Multi-dimensional weighted graph convolutional neural network method for highly sustainable threat classification

Abstract

The invention discloses a multi-dimensional weighted graph convolutional neural network method for highly sustainable threat classification, relates to the field of network security and reinforcement learning, and solves the problems of limitation, low reliability and the like of an existing GCN algorithm in processing complex APT attack node classification. And carrying out attack category identification by utilizing the constructed MW-GCN network model, and determining a classification result of each node. According to the method, the evolution process of the APT attack in a long-time span and complex network topology structure is effectively captured. Through accurate node weight calculation, key nodes which are highly associated with APT attacks and have great influence are highlighted, and the accuracy and reliability of APT attack node classification are improved. According to the method, computing resources and internal storage are saved, multiple local angles such as attribute characteristics of the nodes and the association closeness degree of the direct neighbor nodes are considered, and it is ensured that node weights can comprehensively reflect global and local overall importance of the nodes.

Description

Technical Field

[0001] The present invention relates to the fields of network security and reinforcement learning, and in particular to a multi-dimensional weighted graph convolutional neural network method (Multi-dimensional Weighted GCN, abbreviated as MW-GCN) for classifying advanced persistent threats (APTs). Background Art

[0002] With the rapid development of network technology, network security faces severe challenges from advanced persistent threats (APTs). The graph convolutional neural network (GCN) algorithm is a cutting-edge algorithm for APT node classification. However, traditional GCN algorithms treat neighboring nodes with equal weights, which is overly simplistic and makes it difficult to distinguish differences in node importance. Furthermore, this approach tends to overlook key information, limiting classification accuracy. Given the persistence, stealth, and complexity of APT attacks, a GCN algorithm suitable for APT classification is urgently needed to improve the efficiency of APT node classification and strengthen network security protection capabilities. Summary of the Invention

[0003] In order to solve the limitations and low reliability of the existing GCN algorithm when processing complex APT attack node classification, the present invention provides a multi-dimensional weighted graph convolutional neural network method for highly sustainable threat classification.

[0004] A multi-dimensional weighted graph convolutional neural network method for high sustainable threat classification is implemented by the following steps:

[0005] Step 1: Collect APT attack data, extract characteristic information representing network nodes, and obtain characteristic vectors; construct an adjacency matrix A based on the connection relationship of network nodes, and arrange the characteristic vectors in rows to form a characteristic matrix X;

[0006] Step 2: Calculate the extended adjacency matrix based on the adjacency matrix A According to the extended adjacency matrix Building a graph structure Get the global importance weight component P;

[0007] Step 3: sum the adjacency matrix A to obtain the degree-based local importance weight component M;

[0008] Step 4: Based on the global importance weight component P obtained in step 2 and the local importance weight component M obtained in step 3, a balance parameter β is introduced to calculate the comprehensive weight matrix W;

[0009] Step 5: According to the comprehensive weight matrix W described in step 4, the feature matrix X described in step 1 is weighted to obtain a weighted feature matrix According to the weighted feature matrix and the adjacency matrix described in step 2 Construct MW-GCN network model;

[0010] Step 6: Select a public node classification dataset and divide it into a training set, a validation set, and a test set. Use the training set to train the MW-GCN network model, and adjust the training parameters according to the performance of the validation set until all indicators of the MW-GCN network model converge.

[0011] Step 7: Input the test set into the trained MW-GCN network model, and obtain the probability distribution of the test set nodes belonging to each category through the forward propagation of the network model; according to the probability distribution, determine the classification result of each test set node.

[0012] Beneficial effects of the present invention:

[0013] The neural network method described in this invention effectively captures the evolution of APT attacks over long time spans and in complex network topologies. Through precise node weight calculation, it highlights key nodes with strong correlation and influence with APT attacks, improving the accuracy and reliability of APT attack node classification. It can also identify nodes hidden in normal communication links that act as forwarding nodes, as well as nodes with localized abnormal behavior characteristics, thereby enhancing early warning and detection capabilities for APT attacks. This helps to promptly discover and block APT attack paths, reduce the risk of data leakage and system damage, and provide strong technical support for network security.

[0014] The neural network method of the present invention designs an innovative weight decay adjacency matrix (extended adjacency matrix ) construction method to dynamically adjust the propagation range of network node influence and achieve accurate quantification of the impact on distant nodes.

[0015] The neural network method described in the present invention designs an innovative two-dimensional importance weighted model. The global importance component (P) realizes a stable assessment of the node's propagation influence, and the local importance component (M) innovatively combines the node degree distribution characteristics to construct a weight evaluation system based on connection density.

[0016] The MW-GCN model proposed by the neural network method described in the present invention enhances the key feature representation through the feature matrix weighting method, and effectively solves the gradient vanishing problem by combining the processing of diagonal matrix normalization.

[0017] The neural network method described in this paper, based on the persistent, stealthy, and complex nature of APTs, proposes an innovative graph convolutional neural network approach that weights neighbor node features across multiple dimensions. This approach not only saves computing resources and memory, but also considers multiple local perspectives, such as the node's own attributes and the closeness of its relationships with its immediate neighbors, ensuring that node weights comprehensively reflect their overall global and local importance. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is a flowchart of the multi-dimensional weighted graph convolutional neural network method for high sustainable threat classification described in the present invention.

[0019] Figure 2 This is an example diagram comparing the APT attack classification effects before improvement compared with the multi-dimensional weighted graph convolutional neural network method for high sustainable threat classification described in the present invention.

[0020] Figure 3 This is an example diagram of the classification effect of the multi-dimensional weighted graph convolutional neural network method for high sustainable threat classification described in the present invention. DETAILED DESCRIPTION

[0021] Combine Figures 1 to 3 This embodiment describes a multi-dimensional weighted graph convolutional neural network method suitable for high-sustainability threat classification. The specific method is implemented by the following steps:

[0022] Step 1: Collect and clean APT attack-related data. Based on information related to node communication behavior, protocol usage, traffic load, and system vulnerabilities, extract node feature information and quantize and encode it to form a feature vector corresponding to each node.

[0023] In this implementation, APT attack-related data is collected from network devices, server logs, and network traffic monitoring tools. Based on a combination of fields such as timestamps, source IP addresses, destination IP addresses, port numbers, and protocol types, duplicate records, erroneous data, incomplete data, and data fragments clearly unrelated to APT attacks are removed from the collected data.

[0024] Step 2: Construct an adjacency matrix A based on the node connections from step 1. Assign weights to the elements of the adjacency matrix A based on the degree of node association. Nodes without connections are assigned a value of 0. At the same time, arrange the eigenvectors of all nodes in rows to form a feature matrix X. By assigning weights to the elements of the adjacency matrix A, we can distinguish the importance of different nodes.

[0025] Step 3: Convert the adjacency matrix A in step 2 into a dense matrix a1, and cyclically calculate the multi-hop dense matrix from 2 to the preset maximum hop number u. According to the set attenuation factor formula Calculate the extended adjacency matrix And the extended adjacency matrix The elements in the matrix are truncated to be in the range [0,1].

[0026]

[0027] in, represents the dense matrix of the h-th hop number; γ h Indicates the corresponding attenuation factor; parameter Adjustments are made based on changes in network node activity and node security status.

[0028] In this embodiment, the influence of neighbors with different hop counts on the target node is calculated by exponentiation. This processing method can characterize the influence of distant nodes and hidden nodes on the target node.

[0029] Step 4: According to the expanded adjacency matrix in step 3 Building a graph structure Assign pre-assigned weights to the initial PR values of nodes at different levels and perform multiple iterations according to the following iterative formula until the PR value converges.

[0030]

[0031] Where, node v i is the target node for which PR value is to be calculated; v j For node v i Any node in the adjacent node set; t is the number of iterations; PR(v i ) (t+1) For node v i PR value at t+1 iteration; O(v j ) is the node v j The out-degree; α is the damping factor; N is the graph structure The total number of nodes in ; the convergence threshold is set to ε.

[0032] Finally, the converged PR value is normalized to obtain the global importance weight component P.

[0033] The final result is used as the PR component vector P. The PR value of each node is then normalized as the global component to be reasonably integrated with other weight components. PR is used to measure the communication influence of the node in the entire graph structure as part of the current node's global importance.

[0034] Step 5: Considering that nodes play a key role in APT attack classification in a local environment, a degree-based local importance weight component M is constructed. The adjacency matrix A in step 2 is summed row by row to obtain the degree weight component M of each node. i , forming a degree-based local importance weight component M:

[0035]

[0036] Among them, M i For node v i The degree weight component; m ij is the element in row i and column j in the adjacency matrix A.

[0037] Step 6: Combine the global importance weight component P in step 4 and the local importance weight component M in step 5, introduce the balance parameter β, and calculate the comprehensive weight matrix W according to the local importance weighting mode of the degree:

[0038] W=βP+(1-β)M

[0039] Step 7: According to the comprehensive weight matrix W calculated in step 6, the feature matrix X in step 2 is weighted to obtain the weighted feature matrix Where ⊙ represents the multiplication of corresponding matrix elements.

[0040] According to the weighted feature matrix and the adjacency matrix Construct the MW-GCN model. In MW-GCN, the forward propagation process of each layer is updated according to the following propagation rules:

[0041]

[0042] Where K (l) is the hidden layer feature network of the lth layer, and (The initial input is the weighted feature matrix), W l is the learnable weight matrix of layer l, is the activation function, is a diagonal matrix with diagonal elements To expand the adjacency matrix The sum of all elements in the corresponding row, that is, ( For the extended matrix The connection weight between node i and node j in for The inverse square root matrix is used to normalize the adjacency matrix to ensure the stability and rationality of the information propagation process. This allows us to fully utilize the various information of nodes in the APT attack graph, adopt a weighted processing strategy based on the global and local importance of nodes according to various APT characteristics, and accurately classify nodes according to reasonable propagation rules.

[0043] Step 8: Select datasets such as the public node classification dataset Cora and the classic network security dataset CICIDS2017, and divide them into training, validation, and test sets in a proportional manner. Train the data. If the metrics do not converge, increase the number of training rounds. Use the backpropagation algorithm to calculate the gradient of the loss function with respect to the model parameters. Then, use an optimization algorithm to update the network model parameters based on the gradients until the metrics converge. For example, in one experiment, when the accuracy, F1 value, Rrecision, and Recall values converge to 0.935, 0.891, 0.912, and 0.881, respectively, the network model parameters are no longer updated. Adjust the training parameters based on the performance of the validation set. If the network model's performance on the validation set does not improve for several consecutive cycles or reaches the preset number of training rounds, stop training.

[0044] Step 9: Figure 2 As shown, Figure 2 This diagram shows an example of the classification results after convergence of the metrics in step 8 using this method. The test set data is input into the trained MW-GCN network model. The network model's forward propagation generates the probability distribution of the test set nodes belonging to each category. Based on this probability distribution, evaluation metrics such as accuracy, F1 score, precision, and recall are calculated for the test set. The classification results for each APT attack are then output along with the evaluation metrics.

[0045] like Figure 2 and Figure 3 As shown, Figure 2 In order to intuitively demonstrate the classification effects of the unimproved graph convolutional neural network method and the multi-dimensional weighted graph convolutional neural network method proposed in this embodiment in the APT attack classification task, different colors are used to distinguish the APT attack category labels. Figure 2 In the visualization, some clusters overlap to a certain extent, there are relatively more discrete points in the graph, and the clustering quality is low. Figure 3 In the visualization result diagram, the cluster separation is the strongest, the boundaries of each area can be seen, and there is no obvious overlap. Figure 2 , its clustering effect is clearer, the influence of noise data points is smaller, and the closeness and separation are higher.

[0046] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0047] The above-described embodiments merely illustrate several implementations of the present invention, and while their descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent. It should be noted that a person skilled in the art would be able to make numerous variations and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the patent for this invention shall be determined by the appended claims.

Claims

1. A multi-dimensional weighted graph convolutional neural network method for high-sustainability threat classification, characterized by: The method is implemented by the following steps: Step 1: Collect APT attack data, extract characteristic information representing network nodes, and obtain characteristic vectors; construct an adjacency matrix A based on the connection relationship of network nodes, and arrange the characteristic vectors in rows to form a characteristic matrix X; Step 2: Calculate the extended adjacency matrix based on the adjacency matrix A According to the extended adjacency matrix Building a graph structure Get the global importance weight component P; Step 3: sum the adjacency matrix A to obtain the degree-based local importance weight component M; Step 4: Based on the global importance weight component P obtained in step 2 and the local importance weight component M obtained in step 3, a balance parameter β is introduced to calculate the comprehensive weight matrix W; Step 5: According to the comprehensive weight matrix W described in step 4, the feature matrix X described in step 1 is weighted to obtain a weighted feature matrix According to the weighted feature matrix and the adjacency matrix described in step 2 Construct MW-GCN network model; Step 6: Select a public node classification dataset and divide it into a training set, a validation set, and a test set. Use the training set to train the MW-GCN network model, and adjust the training parameters according to the performance of the validation set until all indicators of the MW-GCN network model converge. Step 7: Input the test set into the trained MW-GCN network model and obtain the probability distribution of the test set nodes belonging to each category through the forward propagation of the network model; According to the probability distribution, the classification result of each test set node is determined.

2. The multi-dimensional weighted graph convolutional neural network method for high-sustainability threat classification according to claim 1, characterized in that: In step 1, from the collected APT attack data, feature information characterizing network nodes is extracted based on information related to node communication behavior, protocol usage, traffic load, and system vulnerabilities. The feature information is quantized and encoded to obtain the feature vector corresponding to each node.

3. The multi-dimensional weighted graph convolutional neural network method for high-sustainability threat classification according to claim 1, characterized in that: In step 1, the elements of the adjacency matrix A are assigned corresponding weight values according to the degree of association of the nodes, so as to distinguish the importance of different nodes; If there is no connection between nodes, the value is 0.

4. The multi-dimensional weighted graph convolutional neural network method for high-sustainability threat classification according to claim 1, characterized in that: The specific process of step 2 is: Step 21: convert the adjacency matrix A into a dense matrix A1, and cyclically calculate the multi-hop dense matrix from 2 to the preset maximum hop number u; Step 2. Set the attenuation factor and calculate the expanded adjacency matrix It can be expressed as follows: Where, is the dense matrix of the h-th hop number; γ h is the corresponding attenuation factor; Step 2 and 3: According to the extended adjacency matrix Building a graph structure Assign pre-assigned weights to the initial PR values of nodes at different levels, and use the following formula for multiple iterations until the PR value converges; Where, node v i is the target node for which PR value is to be calculated; v j For node v i Any node in the adjacent node set; t is the number of iterations; PR(v i ) (t+1) For node v i PR value at t+1 iteration; O(v j ) is the node v j The out-degree; α is the damping factor; N is the graph structure The total number of nodes in ; The converged PR value is normalized to obtain the global importance weight component P.

5. The multi-dimensional weighted graph convolutional neural network method for high sustainable threat classification according to claim 1, characterized in that: In step 3, node v i The degree weight component M i It can be expressed as follows: Where m ij is the element in row i and column j in the adjacency matrix A.

6. The multi-dimensional weighted graph convolutional neural network method for high-sustainability threat classification according to claim 1, characterized in that: In step 4, the calculation formula of the comprehensive weight matrix W is: W = βP + (1-β)M.

7. The multi-dimensional weighted graph convolutional neural network method for high-sustainability threat classification according to claim 1, characterized in that: In step 5, the weighted feature matrix Where ⊙ represents the multiplication of corresponding matrix elements.

8. The multi-dimensional weighted graph convolutional neural network method for high-sustainability threat classification according to claim 1, characterized in that: In the MW-GCN network model, the forward propagation process of each layer is updated according to the following propagation rules: Where K (l) is the hidden layer feature network of the lth layer, To expand the adjacency matrix, W l is the learnable weight matrix of layer l, is the activation function, is a diagonal matrix.

Images