Semi-supervised classification method of relation graph aggregation model for APT attack identification

Abstract

The invention discloses a semi-supervised classification method of a relation graph aggregation model for APT attack recognition, relates to the technical field of graph neural networks, and solves the problems of massive graph data, complex relation modeling, label scarcity and the like in existing advanced persistent threat attacks. And the GraphSAGE layer flexibly processes large-scale graph data through sampling and aggregation of neighbor nodes. And meanwhile, a small amount of marked data and a large amount of unmarked data can be effectively utilized by adopting a semi-supervised learning strategy, so that the pressure of data marking is relieved. Experimental results show that compared with other methods, the AARGS model has certain advantages in the aspects of classification accuracy and generalization ability. Meanwhile, the semi-supervised learning method effectively reduces the dependence on high-quality annotation data, so that the cost and workload of data annotation are reduced.

Description

Technical Field

[0001] The present invention relates to the field of graph neural network technology, and in particular to a semi-supervised classification method of a relationship graph aggregation model for APT attack identification. Background Art

[0002] With the growth of social networks and complex network data, advanced persistent threat (APT) attacks pose a significant challenge to network security due to their stealth and complexity. APT attacks typically involve a large number of interconnected entities and relationships, forming a complex network structure. However, traditional methods often exhibit weak generalization capabilities when processing such multi-relational data. Furthermore, the acquisition and annotation of APT data is arduous and difficult, making it difficult to fully utilize the data's potential during model training, thus hindering performance. Therefore, how to effectively identify and defend against APT attacks, especially in massive and complex graph-structured data, has become a research focus. To this end, a semi-supervised classification method based on a relational graph aggregation model for APT attack identification is proposed. This method can deeply explore multiple relation types in the graph, thereby improving the detection accuracy and robustness of APT attacks. Summary of the Invention

[0003] To address the challenges of massive graph data, complex relationship modeling, and label scarcity in advanced persistent threat (APT) attacks, this paper provides a semi-supervised classification method based on a relationship graph aggregation model for APT attack identification. This method can adaptively handle multiple relationship types, improving the accuracy and robustness of APT attack detection.

[0004] A semi-supervised classification method based on a relational graph aggregation model for APT attack identification is implemented by the following steps:

[0005] Step 1: Collect APT attack data and convert it into graph structure data;

[0006] Step 2: Build an AARGS model, which includes two RGCN layers, one GraphSAGE layer, and a softmax classifier.

[0007] The RGCN layer aggregates and updates node features by different relationship types to generate a low-dimensional embedding representation; the GraphSAGE layer uses the information of neighboring nodes to aggregate features;

[0008] Step 3: Concatenate the node features output by the RGCN layer and the GraphSAGE layer in step 2 to output a comprehensive feature representation;

[0009] Step 4: setting the initialization training parameters of the AARGS model and performing cyclic training; during the training process, inputting the comprehensive feature representation into the classification layer of the AARGS model for classification prediction;

[0010] Step 5: The classifier calculates the cross entropy loss based on the predicted value and the true label and optimizes the AARGS model parameters using the gradient descent method to obtain the trained AARGS model;

[0011] Step 6: Evaluate the performance of the trained AARGS model on the test set and output the final classification results.

[0012] Beneficial effects of the present invention:

[0013] The semi-supervised classification method described in the present invention is implemented by constructing a semi-supervised classification model AARGS for relational graph aggregation. In this method, an adaptive aggregation network model (GraphSAGE) is introduced on the basis of the relation-aware graph convolutional network (RGCN) model; wherein the RGCN model can capture complex graph relationship information, such as different types of dependencies between different nodes in the attack path; and the GraphSAGE model can efficiently process large-scale graph data, reduce the computational burden through neighbor sampling and aggregation, and improve the computational efficiency of the model. The combination of the two can ensure that the model can maintain good modeling capabilities and efficiently cope with the challenges of large-scale data when processing diverse and complex APT attack graphs. At the same time, the use of a semi-supervised learning strategy can effectively utilize a small amount of labeled data and a large amount of unlabeled data, thereby reducing the pressure of data annotation. This strategy enables the APT attack identification system to maintain a high classification performance in the absence of labeled data, which is of great significance to improving APT protection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 This is a flow chart of a semi-supervised classification method of a relationship graph aggregation model for APT attack identification described in the present invention.

[0015] Figure 2 This is a performance comparison chart of the AARGS model in the present invention and other models;

[0016] Figure 3 This is a comparison chart of the loss function of the AARGS model described in the present invention and other models. DETAILED DESCRIPTION

[0017] Combine Figures 1 to 3 This embodiment describes a semi-supervised classification method for a relationship graph aggregation model for APT attack identification. The method is implemented by the following steps:

[0018] Step 1: Preprocess the original data (APT attack data). In the preprocessing stage, the node identifier, feature vector and corresponding label are first parsed from the original data, and these features are converted into a feature matrix X. Each row of the feature matrix corresponds to the attribute information of a node, which is used to store the attribute information of the node.

[0019] Then, the edge relationship between the nodes is read and converted into an adjacency matrix A by mapping the node identifier to the index, which is used to describe the connection relationship between the nodes. The connection relationship describes the edge between the nodes.

[0020] The adjacency matrix A is a sparse matrix that indicates whether there is an edge between nodes. At the same time, edge type information is randomly generated for each edge to indicate different types of relationships.

[0021] Finally, the feature matrix X, adjacency matrix A, and edge type information are integrated and encapsulated into a graph data object, namely, graph structure data. The true node labels are also mapped to the corresponding node indexes, which serve as supervisory signals for subsequent model training. The entire graph structure data is passed as input to the input layer of the AARGS model to implement the graph-based node classification task and provide a foundation for subsequent training and prediction.

[0022] Step 2: Construct a semi-supervised classification model for relational graph aggregation (AARGS); the model consists of two layers of relation-aware graph convolutional networks (RGCNs), one layer of adaptive aggregation network (GraphSAGE), and a softmax classifier.

[0023] Step 3: The RGCN layer aggregates and updates node features by different relationship types to generate a low-dimensional embedding representation. The GraphSAGE layer then aggregates features using information from neighboring nodes to better learn the structural characteristics of the nodes. Given a graph G = (V, E) with R relationships, where V is the set of nodes, E is the set of edges, and R is the set of relationship types, the propagation rule of the improved GraphSAGE layer is:

[0024]

[0025] in, represents the feature vector of node v in layer l, W represents the feature vector (embedded representation) of node v in the l+1 layer, and σ represents the activation function (such as ReLU), which is used to introduce nonlinearity to ensure that the model has the ability to learn complex representations. (l) Represents the learnable weight matrix of the lth layer, which is used to linearly transform the features of the node. |N(v)| represents the number of neighbor nodes (i.e., degree) of node v, It represents the sum of the l-th layer feature vectors of all neighbor nodes u of node v, which is the core operation of aggregating neighbor information. Represents the weight matrix W (l) Dividing by the node's degree plus 1 is a normalization operation used to prevent nodes with higher degrees from having too much influence on the update results.

[0026] In this implementation, the adjacency matrix A and the node feature matrix X are passed to the RGCN layer. The RGCN layer uses graph convolution to aggregate neighbor node information using the adjacency matrix A and the node feature matrix X, resulting in the node features X2 after two layers of graph convolution. Next, the GraphSAGE layer aggregates the node's neighbor information, updates each node's features, and obtains the node features X3 output by GraphSAGE.

[0027] Step 4: Concatenate the node features output by the RGCN layer and the GraphSAGE layer to form a comprehensive feature representation: is the feature output by the RGCN layer, Features output by the GraphSAGE layer;

[0028] After expanding the AGGREGATE function into a specific sum, the combined propagation formula is:

[0029]

[0030] in, is the feature vector of node v in layer l, N r(v) is the neighbor node of node v, is the trainable weight matrix of layer l, Represents the feature vector of the lth layer of node v Through the weight matrix Linear transformation. |R| represents the total number of relationship types (or edge types) in the graph, and σ is the activation function. Is a normalization coefficient, usually calculated based on the node degree or the weight of the relationship type. The characteristics of the neighbor node u First, the relationship-specific weight matrix corresponding to the neighbor edge A linear transformation is performed to capture the varying effects of different relationships on features. The transformed neighbor features are then concatenated (or aggregated) with the features of the central node. This is then processed through a nonlinear activation function (such as ReLU) to enhance the model's expressiveness and enable it to learn more complex node representations. This allows the model to consider both the node's own characteristics and information from neighboring nodes with different types of relationships, achieving richer feature fusion.

[0031] Step 5: Start the cycle training process;

[0032] The node features generated by the RGCN layer and the GraphSAGE layer are concatenated and input into the softmax classification layer for the final classification prediction.

[0033] Step 6: Based on the predicted values ​​and the true labels, calculate the cross-entropy loss and optimize the model parameters using gradient descent. After each round of training, verify the classification performance of the AARGS model and calculate the validation set accuracy. If the validation accuracy is higher than the historical best, update and save the model.

[0034] When val_acc>best_val_acc:best_val_acc=val_acc;

[0035] Where val_acc represents the verification accuracy, and best_val_acc represents the historical best verification accuracy value.

[0036] Step 7: After training is completed, output the final classification results, performance indicators and optimal model parameters.

[0037] The final performance of the model is evaluated on the test set, and metrics such as test accuracy, precision, recall, and F1-score are calculated. The actual labels in the test set are compared with the labels predicted by the model to calculate various performance metrics to help verify the model's generalization ability.

[0038] Combine Figure 2 and Figure 3 As shown, Figure 2 In the results, the AARGS model of the present invention is compared with the existing models HGCN, GAT, and R-GAT in terms of performance indicators accuracy, precision, recall, and F1 score. The AARGS model of the present invention has the best performance in terms of 0.955, 0.979, 0.930, and 0.948, respectively. Figure 3 In the comparison of the loss function between the AARGS model of the present invention and the existing models HGCN, GAT, and R-GAT, the model of the present invention is 0.117, which is the best.

[0039] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0040] The above-described embodiments merely illustrate several implementations of the present invention, and while their descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent. It should be noted that a person skilled in the art would be able to make numerous variations and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the patent for this invention shall be determined by the appended claims.

Claims

1. A semi-supervised classification method based on a relationship graph aggregation model for APT attack identification, characterized by: The method is implemented by the following steps: Step 1: Collect APT attack data and convert it into graph structure data; Step 2: Build an AARGS model, which includes two RGCN layers, one GraphSAGE layer, and a softmax classifier. The RGCN layer aggregates and updates node features by different relationship types to generate a low-dimensional embedding representation; the GraphSAGE layer uses the information of neighboring nodes to aggregate features; Step 3: Concatenate the node features output by the RGCN layer and the GraphSAGE layer in step 2 to output a comprehensive feature representation; Step 4: setting the initialization training parameters of the AARGS model and performing cyclic training; During the training process, the comprehensive feature representation is input into the classification layer of the AARGS model for classification prediction; Step 5: The classifier calculates the cross entropy loss based on the predicted value and the true label and optimizes the AARGS model parameters using the gradient descent method to obtain the trained AARGS model; Step 6: Evaluate the performance of the trained AARGS model on the test set and output the final classification results.

2. The semi-supervised classification method of the relationship graph aggregation model for APT attack identification according to claim 1 is characterized by: In step 1, a feature matrix X and an adjacency matrix A are constructed based on the APT attack data. The feature matrix X includes the attribute information of each node, and the adjacency matrix A describes the connection relationship between nodes. Then, the edge type information is generated based on the feature matrix X and the adjacency matrix A as graph structure data. The graph structure data is passed into the constructed AARGS model.

3. The semi-supervised classification method of the relationship graph aggregation model for APT attack identification according to claim 2 is characterized by: In step 2, the adjacency matrix A and feature matrix X are passed to the RGCN layer. The RGCN layer uses graph convolution operation to aggregate the information of neighbor nodes through the adjacency matrix A and feature matrix X to obtain the node feature X2 after two layers of graph convolution; then, the node neighbor information is aggregated through the GraphSAGE layer, the features of each node are updated, and the node feature X3 output by GraphSAGE is obtained.

4. The semi-supervised classification method of the relationship graph aggregation model for APT attack identification according to claim 1 is characterized by: In step 2, set the relationship graph G = (V, E), where V is the node set, E is the edge set, and R is the relationship type set; the propagation rule of the GraphSAGE layer is: Where, represents the feature vector of node v in layer l, represents the feature vector of node v in the l+1 layer, σ represents the activation function, W (l) represents the learnable weight matrix of layer l, |N(v)| represents the number of neighbor nodes of node v, It represents the sum of the l-th layer feature vectors of all neighboring nodes u of node v.

5. The semi-supervised classification method of the relationship graph aggregation model for APT attack identification according to claim 4 is characterized in that: In step 3, the comprehensive feature representation h is output v , as follows: Where, is the feature output by the RGCN layer, is the feature output by the GraphSAGE layer; combined with the propagation rules of the GraphSAGE layer, the further propagation formula is: Where N r(v) is the neighbor node of node v, is the trainable weight matrix of layer l, Represents the feature vector of the lth layer of node v Through the weight matrix Linear transformation, |R| represents the total number of relationship types in the graph, is the normalization coefficient, the characteristics of neighbor node u Through the relationship-specific weight matrix Transformation.

6. The semi-supervised classification method of the relationship graph aggregation model for APT attack identification according to claim 1 is characterized by: In step 4, the initialization training parameters include: learning rate: used to control the step size of gradient descent; maximum number of training rounds: determines the maximum number of iterations of the AARGS model training; loss function: uses cross entropy loss to calculate the error between the predicted value and the true label.

7. The semi-supervised classification method of the relationship graph aggregation model for APT attack identification according to claim 1 is characterized by: In step 4, after each round of training, the classification performance of the AARGS model is verified and the validation set accuracy is calculated; if the validation accuracy is higher than the historical optimal value, the AARGS model is updated and saved.

Images