for further examination, as these scores indicate high classification confidence and significant influence in the graph structure.

[0128] 5. Iterative misclassification reduced

[0129] To further improve classification accuracy, an iterative optimization process was employed, in which nodes misclassified in the previous cycle were masked and re-evaluated in subsequent iterations. This optimization helps improve overall classification accuracy by centrally addressing initially misclassified nodes.

[0130] In some embodiments of the present invention, after determining the node type based on the classification score, the method further includes:

[0131] The Get_Adjacent function analyzes the current node based on its neighbor relationships and optimizes the detection results based on the node analysis results of all nodes.

[0132] In addition, the malicious attack behavior detection model is trained based on training log data and corresponding label information, and is trained using the FocalLoss function. The FocalLoss function is particularly suitable for handling class imbalance problems, especially for anomaly detection tasks, where positive samples are relatively few.

[0133] During training, in each iteration, the NeighborLoader is used to batch process the source graph used for training, sampling subgraphs. The malicious attack detection model is also trained using backpropagation, and gradients are pruned to stabilize the training process. After each epoch, misclassified nodes are tracked and addressed. Upon obtaining the trained malicious attack detection model, its performance metrics, such as precision, recall, F1 score, false positive rate, and true positive rate, are calculated. These metrics provide a comprehensive evaluation of the model's performance. Auxiliary functions are used to analyze misclassification, updating the true positive and false positive sets using information from two-hop neighbors to improve prediction results.

[0134] In addition, after obtaining the system log data to be detected, the system log data will be preprocessed, and a traceability graph will be constructed based on the preprocessed system log data to obtain the traceability graph.

[0135] Specifically, the system log data to be inspected is typically stored in JSON format. UUIDs and node types are extracted using regular expressions. These UUIDs represent nodes in the graph, and edges are created based on the interactions between these nodes. After reading the JSON-formatted system log data, irrelevant data is filtered out, and UUIDs are mapped to their corresponding node types. Edges represent interactions between nodes, such as data flows or communication events. Finally, preprocessed system log data is obtained.

[0136] In other embodiments of the present invention, the malicious attack detection model is based on LSTM and GNN. Long Short-Term Memory (LSTM) networks perform exceptionally well in processing time-series data, effectively capturing temporal dependencies within the data. In APT attack detection, LSTM networks can be used to process the temporal features of graph nodes or edges. Combining LSTM with GNN enhances the ability to capture temporal dependencies, better addressing long-range dependencies in APT attacks.

[0137] The malicious attack behavior detection method based on Transformer and GNN provided in this invention utilizes GNN to extract local features from the graph structure, such as node neighbor information and local topology, while using Transformer to capture global dependencies in the graph. This method can effectively fuse local and global feature information, ensuring that key graph features are not missed when detecting APT attacks. Through this combination, this invention can not only accurately identify local attack behaviors, but also discover complex attack patterns distributed throughout the network from a global graph perspective. In addition, the malicious attack behavior detection model proposed in this invention can learn and model complex global dependencies, thereby detecting APT attacks more accurately. By using the Word2Vec semantic encoder to capture basic semantic attributes (such as process names and file paths) and combining them with the temporal information of the graph structure, the model can identify subtle signs of attackers lurking and moving in the network. This significantly improves the accuracy of APT attack detection and reduces the risk of false positives and false negatives. Finally, the APT attack detection method based on graph neural networks and Transformers of this invention effectively improves the accuracy and real-time performance of APT attack detection by combining local and global graph features, and enhances the adaptability and scalability of the system, thus having significant practical value.

[0138] Example 2

[0139] Based on Embodiment 1, Embodiment 2 provides a malicious attack behavior detection device based on Transformer and GNN. This malicious attack behavior detection device based on Transformer and GNN corresponds to the aforementioned malicious attack behavior detection based on Transformer and GNN, and specifically includes:

[0140] The data acquisition module is used to acquire the system log data to be detected and to construct a source map based on the system log data to obtain the source map;

[0141] The word embedding processing module is used to perform word embedding generation processing on the source graph to obtain word embeddings;

[0142] The detection module is used to input the source map and the word embedding into a pre-trained malicious attack behavior detection model to obtain detection results;

[0143] The malicious attack detection model is based on Transformer and GNN.

[0144] For specific details, please refer to the description in the section on malicious attack detection methods based on Transformer and GNN, which will not be repeated here.

[0145] Example 3

[0146] Embodiment 3 of the present invention provides an electronic device, including a memory and a processor, which communicate with each other. The memory stores program instructions that can be executed by the processor. The processor calls the program instructions to execute a malicious attack behavior detection method based on Transformer and GNN. The method includes the following steps:

[0147] Obtain the system log data to be detected, and construct a source map based on the system log data to obtain the source map;

[0148] The source graph is subjected to word embedding generation processing to obtain word embeddings;

[0149] The source map and the word embedding are input into a pre-trained malicious attack behavior detection model to obtain detection results;

[0150] The malicious attack detection model is based on Transformer and GNN.

[0151] Example 4

[0152] Embodiment 4 of the present invention provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements a method for detecting malicious attack behavior based on Transformer and GNN. The method includes the following steps:

[0153] Obtain the system log data to be detected, and construct a source map based on the system log data to obtain the source map;

[0154] The source graph is subjected to word embedding generation processing to obtain word embeddings;

[0155] The source map and the word embedding are input into a pre-trained malicious attack behavior detection model to obtain detection results;

[0156] The malicious attack detection model is based on Transformer and GNN.

[0157] Example 5

[0158] Embodiment 5 of the present invention provides a computer program product, including a computer program. When the computer program is executed by a processor, it implements a method for detecting malicious attack behavior based on Transformer and GNN. The method includes the following steps:

[0159] Obtain the system log data to be detected, and construct a source map based on the system log data to obtain the source map;

[0160] The source graph is subjected to word embedding generation processing to obtain word embeddings;

[0161] The source map and the word embedding are input into a pre-trained malicious attack behavior detection model to obtain detection results;

[0162] The malicious attack detection model is based on Transformer and GNN.

[0163] In summary, the malicious attack behavior detection method, apparatus, electronic device, medium, and product based on Transformer and GNN provided in this invention can be applied to products and projects in multiple network security fields, efficiently detecting and defending against complex network attacks and improving network system security. Furthermore, it is suitable for internal network traffic monitoring and attack detection within enterprises, helping them identify and defend against complex APT attacks and protect sensitive data and assets. In addition, it can continuously monitor network traffic and host behavior, identify potential APT attacks through real-time analysis and graph neural network models, and automatically generate security alerts to help security teams respond to and handle threats promptly.

[0164] The malicious attack detection model of this invention can efficiently process large-scale network graph data, enabling real-time detection and response to APT attacks and ensuring system security. By combining graph neural networks and Transformers, it can capture long-range dependencies and complex relationships in the network, effectively addressing distributed, multi-stage APT attacks. Furthermore, it can adapt to network environments of varying sizes and complexities, exhibiting good scalability. Through a multi-task learning approach, it can simultaneously optimize the detection performance against different types of attacks, enhancing detection robustness.

[0165] Those skilled in the art will understand that the accompanying drawings are merely schematic diagrams of one embodiment, and the modules or processes shown in the drawings are not necessarily essential for implementing the present invention.

[0166] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for method or system embodiments, since they are basically similar to method embodiments, the description is relatively simple; relevant parts can be referred to the description of the method embodiments. The method and system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0167] The above are merely preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for detecting malicious attack behavior based on a Transformer and a GNN, characterized in that, include: Obtain the system log data to be detected, and construct a source map based on the system log data to obtain the source map; The source graph is subjected to word embedding generation processing to obtain word embeddings; The source map and the word embedding are input into a pre-trained malicious attack behavior detection model to obtain detection results; The malicious attack behavior detection model is based on Transformer and GNN. The malicious attack detection model includes a GNN network, a Transformer encoder, and a classification layer. The step of inputting the source map and the word embedding into a pre-trained malicious attack behavior detection model to obtain detection results includes: The local dependencies of the graph are captured from the source graph and the word embedding using a GNN network; The local dependencies of the graph, the source graph, and the word embeddings are input into the Transformer encoder to capture the global dependencies of the graph; The local dependencies and global dependencies of the graph are input into the classification layer to obtain the classification score of each node in the graph. The node type is determined based on the classification score. The detection result includes the node type of each node. The step of using a GNN network to capture local dependencies of the graph from the source graph and the word embeddings includes: Based on a multi-head attention mechanism, and utilizing a GNN network, local dependencies of the graph are captured from the source graph and the word embeddings. ； In the formula, and The feature vectors of node i and its neighbor node j are respectively extracted using a GNN network. It is a learnable weight matrix applied to each feature vector. It is the attention vector that determines the importance of each neighbor. It is the attention coefficient between node i and its neighbor node j. This represents a join operation, where k represents each neighbor node of node i, i.e. , Let be the set of neighboring nodes of node i, and LeakyReLU be a non-linear activation function. It is an eigenvector The corresponding local dependencies are m∈M, where M is the total number of attention heads. It is a non-linear activation function; The step of inputting the local dependencies of the graph, the source graph, and the word embeddings into the Transformer encoder to capture the global dependencies of the graph includes: ； in, It is a global dependency. It is a learnable weight matrix used for value projection. It is the attention weight, where N is the total number of neighbor nodes in the neighbor node set. It is a node and nodes Attention scores between them and These are the learnable projection matrices used for querying and key vectors, respectively. It is the dimension of the key vector.

2. The method according to claim 1, characterized in that, The process of constructing a source graph based on the system log data to obtain the source graph includes: Nodes are created based at least on the executed commands and paths in the system log data, and edges between nodes are determined based at least on the data flows and network connections in the system log data, thereby obtaining a source graph including nodes and edges.

3. The method according to claim 1, characterized in that, The step of performing word embedding generation processing on the source graph to obtain word embeddings includes: The Word2Vec model is used to generate word embeddings on the source graph in order to capture the semantic and contextual information of node interactions in the source graph.

4. The method according to claim 1, characterized in that, After determining the node type based on the classification score, the method further includes: The Get_Adjacent function analyzes the current node based on its neighbor relationships and optimizes the detection results based on the node analysis results of all nodes.

5. The method according to claim 1, characterized in that, The malicious attack detection model is trained using training log data and corresponding label information, and is trained using the FocalLoss function.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1-5.

7. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the method as described in any one of claims 1-5.

8. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1-5.

Images