Traceability graph intrusion detection method based on multi-level comparison self-supervised learning

Abstract

The invention discloses a traceability graph intrusion detection method based on multi-level comparison self-supervised learning. The method comprises the following steps: S1, constructing a traceability graph to represent system log information; performing multi-scale feature enhancement and noise suppression processing on node representation in a graph structure by using an improved graph attention network (GAT) integrated with wavelet transform and adaptive denoising processing; s2, a comparative learning mechanism is adopted, a covariance matrix represented by a current node is calculated through comparison with a previous iteration representation, a new node representation is generated through an inference predictor, and the new node representation and the current representation are optimized; and S3, adjusting model parameters according to the contrast learning loss function, further improving the detection precision, and outputting and storing a final trained model. And S4, performing anomaly detection by using a K-nearest neighbor (KNN) algorithm. According to the invention, through the improved graph attention network and the comparison self-supervised learning mechanism, the feature representation capability of the GAT is enhanced, and the intrusion detection precision is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a source graph intrusion detection method based on multi-level comparative self-supervised learning. Background Art

[0002] Contrastive self-supervised learning is a machine learning method that does not require labeled data. It constructs positive and negative sample pairs and optimizes their feature representations. Its core concept is to leverage the data's inherent context to extract meaningful features through a comparison mechanism. This approach is particularly suitable for scenarios where data annotation is expensive. A provenance graph is a graph-structured data model that describes system events and their causal relationships. By abstracting events in system logs into nodes and event relationships into edges, a directed graph is constructed. This clearly illustrates event propagation paths and potential attack chains, providing high-level semantic information for intrusion detection.

[0003] Current intrusion detection methods based on traceability graphs have limited capabilities in processing multi-scale features and noise suppression, resulting in low detection accuracy. Furthermore, these traditional methods, such as TreaTrace, ThreatSniffer, and ATLAS, suffer from reliance on prior knowledge, high computational costs, and poor detection accuracy. Summary of the Invention

[0004] The purpose of the present invention is to provide a traceability graph intrusion detection method based on multi-level contrastive self-supervised learning to solve the problems of current intrusion detection methods such as reliance on prior knowledge, high computational cost and poor detection accuracy.

[0005] In order to achieve the purpose of the above invention, the following technical solutions are adopted:

[0006] A traceability graph intrusion detection method based on multi-level contrastive self-supervised learning includes the following steps:

[0007] S1. Construct a traceability graph to represent system log information; use an autoencoder integrated with an improved graph attention network to generate high-quality node representations;

[0008] S2, adopts an iterative contrast learning mechanism by comparing with the previous iteration representation;

[0009] S3. Adjust the model parameters according to the contrastive learning loss function, output and save the final trained model;

[0010] S4. Use KNN (K-Nearest Neighbors, K nearest neighbor algorithm) for anomaly detection.

[0011] In summary, the present invention provides a provenance graph intrusion detection method based on multi-level contrastive self-supervised learning, which solves the defects of current provenance graph intrusion detection methods. Through contrastive self-supervised learning, meaningful feature representations can be learned without relying on prior knowledge. Through the iterative contrast mechanism, the model collapse problem can be avoided and the computational overhead can be reduced without relying on negative samples. By introducing wavelet transformation and adaptive denoising into the traditional GAT (Graph Attention Networks) architecture, the quality of node representation is improved, thereby improving the accuracy of intrusion detection. Experimental results on multiple public data sets show that the proposed provenance graph intrusion detection method based on multi-level contrastive self-supervised learning can efficiently detect abnormal attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 This is a flow chart of the multi-level comparative self-supervised learning-based traceability graph intrusion detection (CGCLGAT-APT) method of the present invention;

[0013] Figure 2 Schematic diagram of experimental test results of CGCLGAT-APT on Unicorn Wget, StreamSpot and DARPAE3 datasets;

[0014] Figure 3 Schematic diagram of experimental test results of CGCLGAT-APT and other algorithms on Unicorn Wget, StreamSpot and DARPAE3 datasets;

[0015] Figure 4 Schematic diagram of experimental test results of computational overhead and number of parameters of CGCLGAT-APT and other algorithms on the DARPAE3 dataset;

[0016] Figure 5 A schematic diagram showing the effects of wavelet transform and adaptive denoising on the performance of the CGCLGAT-APT model on the dataset;

[0017] Figure 6 A schematic diagram showing the comparison between the CGCLGAT-APT comparison mechanism and the feature reconstruction mechanism on the dataset;

[0018] Figure 7 Schematic diagram of the model comparison results of GAT and GraphSAGE on the CGCLGAT-APT dataset. DETAILED DESCRIPTION

[0019] The embodiments described below with reference to the accompanying drawings are exemplary and are intended to explain the present invention, but are not intended to limit the present invention. Figure 1 As shown, the steps are as follows:

[0020] Step S1: Construct a traceability graph to represent system log information; use an autoencoder integrated with an improved graph attention network to generate high-quality node representations.

[0021] S11. A traceability graph G = (V, E) is constructed to represent system log information, where V represents the node set and E represents the edge set. Each node v∈V is associated with a feature vector Where F is the feature dimension. The construction of the traceability graph can effectively capture the complex relationships between various components in the system, providing a structured data foundation for subsequent feature extraction and intrusion detection.

[0022] S12. In the process of processing node representation, we use an improved graph attention network (GAT), which integrates wavelet transform and adaptive denoising mechanism. Specifically, the node features are first decomposed into multi-scale using Haar wavelet basis to generate sub-band coefficients of different frequencies:

[0023]

[0024] Wherein, haar represents the Haar wavelet basis, and level=1 specifies the decomposition level.

[0025] S13. Subsequently, the coefficients are processed based on the denoising method of adaptive soft threshold, which effectively suppresses the noise while retaining the key multi-scale information. The calculation formula of the adaptive threshold is as follows:

[0026] threshold=0.2×max(|coeffs|)

[0027] And apply the soft threshold function for denoising:

[0028] coeffs denoised ={soft(c,threshold)∣c∈coeffs}

[0029] The denoised coefficients are mapped back to the original feature space through inverse wavelet transform:

[0030]

[0031] S14. The denoised features are then enhanced and optimized through multiple GATConv convolution layers. The specific forward propagation process is as follows:

[0032]

[0033] Where σ is the activation function, represents the set of neighbor nodes of node v, is the attention coefficient of node v in layer l to its neighbor node u, W (l) is the learnable weight matrix of layer l. The calculation formula of attention coefficient is:

[0034]

[0035] In this way, the improved GAT can extract and optimize node features based on multi-scale feature enhancement and noise suppression, thereby improving the quality and robustness of node representation.

[0036] Step S2: adopting an iterative contrast learning mechanism by comparing with the representation of the previous iteration;

[0037] S21. In the node representation optimization stage, we introduced a contrastive learning mechanism to enhance the model's ability to express node features and its consistency. Specifically, let represents the node representation matrix generated by the autoencoder at the tth iteration, where N is the number of nodes in the graph, D is the dimension of the embedding vector, and the node representation of the previous iteration is recorded as H (t -1) .

[0038] First, the node representation of the previous iteration is normalized to obtain the normalized representation H (t-1)′ :

[0039]

[0040] Where m is the mean vector represented by the node, and the calculation formula is:

[0041]

[0042] S22. Calculate the covariance matrix P based on the normalized node representation t :

[0043]

[0044] Among them, H (t-1)′T Indicates H (t-1)′ The transposed matrix of .

[0045] S23, using the node of the current iteration to represent H (t) and the predictor matrix P t , generating predicted node representation Z (t) :

[0046] Z (t) =H (t) P t

[0047] Step S3: Adjust the model parameters according to the contrastive learning loss function, and output and save the final trained model;

[0048] S31. Design a covariance-based contrastive learning loss function to optimize model parameters, aiming to maximize the predicted node representation Z (t) The node representation H of the previous iteration (t-1) The cosine similarity between . The loss function is defined as:

[0049]

[0050] in, is the loss value of the tth iteration, is the representation of node i in the tth iteration of the prediction, is the representation of node i in the previous iteration, <·,·> represents the dot product operation, and ||·||2 represents the L2 norm.

[0051] S32, by minimizing the loss function The model is optimized to improve the consistency between the current node representation and the previous iteration representation, thereby enhancing the stability and robustness of the representation. The model parameters θ are updated according to the loss function through the backpropagation algorithm. The specific update formula is:

[0052]

[0053] Where η is the learning rate, is the gradient of the loss function with respect to the parameter θ. The training process ends when the preset maximum number of iterations is reached or the termination condition is met. Finally, the trained model is output and saved for subsequent intrusion detection tasks.

[0054] Step S4: Use the K-nearest neighbor algorithm (KNN) to perform anomaly detection.

[0055] Specifically, S41, after completing the training of the node representation, the K-nearest neighbor algorithm (KNN) is used to display and evaluate the detection results. First, the node embedding is preprocessed, including graph structure conversion and feature normalization to ensure that the feature scales are consistent across different datasets. Specifically, the feature normalization process is as follows:

[0056]

[0057] Among them, x normalized is the original feature vector of the node, μ train and σ trainRepresent the mean and standard deviation of the training data respectively. The normalized feature vector x normalized It can effectively eliminate the dimensional differences between different feature dimensions and improve the accuracy of the KNN algorithm in distance calculation.

[0058] S42. Use the KNN algorithm to calculate the average distance between each test instance and its k nearest neighbors in the training set, and use this as the anomaly score s i The specific calculation formula is:

[0059]

[0060] in:

[0061] ·s i represents the anomaly score of test instance i.

[0062] ·d(x i ,x j ) is the Euclidean distance between instance i and its jth nearest neighbor instance.

[0063] k is the number of neighbors considered in the KNN algorithm.

[0064] The scoring mechanism measures the deviation from the normal pattern by comparing the distance between the test instance and its neighbors. i The higher it is, the farther instance i is from its neighbors and the more likely it is an anomaly.

[0065] S43, dynamically select the optimal threshold by optimizing the F1 score. i Satisfaction i When ≥θ, the instance is judged as abnormal; otherwise, it is judged as normal. The specific judgment rules are as follows:

[0066] If s i If θ ≥ θ, then i is abnormal; otherwise, it is normal. This dynamic threshold selection method can flexibly adjust the detection sensitivity according to the distribution characteristics of the specific data set, thereby improving the accuracy and robustness of detection.

[0067] like Figure 2 and Figure 3As shown in the figure, the proposed CGCLGAT-APT method was comprehensively evaluated on multiple standard datasets. Experimental results demonstrate that the method demonstrates excellent performance in APT detection tasks: on the StreamSpot dataset, it achieves 100% precision, recall, and F1 score; on the DARPAE3THEIA dataset, it achieves 98.49% precision, 99.99% recall, and 99.23% F1 score, while keeping the false positive rate at a low level of 0.12%; on the Wget dataset, it achieves 100% precision, 96% recall, and 97.95% F1 score; and on the DARPA E3 Trace dataset, it achieves 99.24% precision, 99.97% recall, and 99.61% F1 score, with a false positive rate of only 0.08%. Compared with existing technologies, the CGCLGAT-APT method shows significant advantages in detection accuracy and stability, fully verifying its effectiveness and robustness in the field of APT detection. Figure 4 As shown in the figure, the CGCLGAT-APT method has obvious advantages in terms of model complexity. Experimental data show that the number of trainable parameters of this method on most data sets is significantly lower than that of the comparison method, especially on the Tibela and Trace data sets, where its parameter scale is greatly reduced compared to the MAGIC method. At the same time, the total training time of CGCLGAT-APT is also significantly shortened, which fully demonstrates the efficiency of this method in processing large-scale data sets and provides strong support for its deployment in practical application scenarios. In order to further verify the rationality of the model architecture, the present invention conducted a systematic ablation experiment, and the results are shown in the figure. Figure 5 、 6 , 7. By gradually removing key components of the model, we conducted an in-depth analysis of the contribution of each module to overall performance. Experiments found that removing core components such as the contrast mechanism and feature reconstruction led to a significant decrease in model performance: on the Unicorn Wget dataset, removing the contrast mechanism significantly reduced both the precision and recall of the model; and on the DARPA E3 dataset, removing the adaptive denoising module significantly reduced the model's F1 score and AUC. These experimental results strongly demonstrate the necessity and synergy of the various components in the CGCLGAT-APT method, providing an important basis for optimal model design.

[0068] In summary, the present invention provides a source graph intrusion detection method based on multi-level contrastive self-supervised learning, which solves the defects of the current source graph intrusion detection method. Through contrastive self-supervised learning, meaningful feature representations can be learned without relying on prior knowledge. Through the iterative contrast mechanism, the model collapse problem can be avoided and the computational overhead can be reduced without relying on negative samples. By introducing wavelet transformation and adaptive noise reduction into the traditional GAT architecture, the quality of node representation is improved, thereby improving the accuracy of intrusion detection. The experimental results on multiple public data sets show that the proposed source graph intrusion detection method based on multi-level contrastive self-supervised learning can efficiently detect abnormal attacks. The comparative experimental results with other source graph intrusion detection algorithms show that the detection and computational effects of this algorithm are better.

[0069] Of course, the above description is merely a preferred embodiment of the present invention, and the present invention is not limited to the above-mentioned embodiments. It should be noted that any equivalent substitutions or obvious variations made by any person skilled in the art after reading this specification are within the substantive scope of this specification and should be protected by the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A traceability graph intrusion detection method based on multi-level contrastive self-supervised learning, characterized by: The following steps are involved: S1. Construct a traceability graph to represent system log information. Use an improved graph attention network (GAT) that integrates wavelet transform and adaptive denoising to perform multi-scale feature enhancement and noise suppression on node representations in the graph structure. Node features are extracted and optimized through multiple GATConv convolutional layers. S2, using a contrastive learning mechanism, calculates the covariance matrix of the current node representation by comparing it with the previous iteration representation, and generates a new node representation through the inference predictor; S3. Adjust the model parameters according to the contrastive learning loss function to further improve the detection accuracy, and output and save the final trained model when the maximum number of iterations is reached or the termination condition is met; S4. Use K-nearest neighbor algorithm KNN for anomaly detection.

2. The method for intrusion detection based on multi-level contrastive self-supervised learning according to claim 1, characterized in that: Said S1 specifically includes the following steps: S11. A traceability graph G = (V, E) is constructed to represent system log information, where V represents the node set, E represents the edge set, and each node v∈V is associated with a feature vector Where F is the feature dimension; the construction of the traceability graph can effectively capture the complex relationships between various components in the system, providing a structured data foundation for subsequent feature extraction and intrusion detection; S12. In the process of processing the node representation, the improved graph attention network is adopted, which integrates wavelet transform and adaptive denoising mechanism; specifically, the node features are first decomposed into multi-scale using Haar wavelet basis to generate sub-band coefficients of different frequencies: Where haar represents the Haar wavelet basis, level = 1 specifies the decomposition level; S13. Subsequently, these coefficients are processed based on a denoising method based on an adaptive soft threshold, effectively suppressing noise while retaining key multi-scale information. The calculation formula of the adaptive threshold is as follows: threshold=0.2×max(|coeffs|) And apply the soft threshold function for denoising: coeffs denoised ={soft(c,threshold)∣c∈coeffs} The denoised coefficients are mapped back to the original feature space through inverse wavelet transform: S14. The features after denoising are then enhanced and optimized through the multi-layer GATConv convolution layer. The specific forward propagation process is as follows: Where σ is the activation function, represents the set of neighbor nodes of node v, is the attention coefficient of node v in layer l to its neighbor node u, W (l) is the learnable weight matrix of the lth layer, and the calculation formula of the attention coefficient is: In this way, the improved graph attention network GAT can extract and optimize node features based on multi-scale feature enhancement and noise suppression, thereby improving the quality and robustness of node representation.

3. The method for intrusion detection based on multi-level contrastive self-supervised learning according to claim 1 is characterized in that: The S2 specifically includes the following steps: S21. In the optimization phase of the node representation, the contrastive learning mechanism is introduced to enhance the model's ability to express and maintain consistency of node features. Specifically, represents the node representation matrix generated by the autoencoder in the tth iteration, where N is the number of nodes in the graph, D is the dimension of the embedding vector, and the node representation of the previous iteration is recorded as H (t-1) ; First, the node representation of the previous iteration is normalized to obtain the normalized representation H (t-1)′ : Where m is the mean vector represented by the node, and the calculation formula is: S22. Calculate the covariance matrix P based on the normalized node representation t : in, Indicates H (t-1)′ The transposed matrix of S23, using the node of the current iteration to represent H (t) and the predictor matrix P t , generating predicted node representation Z (t) : Z (t) =H (t) P t 。 4. The method for intrusion detection based on multi-level contrastive self-supervised learning according to claim 1 is characterized in that: The S3 specifically includes the following steps: S31. Design a covariance-based contrastive learning loss function to optimize model parameters, aiming to maximize the predicted node representation Z (t) The node representation H of the previous iteration (t-1) The cosine similarity between , the loss function is defined as: in, is the loss value of the tth iteration, is the representation of node i in the tth iteration of the prediction, is the representation of node i in the previous iteration, <·,·> represents the dot product operation, and ||·||2 represents the L2 norm; S32, by minimizing the loss function The model is optimized to improve the consistency between the current node representation and the previous iteration representation, thereby enhancing the stability and robustness of the representation. The model parameters θ are updated according to the loss function through the backpropagation algorithm. The specific update formula is: Where η is the learning rate, It is the gradient of the loss function with respect to the parameter θ. The training process ends when the preset maximum number of iterations is reached or the termination condition is met. Finally, the trained model is output and saved for subsequent intrusion detection tasks.

5. The method for intrusion detection based on multi-level contrastive self-supervised learning according to claim 1 is characterized in that: The S4 specifically includes the following steps: S41. After completing the training of the node representation, the K-nearest neighbor algorithm (KNN) is used to display and evaluate the detection results. First, the node embedding is preprocessed, including graph structure conversion and feature normalization, to ensure that the feature scales between different data sets are consistent. Specifically, the feature normalization process is as follows: Among them, x normalized is the original feature vector of the node, μ train and σ train Represent the mean and standard deviation of the training data, respectively, and the normalized feature vector x normalized It can effectively eliminate the dimensional differences between different feature dimensions and improve the accuracy of the KNN algorithm in distance calculation; S42, use the KNN algorithm to calculate the average distance between each test instance and the k nearest neighbors in the training set, and use this as the anomaly score s i , the specific calculation formula is: Among them, s i represents the abnormality score of test instance i; d(x i ,x j ) is the Euclidean distance between instance i and its jth nearest neighbor instance; k is the number of neighbors considered in the KNN algorithm; the scoring mechanism measures the degree of deviation from the normal pattern by comparing the distance between the test instance and its neighbors, and the score s i The higher it is, the farther the instance i is from its neighbors and the more likely it is an anomaly; S43, dynamically select the optimal threshold by optimizing the F1 score, when the abnormal score s of the test instance i Satisfaction i When ≥θ, the instance is judged as abnormal; otherwise, it is judged as normal. The specific judgment rules are as follows: If s i ≥θ, then i is abnormal; otherwise it is normal. This dynamic threshold selection method can flexibly adjust the detection sensitivity according to the distribution characteristics of the specific data set, thereby improving the accuracy and robustness of detection.

Images