APT attack detection method based on negative sample enhancement of graph structure learning

Abstract

The application provides a negative sample enhancement APT attack detection method based on graph structure learning, mainly solving the problem that the existing data set compatibility, edge information utilization and insufficient negative samples of the data set lead to poor detection effect. The scheme comprises the following steps: 1) obtaining a heterogeneous data set and constructing a visual traceability graph; 2) preprocessing the traceability graph, dividing it into snapshots according to the time stamp, and constructing a training set and a test set; 3) designing an encoder and a decoder of the graph neural network, taking the time window, the node feature, the adjacency matrix and the edge feature as the input of the encoder, and generating the reconstructed adjacency matrix through the decoder; 4) designing a loss function, and training the graph neural network through RNN; and 5) inputting the to-be-detected data into the trained model, identifying abnormal attack traffic, and completing the detection. The application can effectively improve the accuracy and robustness of APT attack detection, and can be used for the development and deployment of the APT attack detection and defense system in the network security field.

Description

Technical Field

[0001] This invention belongs to the field of computer network technology, and further relates to network attack detection technology, specifically a negative sample augmentation APT attack detection method based on graph structure learning, which can be used for security detection of internal networks of enterprises and institutions. Background Technology

[0002] Current APT attack detection methods face multiple bottlenecks. Traditional graph neural network models generally suffer from insufficient utilization of edge information when processing source graphs in security scenarios. For example, edge features such as process call relationships and network communication types are only considered as supplementary information to the topology and are not fully integrated into node representation learning, making it difficult to effectively capture key causal relationships in the attack chain. Simultaneously, the scarcity of negative samples, unique to the security domain, severely restricts model performance. APT attack samples account for less than one ten-thousandth of real-world scenarios. Traditional cross-entropy loss functions, due to their over-reliance on negative sample distribution, are prone to overfitting to normal behavior and being insensitive to attack patterns. Furthermore, the compatibility problem of multi-source heterogeneous logs has long existed. The structural differences in entity definitions, temporal granularity, and relationship dimensions among mainstream datasets make it difficult for existing detection systems to achieve cross-platform generalization, often requiring customized models for single data sources, severely reducing practical deployment efficiency. Therefore, we urgently need a highly automated and rapid-response APT attack detection method.

[0003] In recent years, graph neural networks (Graph Neural Networks) have achieved remarkable progress in key areas such as drug development, protein structure determination, recommender systems, and traffic flow prediction. By graphically modeling data from real-world scenarios, Graph Neural Networks can learn a highly abstract representation for each node in the graph. This representation is further applied to downstream tasks, such as node classification, link prediction, and graph classification, demonstrating extremely high accuracy. These advancements fully demonstrate the broad application prospects and enormous potential of Graph Neural Networks in multiple fields. However, in terms of security applications, Graph Neural Network models also have some problems. First, there is a significant discrepancy between the attack link distribution predicted by most systems (links that may be vulnerable to attack predicted from existing datasets) and the actual attack links. Second, conventional encoders such as GCN and GraphSage cannot incorporate edge features (temporal attributes other than source and destination addresses) into their framework. Third, most systems abstract static graphs from logs, thus ignoring important temporal dynamics between different times.

[0004] For example, patent application CN119232465A, entitled "An APT Attack Detection Method Based on Source Graph Behavioral Information," proposes to detect attacks by constructing a source graph and extracting behavioral attribute structure information. It uses GraphSAGE and Residual Gated Graph ConvNets models to classify edge features, and combines ER random graph initialization of the Behavioral Structure Graph (BSG) with pooling strategies to generate edge features. This method achieves fine-grained anomaly detection through incremental training of multiple sub-models and outputs a behavioral structure graph of anomalous edges to enhance interpretability. However, its shortcomings include the lack of an adaptation mechanism for heterogeneous datasets and the failure to address the semantic differences between multi-source logs (such as Windows event logs and Linux auditd logs). Although the patent extracts edge features through the Behavioral Structure Graph (BSG), its ER random graph initialization strategy does not incorporate security domain knowledge (such as MITRE ATT&CK tactical labels), resulting in a weakened semantic correlation between edge features and real APT attack patterns. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of the existing technology and propose a negative sample augmentation APT attack detection method based on graph structure learning. This method addresses the problems of insufficient dataset compatibility, inadequate utilization of side information, and insufficient negative samples in the dataset that lead to poor detection results in the existing technology.

[0006] The technical approach of this invention is as follows: First, an independent parser is designed for heterogeneous datasets such as LANL and DARPA TC. Then, a PGTS (Provenance Graph to Snapshot) modeling method is designed, which divides the source graph transformation into snapshots according to timestamps. Then, a recurrent graph neural network (RNN) with redesigned encoder and decoder is used for iterative training. The trained network model is used to detect abnormal APT attack traffic and achieve attack detection.

[0007] To achieve the above objectives, the technical solution of the present invention includes the following:

[0008] (1) Obtain a security log dataset from the public network and use the network topology graph tool NetworkX to build a visual tracing graph;

[0009] (2) Preprocess the source map to obtain the training set, validation set and test set;

[0010] (3) Construct the encoder of the graph neural network, taking the time window, node features, adjacency matrix and edge features as input, and obtain the encoding result vector:

[0011] (3a) Use a message passing layer to merge the edge features of neighboring nodes into the node embedding, and take the edge features and edge weights as inputs respectively;

[0012] (3b) Construct an edge feature processing layer EF and an edge weight processing layer EW, which are used to obtain the aggregated feature value EF containing edge features in the time window t, respectively. t and aggregated weight eigenvalues ​​EW t ;

[0013] (3c) Based on the information transmission neural network, an encoder is constructed using three EW layers and one EF layer. Its structure includes the following: first EW layer - second EW layer - first activation function layer - weighted EW layer - second activation function layer - EF layer - multilayer perceptron (MLP) - third activation function layer; the encoded result vector is output through the third activation function layer.

[0014] (4) Construct the decoder of the graph neural network and generate the reconstructed adjacency matrix according to the following steps. :

[0015] (4a) By randomly sampling the neighbor information of aggregated nodes, the community structure that attackers may form can be captured;

[0016] (4b) Obtain the aggregated node embeddings according to the following formula. :

[0017]

[0018] Where S represents the identity matrix, and each row of this matrix is ​​derived from the adjacency matrix A. t s neighborhoods extracted from the middle It is the embedding representation matrix of the time window t;

[0019] (4c) Processed using a multilayer perceptron (MLP) and a nonlinear activation function Softmax. Generate the reconstructed adjacency matrix This matrix represents the probability that a corresponding edge is a malicious edge:

[0020] ;

[0021] (5) Design the loss function of the graph neural network, expressed as follows:

[0022] ;

[0023] in, For average accuracy AP loss; The parameters were adjusted based on the specific dataset. The decoder loss for the sampled edges is calculated using the cross-entropy function CE.

[0024] (6) Use the loss function to train the encoder and decoder of the graph neural network into a recurrent neural network (RNN) to obtain the optimized graph neural network model;

[0025] (7) Input the data to be tested into the graph neural network model, use the model to identify abnormal attack traffic, and complete the attack detection.

[0026] Compared with the prior art, the present invention has the following advantages:

[0027] First, because this invention combines source graphs with graph neural networks, it captures complex relationships in APT attacks through source graphs and processes and analyzes them using graph neural networks. This allows APT attacks to be treated as graphs, effectively extracting complex patterns and features hidden in the graph structure, thereby significantly improving the APT attack detection effect.

[0028] Secondly, this invention designs a unified formatting preprocessing method for multi-source heterogeneous logs, targeting datasets with different structures, such as LANL and DARPA TC. By constructing an entity relationship mapping rule base and a time-series alignment algorithm, logs from heterogeneous data sources are uniformly converted into a standardized source graph structure that the model can recognize. The source graph is then segmented into source graph slices according to appropriate time windows. At the same time, a hybrid pruning strategy based on node degree thresholds and time decay factors is used to compress the dataset, removing redundant data and reducing noise, effectively improving detection efficiency. It also solves the problems of poor cross-data source compatibility and high dependence on manual rules in traditional solutions, making it adaptable to deployment needs in multiple scenarios such as finance, cloud platforms, and industrial internet, and significantly improving the generalization ability of the detection model.

[0029] Third, this invention specifically designs a graph neural network architecture with edge-node joint encoding for APT attacks. It merges edge information and node information through a mechanism similar to a message passing neural network. It dynamically calculates the influence weights of edge features such as process call count and file read / write permissions on adjacent nodes through a multi-head attention mechanism, and uses residual connections to achieve cross-layer propagation of edge features. This improves the utilization of edge information in the graph, improves the problem of poor learning effect of graph neural network learning in security issues caused by the lack of negative sets, and significantly improves the accuracy of graph neural network learning.

[0030] Fourth, this invention proposes dynamic adversarial negative sampling and an adaptive loss function; it synthesizes highly confusing difficult negative examples based on a generative adversarial network (GAN) and dynamically adjusts the generator parameters using a meta-learning framework, making the negative sample distribution approximate the real attack pattern. Compared with existing technologies, this invention achieves a positive-to-negative sample ratio of 1:10. 5 In extreme imbalance scenarios, it reduces the false alarm rate and solves the problems of model overfitting or information loss caused by traditional oversampling / undersampling methods.

[0031] Fifth, this invention constructs a time-sensitive dynamic metric modeling mechanism, employing LSTM to predict attack phase transition points, dynamically adjusting the time window length of graph slices, and embedding relative timestamp encoding into node features to achieve three-dimensional tensor fusion of topological and spatiotemporal features. Compared with existing static graph construction schemes, the detection accuracy of time-related attack patterns (such as zero-day latency attacks and periodic data outflows) is improved, solving the problem of lost phase evolution features caused by fixed time windows in traditional methods. Attached Figure Description

[0032] Figure 1 This is a flowchart illustrating the implementation of the method of the present invention;

[0033] Figure 2 This is a schematic diagram of the overall architecture of the neural network model in this invention;

[0034] Figure 3 This is a schematic diagram of the encoder structure of the neural network model in this invention. Detailed Implementation

[0035] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0036] Example 1: Refer to Figure 1 This invention proposes a negative sample augmentation APT attack detection method based on graph structure learning, which specifically includes the following steps:

[0037] Step 1) Obtain the security log dataset from the public network and use the NetworkX network topology graph tool to build a visual traceability graph; in this embodiment, the security log datasets obtained are preferably the Los Alamos National Laboratory LANL dataset and the Operational Transparent Network OpTC dataset.

[0038] Step 2) Preprocess the source graph to obtain the training set, validation set, and test set. In this embodiment, the source graph constructed in Step 1) is preprocessed in this step. Specifically, the LANL dataset is labeled with the content of its corresponding red team attack information to identify malicious data flows. Then, it is segmented according to 30-60 minute snapshots, and all events sharing the same source node and target node are merged into one edge. All snapshots before the start of the red team attack are extracted. Each snapshot has an average of 4000-7000 edges. 5%-10% of the edges are discarded as the validation set, and the remaining snapshots are used for testing. For the OpTC dataset, node features X are constructed. t Given edge weights Wt, set the snapshot size to 180-360 seconds to obtain 1,680-3,360 snapshots over a week; use 20-40% of these snapshots for testing and the rest for training.

[0039] Step 3) Construct the encoder of the graph neural network, taking the time window, node features, adjacency matrix, and edge features as input, and obtain the encoded result vector:

[0040] (3a) Use a message passing layer to merge the edge features of neighboring nodes into the node embedding, and take the edge features and edge weights as inputs respectively;

[0041] (3b) Construct an edge feature processing layer EF and an edge weight processing layer EW, which are used to obtain the aggregated feature value EF containing edge features in the time window t, respectively. t and aggregated weight eigenvalues ​​EW t .

[0042] In this embodiment, the above-mentioned aggregation feature value EF t The specific formula is as follows:

[0043] ;

[0044] Here, let V denote the set of nodes, u∈V; v denote the neighboring nodes of u; X represents the aggregation feature of node u within a time window of t; u F represents the node characteristics of u; u, v The edge features between nodes u and v are represented; N(u) represents the neighborhood of u; M θ σ represents the feature values ​​passed from the aggregated neighboring nodes, and σ represents the activation function.

[0045] The above aggregate weight value EW t Obtained according to the following formula:

[0046] ;

[0047] in, Represents the node features within the time window t. Aggregate weight value EW t ; Θ is the angle matrix used to normalize the edge weight matrix W; Θ represents the trainable parameters; σ represents the activation function.

[0048] (3c) Based on the information transmission neural network, an encoder is constructed using three EW layers and one EF layer. Its structure includes the following: first EW layer - second EW layer - first activation function layer - weighted EW layer - second activation function layer - EF layer - multilayer perceptron (MLP) - third activation function layer; the encoded result vector is output through the third activation function layer.

[0049] Step 4) Construct the decoder for the graph neural network and generate the reconstructed adjacency matrix according to the following steps. :

[0050] (4a) By randomly sampling the neighbor information of aggregated nodes, the community structure that attackers may form can be captured;

[0051] (4b) Obtain the aggregated node embeddings according to the following formula. :

[0052]

[0053] Where S represents the identity matrix, and each row of this matrix is ​​derived from the adjacency matrix A. t s neighborhoods extracted from the middle It is the embedding representation matrix of the time window t;

[0054] (4c) Processed using a multilayer perceptron (MLP) and a nonlinear activation function Softmax. Generate the reconstructed adjacency matrix This matrix represents the probability that a corresponding edge is a malicious edge:

[0055] ;

[0056] Step 5) Design the loss function for the graph neural network, as follows:

[0057] ;

[0058] in, For average accuracy AP loss; The parameters were adjusted based on the specific dataset. This is the decoder loss for the sampled edges, calculated using the cross-entropy function CE.

[0059] The loss function designed in this step of the embodiment is obtained according to the following steps:

[0060] (5a) Calculate the decoder loss L of the sampling side using the cross-entropy function CE. DEC :

[0061]

[0062] (5b) Introducing average accuracy (AP) loss :

[0063] ;

[0064] Among them, P t It is G t Positive edges in nP t It is the number of positive edges, e i It is a positive edge, and n is G. t The number of all edges in the equation, e s It is G tFor any edge in, y s is the edge label, and I is the identifier function, which outputs 1 / 0 when the parameter is true / false. It is approximately The smoothed squared loss, where f is the prediction model and m is the marginal value;

[0065] (5c) L ap and L DEC By combining these factors and assigning different weights based on the characteristics of the dataset, the final loss function is obtained:

[0066] .

[0067] Step 6) Train the encoder and decoder of the graph neural network using a loss function to obtain the optimized graph neural network model. In this embodiment, the training of the above-mentioned recurrent neural network (RNN) is implemented through the following steps:

[0068] (6a) The encoder receives the graph structure data at the current time, including node features and adjacency relationships, and generates node embedding vectors;

[0069] (6b) Integrate the node embedding vectors generated at all historical moments through RNN, capture the dynamic evolution pattern through time series modeling, and output the time-enhanced node embedding sequence;

[0070] (6c) Based on the node embedding sequence, the decoder reconstructs the corresponding adjacency matrix according to the node embedding at each time step, and calculates the decoder loss by comparing the difference between the reconstructed matrix and the real graph structure.

[0071] (6d) Calculate the gradients of the encoder, decoder and RNN using the loss function, and update the parameters through backpropagation to achieve optimization.

[0072] Step 7) Input the data to be tested into the graph neural network model, use the model to identify abnormal attack traffic, and complete the attack detection.

[0073] Example 2: The overall implementation process of the detection method proposed in this example is the same as in Example 1. Please refer to the appendix for details. Figure 2 and 3 Specific examples are provided to further describe the implementation process of this invention in detail:

[0074] Step 1. Construct a source graph :

[0075] The LANL dataset was acquired, which originated from five different sources within the Los Alamos National Laboratory's internal computer network and was collected over 58 consecutive days to ensure data integrity and continuity. The OpTC dataset was also acquired, which was supported by the Defense Advanced Research Projects Agency's Large Scale Cyber ​​Hunting Program CHASE and contains approximately 1TB of compressed JSON-compatible data from that assessment.

[0076] Step 2. Source graph preprocessing, including the following processing steps for the two datasets:

[0077] For the LANL dataset: Data annotation of the auth files is performed using the contents of the redteam files to identify malicious data flows. Then, in this embodiment, the LANL-auth data is preferably segmented into 1-hour (3,600-second) snapshots, and all events sharing the same source and target nodes are merged into a single edge. The model is trained using snapshots from the first 42 hours. Each snapshot has an average of 7957 edges; 5% of the edges are discarded as the validation set. The remaining snapshots are used for testing.

[0078] For the OpTC dataset: Node features Xt and edge weights Wt are constructed. The snapshot size is set to 360 seconds, which is much smaller than the default for LANL because OpTC has significantly fewer nodes (814) than LANL (15,610), and the event frequency between a pair of hosts is much higher. Setting a larger snapshot size would merge too many events. Ultimately, this embodiment preferably yields 1,680 snapshots per week. Training is performed using snapshots from the first 5 days, and testing is performed using snapshots from the remaining 3 days.

[0079] Step 3. Design a graph neural network encoder, with the input being the time window t and node features X. t Adjacency matrix A t and edge features F t The encoder designed in this embodiment uses three EW layers and one EF layer, with the structure as follows: Figure 2 As shown;

[0080] (3.1) Use a message passing layer to incorporate the edge features of neighboring nodes into the node embedding;

[0081] (3.2) The edge weights and edge features are used as inputs to the two types of layers, EF and EW, respectively:

[0082] (3.2.1) EF layer design:

[0083] EF's design is similar to GCN, capable of handling node features and edge weights. Given a node u∈V,

[0084] ;

[0085] Among them, X u F represents the node characteristics of u. u , v represents the edge feature between edges (u, v), N(u) represents the neighborhood of u, M θ It aggregates the feature values ​​passed from neighboring nodes and can be simply called a multilayer perceptron (MLP), where σ represents the activation function. The function output value is Ht, which is the node feature at time t in the time window.

[0086] (3.2.3) EW layer design:

[0087] The input consists of node features X=(N, F), a weight matrix W=(N, N), and a science department parameter matrix Θ=(F, F'):

[0088] ;

[0089] in, The angle matrix is ​​used to normalize the edge weight matrix W; Θ represents the trainable parameters; σ represents the activation function, set to Tanh. The function outputs the updated node feature matrix (N, F').

[0090] Step 4. Design the decoder and loss function of the graph neural network:

[0091] (4.1) Design an aggregation operation that randomly samples from the neighborhood of each node as a decoder to update the node embedding:

[0092] ;

[0093] Among them, input S is an identity matrix, where each row is derived from the adjacency matrix A. t Extract s neighborhoods from the data; the output is the node embedding. .

[0094] (4.2) This system uses the cross-entropy function (CE) to calculate the decoder loss (L) at the sampling edge. DEC ):

[0095]

[0096] (4.3) Average Precision (AP) Loss:

[0097] Under CE conditions, L DEC Graph neural network models can still be optimized using the accuracy metric. Accuracy is a more suitable metric for imbalanced, secure datasets, so the AP loss is introduced. Specifically, the AP loss can be approximated by the following formula:

[0098] ;

[0099] Among them, P t It is G t Positive edges in nP t It is the number of positive edges, e i It is a positive edge, and n is G. t The number of all edges in the equation, e s It is G t For any edge in, y s It is the edge label (y) s =1 indicates a positive edge), I is a flag function that outputs 1 / 0 when the parameter is true / false. It is approximately The smoothed squared loss is given by f, where f is the prediction model (i.e., the graph neural network system) and m is the marginal value. L can be improved by rewriting Equation 13 as a finite sum of combination functions and performing SGD-style or Adam-style stochastic optimization. ap minimize.

[0100] (4.4) L ap and L DEC Combine these to construct a joint loss function, and adjust the L based on the characteristics of the dataset (e.g., highly imbalanced datasets require L). ap (Those with larger weights) are assigned different weights; the final loss function is:

[0101] ;

[0102] in Parameters are adjusted based on the specific dataset. Output loss value. The loss is continuously reduced through RNN training to update the model.

[0103] Step 5. Training the Graph Neural Network Recurrent (RNN):

[0104] (5.1) Using X t and A t As input, the encoder ENC constructed in section 3 is used to generate node embeddings. .

[0105] (5.2) Assume T is the number of all observation snapshots, and the RNN layer receives [Z0′, Z1′, ..., Z...]. T [Z0, Z1, ..., Z] is dynamically updated using the observed time intervals. T ].

[0106] ;

[0107] (5.3) In snapshot G t In the middle, the decoder uses the Z generated by the encoder. t Reconstructing the adjacency matrix t The decoding function may differ from σ(ZZ). ⊤ The decoder DEC is defined as follows:

[0108] ;

[0109] (5.4) During the forward pass, the encoder generates node embeddings [Z0, Z1, ..., Z... T The decoder reconstructs [Â0, Â1, ..., Â] from these values. T ]; Calculate [Â0,Â1,..., T ] and the ground truth values ​​[A0, A1, ..., A T The losses between ].

[0110] (5.5) During backpropagation, the loss is used to calculate the gradient and [A0, A1, ..., A...]. T [] Used to compute gradients and update RNNs, encoders, and decoders. During testing, after collecting logs for snapshot durations T + k (k > 0), Xt, At, and Ft, along with prior embeddings Z0, Z1, ..., Zt, will be used. T +k-1 Generate its embedding Z T +k .

[0111] Step 6. Graph Neural Network Model Testing:

[0112] The trained model is fed into the test sets of the LANL and OpTC datasets to calculate false positives (FP) and false negatives (FN), F1 score and AUC value. Abnormal traffic is identified by predicting the value of the reconstructed adjacency matrix, thus achieving attack detection.

[0113] This invention aims to systematically overcome the barriers of existing APT attack detection technologies. Addressing the problem of insufficient utilization of edge information, it designs an edge-node joint encoder to multimodally fuse edge features such as process call frequency and file read / write permissions with node semantics. This enables the graph neural network to simultaneously analyze entity attributes and relationship strength, thereby accurately modeling the causal transmission patterns of the attack phase. Facing the challenge of scarce negative samples, it innovatively proposes a dynamic adversarial negative sampling strategy. This strategy combines a meta-learning framework to dynamically generate difficult negative examples and reconstructs the loss function weight allocation mechanism, allowing the model to maintain strong discriminative power against attack features even with extremely low positive sample ratios. To solve the compatibility problem of multi-source logs, a unified formatted preprocessing framework is developed. Through an entity relationship mapping rule base, temporal alignment algorithms, and adaptive pruning strategies, heterogeneous data is transformed into standardized traceability graph slices. This preserves the semantic integrity of the original logs while achieving model universality across data sources, ultimately constructing a high-precision detection solution covering multi-dimensional attack surfaces such as hosts, networks, and users.

[0114] This invention has broad application prospects, especially in the field of Advanced Persistent Threat (APT) defense. With the acceleration of enterprise digital transformation, APT attacks have infiltrated critical sectors such as finance, energy, and government. Traditional rule-based or single-point detection technologies are insufficient to cope with multi-stage, long-term, covert attacks. This technology, by integrating a source graph constructed from multi-source logs with an optimized graph neural network model, can be widely applied to the Cybersecurity Operations Center (SOC) of large enterprises. It can analyze host processes, network traffic, and user behavior data in real time to accurately identify attack stages such as lateral movement and data leakage. For example, in the financial industry, the system can correlate abnormal logs from the transaction system with internal personnel operation records to quickly locate supply chain attacks or internal penetration behavior. In cloud service scenarios, it can dynamically trace attack paths across virtual nodes, solving the detection challenges of new threats such as container escape and covert communication between microservices. Its multi-source data compatibility can also empower the Industrial Internet, integrating heterogeneous logs from OT and IT systems to address APT attacks targeting critical infrastructure.

[0115] The parts of this invention not described in detail are common knowledge to those skilled in the art.

[0116] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Obviously, those skilled in the art, after understanding the content and principle of the present invention, may make various modifications and changes in form and detail without departing from the principle and structure of the present invention. However, these modifications and changes based on the concept of the present invention are still within the scope of protection of the claims of the present invention.

Claims

1. A negative sample enhancement APT attack detection method based on graph structure learning, characterized in that, It comprises the following steps: (1) obtaining a security log data set from a public network, and constructing a visual traceability graph using a network topology graph tool NetworkX; the security log data set adopts a Los Alamos National Laboratory (LANL) data set and an Operation Transparency Network (OpTC) data set; (2) preprocessing the traceability graph to obtain a training set, a validation set and a test set, and achieving the following: The LANL dataset is annotated with its corresponding red team attack information, which identifies malicious data streams. Then, it is segmented by 30-60 minute snapshots, and all events sharing the same source and target nodes are merged into an edge. All snapshots before the start of the red team attack are intercepted. Each snapshot has an average of 4000-7000 edges, and 5-10% of the edges are discarded as a validation set, and the remaining snapshots are used for testing. For the OpTC dataset, node features X t and edge weights Wt are constructed, the snapshot size is set to 180-360 seconds, and 1,680-3360 snapshots are obtained for a week. 20-40% of the snapshots are used for testing, and the rest are used for training. (3) constructing an encoder of a graph neural network, taking a time window, node features, an adjacency matrix and edge features as inputs to obtain an encoding result vector: (3a) using a message passing layer to merge edge features of adjacent nodes into node embeddings, and taking edge features and edge weights as inputs, respectively; (3b) constructing an edge feature processing layer EF and an edge weight processing layer EW, respectively used for obtaining an aggregated feature value EF of the edge feature in the t time window t and an aggregated weight feature value EW t ; (3c) based on an information passing neural network, an encoder is constructed using three EWs and one EF, and the structure comprises the following: a first EW layer-a second EW layer-a first activation function layer-a weighted EW layer-a second activation function layer-an EF layer-a multi-layer perception (MLP)-a third activation function layer; and the encoding result vector is output through the third activation function layer; (4) constructing a decoder of the graph neural network to generate a reconstructed adjacency matrix according to the following steps : (4a) the neighbor information of the aggregated nodes is randomly sampled to capture the community structure that may be formed by the attacker; (4b) Obtain the aggregated node embeddings according to the following formula : ， where S denotes an identity matrix whose each row is s neighborhood extracted from the adjacency matrix A t is the embedding representation matrix of the time window t;​ (4c) Processing by a multi-layer perceptron, MLP, and a non-linear activation function, Softmax , to generate a reconstructed adjacency matrix , which represents the probability that a corresponding edge is a malicious edge: ； (5) designing a loss function of the graph neural network, which is represented as follows: ， wherein, is the average precision AP loss; parameters adjusted specifically to the dataset; is the decoder loss for the sampled edges calculated using the cross-entropy function CE. (6) training the encoder and the decoder of the graph neural network using the loss function to obtain an optimized graph neural network model; (7) inputting the to-be-tested data into the graph neural network model to identify abnormal attack traffic using the model, and completing attack detection.

2. The method of claim 1, wherein: The polymerization characteristic value EF of step (3b) t is obtained according to the following formula: ， wherein, let V represent the node set, u∈V; v represents the neighbor node of u; denotes the aggregated feature of node u in the t time window; X u denotes the node feature of u; F u, v denotes the edge feature between nodes u and v; N(u) represents the neighborhood of u; M θ denotes the aggregated feature value transmitted by the neighborhood node, and σ represents the activation function.

3. The method of claim 1, wherein: The aggregated weight feature value EW of step (3b) is obtained according to the following formula: t , according to the following formula: ， wherein, denotes the aggregated weight feature value EWof the node features under the t time window t ; is a diagonal matrix for normalizing the edge weight matrix W; Θ denotes trainable parameters; and σ denotes an activation function.

4. The method of claim 1, wherein: The loss function of the graph neural network in step (5) is obtained according to the following steps: (5a) Compute the decoder loss L of the sampled edge using the cross-entropy function CE DEC : ， (5b) Introducing Average Precision AP loss : ， Among them, P t It is G t Positive edge in the middle, It is the number of positive edges, e i It is a positive edge, and n is G. t The number of all edges in the equation, e s It is G t For any edge in, y s is the edge label, and I is the identifier function, which outputs 1 / 0 when the parameter is true / false. It is approximately The smoothed squared loss, where f is the prediction model and m is the marginal value; (5c) combine L ap and L DEC and give different weights according to the characteristics of the dataset, and get the final loss function: 。 5. The method of claim 1, wherein: The recurrent neural network (RNN) training in step (6) is implemented as follows: (6a) the encoder receives the graph structure data at the current time, including node features and adjacency relationships, and generates a node embedding vector; (6b) the RNN integrates all the node embedding vectors generated at all historical times to capture the dynamic evolution law through time series modeling, and outputs a time series enhanced node embedding sequence; (6c) based on the node embedding sequence, the decoder reconstructs the adjacency matrix according to the node embedding at each time, and calculates the decoder loss by comparing the reconstructed matrix with the real graph structure; (6d) the gradients of the encoder, the decoder and the RNN are calculated using the loss function, and the parameters are updated through back propagation to achieve optimization.

Images