Attack chain detection model training method, attack chain detection method, device and vehicle

Abstract

The application relates to a training method and a detection method of an attack chain detection model, a device and a vehicle, and relates to the technical field of big data. The method comprises the following steps: constructing a graph structure based on historical interaction information between network nodes in a target network; wherein the nodes of the graph structure are the network nodes, and the edges of the graph structure are used for representing interaction features between the network nodes; training a graph neural network by using a masked graph structure; performing attack detection on the graph neural network to identify an attack chain in the graph neural network; wherein the attack chain is a link in the graph neural network, the attack score of which satisfies a preset condition; the attack score is determined based on the activity of each edge in the link, the feature similarity between the edge and a previous edge, and attack sensitivity; and the attack chain is marked to the graph neural network to obtain an attack chain detection model. Therefore, potential attack paths in the target network can be captured more comprehensively and accurately.

Description

Technical Field

[0001] This application relates to the field of big data technology, and more particularly to the field of graph data processing technology, specifically to a training method for an attack chain detection model, an attack chain detection method, an apparatus, and a vehicle. Background Technology

[0002] In today's rapidly evolving digital landscape, applications such as enterprise intranets, industrial control systems, cloud computing platforms, and connected vehicles are becoming increasingly widespread and complex, with numerous network nodes frequently interacting to form vast relational networks. Attackers, aiming to steal information or disrupt systems, often employ covert and interconnected attack chains to bypass traditional security measures. However, current attack chain detection methods struggle to capture the potential connections between various interactions within the attack chain, failing to promptly identify attack paths. Summary of the Invention

[0003] This application provides a training method for an attack chain detection model, an attack chain detection method, an apparatus, and a vehicle, to at least address the technical problem in related technologies that it is difficult to capture the potential correlations between various interactive behaviors in an attack chain and to detect attack paths in a timely manner. The technical solution of this application is as follows:

[0004] According to the first aspect provided in this application, a training method for an attack chain detection model is provided, comprising: constructing a graph structure based on historical interaction information between network nodes in a target network; wherein, the nodes of the graph structure are network nodes, and the edges of the graph structure are used to characterize the interaction features between network nodes; the interaction features include at least one of the following: interaction time, interaction frequency that triggers alarms, and interaction behavior type; training a graph neural network using the masked graph structure; performing attack detection on the graph neural network to identify attack chains in the graph neural network; wherein, an attack chain is a link in the graph neural network whose attack score meets preset conditions; the attack score is determined based on the activity of each edge in the link, the feature similarity with the previous edge, and the attack sensitivity; and labeling the attack chain onto the graph neural network to obtain the attack chain detection model.

[0005] Based on the aforementioned technical means, this application can construct a graph structure with multi-dimensional interaction features based on the historical interaction information of target network nodes, enhance the generalization of graph neural network training and the attention to key features by using masking operations, and then accurately identify attack chains by comprehensively determining the attack score based on the activity of the edge, the similarity of features with the previous edge, and the attack sensitivity, and finally label the attack chain detection model. This avoids the problems of insufficient characterization of complex network interaction relationships, low attack chain detection accuracy, and poor adaptability to unknown attack patterns caused by relying on a single network topology or simple interaction indicators to build the model in related technologies. Thus, it can capture potential attack paths in the target network more comprehensively and accurately.

[0006] In one possible approach, the interaction behavior type includes attack behavior; the attack behavior includes a detection phase, a penetration phase, and an attack execution phase with progressively increasing attack completion; attack detection is performed on the graph neural network to identify attack chains in the graph neural network, including: under the condition of satisfying a first constraint, attack detection is performed on the graph neural network to identify attack chains in the graph neural network; the first constraint is that the attack completion of the first target edge in the attack chain is not lower than the attack completion of the edge preceding the first target edge.

[0007] Based on the above technical means, this application can ensure that the attack completion degree of the edges in the attack chain is not in descending order by setting a first constraint condition when attack detection and identification of the attack chain, prohibiting phase backtracking and continuous detection phases, and reducing the generation of invalid paths.

[0008] One possible approach involves attack detection on the graph neural network and identifying attack chains within it. This further includes: under a second constraint condition, attack detection on the graph neural network and identifying attack chains within it; the second constraint condition is that the triggering time of the first target edge in the attack chain is not less than the triggering time of the edge preceding the first target edge.

[0009] Based on the above technical means, this application can set a second constraint condition that the edge triggering time in the attack chain does not flow backward when identifying the attack chain in the graph neural network for attack detection. This avoids the incorrect chaining of temporally disordered edges into an attack chain due to ignoring the time sequence, thereby enabling more accurate identification of complete attack chains that conform to the evolution logic of the attack stage.

[0010] One possible approach involves attack detection on the graph neural network and identifying attack chains within it. This further includes: under a third constraint condition, attack detection on the graph neural network and identifying attack chains within it; the third constraint condition is that the exploration depth of the attack chain is less than or equal to a first threshold, and the exploration length of the attack chain is less than or equal to a second threshold.

[0011] Based on the aforementioned technical means, this application can set a third constraint on the depth and length of attack chain exploration when identifying attack chains in a graph neural network for attack detection. This avoids problems such as excessive consumption of computing resources, excessively long model training and inference time, excessive noise interference due to excessively large exploration range, and difficulty in obtaining effective attack chain information within a reasonable time due to unrestricted exploration of attack chains. Thus, it can more efficiently and accurately identify key and effective attack chains while reasonably controlling computing costs and time overhead, thereby improving the practicality and efficiency of overall network security attack chain detection.

[0012] One possible approach to attack detection on graph neural networks and identification of attack chains within them includes: identifying attack origins in the graph neural network based on the frequency and type of interactions that trigger alarms; and performing attack detection on the graph neural network from these attack origins to identify attack chains within it.

[0013] Based on the aforementioned technical means, this application can accurately identify the attack starting point in a graph neural network by using the interaction frequency and interaction behavior type that triggers alarms, and use this as the starting point to carry out attack detection to identify the attack chain. This avoids the problems of related technologies blindly traversing the entire network or determining the attack starting position based on a single simple feature, which makes it difficult to focus on key attack paths and results in low efficiency in attack chain identification. It can track attack behavior more specifically, quickly and accurately identify complete and effective attack chains, and improve the efficiency and accuracy of network security attack chain detection.

[0014] In one possible approach, the activity of the second target edge in the link is determined based on the ratio of the number of edges directly connected to the second target edge to the total number of edges in the graph neural network; the attack sensitivity of the second target edge is negatively correlated with the triggering time interval between the second target edge and the previous edge of the second target edge.

[0015] Based on the aforementioned technical means, this application can determine the activity level of a second target edge by comparing the ratio of the number of directly connected edges to the total number of edges in the graph neural network. Furthermore, it establishes a negative correlation between the attack sensitivity of the second target edge and the triggering time interval between it and the preceding edge. This avoids the problems of related technologies that rely solely on fixed indicators or simple association rules to assess edge characteristics and attack risks, leading to inaccurate judgments of edge activity and potential attack threats, an inability to dynamically reflect the impact of network interaction changes on attack probability, and difficulty in effectively capturing the role of time factors in attack development. Therefore, it can more scientifically, comprehensively, and dynamically assess edge characteristics, providing a more reliable basis for accurately identifying attack chains and improving the accuracy and timeliness of network attack chain detection.

[0016] In one possible approach, the attack rating is determined based on the activity of each edge in the link, the feature similarity with the previous edge, the attack sensitivity, the importance of the attack phase, and the attack phase leap reward; where the importance of the attack phase is positively correlated with the attack completion rate.

[0017] Based on the aforementioned technical means, this application can determine the attack severity score by comprehensively considering the activity of each edge in the attack chain, the feature similarity with the previous edge, the attack sensitivity, the importance of the attack stage determined based on the positive correlation with the attack completion degree, and the attack stage leap reward. This allows for a more accurate and comprehensive assessment of the attack chain's attack severity, providing stronger decision support for timely detection and blocking of network attacks, and effectively improving the level of network security protection.

[0018] One possible approach involves training a graph neural network using a masked graph structure, including: training a graph neural network using the E-GraphSAGE algorithm and a masked graph structure.

[0019] Based on the above technical means, this application can train a graph neural network by using the E-GraphSAGE algorithm combined with the masked graph structure, so that it can sample and aggregate the edge information of the graph, capture the potential patterns and associations between edges. Compared with the GraphSAGE algorithm that only considers node features, the E-GraphSAGE algorithm can provide richer and more demanding feature representations for subsequent tasks (such as edge correlation analysis in attack chain detection).

[0020] According to the second aspect provided in this application, an attack chain detection method is provided, the method comprising: acquiring interaction information between network nodes in a target network; inputting the interaction information into an attack chain detection model trained based on the training method of the attack chain detection model as described in the first aspect, and obtaining an attack chain detection result.

[0021] Based on the aforementioned technical means, this application can first obtain the interaction information between network nodes in the target network, and then input the interaction information into the attack chain detection model to obtain the detection results. This can closely combine the actual operating status of the target network, accurately identify potential attack chains, provide more targeted and practical decision-making basis for network security protection, and effectively improve the detection and prevention capabilities against real network attacks.

[0022] According to a third aspect provided in this application, a training apparatus for an attack chain detection model is provided, comprising: a construction unit, a training unit, an identification unit, and a processing unit; the construction unit is used to construct a graph structure based on historical interaction information between network nodes in a target network; wherein, the nodes of the graph structure are network nodes, and the edges of the graph structure are used to characterize the interaction features between network nodes; the interaction features include at least one of the following: interaction time, interaction frequency that triggers alarms, and interaction behavior type; the training unit is used to train a graph neural network using the masked graph structure; the identification unit is used to perform attack detection on the graph neural network and identify attack chains in the graph neural network; wherein, an attack chain is a link in the graph neural network whose attack score meets preset conditions; the attack score is determined based on the activity of each edge in the link, the feature similarity with the previous edge, and the attack sensitivity; the processing unit is used to label the attack chain onto the graph neural network to obtain the attack chain detection model.

[0023] In one possible approach, the interaction behavior type includes attack behavior; the attack behavior includes a detection phase, a penetration phase, and an attack execution phase with progressively increasing attack completion; the identification unit is specifically used to: perform attack detection on the graph neural network and identify the attack chain in the graph neural network under the condition of satisfying the first constraint; the first constraint is that the attack completion of the first target edge in the attack chain is not lower than the attack completion of the edge preceding the first target edge.

[0024] In one possible approach, the identification unit is specifically used to: perform attack detection on the graph neural network and identify the attack chain in the graph neural network under the condition that the second constraint is met; the second constraint is that the triggering time of the first target edge in the attack chain is not less than the triggering time of the edge preceding the first target edge.

[0025] In one possible approach, the identification unit is specifically used to: perform attack detection on the graph neural network and identify attack chains in the graph neural network under the condition that a third constraint is met; the third constraint is that the exploration depth of the attack chain is less than or equal to a first threshold and the exploration length of the attack chain is less than or equal to a second threshold.

[0026] In one possible approach, the identification unit is specifically used to: identify the attack origin in the graph neural network based on the frequency and type of interaction that triggers the alarm; and perform attack detection on the graph neural network from the attack origin to identify the attack chain in the graph neural network.

[0027] In one possible approach, the activity of the second target edge in the link is determined based on the ratio of the number of edges directly connected to the second target edge to the total number of edges in the graph neural network; the attack sensitivity of the second target edge is negatively correlated with the triggering time interval between the second target edge and the previous edge of the second target edge.

[0028] In one possible approach, the attack rating is determined based on the activity of each edge in the link, the feature similarity with the previous edge, the attack sensitivity, the importance of the attack phase, and the attack phase leap reward; where the importance of the attack phase is positively correlated with the attack completion rate.

[0029] In one possible approach, the training unit is specifically used to train a graph neural network using the E-GraphSAGE algorithm and a masked graph structure.

[0030] According to the fourth aspect provided in this application, an attack chain detection device is provided, the device comprising: an acquisition unit and a determination unit; the acquisition unit is used to acquire interaction information between network nodes in a target network; the determination unit is used to input the interaction information into an attack chain detection model trained based on the training method of the attack chain detection model as described in the first aspect, to obtain an attack chain detection result.

[0031] According to the fifth aspect provided in this application, a vehicle is provided, the vehicle including the attack chain detection device as described in the fourth aspect.

[0032] According to a sixth aspect provided in this application, an electronic device is provided, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute instructions to implement the method of the first aspect described above and any possible implementation thereof.

[0033] According to the seventh aspect provided in this application, a computer-readable storage medium is provided that, when the instructions in the computer-readable storage medium are executed by a processor of an electronic device, enables the electronic device to perform the methods described in the first aspect and any possible implementation thereof.

[0034] According to the eighth aspect provided in this application, a computer program product is provided, the computer program product including computer instructions that, when executed on an electronic device, cause the electronic device to perform the method described in the first aspect and any possible implementation thereof.

[0035] It should be noted that the technical effects of any of the implementation methods in aspects two through eight can be found in the technical effects of the corresponding implementation methods in aspect one, and will not be repeated here.

[0036] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0037] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application, and do not constitute an undue limitation of this application.

[0038] Figure 1 This is a flowchart illustrating a training method for an attack chain detection model according to an exemplary embodiment;

[0039] Figure 2 This is a flowchart illustrating an attack chain detection method according to an exemplary embodiment;

[0040] Figure 3 This is a schematic diagram illustrating the training process of an attack chain detection model according to an exemplary embodiment;

[0041] Figure 4 This is a block diagram illustrating a training apparatus for an attack chain detection model according to an exemplary embodiment;

[0042] Figure 5 This is a block diagram illustrating an attack chain detection device according to an exemplary embodiment;

[0043] Figure 6 This is a block diagram illustrating an electronic device according to an exemplary embodiment. Detailed Implementation

[0044] To enable those skilled in the art to better understand the technical solutions of this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0045] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0046] In the embodiments of this application, the words "exemplary," "for example," or "e.g.," are used to indicate examples, illustrations, or explanations. Any embodiment or design described as "exemplary," "for example," or "e.g.," in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of the words "exemplary," "for example," or "e.g.," is intended to present the relevant concepts in a specific manner.

[0047] For ease of understanding, the training method of an attack chain detection model provided in this application will be described in detail below with reference to the accompanying drawings.

[0048] Figure 1 This is a flowchart illustrating a training method for an attack chain detection model according to an exemplary embodiment, such as... Figure 1 As shown, the training method for this attack chain detection model includes the following steps:

[0049] S101. Construct a graph structure based on the historical interaction information between network nodes in the target network.

[0050] Optionally, the target network can be selected based on actual needs. For example, the target network could be a vehicle-to-everything (V2X) network, an industrial Internet of Things (IIoT) network, or a social network. This application does not impose any specific limitations in this regard.

[0051] In this graph structure, the nodes are network nodes, and the edges represent the interaction characteristics between them. Interaction characteristics can include at least one of the following: interaction time, frequency of interactions triggering alarms, and type of interaction behavior. Historical interaction information can be used to represent the data set generated and recorded from interactions that have occurred between network nodes in the target network environment within a specific time period. Historical interaction information can reflect the past interaction patterns, relationships, and characteristics between network nodes.

[0052] For example, in the Internet of Vehicles, it is recorded that vehicle A and vehicle B exchanged data on October 15, 2024 at 14:30:25. Or, in the Industrial Internet of Things, a sensor node sends equipment operating parameters, such as temperature, pressure, and speed, to the control center at a certain time.

[0053] In one possible implementation, historical interaction information between network nodes in the target network can be collected in the following way:

[0054] Historical interaction information is collected by collecting and analyzing log files generated by network nodes.

[0055] Network nodes (various devices and systems) in a target network typically generate detailed log files that record interaction information between nodes. For example, server logs can record client access requests, access times, and access results; router logs record packet forwarding information, source Internet Protocol (IP) addresses, and destination IP addresses. By collecting and analyzing the log files generated by network nodes, historical interaction information can be gathered.

[0056] Historical interaction information is collected using dedicated monitoring tools:

[0057] Specialized network monitoring tools are used to capture and analyze interaction data between nodes. For example, network traffic monitoring tools can monitor data traffic in the network in real time, recording information such as the source and destination addresses of data packets, transmission time, and protocol type. Security monitoring tools can detect abnormal behavior and security events in the network and record relevant interaction information.

[0058] Collect historical interaction information through the Application Programming Interface (API):

[0059] Many web applications and services provide APIs that allow developers to access interaction data within the application. For example, social networking platforms typically provide APIs that allow users to retrieve historical interaction information such as friend relationships, posts, and interactions between users.

[0060] In one possible implementation, when constructing the graph structure, the training device for the attack chain detection model can accurately identify graph edges based on four key flow fields from historical interaction information: source IP address, source port, destination IP address, and destination port. Specifically, the training device can combine the source IP address and source port into a 2-tuple to uniquely identify the source node, and use the destination IP address and destination port to identify the destination node. Furthermore, the training device can treat the source node and its corresponding destination node as two nodes of an edge, and use the interaction features between the source node and its corresponding destination node as edges to construct the graph structure.

[0061] For example, when the source node (172.26.185.48:52962) and the destination node (192.168.1.152:80) exchange data, this data interaction relationship between them can be represented as an edge in the graph.

[0062] In addition, during the construction of the graph structure, considering that the original source IP address may have privacy or specific analysis requirements, the training device of the attack chain detection model can map the original IP address to a preset range and randomly assign IP addresses to protect the relevant information of the original data. It also maintains the relative relationship and characteristics of the data when constructing the graph structure, providing strong support for subsequent network analysis and research.

[0063] Optionally, the preset range can be set according to actual needs. For example, the preset range can be from 172.16.0.1 to 172.31.0.1. This application does not impose specific limitations on this.

[0064] In one possible implementation, before constructing the graph structure based on historical interaction information between network nodes in the target network, the training device for the attack chain detection model can remove irrelevant data from the historical interaction information and preprocess the historical interaction information.

[0065] Preprocessing can include text vectorization, temporal feature modeling, feature extraction, and feature fusion.

[0066] Text vectorization includes:

[0067] The training apparatus for the attack chain detection model can segment the input text using a Bidirectional Encoder Representations from Transformers (BERT) model, breaking down continuous text into individual lexical units, or tokens. Simultaneously, the BERT model can add special tokens (e.g., [CLS] and [SEP]) before and after the segmented text. The [CLS] token is located at the beginning of the text, and its corresponding hidden state is typically considered an aggregate representation of the entire text; the [SEP] token is used to separate different text segments, serving as an indicator of the end of text in single-text input scenarios. After segmentation and token addition, the training apparatus can input the processed text into the BERT model. The BERT model performs deep encoding on the text, outputting the hidden state of each token (containing rich semantic information, reflecting the features of each token in its context).

[0068] Furthermore, because the [CLS] token is designed during training to aggregate the semantic information of the entire text, it can better represent the overall features of the text. The training device for the attack chain detection model can select the hidden state of the [CLS] token as the vector representation of the entire text.

[0069] Furthermore, the vectors output by the BERT model are typically 768-dimensional. In scenarios with limited computing resources or high computational efficiency requirements, directly using 768-dimensional vectors can lead to high computational complexity. Therefore, the training mechanism for attack chain detection models can reduce the dimensionality of the 768-dimensional vectors to decrease computational complexity, reduce data redundancy to some extent, and preserve as much key semantic information of the text as possible, providing more efficient data support for subsequent model training and inference.

[0070] Optionally, the dimension of the reduced vector can be set according to actual needs. For example, the dimension of the reduced vector can be 128 dimensions, 256 dimensions, or other dimensions. This application does not impose specific restrictions in this regard.

[0071] For example, the training device for the attack chain detection model can reduce the dimensionality of the vector output by the BERT model using linear layers. When the dimension of the vector after dimensionality reduction is 128, and the dimension of the vector output by the BERT model is 768, the dimensionality reduction process satisfies the following first formula:

[0072]

[0073] in, `x` can be used to represent the output vector, i.e., the vector after dimensionality reduction, with a dimension of 128. `x` can be used to represent the input vector, i.e., the vector output by the BERT model, with a dimension of 768. `W` can be used to represent the weight matrix, with a dimension of 768. Dimension is a core parameter of the linear layer. b can be used to represent the bias vector, which has a dimension of 128.

[0074] By reducing the dimension of the vector output by the BERT model to 128, the computational complexity and memory consumption of the subsequent graph neural network in neighborhood aggregation and message passing can be significantly reduced, while retaining sufficient semantic information to meet the requirements of real-time detection. If computational resources are abundant and the expected attack pattern is extremely complex, requiring the retention of more subtle semantic features, a higher dimension (e.g., 256 dimensions) can be chosen to pursue better performance. Alternatively, if computational efficiency is a certain requirement, a lower dimension (e.g., 64 dimensions) can be considered.

[0075] In the dimensionality reduction process of the proposed vehicle network attack detection method, a linear layer jointly trained with a graph neural network is used to compress high-dimensional BERT vectors to low dimensions. The parameter weights in the linear layer can be continuously optimized during model training through backpropagation and gradient descent, thereby adaptively retaining key semantic patterns that are crucial for detecting complex attacks and discarding redundant information. The final effect of information retention is indirectly verified and guaranteed by performance indicators such as the accuracy of attack chain detection.

[0076] Alternatively, the training mechanism for the attack chain detection model can reduce the dimensionality of the vectors output by the BERT model using an unsupervised representation learning method (Deep GraphInfomax, DGI). The dimensionality reduction formula for DGI satisfies the following second formula:

[0077]

[0078] Here, X can be used to represent the characteristic matrix of a node. A can be used to represent the adjacency matrix. s can be used to represent the embedding vector of node v. s can be used to represent the global summary vector of the graph. D can be used to represent the discriminator, used to distinguish between positive samples (real node embeddings and global summaries) and negative samples (fake node embeddings and global summaries). It can be used to characterize the negative sample feature matrix obtained by destroying the original features. It can be used to characterize the embedding vector of negative samples.

[0079] During the dimensionality reduction of the BERT model output vector using DGI, information loss can be minimized by maximizing mutual information. Temporal feature modeling includes:

[0080] The training apparatus for the attack chain detection model can convert absolute times in historical interaction information into relative time intervals, and use these relative time intervals to construct a temporal feature model. Furthermore, the training apparatus can integrate these temporal features into textual features to capture the temporal relationships between network events.

[0081] Specifically, the training device for the attack chain detection model can calculate the time interval between each event (e.g., message sending event, alarm triggering event, etc.) in the automotive cybersecurity event sequence, thereby obtaining a series of relative time interval data. Subsequently, to ensure data stability and processability, the training device can normalize these time intervals, mapping them to a fixed numerical range (e.g., [0,1]). Finally, the training device can employ sine and cosine coding to integrate the processed time features into the text features, thereby achieving accurate capture and analysis of the temporal relationships in automotive cybersecurity events.

[0082] Feature extraction and feature fusion include:

[0083] The training device for the attack chain detection model can use a fixed time window as the basic analysis unit and dynamically aggregate and analyze alarm types in historical interaction information through a sliding window mechanism. First, a fixed window with a certain time span is defined as the sliding baseline. Within this window range, the frequency of occurrence of various alarm types is statistically analyzed to quantify the density of different types of alarms in a short period of time, thereby capturing the outbreak characteristics of network security incidents within a specific time period.

[0084] During operation, the training device for the attack chain detection model can dynamically adjust the coverage of the sliding window for each cybersecurity event based on its occurrence time, strictly ensuring that the time interval between events covered within the window does not exceed a pre-set threshold. In this way, the training device can accurately focus on the local time region surrounding each event, effectively statistically analyzing the frequency of various alarms within that region. This provides accurate and reliable data support for subsequently integrating frequency features into text features, enabling a more complete and detailed supplement and presentation of cybersecurity information.

[0085] S102. Train the graph neural network using the masked graph structure.

[0086] The graph neural network can consist of at least one E-GraphSAGE layer and one softmax layer. Hidden features, i.e., the dimensions of node embeddings, can be set in each E-GraphSAGE layer.

[0087] In one possible implementation, the training device for the attack chain detection model can mask the edge features in the graph structure to obtain the masked graph structure, and then input it into the graph neural network for supervised training.

[0088] Specifically, after the masked graph structure is input into the graph neural network (GNN), each E-GraphSAGE layer in the GNN can aggregate features of the nodes in the graph structure to obtain node embeddings. When the node embeddings are generated in the last E-GraphSAGE layer, they can be converted into corresponding edge embeddings, and the edge embeddings are output through a softmax layer. The softmax layer can classify the edges, i.e., predict the edge type based on the edge embeddings. A loss value is determined based on the difference between the predicted edge type and the true edge type. This loss value is then used to adjust the model parameters of the GNN during the backpropagation phase.

[0089] For example, the training device of the attack chain detection model can randomly select at least one mask edge to mask one or more dimensions of the feature vector of the mask edge. For example, the mask edge includes a 128-dimensional BERT semantic vector, time encoding, frequency features, etc. The training device of the attack chain detection model can randomly mask the time encoding of the mask edge, set its value to zero or replace it with a special mask mark ([MASK]).

[0090] In graph neural networks, node embedding refers to the generation of a node's final low-dimensional vector representation by aggregating the feature information of the node itself and its nearest to farthest neighbor nodes layer by layer, after k (the number of E-GraphSAGE layers in the graph neural network) message passing and feature transformations. Each hop aggregation only considers neighbors within the current distance range; the larger the value of k, the wider the local structure range of the embedding fusion. The final embedding can simultaneously capture the node's own attributes and its multi-level contextual relationships in the graph topology. Edge embedding is obtained by aggregating the node embeddings of the two nodes of an edge.

[0091] Training a graph neural network (Graph Neural Network) using a masked graph structure enables the network to learn the spatial and semantic relationships between edges, thereby capturing potential complex patterns and associations between edges. These high-quality feature learning results provide a solid and powerful feature representation foundation for subsequent attack chain detection tasks.

[0092] Furthermore, while the original GraphSAGE algorithm outputs node embeddings, the E-GraphSAGE algorithm outputs edge embeddings, providing a foundation for edge classification. The E-GraphSAGE algorithm considers edge features, capturing latent patterns and associations between edges by sampling and aggregating graph edge information. Compared to the GraphSAGE algorithm, which only considers node features, the E-GraphSAGE algorithm can provide richer and more relevant feature representations for subsequent tasks (such as edge correlation analysis in attack chain detection).

[0093] S103. Perform attack detection on the graph neural network and identify the attack chain in the graph neural network.

[0094] An attack chain is a link in a graph neural network that meets preset conditions for an attack score. The attack score is determined based on the activity of each edge in the link, the feature similarity with the previous edge, and the attack sensitivity. Interaction behavior types also include attack behaviors. The attack phases of an attack behavior include the probing phase, the penetration phase, and the attack execution phase, with attack completion increasing sequentially.

[0095] The probing phase refers to attackers identifying potential security vulnerabilities by scanning the target system for information such as open ports, service versions, and operating system type. For example, attackers might send a large number of probe requests from an external network to the target network's gateway in an attempt to discover vulnerabilities and open ports within the target network.

[0096] The penetration phase refers to the period after the probing phase, where attackers attempt to infiltrate the target network using discovered vulnerabilities. For example, if an attacker discovers a known vulnerability in a gateway, they can exploit that vulnerability (such as an unauthorized access vulnerability) to penetrate the gateway and gain certain access privileges. At this point, the attacker's source of attack becomes a controlled node within the gateway.

[0097] The attack execution phase refers to the period when the attacker has successfully infiltrated the target network and is preparing to carry out specific attack actions. For example, the attacker executes malicious code on the server to steal sensitive information stored in the target network (such as vehicle driving data, user personal information, etc.).

[0098] Between the penetration phase and the attack execution phase, the attack phase can also include a lateral movement phase. The lateral movement phase refers to a series of activities an attacker undertakes within the target network after successfully penetrating it, in order to expand their control or access more sensitive data. For example, an attacker might start from a controlled gateway node and launch an attack on a server within the target network, successfully gaining control of the server by exploiting another vulnerability (such as a buffer overflow vulnerability).

[0099] In one possible implementation, the attack score can be determined based on the activity of each edge in the chain, the feature similarity with the previous edge, the attack sensitivity, the importance of the attack phase, and the attack phase leap reward. The activity of the second target edge in the chain is determined based on the ratio of the number of edges directly connected to the second target edge to the total number of edges in the graph neural network; a higher ratio indicates a more active second target edge. The attack sensitivity of the second target edge is negatively correlated with the trigger time interval between the second target edge and the previous edge. The importance of the attack phase is positively correlated with the attack completion rate. The attack score of the entire attack chain can satisfy the following third formula:

[0100]

[0101] The score of the i-th edge in the attack chain The following fourth formula must be satisfied:

[0102]

[0103] in, It can be used to characterize the score of the i-th edge in the attack chain. It can be used to characterize the offensiveness score of the entire attack chain. Used to characterize the feature similarity between the i-th edge and the (i-1)-th edge in the attack chain. It can be used to characterize the activity of the i-th edge in an attack chain. It can be used to characterize the attack sensitivity of the i-th edge in an attack chain. It can be used to characterize the stage jump reward of the i-th edge in the attack chain. It can be used to characterize the stage weight of the i-th edge in the attack chain, that is, the importance of the attack stage.

[0104] Satisfy the following fifth formula:

[0105]

[0106] in, It can be used to characterize the features of the i-th edge. It can be used to characterize the features of the (i-1)th edge.

[0107] Satisfy the following sixth formula:

[0108]

[0109] in, It can be used to represent the number of edges directly connected to the i-th edge. It can be used to represent the total number of edges in a graph neural network.

[0110] Satisfy the following seventh formula:

[0111] in, It can be used to characterize time weighting factors. It can be used to characterize the time decay constant. This can be used to characterize the time interval between the triggering time of the i-th edge and the triggering time of the (i-1)-th edge. The larger the time interval, the higher the attack sensitivity. The lower.

[0112] Satisfy the following eighth formula:

[0113]

[0114] Here, b can be used to represent the reward for a successful stage leap. It can be used to characterize the attack phase of the i-th edge. It can be used to characterize the attack phase of the (i-1)th edge.

[0115] Optionally, the stage advancement reward can be set according to actual needs. For example, the stage advancement reward b can be 1 or 2. This application does not impose specific restrictions on this.

[0116] Optionally, the stage weights (importance of attack stages) can be set according to actual needs. For example, the stage weight for the probing stage is 1.0, the stage weight for the penetration stage is 1.1, the stage weight for the lateral movement stage is 1.3, and the stage weight for the attack execution stage is 1.6. Alternatively, the stage weight for the probing stage is 1.0, the stage weight for the penetration stage is 1.2, the stage weight for the lateral movement stage is 1.5, and the stage weight for the attack execution stage is 2.0. Furthermore, the stage weights can correspond to the attack completion rate of each attack stage. This application does not impose specific limitations in this regard.

[0117] In one possible implementation, the probing phase, as the initial link in the attack chain, is primarily used for information gathering and does not directly damage the target network; its attack completion rate is defined as low (e.g., 5%). The penetration phase characterizes a successful breach of the target network but with limited control; its attack completion rate can be defined as low to medium (e.g., 20%). The lateral movement phase characterizes the spread within the target network but without complete control; its attack completion rate can be defined as high (e.g., 50%). The attack execution phase characterizes successful penetration of the target network and the commencement of the attack; its attack completion rate is 100%. The specific attack completion rates for different phases can be set according to actual needs; this application does not impose specific limitations on this.

[0118] In one possible implementation, the training device for the attack chain detection model can identify the attack origin in the graph neural network based on the frequency and type of interaction that triggers alarms, while meeting constraints. Then, it can start from the attack origin to detect attacks on the graph neural network and identify the attack chain in the graph neural network.

[0119] Optionally, the constraint can be one of the first, second, and third constraints, or two of the first, second, and third constraints, or a combination of the first, second, and third constraints. This application does not impose specific limitations in this regard.

[0120] The first constraint is that the attack completion degree of the first target edge in the attack chain is not lower than that of the edge preceding it. This ensures that the attack detection path conforms to the logical order of the attack behavior, prohibits phase backtracking and continuous detection phases, and reduces the generation of invalid paths. The second constraint is that the trigger time of the first target edge in the attack chain is not lower than that of the edge preceding it. This ensures that the attack trigger time is strictly incremental, avoiding time reversal. The third constraint is that the exploration depth of the attack chain is less than or equal to a first threshold, and the exploration length of the attack chain is less than or equal to a second threshold. This avoids an excessively large search space and improves the algorithm's performance.

[0121] Optionally, the first threshold can be set according to actual needs. For example, the first threshold can be 5 or 6. This application does not impose specific restrictions on this.

[0122] Optionally, the second threshold can be set according to actual needs. For example, the second threshold can be 7 or 4. This application does not impose specific restrictions on this.

[0123] S104. Label the attack chain onto the graph neural network to obtain the attack chain detection model.

[0124] In one possible implementation, after identifying the attack chains in the graph neural network, the training device of the attack chain detection model can sort the identified attack chains from high to low according to the attack chain scores, and construct a graph database based on the top N attack chains in the sort.

[0125] Furthermore, the training device for the attack chain detection model can label the graph database onto the graph neural network to obtain the attack chain detection model.

[0126] In one possible implementation, after labeling the attack chain onto the graph neural network, the training device of the attack chain detection model can evaluate and optimize the labeled graph neural network based on the test dataset until the prediction accuracy of the labeled graph neural network is greater than a preset accuracy threshold.

[0127] Based on the above technical solution, this application can construct a graph structure with multi-dimensional interaction features based on the historical interaction information of the target network nodes, enhance the generalization of graph neural network training and the attention to key features by using masking operations, and then accurately identify attack chains by comprehensively determining the attack score based on the edge activity, the similarity of features with the previous edge, and the attack sensitivity, and finally label the attack chain detection model. This avoids the problems of insufficient characterization of complex network interaction relationships, low attack chain detection accuracy, and poor adaptability to unknown attack patterns caused by relying on a single network topology or simple interaction indicators to build the model in related technologies. Thus, it can capture potential attack paths in the target network more comprehensively and accurately.

[0128] In some embodiments, such as Figure 2 As shown in the embodiment of this application, the attack chain detection method also includes the following steps: S201-S202.

[0129] S201. Obtain the interaction information between network nodes in the target network.

[0130] The description of the interaction information can be found in the description of historical interaction information in S101. The specific implementation method for obtaining the interaction information between network nodes in the target network can be found in the method for collecting historical interaction information in S101 above. It will not be elaborated further here.

[0131] For example, as shown in Table 1, Table 1 illustrates the interaction information.

[0132] Table 1

[0133]

[0134] The maximum number is the frequency of the event within a preset time window.

[0135] S202. Input the interaction information into the attack chain detection model to obtain the attack chain detection results.

[0136] For example, based on the interaction information in Table 1, the attack chain detection results output by the attack chain detection model include:

[0137] Vulnerability path: Sensitive directory / file probing behavior detected -> Sensitive information leakage detected -> Privilege bypass vulnerability detected -> Directory traversal attack behavior detected.

[0138] IP path: 10.74.150.21->172.25.10.41->183.36.35.197->172.25.10.4->10.74.194.25.

[0139] Detailed node redirection includes:

[0140] Step 1: 10.74.150.21->172.25.10.41.

[0141] Time: 1714917248 | Number of times: 1 | Behavior: Sensitive directory / file detection behavior was detected.

[0142] Step 2: 172.25.10.41->183.36.35.197.

[0143] Time: 1714917248 | Number of times: 2 | Behavior: Swagger has sensitive information leakage.

[0144] Step 3: 183.36.35.197 -> 172.25.10.4.

[0145] Time: 1714917760 | Number of occurrences: 1 | Behavior: Apache Shiro privilege bypass vulnerability (CVE-2020-1957 / CVE-2020-11989).

[0146] Step 4: 172.25.10.4 -> 10.74.194.25.

[0147] Time: 1714920704 | Number of times: 1 | Behavior: Directory traversal attack behavior detected.

[0148] Based on the above technical solution, this application can obtain the interaction information between network nodes in the target network first, and then input the interaction information into the attack chain detection model to obtain the detection results. It can closely combine the actual operating status of the target network, accurately identify potential attack chains, provide more targeted and practical decision-making basis for network security protection, and effectively improve the detection and prevention capabilities against real network attacks.

[0149] In some embodiments, such as Figure 3 As shown, Figure 3 This is a schematic diagram illustrating the training process of an attack chain detection model according to an exemplary embodiment:

[0150] In one possible implementation, the training device for the attack chain detection model can preprocess historical interaction information and construct a graph structure based on the preprocessed historical interaction information.

[0151] The preprocessing includes text vectorization, temporal feature modeling, structural feature extraction, and feature fusion of BERT vectors obtained from text vectorization, temporal features obtained from temporal feature modeling, and structural features obtained from structural feature extraction.

[0152] In one possible implementation, the training device for the attack chain detection model can perform self-supervised pre-training of the graph neural network based on the graph structure, reconstruct the attack scenario through the graph neural network, and perform edge classification on the masked graph structure to optimize the parameters of the graph neural network. In other words, the graph neural network is trained using the masked graph structure.

[0153] In one possible implementation, the training apparatus for the attack chain detection model can perform attack detection on the graph neural network, identifying attack chains within the graph neural network, for example... Figure 3 The attack chain shown in the dashed box includes the attack starting point IP1, the intermediate attack node IP5, the attack ending point IP8, and some other nodes.

[0154] The training device for the attack chain detection model can perform attack chain detection based on multi-dimensional deep search. Multi-dimensional deep search includes time constraints, stage control, pruning strategies, and scoring rules, namely, the first constraint, the second constraint, the third constraint, and the response scoring rules.

[0155] In one possible implementation, the training device for the attack chain detection model can build an attack pattern library based on the attack chain and label the attack chain onto a graph neural network to obtain the attack chain detection model.

[0156] In one possible implementation, the training apparatus for the attack chain detection model can be optimized based on a test dataset.

[0157] The above primarily describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, the training method for the attack chain detection model and the attack chain detection method include corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, based on the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0158] This application embodiment can, based on the above method, exemplarily divide the training method, attack chain detection method, or electronic device for attack chain detection models into functional modules. For example, the training device, attack chain detection device, or electronic device for attack chain detection models may include functional modules corresponding to each functional division, or two or more functions may be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. It should be noted that the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0159] Figure 4 This is a block diagram illustrating a training apparatus for an attack chain detection model according to an exemplary embodiment. (Refer to...) Figure 4 The training device for the attack chain detection model includes: a construction unit 401, a training unit 402, an identification unit 403, and a processing unit 404.

[0160] In one possible approach, a construction unit 401 is used to construct a graph structure based on historical interaction information between network nodes in the target network; wherein the nodes of the graph structure are network nodes, and the edges of the graph structure are used to characterize the interaction features between network nodes; the interaction features include at least one of the following: interaction time, interaction frequency that triggers alarms, and interaction behavior type; a training unit 402 is used to train a graph neural network using the masked graph structure; an identification unit 403 is used to perform attack detection on the graph neural network and identify attack chains in the graph neural network; wherein an attack chain is a link in the graph neural network whose attack score meets preset conditions; the attack score is determined based on the activity of each edge in the link, the feature similarity with the previous edge, and the attack sensitivity; and a processing unit 404 is used to label the attack chain onto the graph neural network to obtain an attack chain detection model.

[0161] In one possible approach, the interaction behavior type includes attack behavior; the attack behavior includes a detection phase, a penetration phase, and an attack execution phase with the attack completion degree increasing sequentially; the identification unit 403 is specifically used to: perform attack detection on the graph neural network and identify the attack chain in the graph neural network under the condition of satisfying the first constraint; the first constraint is that the attack completion degree of the first target edge in the attack chain is not lower than the attack completion degree of the previous edge of the first target edge.

[0162] In one possible approach, the identification unit 403 is specifically used to: perform attack detection on the graph neural network and identify the attack chain in the graph neural network under the condition of satisfying the second constraint; the second constraint is that the triggering time of the first target edge in the attack chain is not lower than the triggering time of the previous edge of the first target edge.

[0163] In one possible approach, the identification unit 403 is specifically used to: perform attack detection on the graph neural network and identify the attack chain in the graph neural network under the condition of satisfying the third constraint; the third constraint is that the exploration depth of the attack chain is less than or equal to the first threshold and the exploration length of the attack chain is less than or equal to the second threshold.

[0164] In one possible approach, the identification unit 403 is specifically used to: identify the attack origin in the graph neural network based on the frequency and type of interaction that triggers the alarm; and perform attack detection on the graph neural network from the attack origin to identify the attack chain in the graph neural network.

[0165] In one possible approach, the activity of the second target edge in the link is determined based on the ratio of the number of edges directly connected to the second target edge to the total number of edges in the graph neural network; the attack sensitivity of the second target edge is negatively correlated with the triggering time interval between the second target edge and the previous edge of the second target edge.

[0166] In one possible approach, the attack rating is determined based on the activity of each edge in the link, the feature similarity with the previous edge, the attack sensitivity, the importance of the attack phase, and the attack phase leap reward; where the importance of the attack phase is positively correlated with the attack completion rate.

[0167] In one possible approach, training unit 402 is specifically used to train a graph neural network using the E-GraphSAGE algorithm and a masked graph structure.

[0168] Figure 5 This is a block diagram illustrating an attack chain detection device according to an exemplary embodiment. (Refer to...) Figure 5 The attack chain detection device includes an acquisition unit 501 and a determination unit 502.

[0169] In one possible approach, the acquisition unit 501 is used to acquire interaction information between network nodes in the target network; the determination unit 502 is used to input the interaction information into the attack chain detection model trained based on the training method of the attack chain detection model as described in the first aspect, and obtain the attack chain detection result.

[0170] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0171] Figure 6 This is a block diagram illustrating an electronic device according to an exemplary embodiment. Figure 6 As shown, the electronic device includes, but is not limited to, a processor 601 and a memory 602.

[0172] The memory 602 described above is used to store the executable instructions of the processor 601. It is understood that the processor 601 is configured to execute instructions to implement the training method and attack chain detection method of the attack chain detection model in the above embodiments.

[0173] It should be noted that those skilled in the art will understand that Figure 6 The electronic device structure shown does not constitute a limitation on the electronic device; the electronic device may include, but is not limited to, other electronic devices. Figure 6 This may indicate more or fewer components, or combinations of certain components, or different component arrangements.

[0174] Processor 601 is the control center of the electronic device. It connects various parts of the electronic device via various interfaces and lines. By running or executing software programs and / or modules stored in memory 602, and by calling data stored in memory 602, it performs various functions and processes data, thereby providing overall monitoring of the electronic device. Processor 601 may include one or more processing units. Optionally, processor 601 may integrate an application processor and a modem processor. The application processor mainly handles the operating system, user interface, and applications, while the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into processor 601.

[0175] The memory 602 can be used to store software programs and various data. The memory 602 may primarily include a program storage area and a data storage area. The program storage area may store the operating system, application programs required by at least one functional module (such as a determination unit, processing unit, etc.), etc. Furthermore, the memory 602 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0176] In an exemplary embodiment, a computer-readable storage medium including instructions is also provided, such as a memory 602 including instructions, which can be executed by a processor 601 of an electronic device to implement the methods in the above embodiments.

[0177] In actual implementation, Figure 4 The construction unit 401, training unit 402, recognition unit 403, and processing unit 404, and Figure 5 The functions of the acquisition unit 501 and the determination unit 502 can both be provided by Figure 6 The processor 601 calls the computer program stored in the memory 602 to implement the process. The specific execution process can be found in the description of the method section in the previous embodiment, and will not be repeated here.

[0178] Optionally, the computer-readable storage medium may be a non-transitory computer-readable storage medium, such as a read-only memory (ROM), random access memory (RAM), compact disc read-only memory (CD-ROM), magnetic tape, floppy disk, and optical data storage device. In an exemplary embodiment, this application also provides a computer program product including one or more instructions, which can be executed by the processor 601 of an electronic device to perform the methods in the above embodiments.

[0179] It should be noted that when one or more instructions in the computer-readable storage medium or computer program product are executed by the processor of an electronic device, they implement the various processes of the above method embodiments and achieve the same technical effect as the above method. To avoid repetition, they will not be described again here.

[0180] Through the above description of the embodiments, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0181] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another apparatus, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0182] The units described as separate components may or may not be physically separate. A component shown as a unit can be one or more physical units; that is, it can be located in one place or distributed in multiple different locations. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0183] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0184] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, essentially, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This software product is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0185] This application provides a computer program product containing instructions that, when run on a computer, cause the computer to execute the training method and attack chain detection method of the attack chain detection model in the above method embodiments.

[0186] This application also provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the attack chain detection model training method and the attack chain detection method in the method flow shown in the above method embodiments.

[0187] The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, a random access memory, a read-only memory, an erasable programmable read-only memory, a register, a hard disk, an optical fiber, a portable compact disk read-only memory, an optical storage device, a magnetic storage device, or any suitable combination thereof, or any other form of computer-readable storage medium known in the art. An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can reside in an application-specific integrated circuit (ASIC). In embodiments of this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0188] Since the training device, attack chain detection device, computer-readable storage medium, and computer program product of the attack chain detection model in the embodiments of this application can be applied to the above method, the technical effects that can be obtained can also be referred to the above method embodiments. The embodiments of this application will not be repeated here.

[0189] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A training method for an attack chain detection model, characterized in that, The method includes: A graph structure is constructed based on historical interaction information between network nodes in the target network; wherein, the nodes of the graph structure are the network nodes, and the edges of the graph structure are used to characterize the interaction features between the network nodes; the interaction features include at least one of the following: interaction time, interaction frequency that triggers alarms, and interaction behavior type; the interaction behavior type includes attack behavior; the attack behavior includes an attack phase with progressively increasing attack completion: a probing phase, a penetration phase, and an attack execution phase. Train a graph neural network using the masked graph structure; Attack detection is performed on the graph neural network to identify attack chains within it; wherein, the attack chain is a link in the graph neural network whose attack score meets preset conditions; the attack score is determined based on the activity of each edge in the link, the feature similarity with the previous edge, the attack sensitivity, the importance of the attack stage, and the jump reward of the attack stage; the importance of the attack stage is positively correlated with the attack completion degree. The attack chain is labeled onto the graph neural network to obtain the attack chain detection model; The aggression score satisfies the following formula: in, Used to characterize the aggression score; Used to characterize the score of the i-th edge in the link; Satisfy the following formula: in, Used to characterize the feature similarity between the i-th edge and the (i-1)-th edge in the link; Used to characterize the activity level of the i-th edge; Used to characterize the attack sensitivity of the i-th edge; Used to represent the stage leap reward for the i-th edge; Used to characterize the importance of the attack phase for the i-th edge; Satisfy the following formula: in, Used to characterize the features of the i-th edge; Used to characterize the features of the (i-1)th edge; Satisfy the following formula: in, Used to represent the number of edges directly connected to the i-th edge; Used to characterize the total number of edges in the graph neural network; Satisfy the following formula: in, Used to characterize the time weighting factor; Used to characterize the time decay constant; Used to characterize the time interval between the triggering time of the i-th edge and the triggering time of the (i-1)-th edge; Satisfy the following formula: Where b represents the reward for a successful stage leap; Used to characterize the attack phase of the i-th edge; Used to characterize the attack phase of the (i-1)th edge.

2. The training method for the attack chain detection model according to claim 1, characterized in that, The attack detection of the graph neural network and the identification of attack chains in the graph neural network include: Under the condition of satisfying the first constraint, attack detection is performed on the graph neural network to identify the attack chain in the graph neural network; the first constraint is that the attack completion degree of the first target edge in the attack chain is not lower than the attack completion degree of the edge preceding the first target edge.

3. The training method for the attack chain detection model according to claim 1 or 2, characterized in that, The attack detection of the graph neural network and the identification of attack chains in the graph neural network further includes: Under the condition of satisfying the second constraint, attack detection is performed on the graph neural network to identify the attack chain in the graph neural network; the second constraint is that the triggering time of the first target edge in the attack chain is not less than the triggering time of the edge preceding the first target edge.

4. The training method for the attack chain detection model according to claim 3, characterized in that, The attack detection of the graph neural network and the identification of attack chains in the graph neural network further includes: Under the condition of satisfying the third constraint, attack detection is performed on the graph neural network to identify the attack chain in the graph neural network; the third constraint is that the exploration depth of the attack chain is less than or equal to the first threshold, and the exploration length of the attack chain is less than or equal to the second threshold.

5. The training method for the attack chain detection model according to claim 4, characterized in that, The attack detection of the graph neural network and the identification of attack chains in the graph neural network further includes: Based on the frequency of the interactions that trigger the alarm and the type of the interaction behavior, the attack starting point in the graph neural network is identified; Starting from the attack origin, the graph neural network is probed for attacks, and the attack chain in the graph neural network is identified.

6. The training method for the attack chain detection model according to claim 1, characterized in that, The training of the graph neural network using the masked graph structure includes: A graph neural network is trained using the E-GraphSAGE algorithm and the masked graph structure.

7. An attack chain detection method, characterized in that, The method includes: Obtain interaction information between network nodes in the target network; The interactive information is input into the attack chain detection model trained based on the training method of the attack chain detection model as described in any one of claims 1-6, and the attack chain detection result is obtained.

8. A training device for an attack chain detection model, characterized in that, The device includes: a construction unit, a training unit, a recognition unit, and a processing unit; The construction unit is used to construct a graph structure based on historical interaction information between network nodes in the target network; wherein, the nodes of the graph structure are the network nodes, and the edges of the graph structure are used to characterize the interaction features between the network nodes; the interaction features include at least one of the following: interaction time, interaction frequency that triggers alarms, and interaction behavior type; the interaction behavior type includes attack behavior; the attack phase of the attack behavior includes a detection phase, a penetration phase, and an attack execution phase with the attack completion degree increasing sequentially; The training unit is used to train a graph neural network using the masked graph structure; The identification unit is used to detect attacks on the graph neural network and identify attack chains in the graph neural network; wherein, the attack chain is a link in the graph neural network whose attack score meets preset conditions; the attack score is determined based on the activity of each edge in the link, the feature similarity with the previous edge, the attack sensitivity, the importance of the attack stage, and the jump reward of the attack stage; the importance of the attack stage is positively correlated with the attack completion degree. The processing unit is used to mark the attack chain onto the graph neural network to obtain an attack chain detection model; The aggression score satisfies the following formula: in, Used to characterize the aggression score; Used to characterize the score of the i-th edge in the link; Satisfy the following formula: in, Used to characterize the feature similarity between the i-th edge and the (i-1)-th edge in the link; Used to characterize the activity level of the i-th edge; Used to characterize the attack sensitivity of the i-th edge; Used to represent the stage leap reward for the i-th edge; Used to characterize the importance of the attack phase for the i-th edge; Satisfy the following formula: in, Used to characterize the features of the i-th edge; Used to characterize the features of the (i-1)th edge; Satisfy the following formula: in, Used to represent the number of edges directly connected to the i-th edge; Used to characterize the total number of edges in the graph neural network; Satisfy the following formula: in, Used to characterize the time weighting factor; Used to characterize the time decay constant; Used to characterize the time interval between the triggering time of the i-th edge and the triggering time of the (i-1)-th edge; Satisfy the following formula: Where b represents the reward for a successful stage leap; Used to characterize the attack phase of the i-th edge; Used to characterize the attack phase of the (i-1)th edge.

9. An attack chain detection device, characterized in that, The device includes: an acquisition unit and a determination unit; The acquisition unit is used to acquire interaction information between network nodes in the target network; The determining unit is used to input the interaction information into the attack chain detection model trained based on the training method of the attack chain detection model as described in any one of claims 1-6, and obtain the attack chain detection result.

10. A vehicle, characterized in that, The vehicle includes the attack chain detection device as described in claim 9.

Images