Multi-modal attack behavior depth representation system and method based on graph convolutional network

Abstract

The invention discloses a multi-modal attack behavior depth representation system and method based on a graph convolutional network, and belongs to the technical field of network security, and the system comprises a data obtaining module which is used for obtaining a multi-modal behavior data set of a network system; the feature analysis module is used for performing attack feature analysis on the multi-modal behavior data set to obtain an attack behavior vector set; the anomaly detection module is used for carrying out anomaly detection on the attack behavior vector set to obtain an attack behavior anomaly detection set; and the deep representation module is used for performing deep representation on the attack behavior vector set and the attack behavior anomaly detection set according to the graph convolutional network, and establishing a multi-modal attack behavior representation graph. According to the method, the technical problem that a traditional single-dimensional detection method is difficult to identify the multi-stage cooperative behavior in the hidden attack chain is solved, and the technical effects of realizing accurate detection of the stage behavior in the hidden attack chain and reducing the false alarm rate through multi-modal joint representation and graph convolution network cross-modal feature extraction are achieved.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of network security, in particular to a multi-modal attack behavior deep characterization system and method based on a graph convolution network. BACKGROUND

[0002] With the continuous evolution of network attack means, advanced persistent threats (APTs), zero-day exploit and other covert attacks have become the main threat in the field of network security. Such attacks often achieve intrusion through multi-stage collaboration such as "network traffic camouflage-process behavior hiding-memory payload residence". Each stage of behavior in the attack chain (such as initial penetration, horizontal movement, permission maintenance, and data exfiltration) has high concealment and cross-modal correlation. However, traditional security detection methods mostly rely on single-dimensional features (such as only analyzing network traffic statistics, only monitoring process system calls, or only checking memory snapshots), which have a significant information island effect - network traffic features reflect external communication anomalies, but cannot be associated with malicious operations of processes; process behavior log records system operations, but it is difficult to trace the persistent payload in memory; memory features can capture malicious code residence, but cannot be associated with network layer communication patterns. This single-dimensional detection paradigm results in insufficient correlation analysis capabilities for cross-modal and cross-stage attack behaviors, making it difficult to accurately identify the phased features of covert attack chains, and easy to miss or misreport due to scattered features. SUMMARY

[0003] With the continuous evolution of network attack means, advanced persistent threats (APTs), zero-day exploit and other covert attacks have become the main threat in the field of network security. Such attacks often achieve intrusion through multi-stage collaboration such as "network traffic camouflage-process behavior hiding-memory payload residence". Each stage of behavior in the attack chain (such as initial penetration, horizontal movement, permission maintenance, and data exfiltration) has high concealment and cross-modal correlation. However, traditional security detection methods mostly rely on single-dimensional features (such as only analyzing network traffic statistics, only monitoring process system calls, or only checking memory snapshots), which have a significant information island effect - network traffic features reflect external communication anomalies, but cannot be associated with malicious operations of processes; process behavior log records system operations, but it is difficult to trace the persistent payload in memory; memory features can capture malicious code residence, but cannot be associated with network layer communication patterns. This single-dimensional detection paradigm results in insufficient correlation analysis capabilities for cross-modal and cross-stage attack behaviors, making it difficult to accurately identify the phased features of covert attack chains, and easy to miss or misreport due to scattered features. BRIEF DESCRIPTION OF DRAWINGS

[0004] Figure 1 A structural schematic diagram of a multi-modal attack behavior deep characterization system based on a graph convolution network is provided for the embodiments of the present application.

[0005] Figure 2 A flowchart of a method for deep characterization of multi-modal attack behavior based on a graph convolution network is provided for the embodiments of the present application.

[0006] Reference signs: data acquisition module 11, feature analysis module 12, anomaly detection module 13, deep characterization module 14. DETAILED DESCRIPTION

[0007] The present application provides a multi-modal attack behavior deep characterization system and method based on a graph convolution network, which solves the technical problem that traditional single-dimensional detection methods cannot identify multi-stage coordinated behavior in a hidden attack chain.

[0008] The technical solutions in the present application will be described clearly and completely below with reference to the accompanying drawings. Obviously, the described embodiments are only some of the embodiments of the present application, not all embodiments of the present application. It should be understood that the present application is not limited by the example embodiments described herein. Based on the embodiments of the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application. In addition, it should be noted that, for convenience of description, only parts related to the present application are shown in the drawings, not all.

[0009] Embodiment one, as shown, the present application provides a multi-modal attack behavior deep characterization system based on a graph convolution network, which comprises: Figure 1 A data acquisition module 11 is used to obtain a multi-modal behavior data set of a network system.

[0010] Specifically, in the data acquisition module 11, by collecting real-time data of the network system in all directions, real-time data including network traffic data, process behavior data and memory access data are obtained. These real-time data will have timestamp information. By aligning the timestamps of these real-time data and cleaning them, a complete multi-modal behavior data set can be formed. This multi-modal behavior data set serves as the basis for subsequent analysis and can provide accurate and rich data support for attack feature analysis, anomaly detection, deep characterization and other subsequent processing modules.

[0011] Further, the data acquisition module 11 comprises: The network system is monitored in real time to obtain network traffic data, process behavior data and memory access data. The network traffic data, process behavior data and memory access data are timestamped to obtain a synchronized monitoring data set. The synchronized monitoring data set is cleaned to obtain the multi-modal behavior data set.

[0012] ​In a preferred embodiment, in the data acquisition module 11, the network system is monitored in real time by calling a traffic analysis tool (such as a network traffic probe) to obtain network traffic data, which includes packet transmission information inside or outside the network system, such as IP address, port number, protocol type, packet size, transmission delay, etc. These data help to analyze the activity pattern of network communication and help to identify potential malicious traffic or abnormal traffic pattern. By calling a monitoring tool (such as Process Monitor), the process information in the network system is recorded in real time to obtain process behavior data, which covers the behavior characteristics of each process in the network system, including process start and end information, resource occupation, inter-process communication, system call, etc. By monitoring the life cycle and behavior pattern of the process, abnormal or malicious activities in the process can be found in time, such as Trojan, virus or vulnerability attack. By calling a traffic analysis tool (such as Memory Analyzer), the access and operation of the network system memory are tracked in real time to obtain memory access data, which is the monitoring of the network system memory, involving the time, frequency, data block, etc. These data can effectively capture malicious code or attack tools hidden in the memory, especially those behaviors that modify or abuse the memory for hidden attacks, such as memory horse, malicious script injection, etc. Then, since the network traffic, process behavior and memory access data come from different monitoring sources, their time stamps may be different, so these data will be unified to the same time scale through time stamp matching, so as to obtain a synchronous monitoring data set, ensuring that the subsequent data analysis and anomaly detection will be based on the same time window. Then, for the repeated records that may exist in the synchronous monitoring data set, the repeated items will be removed; for abnormal noise, the mean plus or minus multiple standard deviations (such as 3) will be used to remove, so as to ensure the accuracy and reliability of the data; for missing values, the average value of the data at the previous and subsequent time points will be used to fill the missing part. Then, the cleaned synchronous monitoring data set is processed using the maximum-minimum normalization method to make various data have consistent measurement standards, which is convenient for subsequent processing and analysis. After normalization, a multi-modal behavior data set is formed, which can be used as the input data source for subsequent feature extraction, anomaly detection and deep representation, providing high-quality data support.

[0013] The feature analysis module 12 is used to analyze the attack features of the multi-modal behavior data set and obtain an attack behavior vector set.

[0014] Specifically, after receiving the multi-modal behavior data set delivered by the data acquisition module 11, the feature analysis module 12 performs cross-modal feature extraction on the network traffic, process behavior and memory access data in the multi-modal behavior data set to obtain a plurality of behavior feature vectors, and then matches the extracted feature vectors with an attack behavior recognition graph to determine an attack behavior vector set, which can effectively represent the pattern of attack behavior and provide support for subsequent anomaly detection and deep characterization.

[0015] Further, the feature analysis module 12 includes: According to the multi-modal behavior data set, cross-modal feature extraction and fusion are performed to obtain a plurality of behavior feature vectors; based on a knowledge graph, an attack behavior recognition graph is constructed; and the plurality of behavior feature vectors are input into the attack behavior recognition graph to obtain the attack behavior vector set.

[0016] In a preferred embodiment, in the feature analysis module 12, first, for the network traffic data in the multi-modal behavior data set, the transmission characteristics of the traffic data packets are analyzed to extract features such as packet size, source and target IP, communication delay, protocol type, traffic peak, traffic anomaly, etc., and these features are spliced according to the preset vector template to form a behavior feature vector; for process behavior data, process data is analyzed to extract process resource consumption, execution duration, inter-process data exchange, etc., and the same method is used to splice into a behavior feature vector; for memory access data, various read and write operations of the memory are analyzed to extract memory access frequency, accessed memory address, abnormal memory access, etc., and splice into a behavior feature vector. After obtaining multiple behavior feature vectors, the multiple behavior feature vectors are input into a pre-constructed attack behavior recognition graph. This attack behavior recognition graph is constructed based on a knowledge graph. In the construction process, various attack patterns, attack tools and known attack behaviors are extracted from known attack libraries or security incidents as nodes in the knowledge graph. Each node can represent a specific attack behavior or attack stage. For example, nodes can include attack behaviors such as "network scanning", "malicious process injection", "privilege escalation", etc. The relationships between recorded attack behaviors are used to construct edges in the graph. For example, network scanning may trigger malicious process injection, which may lead to privilege escalation, etc. Therefore, different attack behaviors are connected by directed edges to represent their relationships and attack chains. In addition, in order to improve the coverage and adaptability of the attack behavior recognition graph, the graph structure can be dynamically updated to add newly discovered attack patterns and behaviors, so as to ensure that the attack behavior recognition graph can be continuously optimized. When the attack behavior recognition graph receives multiple behavior feature vectors that need to be matched, the behavior feature vectors are matched with the attack behavior recognition graph to find nodes related to the behavior characteristics. These nodes can be the starting stage of the attack or a representative of the potential attack behavior. Then, information propagation and reasoning are performed on the nodes in the graph to associate the behavior feature vectors with the attack behavior nodes in the graph, infer the type of attack behavior, the attack path and the possible attack chain. These inference results will form an attack behavior vector set, which provides accurate input for subsequent anomaly detection, attack chain analysis, etc., ensuring high precision and high reliability of attack behavior recognition.

[0017] The anomaly detection module 13 is used for anomaly detection of the attack behavior vector set to obtain an attack behavior anomaly detection set.

[0018] Specifically, after receiving the attack behavior vector set delivered by the feature analysis module 12, the anomaly detection module 13 will input the attack behavior vectors in the attack behavior vector set into an attack behavior anomaly detection model one by one. The attack behavior anomaly detection model is pre-trained based on LSTM (Long Short Term Memory network) and can predict whether the behavior belongs to abnormal behavior according to the knowledge learned during training, and form an attack behavior anomaly detection set. The attack behavior anomaly detection can help identify potential attack behaviors and provide support for subsequent defense measures.

[0019] Further, the anomaly detection module 13 includes: Based on the LSTM network, the attack behavior anomaly detection model is trained; each attack behavior vector in the attack behavior vector set is input into the attack behavior anomaly detection model to obtain each attack behavior anomaly detection result; and the attack behavior anomaly detection results are sorted to generate the attack behavior anomaly detection set.

[0020] In a preferred embodiment, in the anomaly detection module 13, the LSTM network is used as a deep learning model for processing time series data, which is suitable for identifying long-term dependencies in time series. Before training the LSTM model, a large amount of normal behavior and attack behavior data (including attack behavior vectors and corresponding anomaly detection results) is collected from the network system, and these data are standardized to ensure that different feature values are in the same order of magnitude, avoiding the dominance of certain features in the training of the entire model. Then, the LSTM network is trained using the collected data. During the training process, the LSTM adjusts the weights through the backpropagation algorithm to learn how to predict whether the next behavior is abnormal based on the input data of the time series, so as to help the LSTM network capture the rules of the normal operation of the system from the historical data and distinguish it from abnormal behavior. The goal of training is to minimize the error between the predicted output and the actual label, so that the model can accurately determine whether each input attack behavior deviates from the normal mode. After training, an attack behavior anomaly detection model is obtained, which is used for real-time detection of received attack behavior vectors. After receiving the attack behavior vector set, the attack behavior anomaly detection model combines the rules learned before to determine whether these behaviors belong to the normal operation range of the network system, and outputs an anomaly probability value to determine whether each attack behavior vector is abnormal. If the probability value exceeds the preset threshold, the model will determine that the behavior is abnormal, i.e. attack behavior, if the probability value is low, it is considered that the behavior is normal, indicating that the behavior will not threaten the network system. The attack behavior anomaly detection model generates attack behavior anomaly detection results for each attack behavior vector according to these prediction results, and finally generates an attack behavior anomaly detection set by summarizing these attack behavior anomaly detection results. The attack behavior anomaly detection result contains all the behavior vectors that are determined to be abnormal. These abnormal behavior vectors are the core content of the attack behavior anomaly detection set, which provides a reliable basis for subsequent attack analysis, response decision, etc., ensuring that potential security threats can be discovered and responded to in a timely manner.

[0021] The deep representation module 14 is used to perform deep representation on the attack behavior vector set and the attack behavior anomaly detection set according to the graph convolution network, and establish a multi-modal attack behavior representation graph.

[0022] Specifically, after receiving the attack behavior vector set and the attack behavior anomaly detection set passed by the anomaly detection module 13, the deep representation module 14 performs deep representation on the attack behavior vector set and the attack behavior anomaly detection set based on a graph convolution network (GCN), that is, each attack behavior in the attack behavior vector set is regarded as a node in a graph, and the node contains data features from different modalities (such as network traffic, process behavior, memory access, etc.), at the same time, each attack behavior anomaly in the attack behavior anomaly detection set is also added as a node in the graph. Subsequently, the GCN is used to perform graph construction and feature learning on the nodes, and the relationship between the nodes (such as the time sequence relationship or the correlation of the behavior patterns) is represented as an edge in the graph. Then, by fusing the graph represented by the attack behavior vector set and the graph represented by the attack behavior anomaly detection set, a multi-modal attack behavior representation graph is established, which can effectively represent complex attack behaviors and their mutual relationships, and improve the accuracy and robustness of attack detection.

[0023] Further, the deep representation module 14 further comprises: According to the graph convolution network, the attack behavior vector set is graph constructed to obtain an attack behavior first representation graph; according to the graph convolution network, the attack behavior anomaly detection set is graph constructed to obtain an attack behavior second representation graph; and the attack behavior first representation graph and the attack behavior second representation graph are fused to obtain the multi-modal attack behavior representation graph.

[0024] In a preferred embodiment, in the deep characterization module 14, first, a graph is constructed for the attack behavior vector set, each attack behavior vector in the attack behavior vector set represents the attack behavior of the network system at a certain time or time window, therefore, in the constructed graph, each attack behavior vector will become a node, and the features of the node will come from the information in the attack behavior vector set, such as network traffic, process behavior, memory access and other multi-modal features. The edges between nodes represent the similarity or association between attack behaviors. In order to determine which attack behaviors should have edges between them, the cosine similarity is used to calculate the similarity between each pair of attack behavior vectors, and if the similarity of two attack behaviors is higher than a similarity threshold, an edge will be added between them in the graph. In addition, if certain attack behaviors occur close in time or belong to the same attack chain, edges can be added between them to indicate that they may have a temporal or causal relationship. Subsequently, the nodes in the graph are processed by a graph convolutional network, which aggregates the information of neighboring nodes, and the feature vectors of the nodes are updated in the multiple iterations of the graph convolution to better reflect the structural relationships and feature patterns in the entire graph. The final graph is the first attack behavior representation graph, which represents the relationships and similarities between attack behaviors. Then, a similar graph construction is performed on the attack behavior anomaly detection set to obtain a second attack behavior representation graph. The nodes in this second attack behavior representation graph represent attack behaviors that have been determined to be abnormal, and the edges represent the similarity or temporal relationship between attack behaviors. The weights of the edges have been adjusted according to the anomaly detection results, for example, if the anomaly probabilities of two adjacent abnormal behaviors are close, the edge between them will be strengthened, indicating that these two behaviors may have a higher association. Similarly, this second attack behavior representation graph also undergoes convolution operations by a graph convolutional network, which enables it to effectively capture abnormal patterns of attack behaviors and reflect the results of attack behavior anomaly detection and their associations. Finally, by concatenating the node features in the first attack behavior representation graph and the second attack behavior representation graph, a new node feature is formed, and by merging the edge sets of the two graphs, a more comprehensive multi-modal attack behavior graph is formed. This multi-modal attack behavior representation graph contains multi-dimensional features of each attack behavior and represents the association and abnormality between attack behaviors through nodes and edges in the graph, providing strong support for subsequent attack analysis, threat identification and security defense.

[0025] Further, the multi-modal attack behavior representation graph is corrected for bias detection according to the attack behavior vector set and the attack behavior anomaly detection set.

[0026] In a preferred embodiment, in order to ensure that the features of nodes and edges in the multi-modal attack behavior characterization graph can truly and accurately reflect the attack behavior in the network system, and eliminate the possible data noise or model bias, bias detection correction will be performed using the attack behavior vector set and the attack behavior anomaly detection set. In this process, the nodes and edges in the multi-modal attack behavior characterization graph will be analyzed, especially the abnormal nodes and edges in the graph, by combining the features of the attack behavior vector set and the abnormal labels in the attack behavior anomaly detection set, the matching of the anomaly detection result of each node with its position in the graph can be evaluated, for example, if the anomaly detection result of a node is normal, but the node is connected with multiple high abnormal nodes in the graph, it may indicate that the node has bias and needs to be further corrected, at this time, for the nodes with large bias, the anomaly detection label of the node will be re-evaluated according to the information in the attack behavior vector set and the anomaly detection set, and the feature value of the node in the graph will be updated. At the same time, the edges in the graph also need to be corrected, especially those edges reflecting the wrong relationship, by optimizing and adjusting the edge weights in the graph, it can be ensured that only the attack behaviors with real correlation will maintain the connection of the edges, so as to optimize the relationship structure of the attack behaviors in the graph. In order to further optimize the accuracy of the graph, graph convolution network (GCN) is also applied for feature propagation and update, so that the features of the nodes are corrected and strengthened in the multi-convolution process, ensuring that each node in the graph can accurately express its role in the attack chain and the relevance with other behaviors. After this process, the node features in the characterization graph will be more accurate, and the edges in the graph will better reflect the actual correlation between attack behaviors, thereby effectively improving the detection ability and robustness of the network system to complex attack behaviors.

[0027] Further, network security operation and maintenance is performed according to the multi-modal attack behavior characterization graph.

[0028] In a preferred embodiment, by constructing a multi-modal attack behavior characterization graph, the dynamic changes of various attack behaviors in the network can be monitored in real time. In the graph, each node represents a specific attack behavior, and its features are integrated with multi-modal information such as network traffic, process behavior, and memory access. The edges between nodes reflect the association between attack behaviors. Based on this graph structure, the occurrence timing, development process, and correlation between stages of attack behaviors can be accurately captured, providing a global perspective for security operations. In the process of network security operations, for the nodes with abnormal behaviors in the multi-modal attack behavior characterization graph, the attack chain can be quickly traced back based on the relationships between nodes in the graph, and the source and expansion path of the attack can be identified. For example, if a node (attack behavior) is associated with multiple other nodes, it can be determined that these behaviors may belong to the same attack chain, and targeted defense measures can be taken to prevent the spread of attacks. In addition, the data in the characterization graph can also be used for regular security posture assessment and risk analysis. By analyzing the graph structure of historical attack behaviors, security operation personnel can identify security vulnerabilities and weaknesses in the network system and take targeted repair and reinforcement. Based on the distribution of nodes and edges in the graph, the security of different regions in the network can be evaluated, and more detailed access control and permission management strategies can be developed to reduce the chances of potential attackers breaking in. Finally, by continuously optimizing and updating the features of nodes and edges in the characterization graph, new attack behaviors and changing network environments can be adapted to, so that security operations can always be in a state of active defense, thereby effectively improving the response capability to network security incidents and ensuring the stability and security of the network system.

[0029] In summary, the multi-modal attack behavior deep characterization system based on graph convolution network provided by the embodiments of the present application has the following technical effects: The data acquisition module 11 is configured to obtain a multi-modal behavior data set of a network system. The feature analysis module 12 is configured to perform attack feature analysis on the multi-modal behavior data set to obtain an attack behavior vector set. The anomaly detection module 13 is configured to perform anomaly detection on the attack behavior vector set to obtain an attack behavior anomaly detection set. The deep characterization module 14 is configured to perform deep characterization on the attack behavior vector set and the attack behavior anomaly detection set according to a graph convolution network to establish a multi-modal attack behavior characterization graph. Through the above steps, the technical problem that the traditional single-dimensional detection method cannot identify the multi-stage collaborative behavior in the hidden attack chain is solved, and the technical effect of accurately detecting the stage behavior in the hidden attack chain and reducing the false positive rate through multi-modal joint characterization and cross-modal feature extraction of the graph convolution network is achieved.

[0030] Embodiment two, based on the same inventive concept as the multi-modal attack behavior deep characterization system based on graph convolution network in the foregoing embodiments, such as Figure 2As shown, the embodiment of the present application provides a multi-modal attack behavior deep characterization method based on a graph convolution network, which comprises the following steps: obtaining a multi-modal behavior data set of a network system; performing attack feature analysis on the multi-modal behavior data set to obtain an attack behavior vector set; performing anomaly detection on the attack behavior vector set to obtain an attack behavior anomaly detection set; performing deep characterization on the attack behavior vector set and the attack behavior anomaly detection set according to a graph convolution network to establish a multi-modal attack behavior characterization graph.

[0031] Further, the method comprises the following steps: real-time monitoring the network system to obtain network traffic data, process behavior data and memory access data; timestamp aligning the network traffic data, the process behavior data and the memory access data to obtain a synchronous monitoring data set; data cleaning the synchronous monitoring data set to obtain the multi-modal behavior data set.

[0032] Further, the method comprises the following steps: cross-modal feature extraction and fusion according to the multi-modal behavior data set to obtain a plurality of behavior feature vectors; constructing an attack behavior recognition graph based on a knowledge graph; inputting the plurality of behavior feature vectors into the attack behavior recognition graph to obtain the attack behavior vector set.

[0033] Further, the method comprises the following steps: training an attack behavior anomaly detection model based on an LSTM network; inputting each attack behavior vector in the attack behavior vector set into the attack behavior anomaly detection model to obtain each attack behavior anomaly detection result; collating the each attack behavior anomaly detection result to generate the attack behavior anomaly detection set.

[0034] Further, the method comprises the following steps: graph construction on the attack behavior vector set according to a graph convolution network to obtain an attack behavior first characterization graph; graph construction on the attack behavior anomaly detection set according to a graph convolution network to obtain an attack behavior second characterization graph; fusing the attack behavior first characterization graph and the attack behavior second characterization graph to obtain the multi-modal attack behavior characterization graph.

[0035] Further, the method comprises the following steps: deviation detection correction on the multi-modal attack behavior characterization graph according to the attack behavior vector set and the attack behavior anomaly detection set.

[0036] Further, the method comprises the following steps: network security operation and maintenance according to the multi-modal attack behavior characterization graph.

[0037] Any step of the above-mentioned methods can be stored as computer instructions or programs in a non-limited computer memory and can be invoked by a non-limited computer processor to recognize to implement any of the methods in the embodiments of the present application, and no more limitations are made herein.

[0038] Further, the first or the second above-mentioned can not only represent the order relationship, but also can represent a certain specific concept, and / or refer to the selection of the elements individually or collectively. Obviously, those skilled in the art can make various modifications and variations to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application belong to the scope of the present application and its equivalent technologies, the present application is intended to include these modifications and variations.

Claims

1. A multi-modal attack behavior deep characterization system based on graph convolutional network, characterized in that, The system comprises: a data acquisition module for obtaining a multi-modal behavior data set of a network system; a feature analysis module for attack feature analysis on the multi-modal behavior data set to obtain an attack behavior vector set; an anomaly detection module for anomaly detection on the attack behavior vector set to obtain an attack behavior anomaly detection set; a deep representation module for deep representation of the attack behavior vector set and the attack behavior anomaly detection set according to a graph convolution network to establish a multi-modal attack behavior representation graph.

2. The graph convolution network-based multi-modal attack behavior deep characterization system of claim 1, wherein, The data acquisition module comprises: real-time monitoring of the network system to obtain network traffic data, process behavior data and memory access data; timestamp alignment of the network traffic data, the process behavior data and the memory access data to obtain a synchronized monitoring data set; data cleaning of the synchronized monitoring data set to obtain the multi-modal behavior data set.

3. The graph convolution network-based multi-modal attack behavior deep characterization system of claim 1, wherein, The feature analysis module comprises: cross-modal feature extraction and fusion according to the multi-modal behavior data set to obtain a plurality of behavior feature vectors; construction of an attack behavior recognition graph based on a knowledge graph; input of the plurality of behavior feature vectors into the attack behavior recognition graph to obtain the attack behavior vector set.

4. The graph convolution network-based multi-modal attack behavior deep characterization system of claim 1, wherein, The anomaly detection module comprises: training of an attack behavior anomaly detection model based on an LSTM network; input of each attack behavior vector in the attack behavior vector set into the attack behavior anomaly detection model to obtain each attack behavior anomaly detection result; collation of the each attack behavior anomaly detection result to generate the attack behavior anomaly detection set.

5. The graph convolution network-based multi-modal attack behavior deep characterization system of claim 1, wherein, The deep representation module comprises: graph construction of the attack behavior vector set according to a graph convolution network to obtain an attack behavior first representation graph; graph construction of the attack behavior anomaly detection set according to a graph convolution network to obtain an attack behavior second representation graph; fusion of the attack behavior first representation graph and the attack behavior second representation graph to obtain the multi-modal attack behavior representation graph.

6. The graph convolution network-based multi-modal attack behavior deep characterization system of claim 1, wherein, deviation detection correction of the multi-modal attack behavior representation graph according to the attack behavior vector set and the attack behavior anomaly detection set.

7. The graph convolution network-based multi-modal attack behavior deep characterization system of claim 1, wherein, network security operation and maintenance according to the multi-modal attack behavior representation graph.

8. A multi-modal attack behavior deep representation method based on a graph convolution network, characterized in that, The method is performed by the multi-modal attack behavior deep representation system based on a graph convolution network according to any one of claims 1 to 7, and the method comprises: obtaining a multi-modal behavior data set of a network system; attack feature analysis on the multi-modal behavior data set to obtain an attack behavior vector set; anomaly detection on the attack behavior vector set to obtain an attack behavior anomaly detection set; deep representation of the attack behavior vector set and the attack behavior anomaly detection set according to a graph convolution network to establish a multi-modal attack behavior representation graph.

Images