Abnormal node detection method and system based on time sequence traceability graph

Abstract

The invention provides an abnormal node detection method and system based on a time sequence traceability graph. The method comprises the following steps: acquiring real-time audit log data and constructing the time sequence traceability graph based on the real-time audit log data; obtaining a node set and an edge attribute set based on the time sequence traceability graph; performing characterization processing based on the node set and the edge attribute set to obtain a node feature matrix and an edge fusion feature matrix; splicing and fusing the node feature matrix and the edge fusion feature matrix to construct a time sequence traceability graph feature matrix; and inputting the time sequence traceability graph feature matrix into a preset anomaly detection model for abnormal node detection, and outputting attribute information of abnormal nodes. According to the abnormal node detection method based on the time sequence traceability graph, node features and edge time sequence features are effectively integrated through a multi-dimensional feature embedding and fusion mechanism, the characterization capability of the time sequence traceability graph is remarkably enhanced, and the accuracy of abnormal node detection is improved.

Description

Technical Field

[0001] This invention belongs to the field of network security, specifically relating to an anomaly node detection method and system based on a time-series source graph. Background Technology

[0002] In the field of cybersecurity, the current cybersecurity situation is becoming increasingly severe. Advanced and Persistent Threats (APTs) and other complex attacks exhibit characteristics such as high concealment, long duration, and complex attack chains, making them difficult to detect effectively using traditional feature-based or rule-based methods. This poses a significant challenge to traditional security protection systems. To effectively address these threats, APT attack detection and investigation technologies that achieve security event monitoring and behavior reconstruction through in-depth analysis of network traffic and system logs have become a research hotspot. However, existing methods generally rely excessively on rules and neglect spatiotemporal correlation features, resulting in persistently high false positive rates. Against this backdrop, APT detection and investigation technologies based on attribution graphs have gradually emerged and made significant progress in spatiotemporal data representation, abnormal behavior detection, and attack investigation and attribution, providing new avenues for improving detection accuracy.

[0003] Despite significant achievements in APT detection techniques based on source graphs, challenges remain in practical applications. Existing methods often struggle to effectively utilize both node attributes and edge temporal semantics for anomaly detection when modeling source graphs. This is because the two have different feature dimensions, making it difficult to effectively integrate node attributes and edge temporal semantics to achieve a comprehensive and accurate representation of the source graph. Consequently, the semantic information of the source graph cannot be fully utilized for anomaly detection. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides an anomaly node detection method based on a temporal source graph, thereby solving the aforementioned problems. This method effectively integrates node features and edge temporal features through multi-dimensional feature embedding and deep fusion mechanisms, significantly enhancing the representational capability of the temporal source graph and ultimately improving the accuracy of anomaly node detection based on this graph.

[0005] To address the aforementioned technical problems, this invention provides an anomaly node detection method based on a time-series source graph, comprising the following steps:

[0006] Acquire real-time audit log data and construct a time-series source diagram based on the real-time audit log data;

[0007] Based on the temporal origin graph, obtain the node set and edge attribute set;

[0008] Based on the node set, feature processing is performed to obtain a node vector set;

[0009] Construct a node feature matrix based on the node feature vector set;

[0010] The edge attribute set is subjected to feature processing to obtain the basic edge feature vector set;

[0011] The basic edge feature vectors in the basic edge feature vector set are sorted by timestamp, and the sorted basic edge feature vector set is encoded to obtain the edge order encoding set.

[0012] The sorted basic edge feature vector set and the edge sequence encoding set are concatenated to obtain the edge temporal feature vector set.

[0013] The edge fusion feature vector is obtained by weighted summation based on the timestamp and the edge temporal feature vector set.

[0014] Construct an edge fusion feature matrix based on the edge fusion feature vector;

[0015] The node feature matrix and the edge fusion feature matrix are concatenated and fused to construct the temporal source graph feature matrix;

[0016] The time-series source graph feature matrix is ​​input into a preset anomaly detection model, so that the preset anomaly detection model can detect anomaly nodes based on the source graph feature matrix and output the attribute information of the anomaly nodes.

[0017] In the above scheme, by concatenating and fusing the node feature matrix with the edge fusion feature matrix, which integrates the basic attributes and temporal information of the edges, a deep integration of the static features of nodes and the dynamic temporal features of edges is achieved. By sorting the edge feature vector set by timestamp, sequentially encoding it, and concatenating it with the basic features, and then constructing the fused edge features through timestamp weighted summation, a multi-dimensional feature embedding mechanism is formed. This mechanism can effectively capture and fuse the structural information and key temporal dependencies in the temporal source graph, thereby improving the overall representational capability of the temporal source graph. Using the temporal source graph feature matrix constructed through the above deep fusion, which contains richer structural and temporal information, as input, the preset anomaly detection model can more accurately identify potential anomaly patterns in the graph, thereby improving the accuracy of anomaly node detection results.

[0018] Furthermore, the step of acquiring real-time audit log data and constructing a time-series source graph based on the real-time audit log data includes:

[0019] Get the log stream;

[0020] The log stream is segmented based on an overlapping sliding window streaming mechanism to obtain the real-time audit log data;

[0021] A time-series source graph is constructed based on real-time audit log data.

[0022] The above solution uses a streaming processing mechanism based on an overlapping sliding time window to perform temporal segmentation on the log stream. Specifically, the log stream is cut by setting consecutive time windows with overlapping regions (the window length is T, the sliding step size is Δt, and Δt < T). The overlapping mechanism can effectively ensure the temporal continuity of cross-window events in the construction of the temporal traceability graph, thus solving the problem of event chain breakage that may occur in traditional non-overlapping window or static snapshot methods, providing a representation basis with complete temporal semantics for subsequent anomaly detection, and at the same time enhancing the ability to capture continuous and subtle temporal dependencies in complex attacks.

[0023] Furthermore, based on the node set, feature extraction is performed to obtain a node vector set, including:

[0024] The node set is divided into process nodes, file nodes, and socket nodes according to the node type of each node;

[0025] Feature extraction is respectively performed on the process nodes, file nodes, and socket nodes according to the node type to obtain a node vector set constructed by process node feature vectors, file node feature vectors, and socket node feature vectors; where:

[0026] For process nodes, the executable file path and process ID value are selected as attributes to obtain a process node feature vector, expressed as:

[0027] x =Hash(Path p )||Hash(PID[[ID=二十]] p )

[0028] In the formula: x p is the process node feature vector, Hash() represents the hash function, Path p is the executable path, || is the feature concatenation operation, and PID p is the process ID value of the process node feature vector;

[0029] For file nodes, the complete file path is selected as an attribute to obtain a file node feature vector, expressed as:

[0030] x f =Hash(FilePath f )

[0031] In the formula: x f is the file node feature vector, and FilePath f is the complete file path;

[0032] For socket nodes, the target IP and port number are selected as attributes to obtain a socket node feature vector, expressed as:

[0033] x s =Hash(IP) s )||Hash(Port s )

[0034] In the formula, x s For socket byte point feature vectors, IP s For target IP, Port s This is the port number.

[0035] Furthermore, the time-series source graph feature matrix is ​​input into a preset anomaly detection model, so that the preset anomaly detection model performs anomaly node detection based on the source graph feature matrix and outputs the attribute information of the anomaly nodes; wherein:

[0036] The input from the time-series source graph feature matrix is ​​fed into a preset anomaly detection model, limiting the anomaly detection scope to process nodes, so that the preset anomaly detection model can detect anomaly nodes based on the source graph feature matrix and output the attribute information of the anomaly nodes.

[0037] In the above scheme, since most critical malicious activities ultimately manifest as process behaviors within the operating system, the pre-defined anomaly detection model can detect abnormal nodes and output their attribute information based on the source graph feature matrix by limiting the scope of anomaly detection to process nodes. This scheme achieves a highly efficient combination of efficiency and accuracy with limited computing resources. It ensures effective coverage of key attack phases, avoids the huge overhead and performance bottlenecks caused by indiscriminate processing of the entire graph, and improves the timeliness of inference by concentrating computing resources. Compared to existing methods that generally perform indiscriminate processing of the entire source graph, the above scheme effectively reduces overhead through targeted detection and improves computational efficiency while ensuring the expected accuracy.

[0038] Further, each basic edge feature vector in the basic edge feature vector set is sorted by timestamp, and the sorted basic edge feature vector set is encoded to obtain an edge order encoding set; including:

[0039] Sort each basic edge feature vector in the basic edge feature vector set by timestamp;

[0040] The edge sequence encoding set is obtained by encoding the sorted basic edge feature vector set using the trigonometric function position encoding method.

[0041] In the above scheme, in order to accurately capture the chronological order of events, it is based on timestamps and node v. i Sort all related edges, and then generate a sequence code o for the nth edge after sorting. im .

[0042] It should be noted that the sequential encoding o im A trigonometric function position encoding method can be used:

[0043] o im =PositionalEncoding(m)

[0044] In the formula, PositionalEncoding() is the trigonometric function position encoding method, and m is the sorted position.

[0045] Unlike existing technologies that typically use simple timestamps or don't explicitly encode temporal information, the above scheme employs trigonometric function positional encoding to assign unique, continuous, and learnable temporal positional information to each edge. This explicit temporal embedding enables the pre-defined anomaly detection model to directly capture and understand the order of events and their causal relationships, thereby enhancing its ability to identify subtle anomaly patterns that can only be detected by relying on event sequences (rather than static graph structures or simple timestamps), and improving the detection performance against temporally sensitive attacks.

[0046] Further, a weighted summation is performed based on the timestamp and the edge temporal feature vector set to obtain the edge fusion feature vector; including:

[0047] Different weights are assigned to the edge time sequence feature vector set based on the timestamp, wherein: the edge time sequence feature vector with more recent time is assigned a greater weight;

[0048] The edge temporal feature vectors are weighted and summed to obtain the edge fusion feature vector.

[0049] In the above scheme, different weights w are assigned to the temporal feature vector of each edge based on the timestamp. im Where: the more recent the time, the greater the weight assigned to the edge's temporal feature vector; for node v i The edge fusion feature vector of a node is obtained by weighted summing of all relevant edge temporal semantic attribute features.

[0050]

[0051] Where Adj(v) i ) indicates the relationship with node v i The set of adjacent edges. The edge fusion feature vectors of all nodes together constitute the edge fusion feature matrix.

[0052] The aforementioned scheme's mechanism of dynamically weighted summation based on timestamps ensures that recent events with a greater impact on the current system state and threat evolution occupy a higher priority in feature representation. This allows the scheme to reflect the latest changes in system behavior more dynamically and accurately, thus possessing greater sensitivity and adaptability to rapidly evolving attack behaviors, and helping to reduce misjudgments or missed detections caused by redundant or irrelevant historical information.

[0053] Further, the temporal source graph feature matrix is ​​input into a preset anomaly detection model, so that the preset anomaly detection model detects anomaly nodes based on the source graph feature matrix and outputs the attribute information of the anomaly nodes. The anomaly detection model includes a mask graph attention subnetwork and a feature reconstruction loss subnetwork; wherein:

[0054] The temporal source graph feature matrix is ​​input into a preset anomaly detection model so that the pre-trained mask graph attention sub-network performs multi-layer aggregation based on the temporal source graph feature matrix to obtain a set of node reconstruction feature vectors.

[0055] The temporal source graph feature matrix and the node reconstruction feature vector set are input into the feature reconstruction loss sub-network so that the feature reconstruction loss sub-network can obtain the node feature reconstruction loss set based on the node reconstruction feature vector set.

[0056] Based on the feature reconstruction loss set, the abnormal threshold of each node in the current time window is obtained sequentially. If the feature reconstruction loss value is greater than the abnormal threshold, the node is determined to be abnormal, and the attribute information of the abnormal node is output.

[0057] It should be noted that the single-layer aggregation operation in the masked image attention subnetwork takes the feature vector of the previous layer node as input, and the single-layer aggregation operation can be expressed as:

[0058]

[0059] Among them, AGG(h) dst ,h N W is the node reconstruction feature vector updated after aggregating the target node dst itself and all its neighboring nodes N. self It is a matrix used to adjust the weights of the nodes themselves, h dst h is the feature vector of the previous layer node. N It is the feature embedding composed of all neighboring nodes of the feature vector of the previous layer node, a(i,dst) is the normalized attention weight of the neighboring nodes to the feature vector of the previous layer node, MSG(i,dst) is the message from the neighboring nodes to the feature vector of the previous layer node, ∑ i∈Na(i,dst)MSG(i,dst) represents a weighted summation of the information of all neighboring nodes of the feature vector of the previous layer node. Finally, the preset anomaly detection model obtains the final set of node reconstruction feature vectors through multi-layer aggregation operations to represent the interaction relationships between multiple nodes.

[0060] It should be noted that the anomaly threshold σ of each node in the current time window, obtained sequentially based on the feature reconstruction loss set, can be expressed as:

[0061]

[0062] Where β is an adjustment parameter used to balance the false alarm rate of anomaly detection; |N T | represents the number of nodes in the temporal origin graph within the time window T; the anomaly threshold σ is represented as β times the average reconstruction loss of all nodes within a time window.

[0063] If the feature reconstruction loss value is greater than the anomaly threshold, the node is determined to be abnormal, and its attribute information is output; otherwise, it is a normal node. Finally, the system will output the attribute information of all nodes identified as abnormal, so that security analysts can further trace and investigate the source.

[0064] It should be noted that, to reduce the training overhead of the anomaly detection model, the masked graph attention subnetwork can randomly mask some node feature vectors before training the anomaly detection model, replacing some node feature vectors with mask labels, while the remaining nodes retain their original features. During the anomaly detection model training, the masked graph attention subnetwork reconstructs the masked nodes. The node reconstruction feature vector obtained using the corresponding multi-layer aggregation operation in the masked graph attention subnetwork is input to the feature reconstruction loss subnetwork to obtain the feature reconstruction error. The anomaly detection model defines the scaling cosine error between the original node feature vector and the node reconstruction feature vector of each masked node as the masked feature reconstruction loss. If the masked feature reconstruction loss is less than the training threshold (defined during anomaly detection model training), the anomaly detection model has been successfully trained; otherwise, the masked feature reconstruction loss is used as part of the input to the anomaly detection model to guide parameter iteration until the masked feature reconstruction loss is less than the training threshold.

[0065] Further, the temporal source graph feature matrix and the node reconstruction feature vector set are input into the feature reconstruction loss sub-network, so that the feature reconstruction loss sub-network obtains the node feature reconstruction loss set based on the node reconstruction feature vector set; including:

[0066] Obtain the node feature vector set based on the feature matrix of the temporal source graph;

[0067] The node feature vector set and the node reconstructed feature vector set are input into the feature reconstruction loss subnetwork. Based on the node feature vector set, the node reconstructed feature vector set, and the preset loss scaling weights, the feature reconstruction loss of each node is obtained. For any node, the feature reconstruction loss is specifically as follows:

[0068]

[0069] In the formula, Δ i The feature reconstruction loss for this node, This is the feature vector of the node. Reconstruct the feature vector for this node, where y is the preset loss scaling weight.

[0070] The node feature reconstruction loss set is obtained based on the feature reconstruction loss of several nodes.

[0071] In the above scheme, the scaled cosine error (i.e., Δ) is used. i As a feature reconstruction loss, it is particularly suitable for the reconstruction of high-dimensional feature vectors, making the anomaly detection model more accurate in representing normal patterns. In the anomaly detection stage, it can generate more discriminative anomaly scores and improve the sensitivity to hidden abnormal behavior.

[0072] This invention also provides an anomaly node detection system based on a time-series source graph, comprising:

[0073] The source graph construction module acquires real-time audit log data and constructs a time-series source graph based on the real-time audit log data.

[0074] The node feature matrix construction module divides the node set into process nodes, file nodes, and socket byte points according to the node type of each node; it performs feature processing on the process nodes, file nodes, and socket byte points respectively according to the node type to obtain a node vector set constructed from the process node feature vector, file node feature vector, and socket byte point feature vector; and constructs a node feature matrix based on the node feature vector set.

[0075] The edge fusion feature matrix construction module obtains an edge attribute set based on the source graph construction module; performs feature processing on the edge attribute set to obtain a basic edge feature vector set; sorts each basic edge feature vector in the basic edge feature vector set by timestamp, and encodes it based on the sorted basic edge feature vector set to obtain an edge sequence encoding set; concatenates the sorted basic edge feature vector set and the edge sequence encoding set to obtain an edge temporal feature vector set; performs a weighted summation based on the timestamp and the edge temporal feature vector set to obtain an edge fusion feature vector; and constructs an edge fusion feature matrix based on the edge fusion feature vector.

[0076] The matrix splicing module performs splicing and fusion based on the node feature matrix obtained by the node feature matrix construction module and the edge fusion feature matrix obtained by the edge fusion feature matrix construction module to construct a temporal traceability graph feature matrix;

[0077] The abnormal node detection module inputs the temporal traceability graph feature matrix obtained by the matrix splicing module into a preset abnormal detection model, so that the preset abnormal detection model performs abnormal node detection based on the traceability graph feature matrix and outputs the attribute information of the abnormal node.

[0078] In the above solution, the traceability graph construction module constructs a temporal traceability graph by obtaining real-time audit log data; the edge fusion feature matrix construction module can quantify the time series pattern implied by the interaction behavior between entities into supplementary features of edge attributes based on the edge sequence coding set generated by sorting and encoding the basic edge feature vector set according to timestamps. It is spliced with the basic edge feature vector set to form an edge time series feature vector set, which can completely carry the spatio-temporal constraint relationship of the audit log behavior chain. Through the mechanism of dynamic weighted summation according to timestamps, it is ensured that events that occurred recently and have a greater impact on the current system state and threat evolution can occupy a higher priority in the feature representation. The matrix splicing module enhances the structured representation ability of the temporal traceability graph through cross-dimensional splicing of the node feature matrix and the temporal edge fusion feature matrix, enabling the abnormal node detection module to more accurately distinguish between compliance operation and maintenance modes and hidden attack chains, thereby improving the accuracy and confidence level of the abnormal detection results.

[0079] Further, the traceability graph construction module obtains real-time audit log data and constructs a temporal traceability graph based on the real-time audit log data; including:

[0080] Obtain the log stream;

[0081] Based on a streaming processing mechanism of an overlapping sliding window, the log stream is cut to obtain the real-time audit log data;

[0082] Construct a temporal traceability graph based on the real-time audit log data.

[0083] In the above solution, the traceability graph construction module performs temporal segmentation on the log stream by adopting a streaming processing mechanism based on an overlapping sliding time window. Specifically, the log stream is cut by setting continuous time windows with overlapping regions (the window length is T, the sliding step size is Δt, and Δt < T). The overlapping mechanism can effectively ensure the temporal continuity of cross-window events in the construction of the temporal traceability graph, thus solving the problem of event chain breakage that may be caused by traditional non-overlapping windows or static snapshot methods, providing a representation basis with complete temporal semantics for subsequent abnormal detection, and at the same time enhancing the ability to capture continuous and subtle temporal dependence relationships in complex attacks. Attached Figure Description

[0084] Figure 1 This is a schematic flowchart of an anomaly node detection method based on a time-series source graph, provided in an embodiment of the present invention.

[0085] Figure 2 This is a schematic diagram of an abnormal node detection system architecture based on a time-series source graph, provided as an embodiment of the present invention. Detailed Implementation

[0086] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0087] Please see Figure 1 This embodiment provides an anomaly node detection method based on a time-series source graph, including the following steps:

[0088] Acquire real-time audit log data and construct a time-series source diagram based on the real-time audit log data;

[0089] Based on the temporal origin graph, obtain the node set and edge attribute set;

[0090] Based on the node set, feature processing is performed to obtain a node vector set;

[0091] Construct a node feature matrix based on the node feature vector set;

[0092] The edge attribute set is subjected to feature processing to obtain the basic edge feature vector set;

[0093] The basic edge feature vectors in the basic edge feature vector set are sorted by timestamp, and the sorted basic edge feature vector set is encoded to obtain the edge order encoding set.

[0094] The sorted basic edge feature vector set and the edge sequence encoding set are concatenated to obtain the edge temporal feature vector set.

[0095] The edge fusion feature vector is obtained by weighted summation based on the timestamp and the edge temporal feature vector set.

[0096] Construct an edge fusion feature matrix based on the edge fusion feature vector;

[0097] The node feature matrix and the edge fusion feature matrix are concatenated and fused to construct the temporal source graph feature matrix;

[0098] Input the time-sequence traceability graph feature matrix into a preset anomaly detection model, so that the preset anomaly detection model performs anomaly node detection based on the traceability graph feature matrix and outputs the attribute information of the anomaly nodes.

[0099] In this embodiment, by splicing and fusing the node feature matrix with the edge fusion feature matrix that integrates the basic attributes and time information, the deep integration of the node static features and the edge dynamic time-sequence features is achieved. Through timestamp sorting, sequential encoding of the edge feature vector set, splicing with the basic features, and then constructing the multi-dimensional feature embedding mechanism of the fusion edge features through timestamp weighted summation, the structural information and key time-sequence dependence relationships in the time-sequence traceability graph can be effectively captured and fused, thereby enhancing the overall representation ability of the time-sequence traceability graph. Using the time-sequence traceability graph feature matrix constructed by the above deep fusion, which contains richer structural and time-sequence information, as the input, the preset anomaly detection model can more accurately identify the potential anomaly patterns in the graph, thus directly improving the accuracy of the anomaly node detection results.

[0100] Further, the obtaining of the real-time audit log data and constructing the time-sequence traceability graph based on the real-time audit log data includes:

[0101] Obtain the log stream;

[0102] Based on the streaming processing mechanism of the overlapping sliding window, cut the log stream to obtain the real-time audit log data;

[0103] Construct a time-sequence traceability graph based on the real-time audit log data.

[0104] In this embodiment, the above solution uses the streaming processing mechanism of the overlapping sliding time window to perform time-sequence segmentation on the log stream. Specifically, the log stream is cut by setting continuous time windows with overlapping regions (the window length is T, the sliding step is Δt, and Δt < T). The overlapping mechanism can effectively ensure the time-sequence continuity of cross-window events in the construction of the time-sequence traceability graph, thus solving the problem of event chain breakage that may be caused by traditional non-overlapping windows or static snapshot methods, providing a representation basis with complete time-sequence semantics for subsequent anomaly detection, and at the same time enhancing the ability to capture continuous and subtle time-sequence dependence relationships in complex attacks. On the basis of time-sequence segmentation, in this embodiment, the audit log data within each time window is modeled as a time-sequence traceability graph G=(V, E), where the node set V={v i |i = 1, 2,..., n} represents system entity objects, which can include security-related entities such as processes, files, network connections, etc.; the edge set E in the time-sequence traceability graph represents the interaction relationships between entities, which can include system behaviors such as process calls, file accesses, network connections, etc.

[0105] Further, feature processing is performed based on the node set to obtain a node vector set; including:

[0106] For each node v∈V in the time-series tracing graph G, it is divided into process nodes, file nodes and socket byte nodes according to the node type of each node;

[0107] Based on the node type, the process node, file node, and socket byte point are respectively characterized to obtain a node vector set constructed from the feature vectors of process nodes, file nodes, and socket byte points; wherein:

[0108] For a process node, its executable file path and process ID value are selected as attributes to obtain the process node feature vector, represented as:

[0109] x p =Hash(Path) p Hash(PID) p )

[0110] In the formula: x p This is a process node feature vector, where Hash() represents the hash function, and Path... p The executable path is represented by ||, which represents the feature concatenation operation, and PID is the PID. p The process ID value is a feature vector of a process node.

[0111] For a file node, its complete file path is selected as the attribute, and the file node feature vector is obtained, represented as:

[0112] x f =Hash(FilePath) f )

[0113] In the formula: x f FilePath is the feature vector of a file node. f The complete file path;

[0114] For a socket byte point, its target IP address and port number are selected as attributes to obtain the socket byte point feature vector, represented as:

[0115] x s =Hash(IP) s )||Hash(Port s )

[0116] In the formula, x s For socket byte point feature vectors, IP s For target IP, Port s Port number;

[0117] The above node features are combined to form a node feature matrix within the time window. Where D v For node feature dimensions.

[0118] Furthermore, the time-series source graph feature matrix is ​​input into a preset anomaly detection model, so that the preset anomaly detection model performs anomaly node detection based on the source graph feature matrix and outputs the attribute information of the anomaly nodes; wherein:

[0119] The input from the time-series source graph feature matrix is ​​fed into a preset anomaly detection model, limiting the anomaly detection scope to process nodes, so that the preset anomaly detection model can detect anomaly nodes based on the source graph feature matrix and output the attribute information of the anomaly nodes.

[0120] In this embodiment, since most critical malicious activities ultimately manifest as process behaviors within the operating system, the anomaly detection scope is limited to process nodes. A pre-defined anomaly detection model can detect abnormal nodes based on the source graph feature matrix and output their attribute information. This design achieves a highly efficient combination of efficiency and accuracy with limited computing resources. It ensures effective coverage of key attack phases, avoids the huge overhead and performance bottlenecks caused by indiscriminate processing of the entire graph, and improves the timeliness of inference by concentrating computing resources. Compared to existing methods that generally perform indiscriminate processing of the entire source graph, the above scheme effectively reduces overhead through targeted detection and improves computational efficiency while maintaining the expected accuracy.

[0121] Further, each basic edge feature vector in the basic edge feature vector set is sorted by timestamp, and the sorted basic edge feature vector set is encoded to obtain an edge order encoding set; including:

[0122] Sort each basic edge feature vector in the basic edge feature vector set by timestamp;

[0123] It should be noted that for each edge e in the temporal origin graph G ij ∈E (representing an event from node to node), its basic attributes can include operation type, source node, destination node, and timestamp TS.

[0124] The edge sequence encoding set is obtained by encoding the sorted basic edge feature vector set using the trigonometric function position encoding method.

[0125] In this embodiment, the basic attributes of the edges are first encoded to generate basic edge feature vectors. Subsequently, in order to accurately capture the chronological order of events, the sequence was calculated using timestamps TS and nodes v. i Sort all related edges, and then generate a sequence code o for the nth edge after sorting.im .

[0126] It should be noted that the sequential encoding o im A trigonometric function position encoding method can be used:

[0127] o im =PositionalEncoding(m)

[0128] In the formula, PositionalEncoding() is the trigonometric function position encoding method, and m is the sorted position.

[0129] In this embodiment, unlike existing technologies that typically use simple timestamps or do not explicitly encode temporal information, trigonometric function position encoding is employed to assign unique, continuous, and learnable temporal positional information to each edge. This explicit temporal embedding enables the pre-defined anomaly detection model to directly capture and understand the order of events and their causal relationships, thereby enhancing the ability to identify subtle anomaly patterns that can only be detected by relying on event sequences (rather than static graph structures or simple timestamps), and improving the detection effect against temporally sensitive attacks.

[0130] In this embodiment, a weighted summation is performed based on the timestamp and the edge temporal feature vector set to obtain the edge fusion feature vector; including:

[0131] Different weights are assigned to the edge time sequence feature vector set based on the timestamp, wherein: the edge time sequence feature vector with more recent time is assigned a greater weight;

[0132] The edge temporal feature vectors are weighted and summed to obtain the edge fusion feature vector.

[0133] In this embodiment, the basic edge feature vector Concatenating with sequential encoding yields a side feature vector containing temporal information.

[0134] Each edge's temporal feature vector is assigned a different weight based on its timestamp. im Where: the more recent the time, the greater the weight assigned to the edge's temporal feature vector; for node v i The edge fusion feature vector of a node is obtained by weighted summing of all relevant edge temporal semantic attribute features.

[0135]

[0136] Where Adj(v) i ) indicates the relationship with node v i The set of adjacent edges. The edge fusion feature vectors of all nodes together constitute the edge fusion feature matrix.

[0137] In this embodiment, the mechanism of dynamically weighted summation based on timestamps ensures that recent events that have a greater impact on the current system state and threat evolution occupy a higher priority in the feature representation. This allows this embodiment to reflect the latest changes in system behavior more dynamically and accurately, thereby having higher sensitivity and adaptability to rapidly evolving attack behaviors, and helping to reduce misjudgments or missed detections caused by redundant or irrelevant historical information.

[0138] Finally, the node feature matrix X and the edge fusion feature matrix X within the time window are combined. edge The features are then concatenated and fused to form the final source map feature matrix F, providing comprehensive and accurate input for subsequent anomaly detection models.

[0139] F = [X||X edge ]

[0140] Further, the temporal source graph feature matrix is ​​input into a preset anomaly detection model, so that the preset anomaly detection model detects anomaly nodes based on the source graph feature matrix and outputs the attribute information of the anomaly nodes. The anomaly detection model includes a mask graph attention subnetwork and a feature reconstruction loss subnetwork; wherein:

[0141] The temporal source graph feature matrix is ​​input into a preset anomaly detection model so that the pre-trained mask graph attention sub-network performs multi-layer aggregation based on the temporal source graph feature matrix to obtain a set of node reconstruction feature vectors.

[0142] The temporal source graph feature matrix and the node reconstruction feature vector set are input into the feature reconstruction loss sub-network so that the feature reconstruction loss sub-network can obtain the node feature reconstruction loss set based on the node reconstruction feature vector set.

[0143] Based on the feature reconstruction loss set, the anomaly threshold σ of each node in the current time window is obtained sequentially:

[0144]

[0145] Where β is an adjustment parameter used to balance the false alarm rate of anomaly detection. |N T | represents the number of nodes in the temporal origin graph within the time window T. The anomaly threshold σ is represented as β times the average reconstruction loss of all nodes within a time window.

[0146] If the feature reconstruction loss value is greater than the anomaly threshold, the node is determined to be abnormal, and its attribute information is output; otherwise, it is a normal node. Finally, the system will output the attribute information of all nodes identified as abnormal, so that security analysts can further trace and investigate the source.

[0147] It should be noted that the single-layer aggregation operation can be expressed as:

[0148]

[0149] Among them, AGG(h) dst ,h N W is the node reconstruction feature vector updated after aggregating the target node dst itself and all its neighboring nodes N. self It is a matrix used to adjust the weights of the nodes themselves, h dst h is the feature vector of the previous layer node. N It is the feature embedding composed of all neighboring nodes of the feature vector of the previous layer node, a(i,dst) is the normalized attention weight of the neighboring nodes to the feature vector of the previous layer node, MSG(i,dst) is the message from the neighboring nodes to the feature vector of the previous layer node, ∑ i∈N a(i,dst)MSG(i,dst) represents a weighted summation of the information of all neighboring nodes of the feature vector of the previous layer node. Finally, the preset anomaly detection model obtains the final set of node reconstruction feature vectors through multi-layer aggregation operations to represent the interaction relationships between multiple nodes.

[0150] It should be noted that, to reduce the training overhead of the anomaly detection model, the masked graph attention subnetwork can randomly mask some node feature vectors before training the anomaly detection model, replacing some node feature vectors with mask labels, while the remaining nodes retain their original features. During the anomaly detection model training, the masked graph attention subnetwork reconstructs the masked nodes. The node reconstruction feature vector obtained using the corresponding multi-layer aggregation operation in the masked graph attention subnetwork is input to the feature reconstruction loss subnetwork to obtain the feature reconstruction error. The anomaly detection model defines the scaling cosine error between the original node feature vector and the node reconstruction feature vector of each masked node as the masked feature reconstruction loss. If the masked feature reconstruction loss is less than the training threshold (defined during anomaly detection model training), the anomaly detection model has been successfully trained; otherwise, the masked feature reconstruction loss is used as part of the input to the anomaly detection model to guide parameter iteration until the masked feature reconstruction loss is less than the training threshold.

[0151] Further, the temporal source graph feature matrix and the node reconstruction feature vector set are input into the feature reconstruction loss sub-network, so that the feature reconstruction loss sub-network obtains the node feature reconstruction loss set based on the node reconstruction feature vector set; including:

[0152] Obtain the node feature vector set based on the feature matrix of the temporal source graph;

[0153] The node feature vector set and the node reconstructed feature vector set are input into the feature reconstruction loss subnetwork. Based on the node feature vector set, the node reconstructed feature vector set, and the preset loss scaling weights, the feature reconstruction loss of each node is obtained. For any node, the feature reconstruction loss is specifically as follows:

[0154]

[0155] In the formula, Δ i The feature reconstruction loss for this node, This is the feature vector of the node. Reconstruct the feature vector for this node, where y is the preset loss scaling weight.

[0156] The node feature reconstruction loss set is obtained based on the feature reconstruction loss of several nodes.

[0157] In this embodiment, the scaled cosine error (i.e., Δ) is used. i As a feature reconstruction loss, it is particularly suitable for the reconstruction of high-dimensional feature vectors, making the anomaly detection model more accurate in representing normal patterns. In the anomaly detection stage, it can generate more discriminative anomaly scores and improve the sensitivity to hidden abnormal behavior.

[0158] Please see Figure 2 This embodiment also provides an anomaly node detection system based on a time-series source graph, including:

[0159] The source graph construction module acquires real-time audit log data and constructs a time-series source graph based on the real-time audit log data.

[0160] The node feature matrix construction module divides the node set into process nodes, file nodes, and socket byte points according to the node type of each node; it performs feature processing on the process nodes, file nodes, and socket byte points respectively according to the node type to obtain a node vector set constructed from the process node feature vector, file node feature vector, and socket byte point feature vector; and constructs a node feature matrix based on the node feature vector set.

[0161] The edge fusion feature matrix construction module obtains an edge attribute set based on the source graph construction module; performs feature processing on the edge attribute set to obtain a basic edge feature vector set; sorts each basic edge feature vector in the basic edge feature vector set by timestamp, and encodes it based on the sorted basic edge feature vector set to obtain an edge sequence encoding set; concatenates the sorted basic edge feature vector set and the edge sequence encoding set to obtain an edge temporal feature vector set; performs a weighted summation based on the timestamp and the edge temporal feature vector set to obtain an edge fusion feature vector; and constructs an edge fusion feature matrix based on the edge fusion feature vector.

[0162] The matrix splicing module splices and fuses the node feature matrix obtained by the node feature matrix construction module and the edge fusion feature matrix obtained by the edge fusion feature matrix construction module to construct a temporal tracing graph feature matrix.

[0163] The abnormal node detection module inputs the time-series source graph feature matrix obtained by the matrix splicing module into a preset abnormal detection model, so that the preset abnormal detection model can detect abnormal nodes based on the source graph feature matrix and output the attribute information of the abnormal nodes.

[0164] In this embodiment, the source graph construction module acquires real-time audit log data and constructs a time-series source graph based on this data. The edge fusion feature matrix construction module generates an edge sequence encoding set by sorting and encoding the basic edge feature vector set based on timestamps. This set quantifies the time-series patterns implied by the interaction behavior between entities into supplementary features of edge attributes. This set is concatenated with the basic edge feature vector set to form an edge time-series feature vector set, which can fully represent the spatiotemporal constraints of the audit log behavior chain. A dynamic weighted summation mechanism based on timestamps ensures that recent events with greater influence on the current system state and threat evolution occupy a higher priority in feature representation. The matrix concatenation module enhances the structured representation capability of the time-series source graph through cross-dimensional concatenation of the node feature matrix and the time-series edge fusion feature matrix. This enables the abnormal node detection module to more accurately distinguish between compliant operation and maintenance modes and covert attack chains, thereby improving the accuracy and confidence level of the anomaly detection results.

[0165] Furthermore, the source tracing graph construction module acquires real-time audit log data and constructs a time-series source tracing graph based on the real-time audit log data; including:

[0166] Get the log stream;

[0167] The log stream is segmented based on an overlapping sliding window streaming mechanism to obtain the real-time audit log data;

[0168] A time-series source graph is constructed based on real-time audit log data.

[0169] In this embodiment, the traceability graph construction module performs temporal segmentation on the log stream by adopting a streaming processing mechanism based on an overlapping sliding time window. Specifically, the log stream is cut by setting consecutive time windows with overlapping regions (the window length is T, the sliding step is Δt, and Δt < T is satisfied). The overlapping mechanism can effectively ensure the temporal continuity of cross-window events in the construction of the temporal traceability graph, thus solving the problem of event chain breakage that may be caused by traditional non-overlapping windows or static snapshot methods, providing a representation basis with complete temporal semantics for subsequent anomaly detection, and at the same time enhancing the ability to capture continuous and subtle temporal dependencies in complex attacks.

[0170] The above is the preferred embodiment of the present invention. It should be noted that for those of ordinary skill in the art, without departing from the principle of the present invention, several improvements and refinements can be made, and these improvements and refinements are also regarded as the protection scope of the present invention.

Claims

1. An anomaly node detection method based on a time-series source graph, characterized in that, Includes the following steps: Acquire real-time audit log data and construct a time-series source diagram based on the real-time audit log data; Based on the temporal origin graph, obtain the node set and edge attribute set; Based on the node set, feature processing is performed to obtain a node vector set; Construct a node feature matrix based on the node feature vector set; The edge attribute set is subjected to feature processing to obtain the basic edge feature vector set; The basic edge feature vectors in the basic edge feature vector set are sorted by timestamp, and the sorted basic edge feature vector set is encoded to obtain the edge order encoding set. The sorted basic edge feature vector set and the edge sequence encoding set are concatenated to obtain the edge temporal feature vector set. The edge fusion feature vector is obtained by weighted summation based on the timestamp and the edge temporal feature vector set. Construct an edge fusion feature matrix based on the edge fusion feature vector; The node feature matrix and the edge fusion feature matrix are concatenated and fused to construct the temporal source graph feature matrix; The time-series source graph feature matrix is ​​input into a preset anomaly detection model, so that the preset anomaly detection model can detect anomaly nodes based on the source graph feature matrix and output the attribute information of the anomaly nodes.

2. The anomaly node detection method based on a time-series source graph according to claim 1, characterized in that, The step of acquiring real-time audit log data and constructing a time-series source graph based on the real-time audit log data includes: Get the log stream; The log stream is segmented based on an overlapping sliding window streaming mechanism to obtain the real-time audit log data; A time-series source graph is constructed based on real-time audit log data.

3. The anomaly node detection method based on a time-series source graph according to claim 1, characterized in that, Based on the node set, feature processing is performed to obtain a node vector set; including: Based on the node set, each node is divided into process nodes, file nodes, and socket byte nodes according to its node type. Based on the node type, the process node, file node, and socket byte point are respectively characterized to obtain a node vector set constructed from the feature vectors of process nodes, file nodes, and socket byte points; wherein: For a process node, its executable file path and process ID value are selected as attributes to obtain the process node feature vector. For a file node, its complete file path is selected as the attribute to obtain the file node feature vector; For a socket byte point, its target IP and port number are selected as attributes to obtain the socket byte point feature vector.

4. The anomaly node detection method based on a time-series source graph according to claim 3, characterized in that, The time-series source graph feature matrix is ​​input into a preset anomaly detection model, so that the preset anomaly detection model performs anomaly node detection based on the source graph feature matrix and outputs the attribute information of the anomaly nodes; including: The input from the time-series source graph feature matrix is ​​fed into a preset anomaly detection model, limiting the anomaly detection scope to process nodes, so that the preset anomaly detection model can detect anomaly nodes based on the source graph feature matrix and output the attribute information of the anomaly nodes.

5. The anomaly node detection method based on a time-series source graph according to claim 1, characterized in that, Each basic edge feature vector in the basic edge feature vector set is sorted by timestamp, and the sorted basic edge feature vector set is then encoded to obtain an edge sequence encoding set; including: Sort each basic edge feature vector in the basic edge feature vector set by timestamp; The edge sequence encoding set is obtained by encoding the sorted basic edge feature vector set using the trigonometric function position encoding method.

6. The anomaly node detection method based on a time-series source graph according to claim 1, characterized in that, The edge fusion feature vector is obtained by weighted summation based on the timestamp and the edge temporal feature vector set; including: Different weights are assigned to the edge time sequence feature vector set based on the timestamp, wherein: the edge time sequence feature vector with more recent time is assigned a greater weight; The edge temporal feature vectors are weighted and summed to obtain the edge fusion feature vector.

7. The anomaly node detection method based on a time-series source graph according to claim 6, characterized in that, The temporal source map feature matrix is ​​input into a preset anomaly detection model, which detects anomaly nodes based on the source map feature matrix and outputs the attribute information of the anomaly nodes. The anomaly detection model includes a mask map attention subnetwork and a feature reconstruction loss subnetwork; wherein: The temporal source graph feature matrix is ​​input into a preset anomaly detection model so that the pre-trained mask graph attention sub-network performs multi-layer aggregation based on the temporal source graph feature matrix to obtain a set of node reconstruction feature vectors. The temporal source graph feature matrix and the node reconstruction feature vector set are input into the feature reconstruction loss sub-network so that the feature reconstruction loss sub-network can obtain the node feature reconstruction loss set based on the node reconstruction feature vector set. Based on the feature reconstruction loss set, the abnormal threshold of each node in the current time window is obtained sequentially. If the feature reconstruction loss value is greater than the abnormal threshold, the node is determined to be abnormal, and the attribute information of the abnormal node is output.

8. The anomaly node detection method based on a time-series source graph according to claim 7, characterized in that, The temporal source graph feature matrix and the node reconstruction feature vector set are input into the feature reconstruction loss sub-network so that the feature reconstruction loss sub-network can obtain the node feature reconstruction loss set based on the node reconstruction feature vector set. include: Obtain the node feature vector set based on the feature matrix of the temporal source graph; The node feature vector set and the node reconstruction feature vector set are input into the feature reconstruction loss sub-network, and the feature reconstruction loss of each node is obtained based on the node feature vector set, the node reconstruction feature vector set and the preset loss scaling weight; The node feature reconstruction loss set is obtained based on the feature reconstruction loss of several nodes.

9. An anomaly node detection system based on a time-series source graph, characterized in that, include: The source graph construction module is used to acquire real-time audit log data and construct a time-series source graph based on the real-time audit log data. The node feature matrix construction module divides the node set into process nodes, file nodes, and socket byte points according to the node type of each node; it performs feature processing on the process nodes, file nodes, and socket byte points respectively according to the node type to obtain a node vector set constructed from the process node feature vector, file node feature vector, and socket byte point feature vector; and constructs a node feature matrix based on the node feature vector set. The edge fusion feature matrix construction module obtains an edge attribute set based on the source graph construction module; performs feature processing on the edge attribute set to obtain a basic edge feature vector set; sorts each basic edge feature vector in the basic edge feature vector set according to its timestamp, and encodes it based on the sorted basic edge feature vector set to obtain an edge sequence encoding set; and concatenates the sorted basic edge feature vector set and the edge sequence encoding set to obtain an edge temporal feature vector set. The edge fusion feature vector is obtained by weighted summation based on the timestamp and the edge temporal feature vector set. Construct an edge fusion feature matrix based on the edge fusion feature vector; The matrix splicing module splices and fuses the node feature matrix obtained by the node feature matrix construction module and the edge fusion feature matrix obtained by the edge fusion feature matrix construction module to construct a temporal tracing graph feature matrix. The abnormal node detection module inputs the time-series source graph feature matrix obtained by the matrix splicing module into a preset abnormal detection model, so that the preset abnormal detection model can detect abnormal nodes based on the source graph feature matrix and output the attribute information of the abnormal nodes.

10. An anomaly node detection system based on a time-series source graph according to claim 9, characterized in that, The source graph construction module is used to acquire real-time audit log data and construct a time-series source graph based on the real-time audit log data; it includes: Get the log stream; The log stream is segmented based on an overlapping sliding window streaming mechanism to obtain the real-time audit log data; A time-series source graph is constructed based on real-time audit log data.

Images