Fine-grained APT attack detection method and system based on node classification model

Abstract

The invention discloses a fine-grained APT attack detection method based on a node classification model. The method comprises the following steps of: 1, distinguishing entity entries and event entries from system log data with tags, and constructing an initial log traceability graph with tags; 2, inputting the log traceability graph into a node classification model, training the node classification model, and storing parameters of the node classification model after training is completed; 3, distinguishing entity entries and event entries from to-be-detected system log data, extracting effective attributes of entities and events, constructing a to-be-detected log traceability graph, and establishing a mapping relation between nodes of the to-be-detected log traceability graph and system log entities; 4, loading the stored node classification model parameters, and inputting the to-be-detected log traceability graph subjected to pruning and noise reduction into the node classification model to obtain a classification result of the node classification model; and 5, obtaining abnormal log entity entries corresponding to the attack category nodes. According to the invention, the efficiency of manual processing of abnormal feedback can be improved.

Description

Technical Field

[0001] The present invention belongs to the field of network security and deep learning technology, and specifically relates to a fine-grained APT attack detection method and system based on a node classification model. Background Art

[0002] Advanced persistent threats (APTs) are highly stealthy and persistent, capable of lurking within target systems for extended periods, making them difficult to detect. They are currently receiving widespread attention as a cybersecurity issue. APTs typically employ advanced techniques, have long incubation periods, target institutions or organizations, and cause significant impacts, making them difficult to detect by traditional attack detection and defense systems.

[0003] Current APT attack detection technologies often rely on system logs and their traceability graphs to learn about benign behavior within the system and detect potential anomalous APT behavior through anomaly detection techniques, such as the Unicorn method, Log2vec, ThreaTrace, and MAGIC. These methods, such as the Unicorn method, Log2vec, ThreaTrace, and MAGIC, fail to consider the role of labels and employ semi-supervised or unsupervised model training. These models lack the ability to discern the difference between anomalous and benign categories. Consequently, in some cases, entries detected as attacks may be mixed with entries that are actually benign. This issue may not have a significant impact during initial APT attack detection, but during subsequent manual processing of anomaly feedback, the inefficiency of manually extracting valid information due to the mixing of entries detected as attacks with entries that are actually benign can be significantly reduced, impacting attack investigations, decision-making, and implementation of defensive measures.

[0004] In response to the above problems, since the difficulty of obtaining labels has been reduced after preliminary APT attack detection, how to conduct more effective secondary detection after preliminary detection of APT attacks, reduce the proportion of entries detected as attacks but actually benign, and improve the efficiency of manual processing of abnormal feedback, is a problem that needs to be solved. Summary of the Invention

[0005] In order to overcome the shortcomings of the above-mentioned prior art, the purpose of the present invention is to provide a fine-grained APT attack detection method and system based on a node classification model. The method is based on a node classification model combined with a GEN network, obtains the graph representation features of the log traceability graph through a GEN encoder, and regards the APT attack detection task as a binary classification task for the nodes of the log traceability graph, so that the log entity entries corresponding to the nodes predicted to be attack categories are regarded as entries related to APT attacks; and improves the efficiency of manual processing of abnormal feedback.

[0006] In order to achieve the above object, the technical solution adopted by the present invention is:

[0007] The fine-grained APT attack detection method based on the node classification model includes the following steps:

[0008] Step 1: Distinguish entity entries and event entries from labeled system log data. Based on the content of the entity entries and event entries, extract the valid attributes of the entities and events, build an initial labeled log provenance graph, and process the log provenance graph through pruning and noise reduction to obtain a log provenance graph that can be used in subsequent steps.

[0009] Step 2: Input the log traceability graph after pruning and noise reduction into the node classification model, train the node classification model, and save the parameters of the node classification model after training;

[0010] Step 3: Distinguish entity entries and event entries from the system log data to be tested. Based on the content of the entity entries and event entries, extract the valid attributes of the entities and events, build a traceability graph for the log to be tested, perform pruning and noise reduction, and establish a mapping relationship between the nodes of the traceability graph for the log to be tested and the system log entities.

[0011] Step 4: Load the saved node classification model parameters, input the pruned and denoised log source graph to be detected into the node classification model, and obtain the classification results of the node classification model. Nodes classified as attack categories are nodes related to APT attacks.

[0012] Step 5: According to the mapping relationship between the nodes in the log source traceability graph to be detected and the system log entities, combined with the attack category nodes determined in step 4, obtain the abnormal log entity entries corresponding to the attack category nodes.

[0013] Furthermore, in step 1, valid attributes of entities and events are extracted, specifically: extracting the unique identifier, category, IP address, label and name information of the entity entry in the log, and extracting the timestamp, category, event source and event destination information of the event log; wherein, the label of the entity entry is obtained by manual annotation.

[0014] Furthermore, in step 1, the method of constructing the labeled initial log traceability graph adopts the method of obtaining the log traceability graph in the APT attack detection method of MAGIC, specifically:

[0015] The entity entries in the system log are constructed as nodes, and the node attributes contain the valid information extracted from the entity log. The event entries in the system log are constructed as edges, and the edge attributes contain the valid information extracted from the event log. The edges connect the corresponding nodes through the entity unique identifiers corresponding to the event source and event destination in the event log to form a graph structure. After the graph structure is constructed, the nodes and edges are initially encoded, pruned, and denoised according to their types. The labels of the nodes in the log tracing graph come from the manually annotated entity entries related to APT attacks in the system log.

[0016] Furthermore, in step 1, the pruning and denoising steps are specifically: operations performed on the edges in the traceability graph, deleting redundant edges of the same type between the same node pairs, and merging edges of different types between the same node pairs, thereby reducing the complexity of the traceability graph structure. Furthermore, in step 2, the node classification model is specifically:

[0017] The node classification model consists of two parts: a GEN encoder and a classifier. The GEN encoder is responsible for encoding the log traceability graph into a graph representation feature that aggregates node attributes and structural information. It has two GEN network layers. The GEN graph neural network model improves and optimizes the graph convolutional network. The classifier is responsible for learning the graph representation features of benign and attack categories, and calculates the classification loss through the cross-entropy loss function. The classification loss is used to update the parameters of the GEN encoder and classifier.

[0018] Furthermore, the GEN encoder is specifically:

[0019] The GEN encoder uses a two-layer GEN network. By combining node features and neighborhood information, it can learn a richer feature representation of the input log provenance graph.

[0020] The GEN network layer is specifically:

[0021] The GEN network layer can represent the log traceability graph input into it as a graph representation feature that aggregates richer information. If the initial feature obtained by node i in step 1 is represented as x i , the edge between node i and neighboring node j is represented by e ij , the graph representation feature of node i output by the GEN network layer is represented as x′ i , the single-layer GEN network layer obtains the content of the graph representation feature as follows:

[0022] x′ i =MLP(x i +AGG({ReLU(x j +e ij )+∈:j∈Neighbor(i)}))

[0023] Among them, AGG represents the aggregation function, which aggregates the features of all neighbor nodes of a node; ReLU(·) represents the activation function; Neighbor(i) represents the set of neighbor nodes of node i; ∈ is the random noise term; MLP(·) represents the multi-layer perceptron.

[0024] Furthermore, the classifier is specifically:

[0025] The classifier can represent the input graph feature x′ i The classification is performed by a multi-layer perceptron to obtain the classification result of the graph representation feature; the multi-layer perceptron, if Represents the output of the l-th layer perceptron, W and b represent the trainable weights and bias respectively, then the output of the l-th layer of the multilayer perceptron is expressed as:

[0026]

[0027] Get the final output x of the multilayer perceptron * After that, the node category probability σ(x * ), obtain the predicted node category obtained by model classification The calculation is as follows:

[0028]

[0029] Get the predicted category of the node Finally, the nodes classified as attack categories are nodes related to APT attacks.

[0030] Furthermore, the training node classification model in step 2 is specifically as follows:

[0031] The log provenance graph obtained in step 1 is input into the node classification model. The node classification model uses the GEN encoder to represent the log provenance graph as a graph representation feature with better representation capabilities through information aggregation and other methods. The node classification model learns the difference between benign and attack categories through classifiers and labels, calculates the classification loss of the provenance graph nodes using cross-entropy loss, and updates the parameters of the GEN encoder and classifier in the node classification model. The loss L is calculated as follows:

[0032]

[0033] Where N is the number of node samples, y i is the actual label of node i, is the predicted label of node i.

[0034] Furthermore, in step 3, the log data to be detected is constructed into a log tracing graph;

[0035] The specific steps of pruning and denoising are: operating on the edges in the traceability graph, deleting redundant edges of the same type between the same node pairs, and merging different types of edges between the same node pairs, thereby reducing the complexity of the traceability graph structure; establishing a mapping relationship between traceability graph nodes and system log entities, specifically:

[0036] The entities in the system log have a unique identifier. When constructing a traceability graph node, the node attribute includes the unique identifier. Based on the unique identifier of the entity in the system log, a mapping relationship table between the log traceability graph node and the system log entity is constructed.

[0037] Furthermore, in step 4, the classification result of the node classification model is obtained, specifically:

[0038] The traceability graph to be detected obtained in step 3 is input into the node classification model trained in step 2. The node classification model inputs the traceability graph to be detected into the GEN encoder to obtain the graph representation features of the node to be detected, and uses the classifier to predict the category of the graph representation features, thereby predicting the category of the node to be detected.

[0039] Furthermore, in step 5, the abnormal log entity entry corresponding to the attack category node is obtained, specifically:

[0040] When constructing the mapping relationship between the log tracing graph node and the system entity in step 3, the unique identifier of the log tracing graph node is the same as the unique identifier in the log entity attribute. The log tracing graph node and the log entity can be matched in the mapping relationship table between the log tracing graph node and the system log entity through the unique identifier, and then the abnormal log entity entry can be obtained through the attack category node.

[0041] Another object of the present invention is to provide a fine-grained APT attack detection system based on a node classification model, comprising:

[0042] a memory for storing system log data and instructions executed by the processor;

[0043] A processor is configured to execute the instructions to implement the method described above.

[0044] Beneficial effects of the present invention:

[0045] (1) The present invention proposes a fine-grained APT attack detection method based on a node classification model. The method adopts a supervised learning method and trains the model based on the log traceability graph. Considering the difference between benign categories and attack categories in the traceability graph nodes, the APT attack detection task is regarded as a binary classification task. First, the information in the system log entries is extracted to construct a log traceability graph. Then, the log traceability graph is encoded by the GEN network to obtain the graph representation features corresponding to the nodes. Then, the graph representation features are classified by a classifier model constructed by a multi-layer perceptron. The nodes corresponding to the graph representation features classified as attacks are the attack nodes. Then, the log entity entries related to the attack can be obtained based on the mapping relationship between the log entity entries and the traceability graph nodes. This method can achieve better detection results in scenarios where label acquisition is relatively easy, and reduces the number of benign log entity entries mixed in the log entity entries detected as attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 The figure is a schematic diagram of the workflow of the fine-grained APT attack detection method based on the node classification model according to an embodiment of the present invention.

[0047] Figure 2 This is a schematic diagram of the basic framework and workflow of the node classification model in the fine-grained APT attack detection method based on the node classification model in an embodiment of the present invention.

[0048] Figure 3 This is a module diagram of a fine-grained APT attack detection system based on a node classification model according to an embodiment of the present invention. DETAILED DESCRIPTION

[0049] The present invention will be further described in detail below with reference to the accompanying drawings.

[0050] A fine-grained APT attack detection method based on node classification model, such as Figure 1 As shown, the method specifically includes the following steps: Step 1: Distinguish entity entries and event entries from labeled system log data, extract valid attributes of entities and events based on the content of the entries, construct a labeled log provenance graph, and perform pruning and noise reduction. This step converts system log entries into a provenance graph with causal relationships, which serves as training data for the node classification model, allowing the causal relationships between log entities to be considered in the subsequent model training process.

[0051] Step 1 specifically includes the following steps:

[0052] Step 1-1: Extract valid attributes of entities and events from labeled system log data. System logs can be divided into two categories based on the type of system log entries: entity logs and event logs. Entity logs are generally records of processes, files, and network flow objects in the system, while event logs are generally records of interactions between system entities such as processes and files. Entity logs require the extraction of information such as unique identifiers, categories, IP addresses, labels, and names from their entries. The labels of entity entries are obtained through manual annotation, and this information is used to construct nodes in the provenance graph. Event logs require the extraction of information such as timestamps, categories, event sources, and event purposes from their entries. This information is used to construct the provenance graph structure.

[0053] Step 1-2: Build a labeled log provenance graph. Based on the valid entity and event information extracted in Step 1-1, the provenance graph nodes are constructed using the information in the entity logs, and the provenance graph structure is constructed using the information in the event logs. The provenance graph structure is constructed by connecting the entity unique identifiers corresponding to the event source and event destination in the event log with the provenance graph nodes that match the event source and event destination in the event log.

[0054] Steps 1-3: Encode, prune, and denoise the provenance graph. Based on the node and edge categories in the provenance graph constructed in steps 1-2, encode the initial features of the nodes and edges using one-hot encoding. Redundant edges of the same type between identical node pairs are deleted, and edges of different types are aggregated. The initial features of these edges are combined by averaging, thus reducing the complexity of the provenance graph structure.

[0055] Step 2: Input the log traceability graph obtained in Step 1 into the node classification model, train the node classification model, and save the node classification model parameters after training. This step uses the node classification model to treat APT attack detection as a binary classification task for the nodes in the log traceability graph. This considers the role of labels and further aggregates node neighborhood features through the GEN network, allowing the classifier in the node classification model to learn more characteristic information about benign and attacking nodes.

[0056] Step 2 specifically includes the following steps:

[0057] Step 2-1: Train the node classification model. The node classification model consists of a GEN encoder and a classifier. Its basic framework and workflow are as follows: Figure 2As shown. GEN is a graph neural network model proposed in the paper DeeperGCN: All You Need to Train Deeper GCNs. After the log traceability graph is input into the node classification model, the GEN encoder is responsible for encoding the log traceability graph into a graph representation feature that aggregates node attributes and structural information. The GEN encoder consists of two layers of GEN network layers. If the initial feature of node i in the traceability graph is represented as x i , the edge between node i and neighboring node j is represented by e ij , the graph representation feature of node i output by the GEN network layer is represented as x′ i , the single-layer GEN network layer obtains the content of the graph representation feature as follows:

[0058] x′ i =MLP(x i +AGG({ReLU(x j +e ij )+∈:j∈Neighbor(i)}))

[0059] Among them, AGG represents the aggregation function, which aggregates the features of all neighbor nodes of a node; ReLU(·) represents the activation function; Neighbbor(i) represents the set of neighbor nodes of node i; ∈ is the random noise term; MLP(·) represents the multi-layer perceptron.

[0060] After obtaining the graph representation features of the nodes, the node classification model will use the classifier to learn the difference between the graph representation features of benign and attack nodes. The classifier is composed of a multi-layer perceptron that can input the graph representation features x′ i The classification is performed by a multi-layer perceptron to obtain the classification result of the graph representation feature. The multi-layer perceptron, if Represents the output of the l-th layer perceptron, W and b represent the trainable weights and bias respectively, then the output of the l-th layer of the multilayer perceptron can be expressed as:

[0061]

[0062] Get the final output x of the multilayer perceptron * After that, the category probability σ(x * ), the activation function in this embodiment uses the softmax function to obtain the predicted node category obtained by model classification The calculation is as follows:

[0063]

[0064] Get the predicted category of the node Finally, the nodes classified as attack categories are nodes related to APT attacks.

[0065] The parameters of the GEN encoder and classifier in the node classification model are updated by the node classification loss calculated by the cross entropy loss function. The loss L is calculated as follows:

[0066]

[0067] Where N is the number of node samples, y i is the actual label of node i, is the predicted label of node i.

[0068] Step 2-2: Save the parameters of the node classification model after training. After the node classification model is trained, save the various parameters in the model for subsequent loading of the trained model parameters in the node classification model and completing the detection of the node to be detected.

[0069] Step 3: Distinguish entity entries and event entries from the system log data to be tested. Based on the content of the entries, extract the valid attributes of the entities and events, construct a traceability graph for the log to be tested, perform pruning and noise reduction, and establish a mapping relationship between traceability graph nodes and system log entities. The traceability graph constructed from the log entities to be tested in this step is used as input to the node classification model to detect attacks in the logs to be tested. The mapping relationship between log entity entries and log traceability graph nodes constructed in this step is used to subsequently query the corresponding log entity entries based on the attack nodes detected.

[0070] Step 3 specifically includes the following steps:

[0071] Step 3-1: Construct a log traceability graph for the system to be tested. Extract the attributes of entities and events in the log data of the system to be tested in the same way as in Step 1, and construct a log traceability graph.

[0072] Step 3-2: Initially encode, prune, and denoise the log traceability graph to be tested. Use one-hot encoding to encode the initial features of the nodes and edges in the log traceability graph to be tested. Redundant edges of the same type between identical node pairs are deleted, and edges of different types are aggregated. The initial features of these edges are combined by averaging, thereby reducing the structural complexity of the log traceability graph to be tested.

[0073] Step 3-3: Construct a mapping relationship between the log provenance graph and log entities. Entities in the system log have unique identifiers. When constructing a provenance graph node, this unique identifier is included in the node attributes. Based on the correspondence between the unique identifiers of the system log entities and the unique identifiers of the nodes in the log provenance graph, a mapping relationship between the provenance graph nodes and the system log entities is constructed. This mapping relationship between provenance graph nodes and system log entities is used to implement fine-grained APT attack detection. The log provenance graph nodes for the detected attack categories can be used to determine the corresponding abnormal log entity entries.

[0074] Step 4: Load the node classification model parameters saved in Step 2 and input the log traceability graph to be detected obtained in Step 3 into the node classification model to obtain the classification results. Nodes classified as attack are nodes associated with APT attacks. This step uses the node classification model to classify the nodes in the log traceability graph to be detected as benign or attack nodes.

[0075] Step 4 specifically includes the following steps:

[0076] Step 4-1: Load the node classification model parameters. Load the trained model parameters saved in step 2 into the node classification model.

[0077] Step 4-2: Input the log traceability graph to be tested into the node classification model. After the node classification model parameters are loaded, the log traceability graph to be tested is input into the node classification model. The node classification model first converts the log traceability graph to be tested into graph representation features of each node using the GEN encoder. Then, the graph representation features are classified by the classifier. The log traceability graph nodes corresponding to the graph representation features classified as attack categories are the nodes of the attack category.

[0078] Step 5: Based on the mapping relationship between the log source graph nodes to be detected and the system log entities obtained in Step 3, combined with the attack category nodes determined in Step 4, obtain the abnormal log entity entries corresponding to the attack category nodes. The purpose of this step is to obtain the log entity entries related to the attack based on the attack nodes.

[0079] An embodiment of the present invention further provides a fine-grained APT attack detection system based on a node classification model, comprising: a memory for storing instructions executable by a processor; and a processor for executing the instructions to implement the method described above.

[0080] A fine-grained APT attack detection system based on node classification model, such as Figure 3 As shown in the figure, it consists of four modules, including log traceability graph construction module, node classification model training module, attack detection module and log feedback module.

[0081] Among them, the log traceability graph construction module is responsible for the corresponding functions in steps 1 and 3. By extracting the valid attribute information of entities and events in the system log, it constructs a labeled log traceability graph for training node classification models, or constructs the log traceability graph to be detected, and at the same time establishes the mapping relationship between nodes and log entities in the log traceability graph to be detected.

[0082] The node classification model training module is responsible for the corresponding functions in step 2. It trains the node classification model through the labeled log traceability graph and saves the trained node classification model after the training is completed.

[0083] The attack detection module is responsible for the corresponding functions in step 4. It obtains the trained node classification model by loading the parameters of the trained node classification model obtained in step 2, and inputs the log tracing graph to be detected obtained in step 3 into the trained node classification model to obtain the classification results of the node classification model. Nodes classified as attack categories are nodes related to APT attacks.

[0084] The log feedback module is responsible for the corresponding functions in step 5. Based on the mapping relationship between the traceability graph nodes to be detected and the log entities obtained in step 3, it obtains the abnormal log entity corresponding to the node predicted to be the attack category and returns the entity log entry corresponding to the abnormal log entity.

[0085] The above embodiment of the fine-grained APT attack detection method based on the node classification model proposed in the present invention performs APT attack detection on a subset of the DARPA-E3 Cadets dataset. Multiple test results show that the F1 score, precision and recall rate of the present invention can all reach about 99%. The test results show that the present invention has a good detection effect in the APT attack detection task. If the GEN network in the node classification model of the present invention is replaced with a GCN network, its F1 score can reach about 87%, the precision rate can reach about 80%, and the recall rate can reach about 98%, reflecting the effectiveness of the GEN as a graph encoder network in the present invention. The above-mentioned fine-grained APT attack detection system based on the node classification model can be implemented as a computer program, stored in a hard disk, and can be recorded in a processor for execution to implement the method of the embodiment of the present invention.

[0086] The present invention proposes a fine-grained APT attack detection method based on a node classification model. The method uses labeled log provenance graph data to train the node classification model, taking into account the influence of labels on the detection effect. Compared with unsupervised or semi-supervised methods, the model can better distinguish the feature differences between benign categories and attack categories in the provenance graph nodes. It regards the APT attack detection task as a binary classification task, and can achieve better detection effects in scenarios where labels are relatively easy to obtain, reducing the number of benign log entity entries mixed in the log entity entries detected as attacks.

[0087] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above and that the invention can be embodied in other specific forms without departing from the spirit or essential characteristics of the invention. Therefore, the embodiments should be considered in all respects as illustrative and non-restrictive, and the scope of the invention is defined by the appended claims, not the foregoing description, and all variations within the meaning and range of equivalents of the claims are intended to be included therein. Any reference sign in a claim should not be construed as limiting the claim to which it relates.

[0088] In addition, it should be understood that although this specification is described in terms of implementation methods, not every implementation method contains only one independent technical solution. This narrative method of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other implementation methods that can be understood by those skilled in the art.

[0089] The above description is only a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention are included in the scope of protection of the present invention.

Claims

1. A fine-grained APT attack detection method based on a node classification model, characterized by: The following steps are included: Step 1: Distinguish entity entries and event entries from labeled system log data. Based on the content of the entity entries and event entries, extract the valid attributes of the entities and events, build an initial labeled log provenance graph, and process the log provenance graph through pruning and noise reduction to obtain a log provenance graph that can be used in subsequent steps. Step 2: Input the log traceability graph after pruning and noise reduction into the node classification model, train the node classification model, and save the parameters of the node classification model after training; Step 3: Establish a mapping relationship between the log source traceability graph node to be detected and the system log entity; Step 4: Load the saved node classification model parameters, input the pruned and denoised log source graph to be detected into the node classification model, and obtain the classification results of the node classification model. Nodes classified as attack categories are nodes related to APT attacks. Step 5: According to the mapping relationship between the nodes in the log source traceability graph to be detected and the system log entities, combined with the attack category nodes determined in step 4, obtain the abnormal log entity entries corresponding to the attack category nodes.

2. The fine-grained APT attack detection method based on the node classification model according to claim 1 is characterized in that: In step 1, valid attributes of entities and events are extracted, specifically: the unique identifier, category, IP address, label, and name information of the entity entry in the log are extracted; the timestamp, category, event source, and event destination information of the event log are extracted; wherein the label of the entity entry is obtained by manual annotation; The method for constructing the labeled initial log traceability graph adopts the method of obtaining the log traceability graph using the APT attack detection method of MAGIC. Specifically: The entity entries in the system log are constructed as nodes, and the node attributes contain the valid information extracted from the entity log. The event entries in the system log are constructed as edges, and the edge attributes contain the valid information extracted from the event log. The edges connect the corresponding nodes through the entity unique identifiers corresponding to the event source and event destination in the event log to form a graph structure. After the graph structure is constructed, the nodes and edges are initially encoded, pruned, and denoised according to their types. The labels of the nodes in the log tracing graph come from the manually annotated entity entries related to APT attacks in the system log.

3. The fine-grained APT attack detection method based on the node classification model according to claim 2 is characterized in that: In step 1, the pruning and denoising steps are specifically as follows: performing operations on the edges in the provenance graph, deleting redundant edges of the same type between the same node pairs, and merging edges of different types between the same node pairs, thereby reducing the complexity of the provenance graph structure.

4. The fine-grained APT attack detection method based on the node classification model according to claim 2 is characterized in that: In step 2, the node classification model is specifically: The node classification model consists of two parts: a GEN encoder and a classifier. The GEN encoder is responsible for encoding the log traceability graph into a graph representation feature that aggregates node attributes and structural information. It has two GEN network layers. The GEN network layer is a graph neural network model that improves and optimizes the graph convolutional network. The classifier is responsible for learning the graph representation features of benign and attack categories and calculating the classification loss through the cross entropy loss function. The classification loss is used to update the parameters of the GEN encoder and classifier.

5. The fine-grained APT attack detection method based on the node classification model according to claim 4 is characterized in that: The GEN network layer is specifically: If the initial feature obtained by node i in step 1 is represented as x i , the edge between node i and neighboring node j is represented by e ij , the graph representation feature of node i output by the GEN network layer is represented as x′ i , the single-layer GEN network layer obtains the content of the graph representation feature as follows: x′ i =MLP(x i +AGG({ReLU(x j +e ij )+∈:j∈Neighbor(i)})) Where AGG represents the aggregation function, which aggregates the features of all neighbor nodes of a node; ReLU(·) represents the activation function; Neighbor(i) represents the set of neighbor nodes of node i; ∈ is a random noise term; MLP(·) represents a multi-layer perceptron; The classifier is specifically: The classifier takes as input the graph representation feature x′ i The classification is performed by a multi-layer perceptron to obtain the classification result of the graph representation feature; the multi-layer perceptron, if Represents the output of the l-th layer perceptron, W and b represent the trainable weights and bias respectively, then the output of the l-th layer of the multilayer perceptron is expressed as: Get the final output x of the multilayer perceptron * After that, the node category probability σ(x * ), obtain the predicted node category obtained by model classification The calculation is as follows: Get the predicted category of the node Finally, the nodes classified as attack categories are nodes related to APT attacks.

6. The fine-grained APT attack detection method based on the node classification model according to claim 5 is characterized in that: The training node classification model in step 2 is specifically as follows: The log traceability graph obtained in step 1 is input into the node classification model. The node classification model uses the GEN encoder to aggregate information from the log traceability graph and represent it as a graph representation feature with better representation capabilities. The node classification model learns the difference between benign and attack categories through classifiers and labels, and calculates the classification loss of the traceability graph nodes through cross entropy loss. It updates the parameters of the GEN encoder and classifier in the node classification model. The loss L is calculated as follows: Where N is the number of node samples, y i is the actual label of node i, is the predicted label of node i.

7. The fine-grained APT attack detection method based on the node classification model according to claim 6 is characterized in that: In step 3, the log data to be detected is constructed into a log traceability graph; The specific steps of pruning and denoising are: operating on the edges in the traceability graph, deleting redundant edges of the same type between the same node pairs, and merging different types of edges between the same node pairs, thereby reducing the complexity of the traceability graph structure; establishing a mapping relationship between traceability graph nodes and system log entities, specifically: The entities in the system log have a unique identifier. When constructing a traceability graph node, the node attribute includes the unique identifier. Based on the unique identifier of the entity in the system log, a mapping relationship table between the log traceability graph node and the system log entity is constructed.

8. The fine-grained APT attack detection method based on the node classification model according to claim 7 is characterized in that: In step 4, the classification results of the node classification model are obtained, specifically: The traceability graph to be detected obtained in step 3 is input into the node classification model trained in step 2. The node classification model inputs the traceability graph to be detected into the GEN encoder to obtain the graph representation features of the node to be detected, and uses the classifier to predict the category of the graph representation features, thereby predicting the category of the node to be detected.

9. The fine-grained APT attack detection method based on the node classification model according to claim 8 is characterized in that: In step 5, the abnormal log entity entry corresponding to the attack category node is obtained, specifically: When constructing the mapping relationship between the log tracing graph node and the system entity in step 3, the unique identifier of the log tracing graph node is the same as the unique identifier in the log entity attribute. The log tracing graph node and the log entity can be matched in the mapping relationship table between the log tracing graph node and the system log entity through the unique identifier, and then the abnormal log entity entry can be obtained through the attack category node.

10. A fine-grained APT attack detection system based on a node classification model, characterized in that: include: a memory for storing system log data and instructions executed by the processor; A processor, configured to execute the instructions to implement the method according to any one of claims 1 to 9.

Images