Method and device for multi-modal attack behavior recognition based on graph convolution network

Abstract

The application provides a multi-modal attack behavior recognition method and device based on a graph convolution network, relates to the technical field of pattern recognition, and comprises the following steps: analyzing cross-behavior accompanying characteristics based on historical attack behaviors, and constructing an attack accompanying topological graph; performing cross-modal attack chain backtracking to obtain K cross-modal attack chains; screening to obtain K multi-modal fragmented attack feature sets; performing isolated parameter training of K attack recognition networks, wherein the K attack recognition networks are all pre-constructed based on a graph convolution network; when an attack behavior early warning is output, locating a warning node in the attack accompanying topological graph; and mapping and activating the attack recognition network in the out-degree direction of the attack accompanying topological graph to perform behavior evolution prediction of cross-type attacks. The application solves the technical problem that the attack behavior recognition technology in the prior art often focuses on a specific mode, ignores cross-modal interaction between different attack behaviors, and thus reduces the accuracy of attack behavior recognition.

Description

Technical Field

[0001] This invention relates to the field of pattern recognition technology, and specifically to a method and apparatus for recognizing multimodal attack behaviors based on graph convolutional networks. Background Technology

[0002] With the rapid development of information technology, network attacks are becoming increasingly complex, exhibiting multimodal and multi-stage characteristics. Traditional attack identification usually relies on specific types of attack characteristics, such as intrusion detection based on network traffic. However, these intrusion detection technologies can often only detect a certain type of attack and cannot handle attack chains that span multiple attack modes. For example, network layer attacks may occur simultaneously with application layer or physical layer attacks. If existing technologies rely solely on network traffic data, it is difficult to identify these cross-layer and cross-modal attack behaviors, resulting in the inability to capture the interrelationships and temporal dependencies between attack behaviors. Consequently, the accuracy of attack behavior identification is low, and cross-modal attacks are either misjudged or missed. Summary of the Invention

[0003] This application provides a method and apparatus for multimodal attack behavior recognition based on graph convolutional networks, aiming to solve the technical problem that existing attack behavior recognition technologies often focus on a specific modality and ignore cross-modal interactions between different attack behaviors, resulting in reduced accuracy of attack behavior recognition.

[0004] The first aspect disclosed in this application provides a method for identifying multimodal attack behaviors based on graph convolutional networks. The method includes: performing cross-behavior-associated characteristic analysis based on historical attack behaviors to construct an attack association topology graph, wherein the attack association topology graph includes K attack topology nodes corresponding to K types of attack behaviors; performing cross-modal attack chain backtracking on the K types of attack behaviors to obtain K cross-modal attack chains; using the K cross-modal attack chains as modality filtering conditions to filter K multimodal fragmented attack feature sets from historical attack logs; using the K multimodal fragmented attack feature sets for isolated parameter tuning training of K attack identification networks, wherein the K attack identification networks are all pre-constructed based on graph convolutional networks; when any of the K attack identification networks outputs an attack behavior warning, locating a warning node in the attack association topology graph; and, starting from the warning node, mapping and activating the attack identification network along the out-degree direction of the attack association topology graph to predict the behavior evolution of cross-type attacks.

[0005] The second aspect of this application discloses a multimodal attack behavior identification device based on graph convolutional networks. The device is used in the aforementioned multimodal attack behavior identification method based on graph convolutional networks. The device includes: an adjunct feature analysis module, used to perform cross-behavior adjunct feature analysis based on historical attack behaviors and construct an attack adjunct topology graph, wherein the attack adjunct topology graph includes K attack topology nodes corresponding to K types of attack behaviors; an attack chain backtracking module, used to perform cross-modal attack chain backtracking on the K types of attack behaviors to obtain K cross-modal attack chains; and an attack feature acquisition module, used to use the K cross-modal attack chains as modality filtering conditions. The system employs a multimodal fragmented attack feature set (K) obtained from historical attack logs. An isolated parameter tuning training module is used to perform isolated parameter tuning training on K attack identification networks using the K multimodal fragmented attack feature sets, where each of the K attack identification networks is pre-built based on a graph convolutional network. An early warning node localization module is used to locate an early warning node in the attack-related topology graph when any of the K attack identification networks outputs an attack behavior warning. A behavior evolution prediction module is used to map and activate the attack identification network along the out-degree direction of the attack-related topology graph, starting from the early warning node, to predict the behavior evolution of cross-type attacks.

[0006] One or more technical solutions provided in this application have at least the following beneficial effects: By analyzing the accompanying characteristics of cross-behavior attacks based on historical attack behaviors, an attack-accompanying topology graph is constructed. This graph structure encapsulates the temporal relationships and interdependencies between different attack behaviors, enabling a more intuitive and systematic identification of these dependencies and providing a foundation for subsequent attack identification and prediction. By backtracking K types of attack behaviors across modal attack chains, the causal relationships and mutual triggering mechanisms between different attack behaviors can be traced, yielding multiple cross-modal attack chains. This backtracking process helps identify the order in which attack behaviors occur and their upstream and downstream connections. By using cross-modal attack chains as a filtering condition, corresponding multimodal fragmented attack feature sets are selected from historical attack logs, ensuring that the selected features accurately reflect the dynamic changes of different modal attack behaviors and maintain the diversity and specificity of attack behaviors. Modal fragmentation attack feature sets are applied to K attack identification networks for training and parameter tuning. This allows for the design of independent attack identification networks for different attack behavior types, improving identification accuracy. The use of graph convolutional networks enables the networks to learn the dependencies between nodes in the graph structure, enhancing the ability to identify complex attack behaviors. When any of the K attack identification networks outputs an attack warning, the warning node related to the attack behavior is accurately located in the attack-related topology graph, enabling rapid response. After locating the warning node, the attack identification network is activated by mapping along the out-degree direction of the attack-related topology graph to predict the evolution of cross-type attack behaviors. This captures the temporal dependencies and propagation paths between different attack behaviors, thereby predicting the evolution trend of cross-type attack behaviors and helping security protection systems take preventive measures to mitigate the impact of potential attacks.

[0007] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0008] Figure 1 This is a schematic diagram of the multimodal attack behavior recognition method based on graph convolutional networks provided in the embodiments of this application.

[0009] Figure 2 This is a schematic diagram of the structure of a multimodal attack behavior recognition device based on graph convolutional networks provided in an embodiment of this application.

[0010] Figure labeling: Accompanying characteristic analysis module 10, attack chain backtracking module 20, attack feature acquisition module 30, isolation parameter tuning training module 40, early warning node positioning module 50, behavior evolution prediction module 60. Detailed Implementation

[0011] This application provides a method and apparatus for recognizing multimodal attack behaviors based on graph convolutional networks, which solves the technical problem that existing attack behavior recognition technologies often focus on a specific modality and ignore cross-modal interactions between different attack behaviors, resulting in reduced accuracy of attack behavior recognition.

[0012] After introducing the basic principles of this application, various non-limiting embodiments of this application will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit this application.

[0013] Example 1, as Figure 1 As shown in the embodiments of this application, a method for identifying multimodal attack behaviors based on graph convolutional networks is provided, the method comprising: Based on historical attack behaviors, cross-behavior accompanying characteristic analysis is performed to construct an attack accompanying topology graph, wherein the attack accompanying topology graph includes K attack topology nodes corresponding to K types of attack behaviors.

[0014] Different attack behaviors are extracted and aggregated from historical attack logs to obtain K independent attack behaviors, such as DDoS attacks and malware infections. The relationships between these attack behaviors are analyzed, especially their temporal correlations. For example, some attack behaviors often occur together, or one attack behavior is followed by another. Based on the above analysis, an attack-related topology graph is constructed. In this graph, each attack behavior is treated as an attack topology node, resulting in K attack topology nodes corresponding to the K attack behaviors. These attack topology nodes are connected by edges to represent their association relationships.

[0015] By backtracking the K types of attack behaviors across modal attack chains, K cross-modal attack chains are obtained.

[0016] The system identifies different modalities within K types of attack behaviors. For example, an attack chain might begin with a network attack, then proceed through internal network penetration (e.g., viruses or malware), ultimately leading to data theft. Based on the timestamps and characteristics of the attack behaviors, the attack chain is traced back chronologically. Through cross-modal tracing, the relationships between different attack behaviors are identified, forming a complete cross-modal attack. For instance, the successful execution of the first attack behavior might be a trigger for the second. Each of the resulting K cross-modal attack chains spans multiple attack behavior modalities and forms an ordered sequence of attack events based on the causal relationships between different modalities. Each chain reflects how the attacker gradually evolves from one behavior to another.

[0017] Using the K cross-modal attack chains as modality filtering conditions, K multimodal fragmented attack feature sets are obtained by filtering historical attack logs.

[0018] Multimodal fragmented attack feature sets are obtained by analyzing historical attack logs. These features include peak network traffic, timestamps of specific attack behaviors, source IPs of the attacks, and attack types. These features are fragmented in the temporal dimension, meaning they may be distributed across different parts of the logs, exhibiting characteristics that span across time or events. K cross-modal attack chains are used as filtering criteria to select features related to these chains from historical attack logs. These features contain specific information about each attack behavior, such as the attacker's origin, attack type, and attack method. Furthermore, these features need to be analyzed in conjunction with behaviors from multiple modalities. Finally, through modal filtering, K multimodal fragmented attack feature sets are obtained. Each feature set contains features related to a specific attack behavior, and these features are multimodal and fragmented, meaning they are not just single-type attack features but features spanning multiple attack behaviors.

[0019] The K multimodal fragmented attack feature sets are used to perform isolated parameter tuning training of K attack identification networks, wherein the K attack identification networks are all pre-built based on graph convolutional networks.

[0020] Graph convolutional networks (GCNNs) are deep learning models for graph data that enable the propagation of node information within a graph structure. Each node (attack behavior) learns not only through its own features but also through its connections with neighboring nodes. Based on K multimodal fragmented attack feature sets, K attack recognition networks based on GCNNs are pre-constructed. Each network is designed for different attack behaviors to identify different types of attacks. Each attack recognition network is trained and parameterized in an independent training environment to ensure that each network focuses on a specific type of attack behavior and learns attack features and their interrelationships through graph convolution.

[0021] When any of the K attack identification networks outputs an attack behavior warning, the warning node is located in the attack-related topology map.

[0022] Each attack identification network, upon receiving input attack characteristics, outputs a warning signal indicating whether an attack has occurred. If the identification network detects a certain attack behavior, such as network intrusion or data leakage, it triggers an attack behavior warning. Warning nodes are nodes associated with a specific attack behavior in the attack-related topology graph, representing an event where an attack behavior has occurred in the topology graph. Based on the output attack behavior warning, the corresponding warning node is located. In the attack-related topology graph, each attack behavior has a corresponding node, and the attack behavior warning points to the node related to the occurrence of the attack behavior, i.e., the warning node.

[0023] Starting from the warning node, the attack identification network is activated by mapping along the out-degree direction of the attack-accompanying topology graph to predict the behavioral evolution of cross-type attacks.

[0024] Starting with the identified early warning node, the evolution of attack behavior is further analyzed based on this starting point. In the attack-related topology graph, each node has an associated out-degree, i.e., other nodes pointing to that node. By traversing the graph along these out-degree directions, the evolutionary trajectory of attack behavior is identified. This means that attack behavior can spread through different attack patterns, expanding from one attack behavior to another. Different types of attack behavior are interconnected, and through these connections, cross-type attacks can occur, such as the combination of network attacks and data theft. The goal of this step is to predict such cross-type attack evolution trends.

[0025] To predict cross-type attack behavior, the corresponding attack identification network is activated. By activating the topological information of the nodes and their neighbors, possible attack development paths are inferred. The correlation between different types of attacks is captured by graph convolutional networks, thereby accurately predicting the evolution of the attack. Through this evolution prediction, appropriate defensive measures can be taken before the attack behavior spreads, such as strengthening firewalls, restricting certain ports, or blocking malicious traffic, thereby enhancing the system's protection capabilities.

[0026] Furthermore, based on historical attack behaviors, cross-behavior accompanying characteristic analysis is performed to construct an attack accompanying topology graph. The method includes: The attack behaviors in the historical attack logs are aggregated to obtain the K types of attack behaviors; the K types of attack behaviors are used as search conditions to retrieve and extract K time-series attack timestamps from the historical attack logs; attack companion analysis is performed based on the K time-series attack behavior timestamps to obtain K attack companion vectors; the K types of attack behaviors are used as K attack topology nodes, and the nodes are connected using the K attack companion vectors to output the attack companion topology graph.

[0027] Identify all attack behaviors from historical attack logs. Attack behaviors can be single or combined, such as a single attack containing multiple behaviors, like network intrusion or data breach. Classify similar or repeated attack behaviors into different attack categories, ultimately obtaining K types of attack behaviors. For example, if the logs contain multiple DDoS attacks, multiple phishing attacks, and multiple malware infections, these attack behaviors can be aggregated into three types of attacks and labeled as attack behavior 1, attack behavior 2, attack behavior 3, and so on, until K types of attack behaviors are obtained. The K types of attack behaviors represent all different categories of attacks.

[0028] In the historical attack log, each attack event is recorded with a timestamp. These timestamps reflect the specific time when the attack occurred. Using K types of attack behaviors as search criteria, the historical attack log is traversed and all timestamps related to these attack behaviors are extracted. For example, if attack behavior 1 is a DDoS attack, the timestamps of all DDoS attack events can be retrieved. For each type of attack behavior, the corresponding attack timestamp is obtained through retrieval. Each attack timestamp reflects the specific time when the attack behavior occurred in the historical log. Through this process, K time-series attack timestamps are obtained, each corresponding to each attack behavior in chronological order.

[0029] Attack co-occurrence analysis aims to identify the temporal relationships between different attack behaviors. For example, if the occurrence of attack behavior A usually follows the occurrence of attack behavior B, then there is a co-occurrence relationship between attack behavior A and attack behavior B. Based on the extracted K temporal attack timestamps, it is analyzed which attack behaviors have close temporal correlations, that is, which attack behaviors often occur together. By analyzing the relationship between these timestamps, the dependency and correlation between attack behaviors are obtained, and K attack co-occurrence vectors are generated. Each attack co-occurrence vector represents the temporal relationship between a certain attack behavior and other attack behaviors.

[0030] Each attack behavior is treated as an attack topology node in the attack topology graph. Each attack topology node represents an attack behavior and possesses its characteristics, such as attack type, attack source, and target. Based on the attack adjoint vector of each attack behavior, the attack topology nodes are connected. The attack adjoint vector describes the temporal relationships and interrelationships between attack behaviors, and these relationships are represented as edges connecting different nodes. Through node connections, a complete attack adjoint topology graph is obtained, where each attack behavior is treated as an attack topology node, and the edges between attack topologies represent their temporal or adjoint relationships.

[0031] Furthermore, the method of using the K multimodal fragmented attack feature sets for isolated parameter tuning training of K attack identification networks includes: A first attack identification network is constructed by mapping graph nodes using a first cross-modal attack chain. Using the first cross-modal attack chain as a modal constraint and the first temporal attack timestamp as a time window constraint, two-dimensional data filtering is performed on the historical attack logs to obtain a first multimodal fragmented attack feature set, wherein the multimodal fragmented attack feature set includes W single-modal fragmented attack feature sets. The W single-modal fragmented attack feature sets are used as training data to train the attack behavior identification of the first attack identification network. Similarly, K attack identification networks for the K types of attack behaviors are constructed.

[0032] The first cross-modal attack chain is one of K cross-modal attack chains. The attack behaviors in the first cross-modal attack chain are mapped to nodes in a graph, and these nodes form the basis of the first attack identification network. Based on the attack behavior sequence of the first cross-modal attack chain, a graph convolutional network is used to construct the first attack identification network. The structure of this network is based on the nodes and edges of the cross-modal attack chain and is used for attack behavior learning.

[0033] Different attack behaviors in the first cross-modal attack chain are used as modal constraints, such as network attacks and application-layer attacks, to limit the filtering conditions and ensure that the filtered features match these attack behavior types. The first time-series attack timestamp is used as a time window constraint to filter attack events occurring within that time window. Based on the modal constraints and time window constraints, two-dimensional data filtering is performed in historical attack logs, meaning that both the attack behavior modality and the occurrence time window are considered simultaneously to filter relevant attack features. Through the above filtering process, a first multimodal fragmented attack feature set is obtained. This feature set includes multiple attack features, and these features are fragmented in both the time and modal dimensions, meaning they may be distributed across different log records and span different time periods. The multimodal fragmented attack feature set includes W single-modal fragmented attack feature sets, each corresponding to different types of attack behaviors, such as network attacks and application-layer attacks.

[0034] Each unimodal fragmented attack feature set is used as training data to train the first attack identification network. The training objective is to enable the network to learn the relationships between attack behaviors through graph convolutional layers and accurately identify the type of each attack. During training, the model parameters are continuously adjusted through optimization methods such as backpropagation and gradient descent to gradually improve the identification accuracy. The first attack identification network makes predictions based on the input features and outputs the identification results of each attack behavior. The training process improves the network's predictive ability by minimizing the loss function.

[0035] After training the first attack identification network, similar methods and processes are used to construct attack identification networks for the other K-1 attack behaviors. Each attack identification network is trained based on a multimodal fragmented attack feature set related to a specific attack behavior to identify a specific type of attack. Through this analogous process, K independent attack identification networks are trained for K attack behaviors, and the goal of each attack identification network is to be able to identify and predict the corresponding attack type.

[0036] Furthermore, a first attack identification network is constructed by mapping graph nodes using a first cross-modal attack chain, the method comprising: The first cross-modal attack chain is parsed to extract the entity association relationships of W single-modal behaviors corresponding to W single-modal entity nodes; the W single-modal entity nodes are mapped to W graph nodes, and edges are constructed to connect the W graph nodes according to the entity association relationships to obtain a first dynamic graph structure; the first attack identification network is constructed based on the first dynamic graph structure.

[0037] The first cross-modal attack chain consists of multiple attack behaviors of different types, which may occur in different attack modalities, such as network layer attacks, application layer attacks, and physical attacks. Each attack behavior represents an event in the attack chain. For each single-modal behavior in the first cross-modal attack chain, its corresponding single-modal entity node is extracted. Each single-modal entity node represents a specific attack behavior associated entity, such as the attacker's IP address, the target device, or the infected application. For each attack behavior, there is a corresponding single-modal entity node. By analyzing the order and dependencies of the behaviors in the attack chain, the entity association relationships of W single-modal entity nodes are established. The entity association relationships describe the mutual dependencies and connections between these single-modal entity nodes. For example, the execution of attack behavior A may depend on attack behavior B as a prerequisite, or a certain attack behavior may affect other behaviors.

[0038] The extracted W unimodal entity nodes are mapped to W graph nodes. Each graph node has certain characteristics, such as the type of attack behavior it represents, timestamp, attack source, target, etc. Based on the extracted entity relationships, edges are constructed in the graph. Edges indicate a dependency or interaction relationship between two graph nodes; for example, one attack behavior is a prerequisite for another, or it occurs immediately after another. Edges are directed, representing the sequential relationship between attack behaviors. The weight of the edges is set according to the strength of the association between entities. For example, if two attack behaviors are very close in time, the edge weight between them can be larger, indicating a strong association. After mapping and edge construction, a first dynamic graph structure is formed. In the first dynamic graph structure, each node represents a unimodal entity of an attack behavior, and the directed edges between nodes represent the temporal relationship and dependency between these behaviors.

[0039] The first dynamic graph structure is modeled using a graph convolutional network. The graph convolutional network propagates information through the edges between nodes, captures the relationships between nodes, and applies these relationships to the feature updates of nodes. During training, the graph convolutional network propagates and updates based on the information of nodes and edges in the first dynamic graph structure, thereby enabling the network to capture the complex relationships and patterns between attack behaviors. Finally, the obtained first attack recognition network can identify each attack behavior in a cross-modal attack chain and predict their possible evolution paths.

[0040] Furthermore, the method of using the W single-modal fragmented attack feature sets as training data to train the attack behavior recognition of the first attack recognition network includes: After associating the W single-modal fragmented attack feature sets with timestamps, the W single-modal fragmented attack feature sets are mapped and injected into the W graph nodes; based on the attack behavior timestamp sequence, a cross-temporal dependency edge sequence between adjacent time slices is constructed; the cross-temporal dependency edge sequence and the first dynamic graph structure are fused to construct a temporal dynamic graph structure set; during the process of inputting the temporal dynamic graph structure set into the first attack identification network, the W single-modal fragmented attack feature sets of the W graph nodes are mapped and loaded, driving the first attack identification network to evolve in the temporal capture attack stage until the cross-entropy loss function value of the attack type classification output by the first attack identification network is lower than a preset threshold.

[0041] W unimodal fragmented attack feature sets are associated with timestamps to ensure that each feature set accurately reflects its temporal information in the attack chain. Each unimodal fragmented attack feature set is mapped to a corresponding graph node, with each graph node representing an attack behavior. These feature sets are mapped to the attributes or features of the corresponding graph nodes. In this way, the attack identification network can understand the behavioral characteristics of each node and its relationship with other nodes during training.

[0042] Based on the timestamps of attack actions, cross-temporal dependency edges are constructed. These edges represent the dependencies between attack actions across different time slices. For example, if attack action A occurs at timestamp T1, and attack action B immediately follows at timestamp T2, then there is a cross-temporal dependency between them. These cross-temporal dependency edges reflect how attack actions migrate from one time slice to the next, thus helping the network capture the temporal dynamics of attack actions. These cross-temporal dependency edges are then sorted according to their time sequence to form a cross-temporal dependency edge sequence, which serves as input for subsequent training, helping the network learn the patterns of attack action evolution over time.

[0043] By integrating the cross-temporal dependent edge sequence with the first dynamic graph structure constructed earlier, a temporal dynamic graph structure is formed. This structure not only includes the spatial relationships between nodes (i.e., the dependencies between attack behaviors), but also the temporal relationship (i.e., the changes and evolution of attack behaviors over time).

[0044] The constructed temporal dynamic graph structure set is input into the first attack identification network. This set provides spatiotemporal information, helping the network capture attack evolution patterns across time. During this process, the features of W graph nodes—that is, W sets of unimodal fragmented attack features—are loaded into the graph nodes. By capturing the dynamic information in the temporal dynamic graph structure set, the first attack identification network learns how attack behavior evolves from one stage to another. Temporal capture helps identify the attack's expansion path, such as the duration of the attack, attack transfers, and the generation of attack chains. During training, the first attack identification network calculates the attack type classification cross-entropy loss function value based on the difference between the predicted results and the true labels. The goal is to minimize the loss function value, thereby improving the accuracy of attack behavior identification. Training continues until the attack type classification cross-entropy loss function value falls below a preset threshold, indicating that the performance of the first attack identification network has reached the desired level.

[0045] Furthermore, based on the timestamps of the K time-series attack behaviors, attack accompaniment analysis is performed to obtain K attack accompaniment vectors. The method includes: Based on the K time-series attack timestamps, calculate the K-1 co-occurrence timestamp sequence of the first attack and the remaining K-1 attack actions; based on the co-occurrence temporal relationship between the first attack and the K-1 attack actions in the K-1 co-occurrence timestamp sequence, quantize the K-1 co-occurrence propagation vectors, and the K-1 co-occurrence propagation vectors constitute the first attack companion vector; similarly, perform attack companion analysis based on the K time-series attack timestamps to obtain the K attack companion vectors.

[0046] The K time-series attack timestamps represent the specific time each attack occurred in the historical attack log. Co-occurrence timestamps refer to the timestamps when two or more attack behaviors occur simultaneously within a certain time window. The first attack behavior is any one of the K attack behaviors and is taken as the current analysis object. First, the co-occurrence timestamp sequence between the first attack behavior and the remaining K-1 attack behaviors is calculated. For each pair of attack behaviors, such as behavior 1 and behavior 2, behavior 1 and behavior 3, ..., behavior 1 and behavior K, their timestamps are found and it is calculated whether they co-occur within the same time range. Finally, the K-1 co-occurrence timestamp sequence is obtained, representing the co-occurrence relationship between the first attack behavior and each of the other attack behaviors.

[0047] For K-1 co-occurrence timestamp sequences, the co-occurrence temporal relationship between the first attack behavior and the other K-1 attack behaviors is analyzed. The co-occurrence temporal relationship describes the order in which these attack behaviors occur and their temporal dependencies. Each co-occurrence temporal relationship is quantified into a co-occurrence propagation vector. The co-occurrence propagation vector can be quantified based on multiple factors, such as time difference, strength of the order relationship, and spatiotemporal distance between the two behaviors. Through the quantified K-1 co-occurrence propagation vectors, the first attack companion vector is constructed. This vector describes the temporal relationship between the first attack behavior and other attack behaviors, reflecting how they depend on each other in time.

[0048] Based on the previously calculated timestamps of the K temporal attack behaviors and their co-occurrence temporal relationships, a similar adjoint analysis is performed on the other K-1 attack behaviors, with each attack behavior having a corresponding attack adjoint vector. By analogy, K attack adjoint vectors are finally obtained, each vector corresponding to an attack behavior and describing the temporal dependency between that attack behavior and other behaviors.

[0049] Furthermore, the method involves treating the K types of attack behaviors as K attack topology nodes, connecting these nodes using the K attack accompaniment vectors, and outputting the attack accompaniment topology graph. The method includes: Construct K attack topology nodes corresponding to the K types of attack behaviors; calculate K sets of attack-accompanying edge weights based on the K attack-accompanying vectors; quantize the K sets of attack-accompanying edge weights to obtain K sets of topology connection scales; after connecting the in-degree and out-degree topology nodes of the K attack topology nodes based on the K attack-accompanying vectors, perform topology connection mapping compensation based on the K sets of topology connection scales, and output the attack-accompanying topology graph.

[0050] Each attack behavior corresponds to an attack topology node in the graph. Each attack topology node represents a specific attack behavior. The construction of the attack topology node not only indicates the existence of the attack behavior, but also includes the characteristic information of the attack behavior, such as attack type, attack source, attack target, etc.

[0051] In the attack-associated topology graph, the associations of attack behaviors are represented by edges in the graph. Based on the information in each attack-associated vector, the association strength between each pair of attack behaviors, i.e., the edge weight, is calculated. The edge weight is calculated based on factors such as the temporal relationship between attack behaviors, the distance between co-occurrence timestamps, and the attack intensity. For example, if attack behavior A and attack behavior B are very close in time, the edge weight between them will be higher, indicating a strong association between them. Through calculation, K sets of attack-associated edge weights are finally obtained, and each set of attack-associated edge weights corresponds to an attack behavior and its relationship with other behaviors.

[0052] Each attack group is accompanied by an edge weight quantized into a numerical scale to represent the edge strength. For example, if the edge weight between attack behavior A and attack behavior B is large, it indicates that they are strongly correlated, and the quantization scale is also large. The quantization process can use normalization or standardization to make the scale of each edge within the same range. This can avoid some extreme values ​​from affecting the overall topology. Finally, the K sets of topology connection scales obtained by quantizing the edge weights are used to adjust the edge connection strength between nodes in the graph. For example, strong connection attacks will appear more prominent in the graph and affect the prediction of attack behavior evolution.

[0053] Each attack topology node has an out-degree and an in-degree, representing the relationship between the attack behavior and other attack behaviors. Based on K attack accompaniment vectors, the out-degree and in-degree of each node are determined. The out-degree indicates that an attack behavior causes other attack behaviors to occur, and the in-degree indicates that other attack behaviors cause the attack behavior to occur. Based on the temporal relationship in the attack accompaniment vectors, the connection method of these out-degree and in-degree is determined.

[0054] Based on the K sets of topological connection scales, topological connection mapping compensation is performed. This means that if certain attack behaviors are strongly correlated, the edges between them are weighted, thus forming stronger connections. This compensation step ensures that the relationships between attack behaviors are reasonably represented; strongly correlated attack behaviors have a higher connectivity in the graph, while weakly correlated attack behaviors have fewer connections. Finally, a complete attack-related topological graph is obtained. This graph describes the temporal relationships, dependencies, and strong correlations among the K types of attack behaviors. Through this attack-related topological graph, the evolution process of attack behaviors and their mutual influence can be more clearly displayed.

[0055] Example 2, based on the same inventive concept as the multimodal attack behavior recognition method based on graph convolutional networks in the previous examples, such as... Figure 2 As shown in the figure, this application provides a multimodal attack behavior identification device based on graph convolutional networks, the device comprising: The system includes: an accompanying characteristic analysis module 10, used to perform cross-behavior accompanying characteristic analysis based on historical attack behaviors and construct an attack accompanying topology map, wherein the attack accompanying topology map includes K attack topology nodes corresponding to K types of attack behaviors; an attack chain backtracking module 20, used to perform cross-modal attack chain backtracking on the K types of attack behaviors to obtain K cross-modal attack chains; an attack feature acquisition module 30, used to use the K cross-modal attack chains as modality filtering conditions to filter K multimodal fragmented attack feature sets from historical attack logs; an isolated parameter tuning training module 40, used to perform isolated parameter tuning training on K attack identification networks using the K multimodal fragmented attack feature sets, wherein the K attack identification networks are all pre-constructed based on graph convolutional networks; an early warning node positioning module 50, used to locate an early warning node in the attack accompanying topology map when any of the K attack identification networks outputs an attack behavior early warning; and a behavior evolution prediction module 60, used to map and activate the attack identification network along the out-degree direction of the attack accompanying topology map starting from the early warning node to perform behavior evolution prediction for cross-type attacks.

[0056] Furthermore, the accompanying characteristic analysis module 10 is used to perform the following operation steps: The attack behaviors in the historical attack logs are aggregated to obtain the K types of attack behaviors; the K types of attack behaviors are used as search conditions to retrieve and extract K time-series attack timestamps from the historical attack logs; attack companion analysis is performed based on the K time-series attack behavior timestamps to obtain K attack companion vectors; the K types of attack behaviors are used as K attack topology nodes, and the nodes are connected using the K attack companion vectors to output the attack companion topology graph.

[0057] Furthermore, the isolated parameter tuning training module 40 is used to perform the following operation steps: A first attack identification network is constructed by mapping graph nodes using a first cross-modal attack chain. Using the first cross-modal attack chain as a modal constraint and the first temporal attack timestamp as a time window constraint, two-dimensional data filtering is performed on the historical attack logs to obtain a first multimodal fragmented attack feature set, wherein the multimodal fragmented attack feature set includes W single-modal fragmented attack feature sets. The W single-modal fragmented attack feature sets are used as training data to train the attack behavior identification of the first attack identification network. Similarly, K attack identification networks for the K types of attack behaviors are constructed.

[0058] Furthermore, the isolated parameter tuning training module 40 is used to perform the following operation steps: The first cross-modal attack chain is parsed to extract the entity association relationships of W single-modal behaviors corresponding to W single-modal entity nodes; the W single-modal entity nodes are mapped to W graph nodes, and edges are constructed to connect the W graph nodes according to the entity association relationships to obtain a first dynamic graph structure; the first attack identification network is constructed based on the first dynamic graph structure.

[0059] Furthermore, the isolated parameter tuning training module 40 is used to perform the following operation steps: After associating the W single-modal fragmented attack feature sets with timestamps, the W single-modal fragmented attack feature sets are mapped and injected into the W graph nodes; based on the attack behavior timestamp sequence, a cross-temporal dependency edge sequence between adjacent time slices is constructed; the cross-temporal dependency edge sequence and the first dynamic graph structure are fused to construct a temporal dynamic graph structure set; during the process of inputting the temporal dynamic graph structure set into the first attack identification network, the W single-modal fragmented attack feature sets of the W graph nodes are mapped and loaded, driving the first attack identification network to evolve in the temporal capture attack stage until the cross-entropy loss function value of the attack type classification output by the first attack identification network is lower than a preset threshold.

[0060] Furthermore, the accompanying characteristic analysis module 10 is used to perform the following operation steps: Based on the K time-series attack timestamps, calculate the K-1 co-occurrence timestamp sequence of the first attack and the remaining K-1 attack actions; based on the co-occurrence temporal relationship between the first attack and the K-1 attack actions in the K-1 co-occurrence timestamp sequence, quantize the K-1 co-occurrence propagation vectors, and the K-1 co-occurrence propagation vectors constitute the first attack companion vector; similarly, perform attack companion analysis based on the K time-series attack timestamps to obtain the K attack companion vectors.

[0061] Furthermore, the accompanying characteristic analysis module 10 is used to perform the following operation steps: Construct K attack topology nodes corresponding to the K types of attack behaviors; calculate K sets of attack-accompanying edge weights based on the K attack-accompanying vectors; quantize the K sets of attack-accompanying edge weights to obtain K sets of topology connection scales; after connecting the in-degree and out-degree topology nodes of the K attack topology nodes based on the K attack-accompanying vectors, perform topology connection mapping compensation based on the K sets of topology connection scales, and output the attack-accompanying topology graph.

[0062] Through the foregoing detailed description of the multimodal attack behavior recognition method based on graph convolutional networks, those skilled in the art can clearly understand the multimodal attack behavior recognition device based on graph convolutional networks in this embodiment. Since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and relevant parts can be referred to the method section.

[0063] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A multimodal attack behavior recognition method based on graph convolutional networks, characterized in that, The method includes: Based on historical attack behaviors, cross-behavior accompanying characteristics are analyzed to construct an attack accompanying topology graph, wherein the attack accompanying topology graph includes K attack topology nodes corresponding to K types of attack behaviors. By backtracking the K types of attack behaviors across modal attack chains, K cross-modal attack chains are obtained; Using the K cross-modal attack chains as modality filtering conditions, K multimodal fragmented attack feature sets are obtained by filtering from historical attack logs; The K multimodal fragmented attack feature sets are used to perform isolated parameter tuning training of K attack identification networks, wherein the K attack identification networks are all pre-built based on graph convolutional networks; When any of the K attack identification networks outputs an attack behavior warning, the warning node is located in the attack-related topology map. Starting from the warning node, the attack identification network is activated by mapping along the out-degree direction of the attack-accompanying topology graph to predict the behavioral evolution of cross-type attacks. Based on historical attack behaviors, cross-behavior-related characteristic analysis is performed to construct an attack-related topology graph. The method includes: The attack behaviors in the historical attack logs are aggregated to obtain the K types of attack behaviors; Using the K types of attack behaviors as search criteria, K time-series attack timestamps are retrieved and extracted from the historical attack log. Based on the K time-series attack timestamps, attack accompaniment analysis is performed to obtain K attack accompaniment vectors; The K types of attack behaviors are used as K attack topology nodes. The nodes are connected using the K attack accompaniment vectors, and the attack accompaniment topology graph is output. The method involves using the K multimodal fragmented attack feature sets to perform isolated parameter tuning training for K attack identification networks, the method comprising: The first cross-modal attack chain is used for graph node mapping to construct the first attack identification network; Using the first cross-modal attack chain as a modal constraint and the first time-series attack timestamp as a time window constraint, a two-dimensional data filtering is performed on the historical attack log to obtain the first multimodal fragmented attack feature set, wherein the multimodal fragmented attack feature set includes W single-modal fragmented attack feature sets. The W single-modal fragmented attack feature sets are used as training data to train the attack behavior recognition of the first attack recognition network. By analogy, construct K attack identification networks for the K types of attack behaviors.

2. The multimodal attack behavior recognition method based on graph convolutional networks as described in claim 1, characterized in that, The method for constructing a first attack identification network by mapping graph nodes using the first cross-modal attack chain includes: Analyze the first cross-modal attack chain to extract the entity association relationships between W single-modal behaviors and W single-modal entity nodes; The W single-modal entity nodes are mapped to W graph nodes, and edges are constructed to connect the W graph nodes based on the entity association relationships to obtain the first dynamic graph structure; The first attack identification network is constructed based on the first dynamic graph structure.

3. The multimodal attack behavior recognition method based on graph convolutional networks as described in claim 2, characterized in that, Using the W single-modal fragmented attack feature sets as training data, the attack behavior recognition training of the first attack recognition network is performed, the method includes: After associating the W single-modal fragmentation attack feature sets with timestamps, the W single-modal fragmentation attack feature sets are mapped and injected into the W graph nodes; Based on the timestamp sequence of attack behavior, construct a sequence of cross-temporal dependency edges between adjacent time slices; By integrating the cross-temporal dependent edge sequence and the first dynamic graph structure, a temporal dynamic graph structure set is constructed. During the process of inputting the temporal dynamic graph structure set into the first attack identification network, the W single-modal fragmented attack feature sets of the W graph nodes are mapped and loaded, driving the first attack identification network to evolve in the temporal capture attack stage until the attack type classification cross-entropy loss function value output by the first attack identification network is lower than a preset threshold.

4. The multimodal attack behavior recognition method based on graph convolutional networks as described in claim 1, characterized in that, Based on the timestamps of the K time-series attack behaviors, attack accompaniment analysis is performed to obtain K attack accompaniment vectors. The method includes: Based on the timestamps of the K time-series attack behaviors, calculate the K-1 co-occurrence timestamp sequence of the first attack behavior and the remaining K-1 attack behaviors; Based on the co-occurrence time sequence relationship between the first attack behavior and the K-1 attack behaviors in the K-1 co-occurrence timestamp sequences, K-1 co-occurrence propagation vectors are quantized, and the K-1 co-occurrence propagation vectors constitute the first attack companion vector; By analogy, attack accompaniment analysis is performed based on the timestamps of the K time-series attack behaviors to obtain the K attack accompaniment vectors.

5. The multimodal attack behavior recognition method based on graph convolutional networks as described in claim 4, characterized in that, The method involves treating the K types of attack behaviors as K attack topology nodes, connecting the nodes using the K attack accompaniment vectors, and outputting the attack accompaniment topology graph. Construct K attack topology nodes corresponding to the K types of attack behaviors; Calculate the weights of K attack-associated edges based on the K attack-associated vectors; The weights of the K groups of attack-accompanying edges are quantified to obtain the K groups of topological connection scales; After connecting the in-degree and out-degree topology of the K attack topology nodes based on the K attack accompaniment vectors, topology connection mapping compensation is performed according to the K sets of topology connection scales, and the attack accompaniment topology graph is output.

6. A multimodal attack behavior recognition device based on graph convolutional networks, characterized in that, The apparatus for implementing the multimodal attack behavior identification method based on graph convolutional networks according to any one of claims 1-5, the apparatus comprising: The accompanying characteristic analysis module is used to perform cross-behavior accompanying characteristic analysis based on historical attack behaviors and construct an attack accompanying topology graph, wherein the attack accompanying topology graph includes K attack topology nodes corresponding to K types of attack behaviors. The attack chain backtracking module is used to perform cross-modal attack chain backtracking on the K types of attack behaviors to obtain K cross-modal attack chains; The attack feature acquisition module is used to use the K cross-modal attack chains as modality filtering conditions to filter out K multimodal fragmented attack feature sets from historical attack logs. The isolated parameter tuning training module is used to perform isolated parameter tuning training of K attack identification networks using the K multimodal fragmented attack feature sets, wherein the K attack identification networks are all pre-built based on graph convolutional networks; The early warning node positioning module is used to locate the early warning node in the attack-related topology map when any of the K attack identification networks outputs an attack behavior warning. The behavior evolution prediction module is used to perform cross-type attack behavior evolution prediction by mapping and activating the attack identification network along the out-degree direction of the attack-accompanying topology graph, starting from the early warning node.

Images