Terminal threat event detection method and apparatus, computer device, and storage medium

Abstract

Embodiments of the present application provide a terminal threat event detection method and device, computer equipment and a storage medium. Including: obtaining the interaction data of the target terminal to construct a heterogeneous network behavior graph, and determining the target node and the associated path meta graph that need to be detected; for each path meta graph, adjusting the neighbor node vector according to the node similarity between the neighbor node and the target node to obtain a first node embedding vector, and obtaining a graph embedding representation based on a plurality of first node embedding vectors; for each neighbor node, fusing the neighbor node vector and the graph embedding representation according to the calculated attention score to obtain a second node embedding vector; aggregating a plurality of second node embedding vectors and the target node to obtain a comprehensive embedding representation of the path meta graph; and fusing a plurality of comprehensive embedding representations to obtain a target node embedding and inputting the target node embedding into a target classification model to obtain a threat event detection result. In this way, the efficiency and accuracy of threat event detection can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a terminal threat event detection method and device, computer equipment and a storage medium. BACKGROUND

[0002] Terminal malicious behavior detection is to identify potential malicious attack behaviors by monitoring and analyzing the process activities, file operations, network communications and other behaviors of terminal devices (such as servers, personal computers, mobile terminals, etc.). In today's highly interconnected network environment, terminal devices are the core nodes of enterprise data storage and business processing. Once attacked, they may lead to serious consequences such as sensitive data leakage, system paralysis, and business interruption. Therefore, efficient terminal threat detection technology is crucial to protect the security of critical infrastructure.

[0003] In related technologies, a detection method based on artificial rules is usually used for terminal threat event detection. Specifically, security experts define fixed detection rules in advance and store them in a rule library. The terminal agent matches the static features in the rule library with the system call logs through monitoring, and if a match is found, it is determined that there is a security threat. However, with the continuous emergence of new attack methods and variants, the rule library needs to be continuously expanded, resulting in a sharp increase in the number of rules, affecting detection efficiency. Secondly, due to the dynamic evolution of attack patterns, the rule library is difficult to update in time, resulting in a decline in detection accuracy. SUMMARY

[0004] The present application proposes a terminal threat event detection method, device, computer equipment and storage medium, which can improve the efficiency and accuracy of terminal threat event detection.

[0005] To achieve the above-mentioned purpose, the first aspect of the embodiment of the present application proposes a terminal threat event detection method, which comprises:

[0006] Obtaining interaction data of a target terminal, and constructing a heterogeneous network behavior graph based on the interaction data;

[0007] Determining a target node to be detected and a plurality of path meta-graphs associated with the target node from the heterogeneous network behavior graph;

[0008] Among them, the plurality of path meta-graphs includes a single path meta-graph and a multi-path meta-graph, the single path meta-graph is composed of a single path corresponding to the target node, the multi-path meta-graph is obtained by path merging of a plurality of paths corresponding to the target node, and the single path meta-graph and the multi-path meta-graph do not have an intersection path.

[0009] For each path meta graph, the neighbor node vector of each neighbor node is weight adjusted according to the node similarity between each neighbor node and the target node, to obtain a first node embedding vector, and a graph embedding representation is obtained based on fusion of a plurality of first node embedding vectors corresponding to a plurality of neighbor nodes;

[0010] For each neighbor node, an attention score is calculated according to the node similarity between the neighbor node and the target node, and context feature fusion is performed on the neighbor node vector and the graph embedding representation based on the attention score, to obtain a corresponding second node embedding vector;

[0011] A plurality of second node embedding vectors corresponding to a plurality of neighbor nodes are aggregated with a target node vector of the target node, to obtain a comprehensive embedding representation corresponding to each path meta graph;

[0012] A target node embedding is obtained based on fusion of a plurality of comprehensive embedding representations corresponding to a plurality of path meta graphs, and the target node embedding is input into a target classification model to obtain a threat event detection result corresponding to the target node.

[0013] Correspondingly, a second aspect of the embodiment of the application provides a terminal threat event detection device, the device comprising:

[0014] An acquisition module is configured to acquire interaction data of a target terminal, and construct a heterogeneous network behavior graph based on the interaction data;

[0015] A determination module is configured to determine a target node to be detected and a plurality of path meta graphs associated with the target node from the heterogeneous network behavior graph;

[0016] The plurality of path meta graphs comprise a single-path meta graph and a multi-path meta graph, the single-path meta graph is composed of a single path corresponding to the target node, the multi-path meta graph is obtained by path merging of a plurality of paths corresponding to the target node, with the target node as a first collection node and a path node common to the plurality of paths as a second collection node, and the single-path meta graph and the multi-path meta graph do not have an intersection path;

[0017] An adjustment module is configured to, for each path meta graph, weight adjust a neighbor node vector of each neighbor node according to a node similarity between each neighbor node and the target node, to obtain a first node embedding vector, and obtain a graph embedding representation based on fusion of a plurality of first node embedding vectors corresponding to a plurality of neighbor nodes;

[0018] The computing module is configured to calculate, for each neighbor node, an attention score according to a node similarity between the target node, and perform context feature fusion on the neighbor node vector and the graph embedding representation based on the attention score, to obtain a corresponding second node embedding vector;

[0019] The aggregating module is configured to aggregate the plurality of second node embedding vectors corresponding to the plurality of neighbor nodes and the target node vector of the target node, to obtain a comprehensive embedding representation corresponding to each path subgraph;

[0020] The input module is configured to fuse a plurality of comprehensive embedding representations corresponding to the plurality of path subgraphs to obtain a target node embedding, and input the target node embedding into a target classification model to obtain a threat event detection result corresponding to the target node.

[0021] In some embodiments, the adjusting module is further configured to:

[0022] For each path subgraph, a node similarity between each neighbor node and the target node is obtained, and the node similarity is mapped to a positive number space through exponential operation to obtain an initial node weight;

[0023] A sum of a plurality of initial node weights corresponding to a plurality of neighbor nodes included in the each path subgraph is obtained to obtain a node weight total sum;

[0024] Based on a ratio of the initial node weight to the node weight total sum, a target node weight of the each neighbor node is obtained;

[0025] Based on the target node weight, a neighbor node vector of the each neighbor node is adjusted in weight to obtain a first node embedding vector.

[0026] In some embodiments, the computing module is further configured to:

[0027] For each neighbor node, a node similarity between a neighbor node vector and a target node vector of the target node is calculated;

[0028] A preset balance parameter of a path subgraph corresponding to the each neighbor node and a graph attention vector of the path subgraph are obtained;

[0029] Based on a product of the preset balance parameter and the node similarity, an attention sub-item is obtained;

[0030] Based on the preset balance parameter, the graph attention vector and the graph embedding representation, a balance sub-item is obtained;

[0031] Based on the attention sub-item and the balance sub-item, an attention score of the each neighbor node is obtained.

[0032] In some embodiments, the input module is further configured to:

[0033] For each path meta-graph, obtain a corresponding semantic fusion weight matrix, a global semantic preference vector and a comprehensive embedding representation, wherein the global semantic preference vector is used to quantify the semantic importance of the each path meta-graph;

[0034] Based on the semantic fusion weight matrix, the global semantic preference vector and the comprehensive embedding representation, an initial graph weight is calculated;

[0035] Obtain the sum of the plurality of initial graph weights corresponding to the plurality of path meta-graphs to obtain a graph comprehensive weight;

[0036] Based on the ratio of each initial graph weight to the graph comprehensive weight, a target graph weight corresponding to the each path meta-graph is obtained;

[0037] According to the target graph weight of the each path meta-graph, the comprehensive embedding representation of the each path meta-graph is adjusted in weight to obtain an updated comprehensive embedding representation;

[0038] Based on the sum of the plurality of updated comprehensive embedding representations corresponding to the plurality of path meta-graphs, a target node embedding of the target node is obtained.

[0039] In some embodiments, the terminal threat event detection device further comprises a training module configured to:

[0040] Obtain sample interaction data and construct a sample heterogeneous network behavior graph based on the sample interaction data;

[0041] Determine a sample target node to be detected and a plurality of sample path meta-graphs associated with the sample target node from the sample heterogeneous network behavior graph;

[0042] The plurality of sample path meta-graphs include a sample single path meta-graph and a sample multi-path meta-graph, the sample single path meta-graph is composed of a single sample meta-path corresponding to the sample target node, the sample multi-path meta-graph is obtained by path merging a plurality of sample meta-paths according to the sample target node as a first collection node and a path node common to the plurality of sample meta-paths as a second collection node, and the sample single path meta-graph and the sample multi-path meta-graph do not have an intersection path;

[0043] For each sample path meta graph, a sample first neighbor node vector of each sample neighbor node is adjusted in weight according to a sample node similarity between each sample neighbor node and the sample target node, to obtain a sample first node embedding vector, and a sample graph embedding representation is obtained based on fusion of a plurality of sample first node embedding vectors corresponding to a plurality of sample neighbor nodes;

[0044] For each sample neighbor node, a sample second node embedding vector corresponding to the sample neighbor node is obtained based on context feature fusion of the sample neighbor node vector and the sample graph embedding representation according to a sample attention score calculated according to the sample node similarity between the sample neighbor node and the sample target node;

[0045] A plurality of sample second node embedding vectors corresponding to a plurality of sample neighbor nodes and a sample target node vector of the sample target node are aggregated to obtain a sample comprehensive embedding representation corresponding to each sample path meta graph;

[0046] A sample target node embedding is obtained based on fusion of a plurality of sample comprehensive embedding representations corresponding to the plurality of sample path meta graphs, and the sample target node embedding is input into a preset classification model to obtain a predicted threat event detection result corresponding to the sample target node;

[0047] A first loss is constructed based on a difference between the predicted threat event detection result and a preset sample threat event detection result;

[0048] A sample first attention score mean corresponding to a plurality of sample first neighbor nodes of a plurality of sample single path meta graphs and a sample second attention score mean corresponding to a plurality of sample second neighbor nodes of a plurality of sample multi-path meta graphs are obtained, and a second loss is constructed based on a difference between the sample second attention score mean and the sample first attention score mean;

[0049] Parameters of the preset classification model are adjusted based on the first loss and the second loss to obtain a target classification model.

[0050] In some embodiments, the training module is further configured to:

[0051] For each sample single path meta graph, a sample first attention score of each sample first neighbor node is obtained;

[0052] A first number of a plurality of sample first neighbor nodes of a plurality of sample single path meta graphs is obtained, and a sample first attention score mean is obtained based on a ratio of a sum of a plurality of sample first attention scores corresponding to the plurality of sample first neighbor nodes to the first number;

[0053] For each sample multi-path meta graph, a second neighbor node of each sample is obtained, and a second attention score of the second neighbor node of each sample is obtained;

[0054] A second number of the plurality of sample second neighbor nodes of the plurality of sample multi-path meta graphs is obtained, and a second attention score mean value is obtained according to a ratio of a sum of the plurality of sample second attention scores corresponding to the plurality of sample second neighbor nodes to the second number.

[0055] In some embodiments, the training module is further configured to:

[0056] A first difference value is determined based on a difference between the sample second attention score mean value and the sample first attention score mean value.

[0057] A preset boundary threshold value is obtained, and a second difference value is determined based on a difference between the preset boundary threshold value and the first difference value.

[0058] A preset reference zero value is obtained, and a second loss is constructed based on a size relationship between the preset reference zero value and the second difference value.

[0059] Correspondingly, a third aspect of the embodiments of the present application provides a computer device, which comprises a memory and a processor. The memory stores a computer program, and the processor implements the terminal threat event detection method of any one of the first aspect of the embodiments of the present application when executing the computer program.

[0060] Correspondingly, a fourth aspect of the embodiments of the present application provides a computer readable storage medium, which stores a computer program. The computer program is executed by a processor to implement the terminal threat event detection method of any one of the first aspect of the embodiments of the present application.

[0061] This application embodiment acquires the interaction data of the target terminal and constructs a heterogeneous network behavior graph based on the interaction data; it determines the target node to be detected and multiple path metagraphs associated with the target node from the heterogeneous network behavior graph; wherein, the multiple path metagraphs include single-path metagraphs and multi-path metagraphs, the single-path metagraph is composed of a single meta-path corresponding to the target node, and the multi-path metagraph is obtained by merging multiple meta-paths according to the target node as the first aggregation node and the path nodes common to the multiple meta-paths corresponding to the target node as the second aggregation node, and the single-path metagraph and the multi-path metagraph have no intersecting paths; for each path metagraph, according to the node similarity between each neighbor node and the target node, the neighbor node vector of each neighbor node is processed. The weights are adjusted to obtain the first node embedding vector, and the graph embedding representation is obtained by fusing multiple first node embedding vectors corresponding to multiple neighboring nodes. For each neighboring node, an attention score is calculated based on the node similarity with the target node, and the contextual features are fused with the neighboring node vector and the graph embedding representation based on the attention score to obtain the corresponding second node embedding vector. The multiple second node embedding vectors corresponding to multiple neighboring nodes are aggregated with the target node vector of the target node to obtain the comprehensive embedding representation corresponding to each path metagraph. The target node embedding is obtained by fusing multiple comprehensive embedding representations corresponding to multiple path metagraphs, and the target node embedding is input into the target classification model to obtain the threat event detection result corresponding to the target node. Therefore, for multiple meta-paths associated with a target node, a path merging strategy can be used to generate a meta-graph composed of multiple paths. This effectively captures cross-path collaboration or inhibition effects between meta-paths, improving the comprehensiveness and accuracy of attack detection, especially combined attacks. Secondly, during feature extraction, the initial embedding vector weights of neighboring nodes are dynamically adjusted based on node similarity, and the resulting meta-graph-level embedding representation is fused to fully consider the contribution of different neighboring nodes to the meta-graph. Furthermore, an attention mechanism is used to quantify the impact of meta-graph semantics on node importance, achieving dynamic fusion of contextual features. This suppresses noise interference from high-frequency normal interactions while preserving the semantic features of key threat paths, significantly improving the detection signal-to-noise ratio. Finally, by aggregating the comprehensive embedding representation of the multi-path meta-graph and inputting it into a pre-trained classification model, malicious behavior in complex attack chains can be identified more flexibly and accurately, effectively improving detection efficiency and accuracy. Attached Figure Description

[0062] Figure 1 This is a schematic diagram of the architecture of the terminal threat event detection system provided in the embodiments of this application;

[0063] Figure 2 This is a flowchart of the terminal threat event detection method provided in the embodiments of this application;

[0064] Figure 3is an example path meta diagram provided by an embodiment of the present application;

[0065] Figure 4 is an example context attention mechanism diagram provided by an embodiment of the present application;

[0066] Figure 5 is a general flowchart of a terminal threat event detection method provided by an embodiment of the present application;

[0067] Figure 6 is a functional module schematic diagram of a terminal threat event detection apparatus provided by an embodiment of the present application;

[0068] Figure 7 is a hardware structure schematic diagram of a computer device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0069] In order to make the purpose, technical scheme and advantages of the present application clearer, the present application is further described in detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0070] It should be noted that although the functional modules are divided in the apparatus schematic diagram, and the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a manner different from the module division in the apparatus or the order in the flowchart. The terms "first", "second", etc. in the specification and claims and the above-described drawings are used to distinguish similar objects, and do not necessarily describe a specific order or sequence.

[0071] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0072] Terminal malicious behavior detection is to identify potential malicious attack behavior by monitoring and analyzing the process activities, file operations, network communications and other behaviors of terminal devices (such as servers, personal computers, mobile terminals, etc.). In today's highly interconnected network environment, terminal devices are the core nodes of enterprise data storage and business processing. Once attacked, they may cause serious consequences such as sensitive data leakage, system paralysis, and business interruption. Therefore, efficient terminal threat detection technology is crucial to protect the security of critical infrastructure.

[0073] In the related art, a detection method based on artificial rules is usually used for terminal threat event detection. Specifically, a security expert defines fixed detection rules in advance and stores them in a rule library. A terminal agent matches the static features in the rule library with system call logs through monitoring, and determines that there is a security threat if the matching is successful. However, as new attack methods and variants continue to emerge, the rule library needs to be continuously expanded, resulting in a sharp increase in the number of rules, which affects the detection efficiency. In addition, due to the dynamic evolution of attack patterns, the rule library is difficult to update in time, resulting in a decrease in detection accuracy.

[0074] Based on this, the embodiments of the present application provide a terminal threat event detection method, device, computer equipment and storage medium, which can improve the efficiency and accuracy of terminal threat event detection.

[0075] The terminal threat event detection method, device, computer equipment and storage medium provided by the embodiments of the present application are specifically explained by the following embodiments. First, the terminal threat event detection system in the embodiments of the present application is described.

[0076] Please refer to Figure 1 In some embodiments, the embodiments of the present application provide a terminal threat event detection system, which includes a terminal 11 and a server 12.

[0077] For example, the terminal 11 can be a smart phone, a tablet computer, a notebook computer or a desktop computer, etc. The terminal 11 is used as a computing tool for daily use by users, and performs various tasks from simple data processing to complex network interaction. In addition, the terminal 11 can also be responsible for collecting behavior data during its own operation, such as system logs, process call relationships and network communication activities, etc. The built-in detection module can preliminarily analyze whether there is a malicious behavior indication.

[0078] Further, the server 12 can be a high-performance server cluster, a cloud service platform or a computing node in a data center, etc. The server 12 can have powerful computing capability and storage resources, and can process and analyze large-scale data sets uploaded from a plurality of terminals 11. The server 12 mainly undertakes the task of deep analysis, which can train a preset classification model, and based on the target classification model obtained by training, comprehensively evaluate the interaction data uploaded by the terminal 11, output the corresponding threat event detection result for the target node to be detected, and generate the corresponding defense strategy.

[0079] The terminal threat event detection method in the embodiments of the present application can be explained by the following embodiments.

[0080] It should be noted that in various specific embodiments of the present application, when relevant processing needs to be performed on data related to the identity or characteristics of the user, such as user information, user behavior data, user history data, and user location information, the user's permission or consent will be obtained first. Moreover, the collection, use, and processing of such data will comply with relevant laws, regulations, and standards. In addition, when the embodiments of the present application need to obtain sensitive personal information of the user, the separate permission or separate consent of the user will be obtained through a pop-up window or a jump to a confirmation page, and after obtaining the separate permission or separate consent of the user, the necessary user-related data for enabling the embodiments of the present application to function normally will be obtained.

[0081] In the embodiments of the present application, the terminal threat event detection device will be described from the dimension of the terminal threat event detection device, which can be integrated in a computer device. Referring to Figure 2 , Figure 2 The step flow chart of the terminal threat event detection method provided by the embodiments of the present application, the embodiments of the present application take the terminal threat event detection device integrated in a terminal or a server as an example, and when the processor on the terminal or the server executes the program instructions corresponding to the terminal threat event detection method, the specific process is as follows:

[0082] Step 101, obtaining interaction data of a target terminal, and constructing a heterogeneous network behavior graph based on the interaction data.

[0083] In some embodiments, in order to achieve accurate detection of terminal malicious behavior, interaction data inside the target terminal can be obtained, and a heterogeneous network behavior graph containing multiple types of nodes and relationships can be constructed to capture complex semantic associations and topological structure features in the interaction data, thereby improving the recognition ability of threat events.

[0084] Among them, the target terminal can be a computer, a mobile device, or a server to be detected for terminal threat events.

[0085] Among them, the interaction data can be the behavior relationship data between entities of the target terminal, which can be obtained through the system log, security device alarm log, threat intelligence, attack and defense exercise data, application program log, network traffic data, etc. of the target terminal.

[0086] Among them, the heterogeneous network behavior graph can be a directed graph structure containing multiple types of nodes (such as processes, files, network connections) and multiple types of relationship edges (such as read-write, communication), which can be constructed by mapping the interaction data into nodes and edges and labeling the types, for example, by converting log entries into graph models through Neo4j or NetworkX tools.

[0087] Exemplarily, interaction data of the target terminal can be collected, such as system logs, security device alarm logs, application program logs, network traffic data, and the like, and data cleaning operations are performed to extract key entities (for example, processes, files, network connections, users, and the like) and their mutual relationships (for example, read-write operations, communication connections, permission changes, and the like) therefrom.

[0088] Further, type labels of each entity and relationship contained in the interaction data can be defined to ensure that nodes and edges of different types can be distinguished. Next, a directed graph is constructed using the data with type labels, where nodes represent entities and edges represent relationships between entities, to capture complex semantic associations and topological structure features.

[0089] In this way, a heterogeneous network behavior graph capable of representing complex semantic relationships between entities of the target terminal can be constructed to retain multi-dimensional topological features and semantic associations in the original interaction data, facilitating subsequent meta-graph analysis and improving the accuracy of terminal threat event detection.

[0090] Step 102, determining a target node to be detected and a plurality of path meta-graphs associated with the target node from the heterogeneous network behavior graph.

[0091] The plurality of path meta-graphs include a single-path meta-graph and a multi-path meta-graph. The single-path meta-graph is composed of a single meta-path corresponding to the target node. The multi-path meta-graph is obtained by path merging of a plurality of meta-paths in accordance with the target node being a first collection node and a path node common to the plurality of meta-paths being a second collection node. The single-path meta-graph and the multi-path meta-graph do not have intersecting paths.

[0092] In some embodiments, to improve the ability to identify high-concealment, multi-step combination attacks, the plurality of meta-paths pointing to the same neighbor node can be merged into a multi-path meta-graph, and the meta-path having no intersecting neighbor nodes with other meta-paths can be determined as a single-path meta-graph. This facilitates modeling of multi-path attack chains of terminal malicious behavior, retains complex semantic associations between the target node and its neighbors and cross-path dependency relationships, enhances the understanding of complex attacks by the model, and further improves the accuracy and robustness of overall malicious behavior detection.

[0093] The target node can be an entity (such as a suspicious process, file, and the like) of the target terminal in the heterogeneous network behavior graph that needs threat event detection. It can be determined by screening high-risk behavior logs or abnormal activity indicators (such as frequent access to sensitive directories, abnormal external Internet Protocol addresses), for example, by threat intelligence matching or behavior clustering algorithms.

[0094] Wherein, the path meta-graph can be a path graph representing the relationship between the target node and the neighbor node, which is a path connected by nodes and the relationship between the nodes, for example, A1→A2→A3, and the corresponding relationship between the nodes is marked.

[0095] Wherein, the single-path meta-graph can be a topology graph structure composed of the neighbor nodes connected by the single-path meta-graph and the target node as the starting node.

[0096] Wherein, the multi-path meta-graph can be a graph structure formed by merging multiple meta-path instances through a shared path node (such as a file or a registry item) with the target node as the first sink node. It can be constructed by merging multiple meta-paths at the second sink node, and each multi-path meta-graph has only one first sink node and one second sink node. For example, if meta-path 1 is a, b, c, d, and meta-path 2 is a, f, d, it is detected that meta-path 1 and meta-path 2 have a common neighbor node d, at this time, meta-path 1 and meta-path 2 are combined to obtain a multi-path meta-graph with a as the first sink node and d as the second sink node, and the intermediate path b, c is parallel to the intermediate path f.

[0097] Wherein, the meta-path can be an alternating sequence defining the entity type and the relationship type in the heterogeneous graph, which can be represented as Wherein, A represents the corresponding path node, and R represents the relationship between the path nodes. In addition, the starting point and the ending point of the meta-path are nodes of the same type and the positive and negative structures are symmetrical, which can effectively model the semantic similarity between the same path nodes and enhance the semantic association and suppress noise interference through the closed loop structure.

[0098] Wherein, the first sink node can be the common starting point of all meta-paths in the multi-path meta-graph (when the second sink node is the terminal sink node); or, the first sink node can be the common terminal point of all meta-paths in the multi-path meta-graph (when the second sink node is the starting sink node); among the first sink node and the second sink node, at least one node is the target node, and the other starting / terminal path node except the target node is the intersection node of the multiple meta-paths of the multi-path meta-graph.

[0099] Wherein, the path node can be an intermediate entity node in the meta-path except the starting and terminal points, which can be extracted by analyzing the intermediate steps in the meta-path instance, for example, the “file” node in the “process-file-registry” meta-path as a path node.

[0100] The second collection node can be a common end point of all the merged meta-paths in the multi-path meta-graph (when the first collection node is a starting collection node); or the second collection node can be a common starting point of all the meta-paths in the multi-path meta-graph (when the first collection node is an end collection node). The second collection node can be obtained by extracting a shared path node as a merging point, for example, when multiple meta-paths converge at a "file" node, the file node is the second collection node.

[0101] The intersection path can be a shared path between the meta-paths, for example, the meta-path A in the multi-path meta-graph does not need to be independently generated into a single-path meta-graph, and therefore, there is no intersection path between the multi-path meta-graph and the single-path meta-graph.

[0102] In some embodiments, the target node can be determined from the heterogeneous network behavior graph. The target node can be determined by the system after risk detection or can be determined by a user. For example, a process that frequently attempts to access unauthorized resources, a file that suddenly increases the amount of external communication, and the like can be determined as a target node.

[0103] Further, all meta-paths related to the target node can be obtained from the heterogeneous network behavior graph. The meta-paths are designed as symmetric meta-paths, the starting point and the end point of which are nodes of the same type and the forward and reverse structures are symmetric, for example, the starting point is a process and the end point is also a process. In this way, the semantic similarity between nodes of the same type can be effectively modeled.

[0104] For example, a meta-path that has no common path node with other meta-paths except the target node can be determined as a single-path meta-path, and a single-path meta-graph is directly converted from the single-path meta-path. Each node of the single-path meta-graph has at least one attribute, and each edge corresponds to at least one relationship. Figure 3 For example, the single-path meta-graph in FIG. 5 can be directly constructed according to the meta-path corresponding to process B created by process A.

[0105] Further, if there is a meta-path that has a common path node with other meta-paths except the target node, for example, process D, the path collection can be performed according to the target node of the meta-path and other meta-paths as a first collection node, and the common path node as a second collection node, and the multiple meta-paths are merged to construct a multi-path meta-graph. Figure 3 For example, the multi-path meta-graph in FIG. 6 can perform path merging on the permission diffusion paths corresponding to process A, user C, and process D, and the data leakage paths corresponding to process A, sensitive file F, and process D, by taking the target node (process A) as a first collection point and the common path node (process D) as a second collection point, to obtain the multi-path meta-graph as shown in FIG. 6. Figure 3 ​

[0106] In some embodiments, the construction of the single-path meta-graph and the multi-path meta-graph described above is only an example. In actual cases, the nodes and relationships of the single-path meta-graph and the multi-path meta-graph can be different, and the form of the single-path meta-graph and the multi-path meta-graph can also be set according to actual situations, which are not listed one by one here.

[0107] In the above manner, the single-path meta-graph and the multi-path meta-graph can be determined from the heterogeneous network behavior graph, thereby completely retaining the multi-dimensional semantic association and cross-path dependence features between the target node and its neighbors, and further providing a high-fidelity input for subsequent malicious behavior modeling based on the meta-graph context attention mechanism, significantly improving the detection accuracy and robustness of complex attack chains (such as multi-stage ransomware attacks and horizontal penetration attacks).

[0108] In step 103, for each path meta-graph, the neighbor node vector of each neighbor node is weighted and adjusted according to the node similarity between each neighbor node and the target node, to obtain a first node embedding vector, and a graph embedding representation is obtained based on the fusion of multiple first node embedding vectors corresponding to multiple neighbor nodes.

[0109] In some embodiments, in order to realize the differential modeling of the target node associated path meta-graph neighbor nodes, embedding vector weight adjustment and multi-path information fusion based on node similarity can be used to accurately capture the complex features of semantic association and structural dependence in heterogeneous graphs, thereby improving the sensitivity recognition ability of malicious behavior propagation paths.

[0110] wherein the neighbor node can be an entity (such as a file, a process, or an IP) directly or indirectly connected to the target node through a meta-path in the single-path meta-graph or the multi-path meta-graph, which can be obtained by analyzing the adjacency relationship of the target node in the path meta-graph, for example, in the “process-file-registry” meta-path, the “file” and “registry” nodes are the neighbor nodes of the target node “process”.

[0111] wherein the node similarity can be the matching degree of the target node and the neighbor node in the feature space, which can be calculated by vector dot product or cosine similarity, for example, the semantic similarity can be quantified by the inner product of the target node vector of the target node and the neighbor node vector of the neighbor node.

[0112] wherein the neighbor node vector can be a low-dimensional semantic representation of the neighbor node generated by the Metapath2vec++ algorithm.

[0113] wherein the first node embedding vector can be a feature representation of the neighbor node after weighted adjustment according to the node similarity.

[0114] The path meta graph embedding representation can be a path meta graph overall feature vector aggregated from a plurality of neighbor node first embedding vectors, and is a comprehensive semantic feature of the path meta graph.

[0115] For example, for each neighbor node included in each path meta graph, the Metapath2vec++ algorithm can be used to explicitly model the high-order semantic relationship between cross-type nodes in the heterogeneous graph through the meta path constrained random walk strategy, so as to obtain the initial node embedding representation of each neighbor node, so as to better maintain the semantic structure of the heterogeneous graph, improve the node feature expression ability, and provide low-noise and high semantic initialization features for subsequent models. Alternatively, the initial node embedding representation of each neighbor node can also be generated by other algorithms, such as the FastHINE algorithm, the GATNE algorithm, etc.

[0116] Further, the initial node embedding representation of each neighbor node can be projected to a unified vector space through linear transformation, and each neighbor node corresponds to a neighbor node vector. In this way, the problem of inconsistent feature spaces of different types of nodes can be solved, and the redundancy and noise in the initial node embedding representation can be reduced through feature selection. The neighbor node vector The specific process is as follows:

[0117] ;

[0118] wherein, is the initial node embedding representation of the neighbor node; is a node type-specific learnable weight matrix used to project the initial node embedding representation to the same vector space.

[0119] Further, since different neighbor nodes are of different types or have different distances from the target node, different weights are needed for different contributions to the path meta graph. For example, the weight of each neighbor node can be obtained by calculating the node similarity between each neighbor node and the target node and normalizing the similarity. The specific process is as follows:

[0120] ;

[0121] wherein, is the target node vector of the target node, is the neighbor node vector of the neighbor node, is the neighbor node set of the current path meta graph; is the weight of the current neighbor node.

[0122] Further, the neighbor node vector of the corresponding neighbor node can be adjusted according to the weight of each neighbor node, that is, by multiplying the weight and the neighbor node vector , the first node embedding vector of the target node is calculated.

[0123] In some embodiments, the first node embedding vectors of all neighbor nodes can be fused to obtain a final graph embedding representation :

[0124] ;

[0125] wherein, is a neighbor node set of the current path meta-graph; is a weight of the i-th neighbor node, is a neighbor node vector of the i-th neighbor node.

[0126] In this way, the complex relationship between the target node and its neighbor nodes can be effectively captured, and a graph embedding representation with semantic correlation can be generated, thereby preserving the high-order correlation characteristics of the key threat path in the heterogeneous graph, and further providing a high-discriminability graph-level feature input for subsequent threat event detection, significantly improving the detection accuracy and robustness of complex attack chains.

[0127] In some embodiments, in order to realize the differentiated feature fusion of the neighbor nodes in the path meta-graph, the semantic influence of different neighbor nodes on the target node can be dynamically quantified by exponential mapping and normalized weight allocation based on node similarity, thereby improving the sensitivity recognition ability of the key threat path in the complex attack chain. For example, the step 103 of "for each path meta-graph, adjusting the neighbor node vector of each neighbor node according to the node similarity between each neighbor node and the target node to obtain the first node embedding vector" can include:

[0128] (103.1) For each path meta-graph, obtain the node similarity between each neighbor node and the target node, and map the node similarity to the positive number space through exponential operation to obtain an initial node weight;

[0129] (103.2) Obtain the sum of the plurality of initial node weights corresponding to the plurality of neighbor nodes included in each path meta-graph to obtain a node weight sum;

[0130] (103.3) Based on the ratio of the initial node weight to the node weight sum, obtain the target node weight of each neighbor node;

[0131] (103.4) Adjust the neighbor node vector of each neighbor node based on the target node weight to obtain the first node embedding vector.

[0132] The initial node weight can be a neighbor node feature importance value obtained by mapping the node similarity index, which can be calculated by taking the exponential function of the node similarity to eliminate negative values and amplify the influence of high similarity.

[0133] The node weight sum can be the cumulative value of the initial node weights of all neighbor nodes in the same path meta-graph.

[0134] The target node weight can be the weight of the normalized neighbor node, which can be obtained by dividing the initial node weight of the corresponding neighbor node by the node weight sum.

[0135] In some embodiments, different weights are needed due to different neighbor node types or different distances from the target node, which contribute differently to the path meta-graph. First, for each path meta-graph, the node similarity between each neighbor node and the target node can be calculated, which can be calculated by the dot product of the target node vector and the neighbor node vector . After that, the node similarity is mapped to the positive number space by exponential operation to obtain the initial node weight .

[0136] Further, the sum of the initial node weights corresponding to the multiple neighbor nodes contained in each path meta-graph can be obtained, and the node weight sum is obtained, and the specific calculation process is as follows:

[0137] ;

[0138] wherein, is the target node vector of the target node; is the i-th neighbor node vector; is the neighbor node set of the target node u in the current path meta-graph.

[0139] Further, the weight of the corresponding neighbor node can be normalized by the ratio of the initial node weight to the node weight sum, to obtain the target node weight of each neighbor node, and the specific process is as follows:

[0140] ;

[0141] wherein, is the target node vector of the target node, is the neighbor node vector of the neighbor node, is the neighbor node set of the current path meta-graph; is the weight of the current neighbor node. Thus, the normalized target node weight can be obtained, ensuring that the sum of the weights of all neighbor nodes is 1.

[0142] Further, the neighbor node vector of the corresponding neighbor node can be adjusted according to the target node weight of each neighbor node, that is, the first node embedding vector is calculated by the product of the target node weight and the neighbor node vector .

[0143] Further, the graph embedding representation of the current path meta-graph can be obtained by fusing a plurality of first node embedding vectors corresponding to a plurality of neighbor nodes , and the specific process is as follows:

[0144] ;

[0145] wherein, is the target node weight of the i-th neighbor node of the current path meta-graph; is the neighbor node vector of the i-th neighbor node.

[0146] In the above manner, the semantic influence of the neighbor node on the target node can be dynamically quantified, and low-similarity noise interference can be suppressed, so as to retain the high-order correlation features of the key threat path, and then provide a high-discrimination node-level feature input for subsequent malicious behavior classification based on contrast importance learning, thereby significantly improving the detection accuracy and robustness of threat events.

[0147] Step 104, for each neighbor node, an attention score is calculated according to the node similarity between the target node, and context feature fusion is performed on the neighbor node vector and the graph embedding representation based on the attention score, to obtain a corresponding second node embedding vector.

[0148] In some embodiments, in order to realize the differential semantic modeling of the associated neighbor nodes of the target node, the semantic influence of each neighbor node on the target node can be dynamically quantified, and the high-order correlation features of the key threat path can be retained by attention score calculation and context feature fusion based on node similarity and meta-graph instance embedding, thereby improving the threat event identification accuracy of complex attack chains.

[0149] wherein the attention score can be for each neighbor node, which adjusts the contribution proportion of the corresponding path meta-graph context feature vector, and is used to measure the similarity between the neighbor node and the target node and the semantic association strength of the meta-path at the same time.

[0150] wherein the second node embedding vector can be a context-aware feature representation of the current neighbor node vector fused with the meta-graph instance features for each neighbor node.

[0151] In some embodiments, the attention score can be fused for each neighbor node to obtain a second node embedding vector corresponding to the neighbor node, so as to realize efficient information aggregation of the neighbor node. For example, for a target node u and a neighbor node v connected through a path meta graph G, the attention score is calculated according to the following formula:

[0152] ;

[0153] wherein, is a target node vector, is a current neighbor node vector, and the two are calculated by dot product to measure the proximity of the two in the feature space; is a graph embedding representation of the current path meta graph, so that the semantic features of the connection path between nodes can be considered, and the filtering ability of the classification model to noise can be enhanced; is a learnable parameter for dynamically balancing node similarity and path meta graph semantic weight; is a graph attention vector of the current path meta graph G. During the training of the preset classification model, the preset classification model can learn the semantic preference of different path meta graphs through back propagation. After the training of the classification model is completed, the attention vector can be directly obtained for different path meta graph types; is an activation function for enhancing the nonlinear expression ability of the model. The attention score calculated in this way can ensure that the target classification model considers both node similarity and semantic features of the connection path during the aggregation process.

[0154] Further, in order to make the importance of each neighbor node of the path meta graph easy to compare, the softmax function can be used to normalize the attention scores of all neighbor nodes, that is, for each neighbor node, the attention score preliminarily calculated is divided by the comprehensive attention score of all neighbor nodes contained in the current path meta graph. The specific calculation formula is as follows:

[0155] ;

[0156] wherein, is a set of neighbor nodes connected through the path meta graph G, and after normalization, it satisfies which is equal to 1, so as to facilitate subsequent weighted aggregation operation.

[0157] Further, based on the normalized attention score , the information of all neighbor nodes contained in the current path meta graph can be weighted and aggregated to generate a second node embedding vector corresponding to the current neighbor node, and the specific representation is as follows:

[0158] ;

[0159] wherein, denotes the neighbor node vector graph embedding representation of the current path meta-graph splicing operation to fuse the features of the current neighbor node and the context information of the corresponding path meta-graph, realizing effective aggregation of the information of the neighbor node.

[0160] In this way, the semantic influence of the neighbor node on the target node can be dynamically quantified, and low-similarity noise interference can be suppressed, thereby retaining high-order correlation features of key threat path meta-graphs, and further providing high-discrimination context-aware node feature input for subsequent threat event classification based on contrastive importance learning, significantly improving the accuracy and robustness of terminal threat event detection.

[0161] In some embodiments, in order to realize dynamic importance quantification of neighbor nodes in meta-graph paths, the attention score of each neighbor node can be calculated through an attention mechanism to accurately distinguish key nodes from noise in malicious behavior propagation paths, thereby improving the recognition ability of multi-path collaborative attack patterns. For example, in step 104, "for each neighbor node, calculate the attention score according to the node similarity between the target node and the target node", can include:

[0162] (104.1) For each neighbor node, calculate the node similarity between the neighbor node vector and the target node vector of the target node;

[0163] (104.2) Obtain the preset balance parameter of the path meta-graph corresponding to each neighbor node, and the graph attention vector of the path meta-graph;

[0164] (104.3) Based on the product of the preset balance parameter and the node similarity, obtain the attention sub-item;

[0165] (104.4) Based on the preset balance parameter, the graph attention vector and the graph embedding representation, obtain the balance sub-item;

[0166] (104.5) Based on the attention sub-item and the balance sub-item, obtain the attention score of each neighbor node.

[0167] Wherein, the preset balance parameter can be a meta-graph path type weight coefficient obtained through model training and optimization, which can be obtained after adjusting the model parameters through the back propagation algorithm.

[0168] The graph attention vector can be a vector representation quantifying semantic features of the current path meta-graph; during the training of the preset classification model, the preset classification model can learn semantic preferences of different path meta-graphs through back propagation; after the model is trained, the graph attention vector can be directly obtained for different path meta-graph types.

[0169] The attention sub-item can be a product of the node similarity and the preset balance parameter.

[0170] The balance sub-item can be a balance term constructed by combining the graph attention vector of the current path meta-graph, the graph embedding representation, and the preset balance parameter, which can be used to suppress the influence of redundant features.

[0171] In some embodiments, for each neighbor node, the corresponding neighbor node vector can be calculated by dot product calculation between the target node vector of the target node and the node similarity. In this way, the proximity of the neighbor node and the target node in the feature space can be quantified.

[0172] In some embodiments, the preset balance parameter pre-set by the target classification model can be obtained, as well as the graph attention vector of the path meta-graph corresponding to the current neighbor node. Then, based on the product of the preset balance parameter and the node similarity, the attention sub-item can be obtained, so that the local consistency of the node feature space can be ensured; further, based on the preset balance parameter, the graph attention vector, and the graph embedding representation, the balance sub-item can be obtained, so that global path semantic constraints can be introduced to effectively suppress noise interference. Finally, for the target node u and its neighbor node v connected through the path meta-graph G, the attention score of each neighbor node can be obtained based on the attention sub-item and the balance sub-item, and the calculation process is as follows:

[0173] ;

[0174] wherein, is the target node vector, is the current neighbor node vector, and the two are calculated by dot product to calculate the node similarity, to measure the proximity of the two in the feature space; is the graph embedding representation of the current path meta-graph, so that the semantic features of the connection path between nodes can be considered, and the filtering ability of the classification model to noise is enhanced; is a preset balance parameter, used to dynamically balance the node similarity and the path meta-graph semantic weight. The graph attention vector of the current path meta graph G is a graph attention vector, and in the process of training the preset classification model, the preset classification model can learn the semantic preferences of different path meta graphs through back propagation. After the classification model is trained, the graph attention vector can be directly obtained for different path meta graph types; is an activation function used to enhance the non-linear representation ability of the model. The attention score is calculated as follows , which can ensure that the target classification model considers both the similarity between nodes and the semantic features of the connection path during the aggregation process.

[0175] Further, the attention score of each neighbor node in the path meta graph is calculated After that, the attention score of each neighbor node in the path meta graph can be normalized, and the specific processing method has been described above, which will not be repeated here.

[0176] By the above method, the contribution of neighbor nodes in the multi-path attack chain can be accurately quantified, and high-differentiation feature input can be provided for the subsequent classification process, significantly improving the detection accuracy and robustness of threat events.

[0177] Step 105, aggregating the plurality of second node embedding vectors corresponding to the plurality of neighbor nodes and the target node vector of the target node to obtain a comprehensive embedding representation corresponding to each path meta graph.

[0178] In some embodiments, in order to realize the global integration of the semantic information of the multiple neighbor nodes in the path meta graph, the context features of the plurality of second node embedding vectors corresponding to the plurality of neighbor nodes and the target node vector in each path meta graph can be aggregated to construct a high-fidelity path-level comprehensive representation, so as to accurately identify threat events.

[0179] The target node vector can be a feature representation of the target node in the corresponding path meta graph, which can be generated by random walk in the corresponding path meta graph through the Metapath2vec++ algorithm, and the target node initial embedding can be projected into a unified vector space. Alternatively, the target node vector can also be a node vector calculated separately, and all path meta graphs correspond to the same target node vector.

[0180] The comprehensive embedding representation can be a fusion vector of all node features in the path meta graph.

[0181] In some embodiments, for each path meta graph containing a plurality of neighbor nodes, the second node embedding vector adjusted by the normalized attention score can be added to obtain a comprehensive neighbor node embedding representation The specific formula is as follows:

[0182] ;

[0183] wherein, denotes the aggregation weight matrix, denotes the normalized attention score of the current neighbor node, denotes the neighbor node vector and the graph embedding representation of the current path meta-graph is concatenated, for fusing the feature of the current neighbor node and the context information of the corresponding path meta-graph, to realize the effective aggregation of the information of the neighbor node.

[0184] Further, the comprehensive neighbor node embedding representation obtained by fusing the above plurality of second node embedding vectors can be further aggregated with the target node vector, and in this way, the comprehensive embedding representation of the target node u under the entire path meta-graph :

[0185] ;

[0186] wherein, denotes the comprehensive neighbor node embedding representation; is the target node vector.

[0187] For example, please refer to Figure 4 , Figure 4 is an example diagram of a context attention mechanism for attention processing of a path meta-graph, which shows the calculation process of the comprehensive embedding representation of the target node u under a single path meta-graph . First, the target node vector , the neighbor node vector and the graph embedding representation of the current path meta-graph can be input into the attention module of the model; in the attention module, the attention score is generated by calculating the balance sub-item fusion of the node similarity and the graph embedding representation , and then passing through a tanh activation function; then, the attention scores of all neighbor nodes in the same path meta-graph are normalized by a softmax function, to obtain the attention score corresponding to each neighbor node ; finally, the neighbor node vector of each neighbor node corresponding to the attention score, the neighbor node vector and the graph embedding representation are aggregated, and the specific process can be represented by to obtain the second node embedding vector corresponding to each neighbor node.

[0188] Further, the second node embedding vectors of all neighbor nodes contained in the current path meta-graph can be added and aggregated into the target node vector of the target node to obtain a comprehensive embedding representation under the current path meta-graph .

[0189] In this way, the context semantic information of the target node and the neighbor nodes can be dynamically integrated and the comprehensive feature representation of the path meta-graph can be constructed, so as to retain the key threat patterns and structural correlation features in the multi-path attack chain, and then provide a high-discrimination meta-graph level input for subsequent malicious behavior classification based on comparative importance learning, thereby significantly improving the detection accuracy and robustness of complex multi-stage attacks.

[0190] In step 106, the target node embedding is obtained by fusing the plurality of comprehensive embedding representations corresponding to the plurality of path meta-graphs, and the target node embedding is input into a target classification model to obtain a threat event detection result corresponding to the target node.

[0191] In some embodiments, in order to realize multi-dimensional threat feature integration of the target node, the comprehensive embedding representations of the plurality of path meta-graphs can be fused and input into the target classification model to accurately quantify the probability of the target node having a threat event, thereby improving the recognition accuracy of the model for the threat event.

[0192] The target node embedding can be a final feature vector of the target node after aggregating the plurality of comprehensive embedding representations of all path meta-graphs corresponding to the target node.

[0193] The target classification model can be a malicious behavior classifier based on a multi-layer perceptron or a graph neural network, which is a pre-trained classification model and can accurately determine whether the target node is a threat based on the target node embedding.

[0194] The threat event detection result can be a threat event classification output of the target node, which can be generated by the final prediction layer of the classification model and used to determine whether the target node has a threat (such as ransomware, lateral movement, etc.).

[0195] For example, the plurality of comprehensive embedding representations can be directly added to obtain the target node embedding. Alternatively, different weights can be set for the comprehensive embedding representations corresponding to different path meta-graphs, the plurality of comprehensive embedding representations can be adjusted based on the weights, and the adjusted plurality of comprehensive embedding representations can be added to obtain the target node embedding.

[0196] For example, the process of calculating the target node embedding may be as follows:

[0197] ;

[0198] wherein, For the i-th path metagraph The adjusted weights are set; For the i-th path metagraph The comprehensive embedded representation.

[0199] In some implementations, for the i-th path metagraph Adjustment weight settings The formula for calculating it is as follows:

[0200] ;

[0201] in, It is the semantic fusion weight matrix, which is the parameter matrix of the preset classification model. It is determined after the preset classification model has been trained and the target classification model has been obtained. It is the global semantic preference vector, which is the parameter vector of the predefined classification model, and... Synchronous optimization is performed after the target classification model is obtained following the completion of training the preset classification model. It is a set corresponding to multiple path metagraphs; This is the path metagraph for which weights need to be calculated.

[0202] The embodiment of the application obtains the interaction data of the target terminal, constructs a heterogeneous network behavior graph based on the interaction data, determines a target node to be detected and a plurality of path meta graphs associated with the target node from the heterogeneous network behavior graph, wherein the plurality of path meta graphs include a single-path meta graph and a multi-path meta graph, the single-path meta graph is composed of a single path corresponding to the target node, the multi-path meta graph is obtained by path merging of a plurality of paths corresponding to the target node, the target node is a first collection node, and a path node common to the plurality of paths is a second collection node, and the single-path meta graph and the multi-path meta graph do not have an intersection path; for each path meta graph, the weight of a neighbor node vector of each neighbor node is adjusted according to the node similarity between each neighbor node and the target node to obtain a first node embedding vector, and a graph embedding representation is fused based on a plurality of first node embedding vectors corresponding to a plurality of neighbor nodes; for each neighbor node, an attention score is calculated according to the node similarity between the neighbor node and the target node, and a context feature is fused based on the attention score to obtain a corresponding second node embedding vector; a plurality of second node embedding vectors corresponding to a plurality of neighbor nodes and a target node vector of the target node are aggregated to obtain a comprehensive embedding representation corresponding to each path meta graph; a target node embedding is fused according to a plurality of comprehensive embedding representations corresponding to a plurality of path meta graphs, and the target node embedding is input into a target classification model to obtain a threat event detection result corresponding to the target node. In this way, the meta graph composed of a plurality of paths can be generated by a path merging strategy for a plurality of paths associated with the target node, the cross-path cooperation or inhibition effect between the meta paths can be effectively captured, and the comprehensiveness and accuracy of attack detection, especially combined attack detection, can be improved. Secondly, in the feature extraction process, the initial embedding vector weight of the neighbor node is dynamically adjusted based on the node similarity, and a meta graph level embedding representation is fused and generated, which can fully consider the contribution degree of different neighbor nodes to the meta graph. Moreover, the influence of the meta graph semantics on the importance of the node is quantified through the attention mechanism, the dynamic fusion of the context feature is realized, the noise interference of high-frequency normal interaction is inhibited, and the semantic features of the key threat path are retained, which significantly improves the signal-to-noise ratio of detection. Finally, by aggregating the comprehensive embedding representations of the multi-path meta graphs and inputting them into the pre-trained classification model, the malicious behavior of the complex attack chain can be more flexibly and accurately identified, and the detection efficiency and accuracy are effectively improved.

[0203] In some embodiments, in order to dynamically quantify the semantic association features in the multi-path meta graph, the contribution weight of different meta graph paths can be dynamically adjusted by weighted calculation based on a semantic fusion weight matrix and global semantic preference, so as to accurately capture the threat mode of the key semantic path in the complex attack chain and improve the accuracy of threat event detection. For example, the step of "fusing the target node embedding according to a plurality of comprehensive embedding representations corresponding to a plurality of path meta graphs" in step 106 can include:

[0204] (106.1) For each path meta-graph, obtain a corresponding semantic fusion weight matrix, a global semantic preference vector, and a comprehensive embedding representation, wherein the global semantic preference vector is used to quantify the semantic importance of each path meta-graph;

[0205] (106.2) Based on the semantic fusion weight matrix, the global semantic preference vector, and the comprehensive embedding representation, an initial graph weight is calculated;

[0206] (106.3) Obtain the sum of the plurality of initial graph weights corresponding to the plurality of path meta-graphs to obtain a graph comprehensive weight;

[0207] (106.4) Based on the ratio of each initial graph weight to the graph comprehensive weight, obtain a target graph weight corresponding to each path meta-graph;

[0208] (106.5) According to the target graph weight of each path meta-graph, the comprehensive embedding representation of each path meta-graph is adjusted in weight to obtain an updated comprehensive embedding representation;

[0209] (106.6) Based on the sum of the plurality of updated comprehensive embedding representations corresponding to the plurality of path meta-graphs, obtain a target node embedding of the target node.

[0210] The semantic fusion weight matrix can be a matrix for quantifying the semantic association relationship between path meta-graphs, which can be calculated during the process of training a pre-set classification model.

[0211] The global semantic preference vector can be a weight vector representing the semantic importance of different path meta-graphs, which can be learned during the model training process and used to quantify the contribution of each path meta-graph to threat event detection.

[0212] The initial graph weight can be the initial path weight of the path meta-graph.

[0213] The graph comprehensive weight can be the normalized sum of the initial graph weights of all path meta-graphs.

[0214] The target graph weight can be the contribution value of the comprehensive embedding representation of a single path meta-graph when performing terminal threat event detection.

[0215] The updated comprehensive embedding representation can be a meta-graph level feature vector adjusted by the target graph weight.

[0216] For example, for the i-th path meta-graph , first obtain its corresponding semantic fusion weight matrix , global semantic preference vector , and comprehensive embedding representation of the path meta-graph . Among them, is a parameter matrix of the target classification model, which is obtained through model training; is a parameter vector of the target classification model, which is used to quantify the semantic importance of the path meta-graph, and is also obtained through model training.

[0217] Further, for each path meta-graph , the initial graph weight can be calculated using the corresponding semantic fusion weight matrix, global semantic preference vector, and comprehensive embedding representation. The specific calculation formula is as follows:

[0218] ;

[0219] Further, let P be a set corresponding to a plurality of path meta-graphs, and the graph comprehensive weight is obtained by summing the initial graph weights of the plurality of path meta-graphs, and is specifically:

[0220] ;

[0221] In some embodiments, based on the ratio of each initial graph weight to the graph comprehensive weight, the target graph weight corresponding to each path meta-graph can be obtained, and the calculation formula can be as follows:

[0222] ;

[0223] wherein, is a semantic fusion weight matrix; is a global semantic preference vector; is a set corresponding to a plurality of path meta-graphs; is the path meta-graph whose weight needs to be calculated at present.

[0224] Further, the comprehensive embedding representation of each path meta-graph can be adjusted in weight according to the target graph weight of each path meta-graph, to obtain the updated comprehensive embedding representation of each target node corresponding to each path meta-graph:

[0225] ;

[0226] Further, the process of calculating the target node embedding of the target node can be as follows:

[0227] ;

[0228] wherein, is an adjustment weight set for the i-th path meta-graph ; is the i-th path meta-graph comprehensive embedding representation.

[0229] By the above manner, the threat discriminativeness of each path meta-graph (such as distinguishing the semantic importance of "process-file-network" and "process-registry" paths) can be dynamically evaluated by using a learnable global semantic preference vector, the semantic correlation and threat contribution degree of multi-path meta-graphs are dynamically quantified, meanwhile, the semantic dependency relationship between path meta-graphs (such as the correlation strength of horizontal penetration and data leakage paths) is modeled by a semantic fusion weight matrix, the perception ability of composite attack chains is enhanced, and based on the ratio of the initial graph weight and the graph comprehensive weight, the target graph weight is generated, forcing the model to strengthen the contribution of key threat paths (such as high-frequency abnormal access paths) and suppress the noise interference of low-risk paths, and finally, the weighted and adjusted comprehensive embedding representation is aggregated into the target node embedding, so that the final feature retains the local behavior pattern of the target node and the global semantic correlation across meta-graphs, effectively improving the detection accuracy of the subsequent target node embedding input into the target classification model.

[0230] In some embodiments, in order to realize high-precision detection of terminal threat events, a plurality of sample path meta-graphs associated with a sample target node can be determined by constructing a sample heterogeneous network behavior graph from sample interaction data, and context fusion can be performed according to the plurality of sample path meta-graphs to output a predicted threat event detection result of the target sample node, and after obtaining the predicted threat event detection result, a first loss can be constructed based on the difference between the predicted threat event detection result and a preset sample threat event detection result, and a second loss can be constructed based on the difference in attention assigned to each sample neighbor node in the sample single-path meta-graph and the sample multi-path meta-graph during the prediction process, and the parameters of the preset classification model can be trained based on the first loss and the second loss to obtain a target classification model. In this way, the multi-path semantic correlation of complex attack chains can be dynamically modeled and the model parameters can be optimized by combining the meta-graph enhanced attention mechanism and the contrastive importance learning, thereby improving the model's ability to recognize threat events, especially multi-stage combined attacks and hidden threats. For example, the target classification model is trained in the following way:

[0231] (A.1) Obtain sample interaction data, and construct a sample heterogeneous network behavior graph based on the sample interaction data;

[0232] (A.2) Determine a sample target node to be detected and a plurality of sample path meta-graphs associated with the sample target node from the sample heterogeneous network behavior graph;

[0233] The plurality of sample path meta-graphs include a sample single path meta-graph and a sample multi-path meta-graph. The sample single path meta-graph is formed by a single sample path corresponding to the sample target node. The sample multi-path meta-graph is obtained by path merging of a plurality of sample paths corresponding to the sample target node, and the sample target node is a first collection node, and a path node common to the plurality of sample paths is a second collection node. The sample single path meta-graph and the sample multi-path meta-graph do not have an intersection path.

[0234] (A.3) For each sample path meta-graph, the sample neighbor node vector of each sample neighbor node is adjusted in weight according to the sample node similarity between each sample neighbor node and the sample target node, to obtain a sample first node embedding vector, and a sample graph embedding representation is obtained by fusion of a plurality of sample first node embedding vectors corresponding to a plurality of sample neighbor nodes.

[0235] (A.4) For each sample neighbor node, a sample attention score is calculated according to the sample node similarity between the sample neighbor node and the sample target node, and a corresponding sample second node embedding vector is obtained by context feature fusion of the sample neighbor node vector and the sample graph embedding representation based on the sample attention score.

[0236] (A.5) The plurality of sample second node embedding vectors corresponding to the plurality of sample neighbor nodes and the sample target node vector of the sample target node are aggregated to obtain a sample comprehensive embedding representation corresponding to each sample path meta-graph.

[0237] (A.6) A sample target node embedding is obtained by fusion of a plurality of sample comprehensive embedding representations corresponding to a plurality of sample path meta-graphs, and the sample target node embedding is input into a preset classification model to obtain a predicted threat event detection result corresponding to the sample target node.

[0238] (A.7) A first loss is constructed based on the difference between the predicted threat event detection result and the preset sample threat event detection result.

[0239] (A.8) A sample first attention score mean corresponding to a plurality of sample first neighbor nodes corresponding to a plurality of sample single path meta-graphs, and a sample second attention score mean corresponding to a plurality of sample second neighbor nodes corresponding to a plurality of sample multi-path meta-graphs are obtained, and a second loss is constructed based on the difference between the sample second attention score mean and the sample first attention score mean.

[0240] (A.9) The parameters of the preset classification model are adjusted based on the first loss and the second loss to obtain a target classification model.

[0241] The sample interaction data can be entity relationship data extracted from system logs of a terminal (or other terminals) to be detected, which can be obtained by analyzing system calls, file access, network connection, and the like. In addition to being obtained from system logs, the sample interaction data can also be collected from terminal security device alarm logs, threat intelligence, and attack and defense exercise data, and the like, and after data cleaning processing such as deduplication, field merging, and noise reduction, the sample interaction data is obtained.

[0242] The sample heterogeneous network behavior graph can be a directed graph structure containing multiple types of nodes (such as processes, files, network connections) and multiple types of relationship edges (such as read-write, communication), which can be constructed by mapping the interaction data into nodes and edges and labeling the types.

[0243] The sample target node can be an entity (such as a malicious process or file) to be detected for a threat event, which can be determined by screening high-risk behavior features (such as high-frequency file operations) or threat intelligence matching.

[0244] The sample path meta-graph can be a sample path graph representing the relationship between the sample target node and the sample neighbor nodes, which is a path obtained by connecting the sample path nodes and the relationship between the sample path nodes, for example, A1→A2→A3, and the corresponding relationship between the sample path nodes is labeled.

[0245] The sample single-path meta-graph can be a topological graph structure composed of sample neighbor nodes connected by a sample target node as a starting node.

[0246] The sample multi-path meta-graph can be a graph structure formed by merging multiple meta-path instances through a shared path node (such as a file or a registry item) with the sample target node as a first aggregation node, which can be constructed by merging multiple sample meta-paths at a second aggregation node. Each multi-path meta-graph has only one first aggregation node and one second aggregation node. For example, meta-path 1 is a, b, c, d, and meta-path 2 is a, f, d, and it is detected that meta-path 1 and meta-path 2 have a common neighbor node d. At this time, meta-path 1 and meta-path 2 are combined to obtain a sample multi-path meta-graph with a as the first aggregation node and d as the second aggregation node, and the intermediate paths b, c and the intermediate paths f are parallel.

[0247] The sample node similarity can be the matching degree of the sample target node and the neighbor node in the feature space, which can be calculated by vector dot product or cosine similarity, for example, by quantifying semantic similarity through the inner product of embedding vectors.

[0248] The sample first node embedding vector can be a neighbor node feature representation adjusted by node similarity weighting, which can be obtained by multiplying the initial embedding vector by the sample node similarity.

[0249] wherein, the sample graph embedding representation can be the path meta-graph overall feature vector aggregated from the plurality of sample neighbor node first embedding vectors, which can be fused by weighted summation or concatenation operation.

[0250] wherein, the sample attention score can be the weight value quantifying the semantic influence of the sample neighbor node on the sample target node, which can be calculated by the dot product of the sample node similarity and the sample first node embedding vector, and normalized by softmax.

[0251] wherein, the sample second node embedding vector can be the context-aware feature representation of each sample path node in the sample path meta-graph, which is fused from the sample first node embedding vector and the meta-graph instance feature, and can be realized by weighted concatenation or dot product operation.

[0252] wherein, the sample comprehensive embedding representation can be the fusion vector of the sample second node embedding vectors of all sample neighbor nodes within the sample path meta-graph, which can be obtained by weighted summation or concatenation of the plurality of sample second node embedding vectors and the sample target node vector of the sample target node contained in the corresponding sample path meta-graph.

[0253] wherein, the sample target node embedding can be the target node final feature vector aggregated from the plurality of sample comprehensive embedding representations of the plurality of sample path meta-graphs (including sample multi-path meta-graphs and sample single-path meta-graphs), which can be calculated by weighted concatenation or summation operation.

[0254] wherein, the preset classification model can be a classifier based on multi-layer perceptron or graph neural network.

[0255] wherein, the predicted threat event detection result can be the result output of the threat event detection of the target node, which can be generated by the final prediction layer of the preset classification model.

[0256] wherein, the first loss can be the cross-entropy loss of classification error, which can be calculated by the difference between the prediction result (predicted threat event detection result) and the true label (sample threat event detection result).

[0257] wherein, the first attention score mean can be the average attention weight of all sample first neighbor nodes except the sample target node contained in all sample single-path meta-graphs corresponding to the sample interaction data.

[0258] wherein, the sample second attention score mean can be the average attention weight of all sample second neighbor nodes except the sample target node contained in all sample multi-path meta-graphs corresponding to the sample interaction data.

[0259] The second loss can be a hinge loss that constrains the average of the first attention scores to be higher than the average of the second attention scores of the samples.

[0260] In some embodiments, the sample target node embedding is obtained and input into the preset classification model to obtain a predicted threat event detection result corresponding to the sample target node. The process of obtaining the predicted threat event detection result is basically the same as the process of obtaining the target node embedding and inputting the target node embedding into the target classification model to obtain the threat event detection result corresponding to the target node. The difference is that, for the preset classification model, the input is sample data, while for the target classification model, the input is actual data, and the parameter states of the preset classification model and the target classification model are different. The parameters of the preset classification model need to be further trained and adjusted, while the target classification model has been trained. Therefore, the process of obtaining the predicted threat event detection result is not repeated here.

[0261] In some embodiments, the first loss is calculated according to the following formula:

[0262] ;

[0263] wherein, is the size of the training data set of the current training task, ensuring that the first loss is calculated on the entire data set; is the preset sample threat event detection result (i.e., the true label); is the classification probability of the sample target node belonging to the threat event, i.e., the predicted threat event detection result.

[0264] As can be seen from the calculation formula of the first loss, when the sample target node is threatening (the is 1), if the is close to 1, it indicates that the preset classification model makes a correct prediction, and the loss value is small; otherwise, if the is close to 0, it indicates that the preset classification model makes an incorrect prediction, and the loss value is large; similarly, when the sample target node is not threatening (non-malicious) (the is 0), if the is close to 0, it indicates that the preset classification model makes a correct prediction, and the loss value is small; otherwise, if the is close to 1, it indicates that the preset classification model makes an incorrect prediction, and the loss value is large. In this way, by minimizing the first loss, the classification accuracy of the preset classification model can be improved, so as to more effectively identify the target nodes with threatening behaviors.

[0265] In some embodiments, the average first attention score corresponding to each sample first neighbor node of the plurality of sample single-path meta-graphs and the average second attention score corresponding to each sample second neighbor node of the plurality of sample multi-path meta-graphs can be obtained. Specifically, the average first attention score can be calculated by the following formula :

[0266] ;

[0267] wherein, is the first quantity; is the set of all sample first neighbor nodes corresponding to the plurality of sample single-path meta-graphs; here, is the sample first attention score corresponding to a single sample first neighbor node.

[0268] Further, the average second attention score can be calculated by the following formula :

[0269] ;

[0270] wherein, is the second quantity; is the set of all sample second neighbor nodes corresponding to the plurality of sample multi-path meta-graphs; here, is the sample second attention score corresponding to a plurality of sample second neighbor nodes.

[0271] In some embodiments, by comparing the average attention scores of the multi-path meta-graphs and the single-path meta-graphs and combining the preset boundary threshold, a higher average attention weight can be assigned to each neighbor node in the multi-path meta-graph, ensuring that the model can identify and pay attention to the nodes that show higher threat in the multi-path association. In this way, the detection capability of the model for hidden and multi-stage attack patterns can be improved, and the overall robustness and accuracy of the model can be enhanced, thereby more effectively dealing with complex network security threats. Specifically, the calculation formula of the second loss is as follows:

[0272] ;

[0273] wherein, is the set of first neighbor nodes connected by the single-path meta-graph, is the set of second neighbor nodes connected by the multi-path meta-graph, is the average attention score in the set; is the preset boundary threshold; 0 is the preset reference zero value.

[0274] In some embodiments, in order to prevent model overfitting and improve the generalization ability of the model, the model complexity can be effectively controlled by introducing a regularization term, which helps the model to better capture the true distribution of the data rather than just memorizing the specific details of the training data. In this way, overfitting of the model to the training data can be avoided. For example, the regularization term can be L1 regularization (Lasso regularization), L2 regularization (Ridge regularization), elastic network regularization, etc., which are not limited in the present application.

[0275] For example, by the first loss, the second loss and the regularization term, the following target loss L can be constructed:

[0276] ;

[0277] Wherein, is the first loss, which adopts a binary cross-entropy loss function to minimize the prediction error of threat event detection; is a pair loss weight coefficient for balancing the contribution of the two supervision signals; is the second loss, which is designed based on a hinge loss function; is the regularization term, which can constrain the model parameters by L2 norm to prevent overfitting.

[0278] In some embodiments, the target classification model can be obtained by adjusting the parameters of the preset classification model based on the target loss L constructed by the first loss, the second loss and the third loss.

[0279] The target classification model trained in the above manner can effectively improve the detection accuracy of the classification model for hidden and multi-stage attacks, and also enhances its stability and reliability in practical applications, thereby more effectively protecting network security.

[0280] In some embodiments, in order to optimize the recognition ability of the model for complex correlation patterns, the average value of the attention scores of the single-path meta-graph and the multi-path meta-graph neighbor nodes can be calculated to facilitate subsequent optimization of model parameter allocation and enhancement of recognition ability for high concealment and multi-stage combined attacks. For example, the “obtaining the average value of the sample first attention score of each sample first neighbor node corresponding to the sample single-path meta-graph, and the average value of the sample second attention score of each sample second neighbor node corresponding to the sample multi-path meta-graph” in (A.8) can include:

[0281] (A.8.a1) For each sample single-path meta-graph, obtaining the sample first attention score of each sample first neighbor node;

[0282] (A.8.a2) obtaining a first number of a plurality of sample first neighbor nodes of a plurality of sample single-path meta-graphs, and obtaining a sample first attention score mean according to a ratio of a sum of a plurality of sample first attention scores corresponding to the plurality of sample first neighbor nodes to the first number;

[0283] (A.8.a3) obtaining, for each sample multi-path meta-graph, a sample second attention score of each sample second neighbor node;

[0284] (A.8.a4) obtaining a second number of a plurality of sample second neighbor nodes of a plurality of sample multi-path meta-graphs, and obtaining a sample second attention score mean according to a ratio of a sum of a plurality of sample second attention scores corresponding to the plurality of sample second neighbor nodes to the second number.

[0285] The sample first neighbor node can be a neighbor entity, such as a file node, included in the sample single-path meta-graph corresponding to the sample target node, except for the sample target node.

[0286] The first attention score can be a semantic influence weight assigned by a preset classification model to each sample first neighbor node in different sample single-path meta-graphs, which can be calculated by a meta-graph context attention mechanism. The calculation method can refer to the calculation process of the attention score described above, and will not be repeated here.

[0287] The first number can be the total number of all sample first neighbor nodes included in all sample single-path meta-graphs in the sample interaction data, which can be obtained by accumulating the number of neighbor nodes of all single-path meta-graphs. For example, the sample single-path meta-graph corresponding to the sample target node has sample single-path meta-graph A and sample single-path meta-graph B, wherein sample single-path meta-graph A includes 3 sample first neighbor nodes, and sample single-path meta-graph B includes 2 sample first neighbor nodes. The first number is the sum of 3 and 2, i.e. 5.

[0288] The sample second neighbor node can be a neighbor entity, such as a network connection node, included in the sample multi-path meta-graph corresponding to the sample target node, except for the sample target node.

[0289] The sample second attention score can be a semantic influence weight assigned by a preset classification model to each sample second neighbor node in different sample multi-path meta-graphs, which can be calculated by a meta-graph context attention mechanism. The calculation method can refer to the calculation process of the attention score described above, and will not be repeated here.

[0290] The second quantity can be the total number of all sample second neighbor nodes contained in all sample multipath metagraphs in the sample interaction data. It can be obtained by summing the neighbor node counts of all multipath metagraphs. For example, if the sample multipath metagraphs corresponding to the sample target node are sample multipath metagraph A, sample multipath metagraph B, and sample multipath metagraph C, where sample multipath metagraph A contains 7 sample second neighbor nodes, sample multipath metagraph B contains 5 sample second neighbor nodes, and sample multipath metagraph C contains 6 sample second neighbor nodes, then the second quantity is the sum of 7, 5, and 6, which is 18.

[0291] For example, the mean of the first attention score of the sample can be calculated using the following formula. :

[0292] ;

[0293] in, The first quantity; This is the set of all first neighbor nodes of all samples corresponding to the single-path metagraph of multiple samples; here... The first attention score is the score of the sample corresponding to the first neighbor node of a single sample.

[0294] For example, the mean of the second attention score of the sample can be calculated using the following formula. :

[0295] ;

[0296] in, The second quantity; This is the set of all second-neighbor nodes of the samples corresponding to the multipath metagraph of multiple samples; here... The second attention score is the score of the sample corresponding to the second neighbor node of multiple samples.

[0297] For example, if the sample single-path metagraph corresponding to the sample target node has sample single-path metagraph A and sample single-path metagraph B, where sample single-path metagraph A contains 2 sample first neighbor nodes, sample first neighbor node a1 has a sample first attention score of 0.8 and sample first neighbor node a2 has a sample first attention score of 0.5; sample single-path metagraph B contains 3 sample first neighbor nodes, sample first neighbor node b1 has a sample first attention score of 0.3, sample first neighbor node b2 has a sample first attention score of 0.7 and sample first neighbor node b3 has a sample first attention score of 0.6.

[0298] Then, the sum of the plurality of sample first attention scores can be calculated by 0.8+0.5+0.3+0.7+0.6=2.9, the first number can be calculated by 2+3=5, and finally, the sample first attention score mean can be calculated as 2.9 / 5=0.58.

[0299] In some embodiments, the calculation principle and process of the sample second attention score mean are the same as the calculation process of the sample first attention score mean described above. When calculating the sample second attention score mean, the calculation method of the sample first attention score mean can be referred to for calculation, which is not described here.

[0300] It should be noted that when calculating the sample first attention score mean and the sample second attention score mean, the attention score of each sample neighbor node that has not been normalized should be used for calculation to avoid the weight competition effect interference of the Softmax normalization from affecting the group importance comparison.

[0301] In the above manner, the attention distribution difference between the single-path and multi-path meta-graph neighbor nodes can be quantified to strengthen the weight allocation of the multi-semantic group neighbor by the model, and to provide a key constraint condition for subsequent parameter optimization based on comparative importance learning, thereby significantly improving the detection accuracy and robustness of complex multi-stage attacks.

[0302] In some embodiments, in order to realize the differential modeling of single-semantic path and multi-semantic path attack features, the difference between the single-semantic group and multi-semantic group attention score mean can be compared and a boundary threshold constraint can be introduced to quantify the importance of multi-path synergy effect in complex attack chains, thereby optimizing model parameter allocation and enhancing the recognition ability of high concealment and multi-stage combined attacks. For example, “based on the difference between the sample second attention score mean and the sample first attention score mean, a second loss is constructed” in (A.8) can include:

[0303] (A.8.b1) determining a first difference value based on the difference between the sample second attention score mean and the sample first attention score mean;

[0304] (A.8.b2) obtaining a preset boundary threshold value, and determining a second difference value based on the difference between the preset boundary threshold value and the first difference value;

[0305] (A.8.b3) obtaining a preset reference zero value, and constructing a second loss based on the size relationship between the preset reference zero value and the second difference value.

[0306] The first difference value can be a value obtained by subtracting the sample first attention score mean from the sample second attention score mean, and is used to measure the exceeding degree of the average attention of the sample second neighbor node relative to the average attention of the sample first neighbor node.

[0307] The preset boundary threshold can be a constant greater than 0, which can be used to set a minimum expected margin by which the average attention of the sample second neighbor node must exceed the average attention of the sample first neighbor node, and can be set by cross-validation or expert experience, for example, 0.15, 0.5, etc.

[0308] The second difference value can be the difference between the preset boundary threshold and the first difference value, and is used to measure the gap between the exceeding degree of the attention of the sample second neighbor node (the first difference value) and the preset minimum expected margin (the preset boundary threshold).

[0309] The preset reference zero value can be a reference value (usually 0) for judging the positive and negative of the second difference value, and is used to judge whether the second difference value (margin gap) is greater than zero (i.e., whether a loss penalty needs to be applied).

[0310] In some embodiments, the calculation formula of the second loss is as follows:

[0311] ;

[0312] wherein, is a first neighbor node set connected by a single-path meta-graph, is a second neighbor node set connected by a multi-path meta-graph, is the mean of the attention scores in the set; is a preset boundary threshold; 0 is a preset reference zero value.

[0313] As can be seen from the above formula, the difference between the sample second attention score mean and the sample first attention score mean (the first difference value) can be calculated first to quantify the preference strength of the preset classification model for complex correlation patterns (multi-path).

[0314] Further, the second difference value is calculated by subtracting the first difference value from the preset boundary threshold. When the second difference value is greater than 0, it indicates that the preset classification model does not achieve the expected complex pattern recognition ability, i.e., the attention to the multi-path meta-graph is insufficient. Therefore, the preset reference zero value (0) can be used as a judgment threshold, i.e., when The function realizes selective loss activation: only when the second difference is greater than 0 (i.e., the actual margin is insufficient), the loss is generated, forcing the preset classification model to improve the attention to the multi-path neighbor; if the expected margin has been reached (the second difference is less than or equal to 0), the second loss is 0, avoiding over-optimization. In this way, the preset classification model can be forced to significantly improve the detection rate of complex attack chains (such as APT attacks).

[0315] In the above manner, the detection capability of the classification model on complex and hidden multi-stage attack behaviors can be enhanced, thereby improving the accuracy and robustness of the overall malicious behavior detection system.

[0316] Please refer to Figure 5 In some embodiments, in combination Figure 5 The general embodiments of the present application are introduced. For example, first, interaction data of a target terminal is collected, a heterogeneous network behavior graph is constructed, and a target node to be detected and its associated multiple path meta-graphs are determined in the heterogeneous network behavior graph, which include single-path and multi-path types. Then, for each path meta-graph, the similarity between the neighbor nodes and the target node is calculated to adjust the neighbor node vector of each neighbor node, generate a first node embedding vector, and fuse to obtain a graph embedding representation. Next, the attention mechanism is used to calculate the attention score of each neighbor node, and the neighbor node vector and the graph embedding representation are context feature fused based on the attention score to form a second node embedding vector. In this way, the key information in different path meta-graphs can be effectively extracted and integrated.

[0317] Subsequently, the second node embedding vectors corresponding to all neighbor nodes and the target node vector of the target node are aggregated to form a comprehensive embedding representation, which is input into a target classification model for analysis. Finally, the model outputs a threat event detection result, realizing effective identification of terminal threats. The present application can process multiple meta-paths associated with the target node through the path merging strategy, capture complex combined attack patterns, and improve detection accuracy. At the same time, based on the dynamic adjustment of the node similarity and the application of the attention mechanism, the feature fusion process is optimized, the noise interference caused by normal high-frequency interaction is reduced, the semantic information of the key threat path is preserved, and the detection efficiency and reliability are significantly improved.

[0318] Please refer to Figure 6 The embodiments of the present application also provide a terminal threat event detection device, which can implement the above terminal threat event detection method. The terminal threat event detection device comprises:

[0319] The acquisition module 61 is configured to acquire interaction data of a target terminal, and construct a heterogeneous network behavior graph based on the interaction data;

[0320] The determining module 62 is configured to determine a target node to be detected and a plurality of path subgraphs associated with the target node from the heterogeneous network behavior graph.

[0321] The plurality of path subgraphs include a single-path subgraph and a multi-path subgraph. The single-path subgraph is composed of a single path corresponding to the target node. The multi-path subgraph is obtained by performing path merging on a plurality of paths corresponding to the target node, taking the target node as a first sink node, and taking a path node common to the plurality of paths as a second sink node. The single-path subgraph and the multi-path subgraph do not have an intersection path.

[0322] The adjusting module 63 is configured to, for each path subgraph, perform weight adjustment on a neighbor node vector of each neighbor node according to a node similarity between each neighbor node and the target node, to obtain a first node embedding vector, and fuse a plurality of first node embedding vectors corresponding to a plurality of neighbor nodes to obtain a graph embedding representation.

[0323] The computing module 64 is configured to, for each neighbor node, calculate an attention score according to the node similarity between the neighbor node and the target node, and perform context feature fusion on the neighbor node vector and the graph embedding representation based on the attention score, to obtain a corresponding second node embedding vector.

[0324] The aggregating module 65 is configured to aggregate a plurality of second node embedding vectors corresponding to a plurality of neighbor nodes and a target node vector of the target node, to obtain a comprehensive embedding representation corresponding to each path subgraph.

[0325] The input module 66 is configured to fuse a plurality of comprehensive embedding representations corresponding to a plurality of path subgraphs to obtain a target node embedding, and input the target node embedding into a target classification model to obtain a threat event detection result corresponding to the target node.

[0326] The specific implementation of the terminal threat event detection apparatus is basically the same as that of the terminal threat event detection method described above, and will not be described here again. The terminal threat event detection apparatus can also be provided with other functional modules to realize the terminal threat event detection method in the above embodiments, as long as the requirements of the embodiments of the present application are met.

[0327] The embodiments of the present application also provide a computer device. The computer device includes a memory and a processor. The memory stores a computer program. The processor implements the terminal threat event detection method described above when executing the computer program. The computer device can be any intelligent terminal including a tablet computer, a vehicle-mounted computer, etc.

[0328] Please refer to Figure 7 , Figure 7 The hardware structure of the computer device of another embodiment is illustrated, which includes:

[0329] The processor 71 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits, and is configured to execute related programs to implement the technical solutions provided by the embodiments of the present application.

[0330] The memory 72 can be implemented by a ROM (ReadOnly Memory), a static storage device, a dynamic storage device, or a RAM (Random Access Memory), and the like. The memory 72 can store an operating system and other application programs. When the technical solutions provided by the embodiments of the present application are implemented by software or firmware, the related program codes are stored in the memory 72 and are called and executed by the processor 71 to implement the terminal threat event detection method of the embodiments of the present application.

[0331] The input / output interface 73 is configured to implement information input and output.

[0332] The communication interface 74 is configured to implement the communication interaction between the device and other devices. The communication can be realized by a wired manner (for example, a USB, a network cable, and the like) or a wireless manner (for example, a mobile network, WIFI, Bluetooth, and the like).

[0333] The bus 75 is configured to transmit information between the components (for example, the processor 71, the memory 72, the input / output interface 73, and the communication interface 74) of the device.

[0334] The processor 71, the memory 72, the input / output interface 73, and the communication interface 74 are connected to each other through the bus 75 to realize the communication connection between the components in the device.

[0335] The embodiments of the present application further provide a computer readable storage medium, which stores a computer program. The computer program is executed by a processor to implement the terminal threat event detection method.

[0336] The memory is a non-transitory computer readable storage medium, which can be used to store non-transitory software programs and non-transitory computer executable programs. In addition, the memory can include a high-speed random access memory, and can further include a non-transitory memory, for example, at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory can optionally include a memory remotely arranged relative to the processor, and the remote memory can be connected to the processor through a network. Examples of the network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0337] The embodiments described in the specification are for more clearly illustrating the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. Those skilled in the art can know that, with the evolution of technology and the appearance of new application scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0338] Those skilled in the art can understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and can include more or fewer steps than those shown in the figures, or combine certain steps, or different steps.

[0339] The device embodiments described above are only schematic, and the units described as separate components can or can not be physically separate, that is, can be located in one place, or can be distributed on multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the embodiments of the present application.

[0340] Those skilled in the art can understand that all or some of the steps in the above disclosed method, the function modules / units in the system and the device can be implemented as software, firmware, hardware and their appropriate combinations.

[0341] The terms "first", "second", "third", "fourth" and the like (if any) in the specification of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily have to be used to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0342] It should be understood that, in the application, "at least one" and "several" refer to one or more, and "multiple" refers to two or more. "And / or" is used to describe the association relationship of the associated objects, which means that there can be three relationships, for example, "A and / or B" can represent three cases of only A, only B, and A and B existing at the same time, wherein A and B can be singular or plural. The character " / " generally represents an "or" relationship between the associated objects before and after it. "At least one of the following" or similar expressions means any combination of these items, including any combination of single or multiple items. For example, at least one of a, b or c can represent a, b, c, "a and b", "a and c", "b and c", or "a and b and c", wherein a, b, and c can be single or multiple.

[0343] In several embodiments provided in the application, it should be understood that the disclosed system and method can be implemented in other ways. For example, the system embodiments described above are only illustrative, for example, the division of the above units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed units can be indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0344] The units described above as separate components can or can not be physically separated, and the components displayed as units can or can not be physical units, that is, they can be located in one place, or can be distributed on multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0345] In addition, the functional units in each embodiment of the application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0346] The integrated unit, if implemented in the form of a software function unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application, essentially or in other words, the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes multiple instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various program storage media.

[0347] The preferred embodiments of the embodiments of the present application are described above with reference to the accompanying drawings, and are not limited to the scope of the embodiments of the present application. Any modifications, equivalent replacements and improvements made by those skilled in the art without departing from the scope and essence of the embodiments of the present application shall be within the scope of the embodiments of the present application.

Claims

1. A method of detecting terminal threat events, characterized by, The method comprises: acquiring interaction data of a target terminal, and constructing a heterogeneous network behavior graph based on the interaction data; determining a target node to be detected from the heterogeneous network behavior graph, and a plurality of path meta graphs associated with the target node; wherein the plurality of path meta graphs comprise a single-path meta graph and a multi-path meta graph, the single-path meta graph is composed of a single path corresponding to the target node, the multi-path meta graph is obtained by path merging of a plurality of paths corresponding to the target node, taking the target node as a first aggregation node and taking a path node common to the plurality of paths as a second aggregation node, and the single-path meta graph and the multi-path meta graph do not have an intersection path; for each path meta graph, adjusting a neighbor node vector of each neighbor node according to a node similarity between the neighbor node and the target node to obtain a first node embedding vector, and fusing a plurality of first node embedding vectors corresponding to a plurality of neighbor nodes to obtain a graph embedding representation; for each neighbor node, calculating an attention score according to a node similarity between the neighbor node and the target node, and performing context feature fusion on the neighbor node vector and the graph embedding representation based on the attention score to obtain a corresponding second node embedding vector; aggregating a plurality of second node embedding vectors corresponding to a plurality of neighbor nodes and a target node vector of the target node to obtain a comprehensive embedding representation corresponding to each path meta graph; fusing a plurality of comprehensive embedding representations corresponding to the plurality of path meta graphs to obtain a target node embedding, and inputting the target node embedding into a target classification model to obtain a threat event detection result corresponding to the target node.

2. The method of claim 1, wherein, The method comprises: acquiring interaction data of a target terminal, and constructing a heterogeneous network behavior graph based on the interaction data; determining a target node to be detected from the heterogeneous network behavior graph, and a plurality of path meta graphs associated with the target node; wherein the plurality of path meta graphs comprise a single-path meta graph and a multi-path meta graph, the single-path meta graph is composed of a single path corresponding to the target node, the multi-path meta graph is obtained by path merging of a plurality of paths corresponding to the target node, taking the target node as a first aggregation node and taking a path node common to the plurality of paths as a second aggregation node, and the single-path meta graph and the multi-path meta graph do not have an intersection path; for each path meta graph, adjusting a neighbor node vector of each neighbor node according to a node similarity between the neighbor node and the target node to obtain a first node embedding vector, and fusing a plurality of first node embedding vectors corresponding to a plurality of neighbor nodes to obtain a graph embedding representation; 3. The method of claim 1, wherein, for each neighbor node, calculating an attention score according to a node similarity between the neighbor node and the target node, and performing context feature fusion on the neighbor node vector and the graph embedding representation based on the attention score to obtain a corresponding second node embedding vector; aggregating a plurality of second node embedding vectors corresponding to a plurality of neighbor nodes and a target node vector of the target node to obtain a comprehensive embedding representation corresponding to each path meta graph; fusing a plurality of comprehensive embedding representations corresponding to the plurality of path meta graphs to obtain a target node embedding, and inputting the target node embedding into a target classification model to obtain a threat event detection result corresponding to the target node. The method comprises: acquiring interaction data of a target terminal, and constructing a heterogeneous network behavior graph based on the interaction data; determining a target node to be detected from the heterogeneous network behavior graph, and a plurality of path meta graphs associated with the target node; wherein the plurality of path meta graphs comprise a single-path meta graph and a multi-path meta graph, the single-path meta graph is composed of a single path corresponding to the target node, the multi-path meta graph is obtained by path merging of a plurality of paths corresponding to the target node, taking the target node as a first aggregation node and taking a path node common to the plurality of paths as a second aggregation node, and the single-path meta graph and the multi-path meta graph do not have an intersection path; for each path meta graph, adjusting a neighbor node vector of each neighbor node according to a node similarity between the neighbor node and the target node to obtain a first node embedding vector, and fusing a plurality of first node embedding vectors corresponding to a plurality of neighbor nodes to obtain a graph embedding representation; for each neighbor node, calculating an attention score according to a node similarity between the neighbor node and the target node, and performing context feature fusion on the neighbor node vector and the graph embedding representation based on the attention score to obtain a corresponding second node embedding vector; aggregating a plurality of second node embedding vectors corresponding to a plurality of neighbor nodes and a target node vector of the target node to obtain a comprehensive embedding representation corresponding to each path meta graph; fusing a plurality of comprehensive embedding representations corresponding to the plurality of path meta graphs to obtain a target node embedding, and inputting the target node embedding into a target classification model to obtain a threat event detection result corresponding to the target node. The method comprises: acquiring interaction data of a target terminal, and constructing a heterogeneous network behavior graph based on the interaction data; determining a target node to be detected from the heterogeneous network behavior graph, and a plurality of path meta graphs associated with the target node; wherein the plurality of path meta graphs comprise a single-path meta graph and a multi-path meta graph, the single-path meta graph is composed of a single path corresponding to the target node, the multi-path meta graph is obtained by path merging of a plurality of paths corresponding to the target node, taking the target node as a first aggregation node and taking a path node common to the plurality of paths as a second aggregation node, and the single-path meta graph and the multi-path meta graph do not have an intersection path; for each path meta graph, adjusting a neighbor node vector of each neighbor node according to a node similarity between the neighbor node and the target node to obtain a first node embedding vector, and fusing a plurality of first node embedding vectors corresponding to a plurality of neighbor nodes to obtain a graph embedding representation; for each neighbor node, calculating an attention score according to a node similarity between the neighbor node and the target node, and performing context feature fusion on the neighbor node vector and the graph embedding representation based on the attention score to obtain a corresponding second node embedding vector; aggregating a plurality of second node embedding vectors corresponding to a plurality of neighbor nodes and a target node vector of the target node to obtain a comprehensive embedding representation corresponding to each path meta graph; fusing a plurality of comprehensive embedding representations corresponding to the plurality of path meta graphs to obtain a target node embedding, and inputting the target node embedding into a target classification model to obtain a threat event detection result corresponding to the target node. Based on the attention sub-item and the balance sub-item, an attention score of each neighbor node is obtained.

4. The method of claim 1, wherein, The target node embedding is obtained based on a sum of the plurality of updated comprehensive embedding representations corresponding to the plurality of path meta-graphs. For each path meta-graph, a corresponding semantic fusion weight matrix, a global semantic preference vector, and a comprehensive embedding representation are obtained, wherein the global semantic preference vector is used to quantify the semantic importance of the each path meta-graph. Based on the semantic fusion weight matrix, the global semantic preference vector, and the comprehensive embedding representation, an initial graph weight is calculated. A sum of the plurality of initial graph weights corresponding to the plurality of path meta-graphs is obtained to obtain a graph comprehensive weight. Based on a ratio of each initial graph weight to the graph comprehensive weight, a target graph weight corresponding to the each path meta-graph is obtained. According to the target graph weight of the each path meta-graph, the comprehensive embedding representation of the each path meta-graph is adjusted in weight to obtain an updated comprehensive embedding representation. The target node embedding of the target node is obtained based on a sum of the plurality of updated comprehensive embedding representations corresponding to the plurality of path meta-graphs.

5. The method of claim 1, wherein, The target classification model is trained in the following manner: Sample interaction data is obtained, and a sample heterogeneous network behavior graph is constructed based on the sample interaction data. A sample target node to be detected and a plurality of sample path meta-graphs associated with the sample target node are determined from the sample heterogeneous network behavior graph. The plurality of sample path meta-graphs include a sample single path meta-graph and a sample multi-path meta-graph, the sample single path meta-graph is composed of a single sample meta-path corresponding to the sample target node, the sample multi-path meta-graph is obtained by path merging of a plurality of sample meta-paths in common with the sample target node as a first sink node and a path node as a second sink node, and the sample single path meta-graph and the sample multi-path meta-graph do not intersect. For each sample path meta-graph, a sample first node embedding vector is obtained by adjusting a weight of a sample neighbor node vector of each sample neighbor node according to a sample node similarity between the each sample neighbor node and the sample target node, and a sample graph embedding representation is obtained by fusing a plurality of sample first node embedding vectors corresponding to a plurality of sample neighbor nodes. For each sample neighbor node, a sample attention score is calculated according to a sample node similarity between the sample neighbor node and the sample target node, and a corresponding sample second node embedding vector is obtained by context feature fusion of the sample neighbor node vector and the sample graph embedding representation based on the sample attention score. A plurality of sample second node embedding vectors corresponding to a plurality of sample neighbor nodes and a sample target node vector of the sample target node are aggregated to obtain a sample comprehensive embedding representation corresponding to the each sample path meta-graph. According to the plurality of sample path meta-graph corresponding to a plurality of sample comprehensive embedding representation fusion sample target node embedding, and inputting the sample target node embedding into a preset classification model to obtain a predicted threat event detection result corresponding to the sample target node; Based on the difference between the predicted threat event detection result and the preset sample threat event detection result, a first loss is constructed; Obtain the sample first attention score mean value corresponding to the plurality of sample first neighbor nodes of the plurality of sample single path meta-graph, and the sample second attention score mean value corresponding to the plurality of sample second neighbor nodes of the plurality of sample multi-path meta-graph, and based on the difference between the sample second attention score mean value and the sample first attention score mean value, a second loss is constructed; Based on the first loss and the second loss, the parameters of the preset classification model are adjusted to obtain a target classification model.

6. The method of claim 5, wherein, The method comprises the following steps: For each sample single path meta-graph, the sample first attention score of each sample first neighbor node is obtained; Obtain the first number of the plurality of sample first neighbor nodes of the plurality of sample single path meta-graph, and obtain the sample first attention score mean value according to the ratio of the sum of the plurality of sample first attention scores corresponding to the plurality of sample first neighbor nodes to the first number; For each sample multi-path meta-graph, the sample second attention score of each sample second neighbor node is obtained; Obtain the second number of the plurality of sample second neighbor nodes of the plurality of sample multi-path meta-graph, and obtain the sample second attention score mean value according to the ratio of the sum of the plurality of sample second attention scores corresponding to the plurality of sample second neighbor nodes to the second number.

7. The method of claim 5, wherein the terminal threat event is detected by: The method comprises the following steps: Based on the difference between the sample second attention score mean value and the sample first attention score mean value, a first difference value is determined; Obtain a preset boundary threshold value, and based on the difference between the preset boundary threshold value and the first difference value, a second difference value is determined; Obtain a preset reference zero value, and based on the size relationship between the preset reference zero value and the second difference value, a second loss is constructed.

8. A terminal threat event detection apparatus characterized by comprising: The device comprises: An acquisition module is configured to acquire interaction data of a target terminal, and construct a heterogeneous network behavior graph based on the interaction data; A determination module is configured to determine a target node to be detected and a plurality of path meta-graphs associated with the target node from the heterogeneous network behavior graph. The plurality of path meta-graphs include a single-path meta-graph and a multi-path meta-graph, the single-path meta-graph is composed of a single path corresponding to the target node, the multi-path meta-graph is obtained by path merging of a plurality of paths corresponding to the target node, the single-path meta-graph and the multi-path meta-graph do not have an intersection path; The adjusting module is configured to, for each path meta-graph, perform weight adjustment on a neighbor node vector of each neighbor node according to a node similarity between the each neighbor node and the target node, to obtain a first node embedding vector, and to obtain a graph embedding representation based on a plurality of first node embedding vectors corresponding to a plurality of neighbor nodes; The computing module is configured to, for the each neighbor node, calculate an attention score according to the node similarity between the each neighbor node and the target node, and to perform context feature fusion on the neighbor node vector and the graph embedding representation based on the attention score, to obtain a corresponding second node embedding vector; The aggregating module is configured to aggregate a plurality of second node embedding vectors corresponding to a plurality of neighbor nodes and a target node vector of the target node, to obtain a comprehensive embedding representation corresponding to the each path meta-graph; The input module is configured to fuse a plurality of comprehensive embedding representations corresponding to the plurality of path meta-graphs to obtain a target node embedding, and to input the target node embedding into a target classification model to obtain a threat event detection result corresponding to the target node.

9. A computer device, comprising: The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the terminal threat event detection method of any one of claims 1 to 7 when executing the computer program.

10. A computer readable storage medium, the storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the terminal threat event detection method of any one of claims 1 to 7.

Images