A collaborative modeling method for APT knowledge graph reasoning task

Abstract

The application provides a collaborative modeling method for an APT knowledge graph reasoning task, comprising: differentially processing and mapping node feature vectors according to the attribute types of node information in the APT knowledge graph; iteratively sampling and aggregating the features of the nodes to generate embedding vectors; constructing an interaction feature vector according to the embedding vectors of the nodes on a to-be-predicted path, constructing a relationship type prediction model, and performing relationship type prediction according to the interaction feature vector; obtaining a training set, calculating the dynamic class weights of each relationship type according to the training set, and defining a weighted cross-entropy loss function; training the relationship type prediction model using the training set to obtain a trained prediction model, and using the prediction model to perform explicit triple completion reasoning and implicit path reasoning of the APT knowledge graph according to the interaction feature vector. The method can significantly improve the accuracy of APT organization image completion, attack target prediction and other tasks.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a collaborative modeling method for an APT knowledge graph reasoning task. BACKGROUND

[0002] With the continuous evolution of advanced persistent threat (APT) attacks, their attack behaviors increasingly exhibit characteristics such as chain-like staging, strong behavior concealment, flexible payload reconstruction, and high attack path reuse rate. To cope with such complex attack scenarios, the field of network security research has gradually introduced the knowledge graph (KG) method, which organizes multi-source heterogeneous threat intelligence in a structured manner to support subsequent attribution analysis, path identification, and dynamic response.

[0003] Existing technologies have made some progress in the field of APT knowledge graph reasoning, but still have many deficiencies:

[0004] Technologies that perform multi-hop dependency modeling need to manually predefine path patterns, making it difficult to adaptively mine potential multi-hop weak associations, resulting in implicit attack chain discovery relying on prior knowledge and limiting dynamic perception of new APT attacks. There are multi-dimensional heterogeneous characteristics in APT entities, and explicit and implicit relationship reasoning are independent of each other, lacking an end-to-end joint mechanism, which affects the fine-grained discrimination of relationship reasoning and the efficiency of attack panorama restoration.

[0005] Long-tail distribution optimization does not adjust weights combined with graph structure characteristics, and is disconnected from reasoning tasks, making the performance of low-frequency relationship identification limited, and making it difficult to support actual reasoning tasks that need to balance multiple types of relationships.

[0006] Therefore, it is necessary to provide an APT knowledge graph reasoning method to improve the implementation accuracy of the APT knowledge graph reasoning task and provide technical support for building a more adaptive and forward-looking active defense system. SUMMARY

[0007] The purpose of the present application is to provide a collaborative modeling method for an APT knowledge graph reasoning task to improve the implementation accuracy of the APT knowledge graph reasoning task.

[0008] In a first aspect, the application provides a collaborative modeling method for an APT knowledge graph reasoning task, including: differentiating and mapping node feature vectors according to attribute types of node information in the APT knowledge graph; taking the node feature vectors as initial features of nodes in the APT knowledge graph, iteratively sampling and aggregating the features of the nodes to generate embedding vectors containing multi-hop context information; constructing an interaction feature vector according to the embedding vectors of nodes on a to-be-predicted path, constructing a relationship type prediction model according to the interaction feature vector using a multi-class Softmax classifier, and predicting the relationship type according to the interaction feature vector by the relationship type prediction model; obtaining a training set, calculating dynamic class weights of each relationship type according to the training set, and defining a weighted cross-entropy loss function in combination with the dynamic class weights; training the relationship type prediction model using the training set, and obtaining a trained prediction model when the weighted cross-entropy loss function converges, the prediction model being used for explicit triple completion reasoning and implicit path reasoning of the APT knowledge graph according to the interaction feature vector.

[0009] The collaborative modeling method for the APT knowledge graph reasoning task has the beneficial effects that: a unified vector space can be constructed to achieve fusion, the attribute semantics can be more completely preserved and aligned, and the semantic expression integrity of node features and the graph structure modeling basis are significantly improved; the structural dependency relationship between multi-stage entities in an APT attack chain can be explicitly captured, and the recognition ability of complex attack paths is enhanced; the gradient update amplitude of each relationship in the loss function is dynamically adjusted according to the class frequency in the training set, and the prediction deviation problem caused by the long-tail distribution in the APT graph is effectively alleviated.

[0010] In a possible embodiment, the attribute types of node information in the APT knowledge graph include category attributes, numerical attributes and text attributes; the differentiating and mapping of the node feature vectors according to the attribute types of the node information in the APT knowledge graph includes: mapping single-category attribute information into a corresponding integer index vector using a dictionary mapping method, converting multi-category attribute information into a binary coefficient vector using a hot one encoding method, mapping numerical attribute information through a standardization function to obtain a standardized feature vector, and converting text attribute information into a fixed-dimensional semantic vector through a word vector embedding model; and the vectors formed by the differentially processed node information are spliced to form a unified node feature vector.

[0011] In another possible embodiment, iterative sampling and aggregation of node features are performed to generate an embedding vector containing multi-hop context information. This includes: performing three-layer convolutional propagation on the node features to generate an embedding vector containing multi-hop context information. Each layer of convolutional propagation includes selecting a fixed number of neighboring nodes for each target node to obtain aggregated features, and concatenating the previous layer features of the target node with the aggregated features to generate the current layer representation. The aggregated features obtained by selecting a fixed number of neighboring nodes for each target node satisfy the following formula: , Indicates the target node is at the . Layer aggregation characteristics, Indicates the target node is at the . Vector representation of layers, This represents a fixed set of adjacent nodes of the target node. The neighboring nodes of the target node are represented; the previous layer features of the target node are concatenated with the aggregated features to generate the current layer representation, satisfying the following formula: , Indicates the target node is at the . Vector representation of layers, Represents a non-linear activation function. Indicates the first The weight matrix of the layer, Indicates the first Layer bias terms.

[0012] Other possible embodiments involve constructing an interaction feature vector based on the embedding vectors of nodes on the path to be predicted, including: obtaining node pairs corresponding to missing triples and concatenating the embedding vectors of the node pairs to form the interaction feature vector; or, extracting the length of the APT knowledge graph. semantic path set , for set Each path in P k =[ v s →⋯→ v t ] The average embedding of the node sequence along the path is calculated, and the average embedding is calculated according to the following formula: The average embedding is concatenated with the node embedding vector of the target node to form an interaction feature vector, where, This represents the embedding vector of a node on the path.

[0013] The dynamic class weights for each relation type are calculated based on the training set, including: obtaining the frequency of occurrence of each relation type in the training set; calculating the initial class weights for each relation type based on the total number of samples in the training set and the frequency of occurrence of each relation type; and exponentially compressing the initial class weights to obtain the dynamic class weights.

[0014] The weighted cross-entropy loss function, defined by dynamic class weights, satisfies the following formula: ,in, Denotes the set of edges in the training set. Represents the edges in the training set. Representing an edge The true type of relationship, Representing relation type The corresponding dynamic class weights, This indicates that the prediction result belongs to the relation type. The predicted probability.

[0015] After performing explicit triple completion reasoning and implicit path reasoning of the APT knowledge graph based on the interaction feature vectors, the process also includes: establishing a decision mapping mechanism between the reasoning results and honeycomb array resource scheduling; when the explicit triple completion reasoning and implicit path reasoning results of the APT knowledge graph are obtained using the prediction model, calculating monitoring indicators based on the reasoning results; determining whether the monitoring indicators exceed preset thresholds; and adjusting the honeycomb array defense deployment strategy according to the mapping rules in the decision mapping mechanism when the detected indicators exceed the preset thresholds.

[0016] Secondly, the present invention also provides a collaborative modeling device for APT knowledge graph reasoning tasks, comprising: an information mapping unit, used to perform differential processing based on the attribute types of node information in the APT knowledge graph and map to generate node feature vectors;

[0017] The node embedding generation unit is used to take the node feature vector as the initial feature of the node in the APT knowledge graph, perform iterative sampling and aggregation on the node features, and generate an embedding vector containing multi-hop context information.

[0018] The model building unit is used to construct an interaction feature vector based on the embedding vectors of nodes on the path to be predicted. A multi-class Softmax classifier is used to construct a relationship type prediction model based on the interaction feature vector. The relationship type prediction model predicts the relationship type based on the interaction feature vector.

[0019] The loss function definition unit is used to obtain the training set, calculate the dynamic class weights of each relation type based on the training set, and define the weighted cross-entropy loss function in combination with the dynamic class weights.

[0020] The model training unit is used to train a relation type prediction model using the training set. When the weighted cross-entropy loss function converges, the trained prediction model is obtained. The prediction model is used to perform explicit triple completion reasoning and implicit path reasoning of the APT knowledge graph based on the interaction feature vector.

[0021] In a third aspect, the present application also provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the collaborative modeling method for the APT knowledge graph reasoning task.

[0022] In a fourth aspect, the present application also provides an electronic device, which comprises a processor and a memory, the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to make the electronic device execute the collaborative modeling method for the APT knowledge graph reasoning task.

[0023] The beneficial effects of the above-mentioned second to fourth aspects can be referred to the description of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0024] Figure 1 A flowchart of a collaborative modeling method for an APT knowledge graph reasoning task provided by an embodiment of the present application;

[0025] Figure 2 A schematic diagram of a collaborative modeling device for an APT knowledge graph reasoning task provided by an embodiment of the present application;

[0026] Figure 3 A structural schematic diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0027] In order to make the objectives, technical solutions and advantages of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application. Unless otherwise defined, the technical terms or scientific terms used herein should be understood as the general meanings understood by those skilled in the art in the field of the present application. The words such as “comprise” and similar words used herein mean that the elements or objects before the words cover the elements or objects listed after the words and their equivalents, and do not exclude other elements or objects.

[0028] The present embodiment provides a collaborative modeling method for an APT knowledge graph reasoning task. Referring to the accompanying drawings Figure 1 The method comprises:

[0029] S101: Differentiating and mapping to generate a node feature vector according to the attribute type of the node information in the APT knowledge graph.

[0030] In a possible embodiment, the attribute types of the node information in the APT knowledge graph include category attributes, numerical attributes, and text attributes. The attribute types of the node information in the APT knowledge graph are differentiated and mapped to generate node feature vectors, including: using a dictionary mapping method to map single-category attribute information into a corresponding integer index vector, using a one-hot encoding method to convert multi-category attribute information into a binary coefficient vector, mapping numerical attribute information through a standardization function to obtain a standardized feature vector, and converting text attribute information into a fixed-dimension semantic vector through a word vector embedding model; and concatenating the vectors formed by the differentiated node information to form a unified node feature vector.

[0031] Exemplarily, the specific process of a feature encoding mechanism designed for the multi-source heterogeneous attribute information possessed by an entity node in an APT knowledge graph to convert three types of original information, i.e., category attributes, numerical attributes, and text attributes, into node feature vectors in the form of unified dimensions and computable dense vectors includes:

[0032] The category attributes include the ownership type of an attack organization, the function label of malicious software, the deployment mode of attack infrastructure, and the like, and have the characteristics of discrete labels. According to the annotation form, the category attributes are divided into single-category attributes and multi-category attributes. The dictionary mapping method is used for single-category attribute information to map the category labels into corresponding integer index vectors , and then perform numerical embedding; the one-hot encoding method is used for multi-category attribute information to convert the label set into a binary sparse vector , and eliminate the scale deviation between dimensions through a normalization operation.

[0033] The numerical attributes cover quantitative indicators such as attack resource level, threat score (such as CVSS), and propagation speed. Let the numerical attribute set be , which is mapped to the interval [0, 1] through a standardization function to obtain a standardized feature vector .

[0034] The text attributes include unstructured semantic information such as attack behavior description, technical method description, and tactic background. For each piece of text attribute , a word vector embedding model (such as GloVe, Global Vectors for Word Representation) based on global corpus statistics is used to convert it into a fixed-dimension semantic vector . For multiple pieces of text information, an average pooling method is used to combine them into an overall representation: .

[0035] After the three types of attribute information, i.e., category attribute, numerical attribute and text attribute, are converted through the above-mentioned corresponding conversion, they are spliced to form a unified node feature representation: , wherein, is the unified node feature representation of the node . represents a vector splicing operation; the dimension corresponds to the sum of the dimensions of the category, numerical and text features, respectively.

[0036] In a specific embodiment, taking the attack organization node "Sandworm Team" as an example, it has the following attributes: category label: national APT organization (single category); numerical indicators: attack resource level is 6, threat level is 8 (2 dimensions in total); text description: "mainly attacks the energy industry through supply chain poisoning means to launch power outage events" and the like. The information of the node is processed as follows: the category attribute is encoded into an integer through dictionary mapping and then embedded; the numerical attribute is normalized to [0.857, 1.0][0.857, 1.0][0.857, 1.0]; the text information is encoded into a 200-dimensional dense semantic vector through GloVe. Then, the processed category attribute information, numerical attribute information and text information are spliced to form a unified representation of , which is used as the input of the graph neural network. This feature encoding scheme guarantees the semantic integrity and computability of the generated node feature vector, which can provide a basis for subsequent relationship reasoning.

[0037] S102: Taking the node feature vector as the initial feature of the node in the APT knowledge graph, iteratively sampling and aggregating the features of the node to generate an embedding vector containing multi-hop context information.

[0038] In a possible embodiment, iteratively sampling and aggregating the features of the node to generate an embedding vector containing multi-hop context information includes: generating an embedding vector containing multi-hop context information through three-layer convolution propagation of the features of the node, each layer of convolution propagation including selecting a fixed number of adjacent nodes of each target node to aggregate to obtain aggregated features, and splicing the last layer features of the target node and the aggregated features to generate the current layer representation; wherein selecting a fixed number of adjacent nodes of each target node to aggregate to obtain aggregated features satisfies the following formula: , represents the aggregated features of the target node in the layer, represents the vector representation of the target node in the layer, represents a fixed number of adjacent node sets of the target node, neighbor nodes of the target node; concatenating the last layer feature of the target node and the aggregated feature to generate the current layer representation satisfies the following formula: denotes the vector representation of the target node at the layer, denotes a nonlinear activation function, denotes the weight matrix of the layer, denotes the bias term of the layer.

[0039] In one possible embodiment, a fixed number of neighbor nodes of the target node are selected for selection based on node importance scores: the importance scores of all neighbors of the target node are calculated, and the Top-K nodes are selected in descending order of the importance scores. When the actual number of neighbors is insufficient, a zero vector filling strategy is used to maintain a fixed number. Among them, the Top-K nodes are selected according to a fixed number, and the fixed number is a pre-set hyperparameter; the importance scores are calculated through an attention mechanism, considering node features and graph structure attributes.

[0040] Exemplarily, an APT knowledge graph is denoted as , wherein is a set of entity nodes, is a set of relationship edges, including multiple entity types and edge types. Each node has an initial feature , and the node feature of the l-th layer is denoted as , and three layers of convolution propagation processing are superimposed (i.e., l=1, 2, 3). In each layer of convolution propagation processing, in order to realize efficient information transmission and calculation cost control, an importance-based random neighbor sampling strategy is designed, and a fixed number of neighbor nodes of each target node are selected for aggregation. The selection of neighbor nodes considers entity types and edge types at the same time, ensuring semantic consistency under heterogeneous structure.

[0041] The convolution propagation processing of each layer is composed of two stages of neighborhood feature aggregation and node feature update, specifically including: inputting the feature representation of the neighbor nodes of the target node at the last layer into an LSTM unit for semantic encoding, and outputting an intermediate representation vector . After concatenating the last layer feature of the target node itself with the aggregated feature , the current layer representation is generated through linear transformation and activation function, wherein denotes the weight matrix of the layer, denotes the bias term of the ​bias term of the layer, represents a nonlinear activation function. After adding the Dropout mechanism to the generated current layer representation, the output . In the convolution propagation process, the LSTMs (Long Short-Term Memory) can capture the syntactic structure and long-range dependencies between neighboring nodes, improve the semantic preservation ability of aggregation, and add the Dropout mechanism before each layer output to alleviate overfitting and support robust modeling of uncertain neighbors. When the feature of the node is processed by three layers of convolution propagation, the following vectors are generated from input to output: , , , , where is the input layer dimension vector, and are intermediate representations, is the output layer dimension (i.e., the final embedding vector). After three layers of convolution propagation, each node obtains a final embedding vector with three-hop neighborhood information fusion: .

[0042] In a specific embodiment, taking the "Sandworm Team" node as an example, its one-hop neighbor is the "BlackEnergy" malware, its two-hop neighbor is the "CVE-2014-4114" vulnerability, and its three-hop neighbor is the "*** power system". Through the three-layer aggregation mechanism, the final embedding of the Sandworm not only contains its own attribute semantics, but also encodes the context structure features associated with the multi-level attack chain, providing fine semantic support for subsequent attack chain path restoration and organization attribution.

[0043] S103: Construct an interaction feature vector according to the embedding vector of the node on the path to be predicted, and use a multi-class Softmax classifier to construct a relationship type prediction model according to the interaction feature vector. The relationship type prediction model predicts the relationship type according to the interaction feature vector.

[0044] In a possible embodiment, the relationship type prediction model constructed by the multi-class Softmax classifier according to the interaction feature vector includes an input layer, a linear mapping layer (relationship classification linear layer), and a Softmax output layer. Let the pre-defined relationship type set in the knowledge graph be , and the interaction feature vector be the input, the relationship type distribution corresponding to the edge to be predicted is predicted as , where represents the weight matrix of the relationship classification linear layer, which is obtained by backpropagation training; denotes a bias vector, which is automatically learned by gradient update during model training process; denotes a node pair belongs to a relation type .

[0045] In one possible embodiment, the interaction feature vector is constructed according to the embedding vectors of the nodes on the path to be predicted, including: obtaining a node pair corresponding to a missing triple, and splicing the embedding vectors of the node pair to form an interaction feature vector; or, extracting a set of semantic paths with a length of from the APT knowledge graph , calculating the average embedding of the node sequence on each path in the set , and splicing the average embedding with the node embedding vector of the target node to form an interaction feature vector, wherein P k =[ v s →⋯→ v t ] calculating the average embedding of the node sequence on the path, which satisfies the following formula: splicing the average embedding with the node embedding vector of the target node to form an interaction feature vector, wherein denotes the embedding vector of the node on the path.

[0046] In one specific embodiment, for a pair of edges to be predicted , an interaction feature vector is constructed using the node embedding vectors , , which satisfies , wherein denotes a vector splicing operation. This feature representation can effectively encode the contextual structural semantics between the node pair.

[0047] The relation type prediction model is used for explicit triple completion and implicit path reasoning. Illustratively, the explicit triple completion includes: for a missing triple (h,?, t), an interaction feature vector is constructed using the target node pair , which is input into the relation type prediction model to obtain the prediction probability as a confidence score, and the relation type with the highest confidence score is selected as the prediction result, so as to predict the most possible relation type of the missing triple and realize the explicit completion of the broken edge in the knowledge graph.

[0048] The implicit path reasoning includes: for a node pair that does not exist explicitly but has a multi-hop path , a set of semantic paths with a length of is extracted from the graph, the average embedding of the node sequence on each path is calculated, and the average embedding is spliced with the target node embedding The concatenation is input into a relationship type prediction model as an interaction feature vector to perform relationship inference and confidence scoring, and the path with the highest confidence and its inference result are selected as the optimal reasoning result of the implicit semantic path.

[0049] In a specific embodiment, taking the node pair ("Sandworm Team", "CVE-2014-4114") as an example, although there is no direct triple connection between the two, there is a path "Sandworm Team"→"BlackEnergy"→"Exploits"→"CVE-2014-4114" in the graph, and the path vector is generated by embedding aggregation After being concatenated with the endpoint node embedding, the relationship prediction module is input, and the probability of the predicted result "Exploits" relationship is the highest, thereby completing the implicit relationship inference.

[0050] S104: Obtain a training set, calculate dynamic class weights of each relationship type according to the training set, and define a weighted cross-entropy loss function in combination with the dynamic class weights.

[0051] In a possible embodiment, the relationship types in the APT knowledge graph generally have a serious long-tailed distribution characteristic, that is, a small number of high-frequency relationships (such as "use", "contain", etc.) dominate in the training samples, and a large number of low-frequency relationships (such as "imitation", "shared DNS", and "pollution") appear rarely. The gradient update of the traditional graph neural network for the low-frequency relationships is insufficient in the training process, which easily causes prediction bias of the model and reduces the recognition ability of the model for a small number of attack behavior patterns. To address this challenge, a dynamic class weight mechanism is designed to adaptively assign different loss weights to different relationship types in the training process, thereby enhancing the robustness and recognition ability of the model for long-tailed relationships.

[0052] In a possible embodiment, a training set is obtained, and the training set is composed of labeled triples. The dynamic class weights of each relationship type are calculated according to the training set, including: obtaining the occurrence frequency of each relationship type in the training set; calculating the initial class weights of each relationship type according to the total number of samples in the training set and the occurrence frequency of each relationship type; and performing exponential compression processing on the initial class weights to obtain the dynamic class weights.

[0053] In a possible embodiment, the weighted cross-entropy loss function is defined in combination with the dynamic class weights and satisfies the following formula: wherein, represents a set of edges in the training set, represents an edge in the training set, represents the edge a true relationship type, representing a relationship type a corresponding dynamic class weight, representing a prediction probability that the prediction result belongs to the relationship type .

[0054] Exemplarily, assuming that the set of all edges in the training set is , and the set of relationship types is . The occurrence frequency of a relationship r is defined as , and the total number of samples is . The initial class weight of the relationship is set as the inverse proportional function of the frequency of the relationship in the training set, and a power index p∈[0,1] is introduced to control the growth intensity. The calculation of the initial class weight satisfies the following formula: , wherein, represents the initial class weight of the relationship r; is a smooth control parameter that can be adjusted, which is manually set by the administrator according to the experimental effect. The greater the value is, the stronger the compensation degree for low-frequency relationships is.

[0055] Further, in order to avoid the training instability problem caused by excessive weighting of tail classes, a smoothing factor is designed for exponential compression processing, which satisfies: w r = w r init power ,power∈(0,1] , wherein, represents a smoothing factor. The smoothing factor is artificially optimized as a hyperparameter, which is used to control the stability of the weight distribution. When , no compression is performed, , extreme large weights are inhibited, so that the overall class weight is more stably distributed in a controllable interval.

[0056] In order to adapt to the fine-tuning of edge distribution in the model training process, the frequency of each relationship type is dynamically counted before each training round , and the weight is recalculated to ensure that it always matches the current data distribution, thereby realizing class-aware adaptive update in the training phase.

[0057] In combination with the above dynamic class weight mechanism, a weighted cross-entropy loss function is defined: for each training edge , assuming that the true relationship type is , and the prediction probability is , the defined weighted cross-entropy loss function specifically satisfies , wherein, is the class weight corresponding to the relationship type in the current training round.

[0058] The design of the dynamic category weight mechanism can significantly improve the degree of attention to low-frequency relationship types in training, effectively solving the recognition difficulty problem caused by gradient sparsity.

[0059] In a specific embodiment, taking the long-tail relationship type "Impersonates" in the APT knowledge graph as an example, the number of this type of edges in the training set accounts for only 0.8% of the total. Using the dynamic category weight mechanism of the present application, when the total number of samples is , the number of samples of this relationship type is , assuming p=0.5, the initial weight is: , after smoothing compression (such as ), the final weight is , which means that the prediction error of the "Impersonates" relationship will be more than 5 times the loss penalty weight, thereby strengthening the training signal of this relationship.

[0060] S105: Apply the training set to train the relationship type prediction model, and when the weighted cross-entropy loss function converges, the trained prediction model is obtained, which is used for explicit triple completion reasoning and implicit path reasoning of the APT knowledge graph according to the interaction feature vector.

[0061] The design of the dynamic category weight mechanism can provide solid training guarantee for subsequent multi-class relationship prediction (especially tail attack behavior reasoning), and by taking the calculated dynamic category weight as the weight factor of the weighted cross-entropy loss function in the training of the relationship type prediction model, and updating it every round to train the converged model, the converged model is used for explicit and implicit reasoning, supporting the high-confidence modeling task of all inertia types in the APT knowledge graph.

[0062] In a possible embodiment, the trained prediction model is used for explicit triple completion reasoning and implicit path reasoning of the APT knowledge graph. After obtaining the reasoning result using the prediction model, a decision mapping mechanism for mapping the reasoning result to the honeypot resource scheduling is established; when the explicit triple completion reasoning and implicit path reasoning results of the APT knowledge graph are obtained using the prediction model, a monitoring index is calculated according to the reasoning result; it is judged whether the monitoring index exceeds a preset threshold; when the monitoring index exceeds the preset threshold, the honeypot defense deployment strategy is adjusted according to the mapping rule in the decision mapping mechanism.

[0063] In a possible embodiment, the technical evolution judgment is implemented by continuously monitoring the change trend of the attack pattern in the APT knowledge graph according to the prediction result. The specific monitoring indicators include new vulnerability exploitation methods, new attack relationship patterns, and changes in the frequency of long-tail relationships. When the monitoring indicators exceed the preset threshold, the resource scheduling process is triggered according to the predefined decision mapping mechanism of the inference result and the honeynet resource scheduling, so as to dynamically adjust the honeynet defense deployment strategy according to the predefined mapping rule, and ensure that the defense system can respond to the adaptive changes of the attacker's technology in a timely manner. According to the decision mapping mechanism, the resources are scheduled to make the defense strategy of the honeynet always dynamically match the technical evolution trend of the attacker, thereby maximizing the synergistic efficiency of the active deception and dynamic defense of the honeynet system, and improving the initiative and adaptability of the overall network security defense.

[0064] In a specific embodiment, after the prediction model is used to complete the inference of the APT knowledge graph, the inference result includes explicit relationship completion, implicit attack chain path, attacker behavior preference, and confidence score of each type of relationship. The decision mapping mechanism that is pre-constructed to adapt the inference result to the logic of the honeynet resource scheduling is used to realize the transformation of the inference result to the dynamic deployment strategy of the honeynet, which specifically includes: based on the attacker path preference obtained by inference (such as the implicit path of "attack organization → impersonation → legitimate certificate → supply chain pollution"), the honeynet system can enhance the simulation strength of the nodes on the corresponding path, for example, implanting features matched with the common impersonation methods of the attack organization in the "legitimate certificate" simulation node, to improve the success rate of deception to the attacker; according to the attack target prediction result (such as the inference that a certain type of system is the potential target of the attacker), the distribution density and resource allocation of the system node in the honeynet are dynamically adjusted, a denser deception subnetwork is formed in the area where the attacker may penetrate, and the deception range is expanded; in combination with the identification result of the low-frequency but high-threat long-tail relationship (such as "pollution" and "shared DNS"), the nodes involved in the relationship in the honeynet are deployed and monitored, to ensure the timely response to new or rare attack patterns.

[0065] The collaborative modeling method for the APT knowledge graph reasoning task provided by the application designs differentiated processing strategies (dictionary mapping, standardization, GloVe coding) for category, numerical value and text attributes, and constructs a unified vector space to realize fusion, so that the attribute semantics is more completely reserved and aligned. Three-hop HeteroGraphSAGE combined with an LSTM aggregator is adopted to adaptively mine multi-hop semantic dependencies, which can more comprehensively model the multi-stage structure of the APT attack chain. A dynamic category weight mechanism is designed to adjust the weight in real time according to the training data and integrate it into the model training process, which can flexibly alleviate the prediction bias caused by the long-tail distribution and improve the performance of low-frequency relationship recognition. In addition, the application also constructs a real-time linkage mechanism between the reasoning result and the honeynet scheduling, which can dynamically optimize the deployment of honeynet nodes, resource allocation and feature updating according to the attack path and target preference obtained by reasoning, so that the honeynet defense is more targeted and timely.

[0066] Overall, the technical scheme of the application establishes a full-link reasoning engine of "attribute fusion deep aggregation dynamic optimization", solves the challenges of attribute heterogeneity, long-range path and long-tail distribution in the APT knowledge graph, and significantly improves the precision of security tasks such as APT organization portrait completion and attack target prediction, providing accurate and real-time decision support for dynamic deployment and strategy optimization of the honeynet system. Through the deep cooperation of APT knowledge graph reasoning and honeynet defense mechanism, the deception defense system is promoted from passive response to active prediction, from single-point deception to global cooperation, and the overall network security defense system is improved in resisting complex APT attacks and response efficiency, providing technical support for building a more adaptive and forward-looking active defense system.

[0067] The collaborative modeling method for the APT knowledge graph reasoning task of the application can realize unified modeling of explicit and implicit relationships in complex, sparse and heterogeneous graph structures, and balance the model generalization ability and the ability to recognize minority class relationships. Not only can it improve the overall prediction performance of the APT knowledge graph reasoning task, but also has stronger practicality and generalizability in actual network threat scenarios with complex attack patterns, unbalanced relationship categories and limited sample sizes, while providing key support for accurate transformation of honeynet graphs.

[0068] Compared with the prior art, the technical scheme of the application has strong multi-dimensional heterogeneous attribute fusion capability, stronger cross-hop dependency modeling capability, and significantly enhanced low-frequency relationship prediction capability, and can provide accurate guidance for honeynet scheduling. Specifically, by designing a differential processing mechanism for category type, numerical type and text type attributes, the problem of attribute format fragmentation and weak semantic expression capability in the prior art is solved, significantly improving the semantic expression integrity of node features and the graph structure modeling basis. The three-hop HeteroGraphSAGE structure combined with the LSTM aggregator effectively breaks through the semantic degradation problem of traditional GNN structure in 2-hop and above reasoning, enabling the model to explicitly capture the structural dependency relationship between multi-stage entities in the APT attack chain and enhance the recognition capability of complex attack paths. A dynamic class weight mechanism is designed to dynamically adjust the gradient update amplitude of each relationship in the loss function according to the class frequency in the training set, effectively alleviating the prediction bias problem caused by the long-tail distribution in the APT graph, and being more adaptive and robust than the fixed static weighting method used in the prior art. A decision mapping mechanism adapted to the logic of honeynet scheduling is constructed through the reasoning result, realizing the conversion of the reasoning result to the dynamic deployment strategy of the honeynet. Unlike the existing honeynet deployment method which relies on artificial experience or simple data support, the design of the decision mapping mechanism makes the honeynet deployment more in line with the attacker's behavior and technical evolution, improving the synergistic efficiency of active deception and dynamic defense of the honeynet.

[0069] Referring to the drawings accompanying Figure 2 The embodiment also provides a collaborative modeling device for an APT knowledge graph reasoning task, which is used to implement the above-mentioned method embodiment. The device comprises:

[0070] An information mapping unit 201 is configured to perform differential processing on the attribute types of node information in the APT knowledge graph and map to generate a node feature vector.

[0071] A node embedding generation unit 202 is configured to use the node feature vector as the initial feature of a node in the APT knowledge graph, and perform iterative sampling and aggregation processing on the feature of the node to generate an embedding vector containing multi-hop context information.

[0072] A model construction unit 203 is configured to construct an interaction feature vector according to the embedding vector of a node on a to-be-predicted path, construct a relationship type prediction model according to the interaction feature vector using a multi-class Softmax classifier, and perform relationship type prediction according to the interaction feature vector.

[0073] A loss function definition unit 204 is configured to obtain a training set, calculate dynamic class weights of each relationship type according to the training set, and define a weighted cross-entropy loss function in combination with the dynamic class weights.

[0074] Model training unit 205 is used to train a relation type prediction model using the training set. When the weighted cross-entropy loss function converges, the trained prediction model is obtained. The prediction model is used to perform explicit triple completion reasoning and implicit path reasoning of the APT knowledge graph based on the interaction feature vector.

[0075] All relevant content of each step involved in the above method embodiments can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0076] In other embodiments of this application, an electronic device is disclosed, such as... Figure 3 As shown, the electronic device 300 may include: one or more processors 301; a memory 302; a display 303; one or more application programs (not shown); and one or more computer programs 304. These devices can be connected via one or more communication buses 305. The one or more computer programs 304 are stored in the memory and configured to be executed by the one or more processors 301. The one or more computer programs 304 include instructions that can be used to perform actions such as... Figure 1 And the various steps in the corresponding embodiments.

[0077] Through the above description of the embodiments, those skilled in the art will clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0078] In the embodiments of this application, the functional units can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0079] The integrated unit, if implemented in the form of a software function unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the embodiments of the present application essentially or say the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor execute all or part of the steps of the methods described in the embodiments of the present application. The foregoing storage medium includes: flash memory, mobile hard disk, read-only memory, random access memory, magnetic disk or optical disk, and various media that can store program codes.

[0080] The above is only a specific implementation of the embodiments of the present application, but the protection scope of the embodiments of the present application is not limited thereto. Any change or replacement within the technical scope disclosed in the embodiments of the present application should be covered in the protection scope of the embodiments of the present application. Therefore, the protection scope of the embodiments of the present application should be subject to the protection scope of the claims.

Claims

1. A collaborative modeling method for APT knowledge graph reasoning tasks, characterized in that, The method comprises the following steps: differential processing and mapping according to the attribute type of the node information in the APT knowledge graph to generate a node feature vector; using the node feature vector as the initial feature of the node in the APT knowledge graph, iteratively sampling and aggregating the features of the node to generate an embedding vector containing multi-hop context information; constructing an interaction feature vector according to the embedding vector of the node on the to-be-predicted path, constructing a relationship type prediction model according to the interaction feature vector using a multi-class Softmax classifier, and predicting the relationship type according to the interaction feature vector by the relationship type prediction model; obtaining a training set, calculating the dynamic class weight of each relationship type according to the training set, and defining a weighted cross-entropy loss function in combination with the dynamic class weight; training the relationship type prediction model by using the training set, and obtaining a trained prediction model when the weighted cross-entropy loss function converges, wherein the prediction model is used for explicit triple completion reasoning and implicit path reasoning of the APT knowledge graph according to the interaction feature vector; wherein, calculating the dynamic class weight of each relationship type according to the training set comprises: obtaining the occurrence frequency of each relationship type in the training set; calculating the initial class weight of each relationship type according to the total number of samples in the training set and the occurrence frequency of each relationship type; and performing exponential compression processing on the initial class weight to obtain the dynamic class weight; The weighted cross-entropy loss function defined in combination with the dynamic class weight satisfies the following formula: wherein, represents a set of edges in the training set, represents an edge in the training set, represents a true relationship type of the edge , represents a relationship type corresponding to the dynamic class weight, represents a predicted probability that the prediction result belongs to the relationship type .

2. The method of claim 1, wherein, The attribute type of the node information in the APT knowledge graph includes category attribute, numerical attribute and text attribute. The differential processing and mapping according to the attribute type of the node information in the APT knowledge graph to generate a node feature vector comprises: using a dictionary mapping method to map single-class attribute information into a corresponding integer index vector, using a hot one encoding method to convert multi-class attribute information into a binary coefficient vector, mapping numerical attribute information through a standardization function to obtain a standardized feature vector, and converting text attribute information into a fixed-dimensional semantic vector through a word vector embedding model; splicing the vectors formed by the differentially processed node information to form a unified node feature vector.

3. The method of claim 1, wherein, The iteratively sampling and aggregating the features of the node to generate an embedding vector containing multi-hop context information comprises: generating an embedding vector containing multi-hop context information by three-layer convolution propagation of the features of the node, wherein each layer of convolution propagation comprises selecting a fixed number of adjacent nodes for each target node to obtain aggregated features, splicing the features of the last layer of the target node and the aggregated features to generate the current layer representation; wherein the aggregated features of a fixed number of neighboring nodes selected for each target node satisfy the following formula: , denotes the aggregated features of the target node at the layer, denotes the vector representation of the target node at the layer, denotes a fixed number of neighboring nodes of the target node, denotes a neighboring node of the target node; The last layer feature of the target node is spliced with the aggregated feature to generate the current layer representation, which satisfies the following formula: , represents the vector representation of the target node at the layer, represents a nonlinear activation function, represents a weight matrix of the layer, represents a bias term of the layer.

4. The method of claim 1, wherein, constructing an interaction feature vector according to the embedding vector of the node on the to-be-predicted path comprises: obtaining a node pair corresponding to the missing triple, and splicing the embedding vectors of the node pair to form an interaction feature vector; Alternatively, extract the length from the APT knowledge graph. semantic path set , for set Each path in The average embedding of the node sequence along the path is calculated, and the average embedding is calculated according to the following formula: The average embedding is concatenated with the node embedding vector of the target node to form an interaction feature vector, where, This represents the embedding vector of a node on the path.

5. The method of claim 1, wherein, The method further comprises: establishing a decision mapping mechanism between the reasoning result and the honeynet resource scheduling; when the explicit triple completion reasoning and implicit path reasoning results of the APT knowledge graph are obtained by using the prediction model, calculating a monitoring index according to the reasoning result; determining whether the monitoring index exceeds a preset threshold; when the monitoring index exceeds the preset threshold, adjusting the honeynet defense deployment strategy according to the mapping rule in the decision mapping mechanism.

6. A collaborative modeling device for an APT knowledge graph reasoning task, characterized in that, The device comprises: An information mapping unit is configured to perform differential processing and mapping to generate a node feature vector according to the attribute type of node information in the APT knowledge graph. A node embedding generation unit is configured to use the node feature vector as the initial feature of a node in the APT knowledge graph, iteratively sample and aggregate the feature of the node, and generate an embedding vector containing multi-hop context information. A model construction unit is configured to construct an interaction feature vector according to the embedding vector of a node on a to-be-predicted path, construct a relationship type prediction model according to the interaction feature vector using a multi-class Softmax classifier, and perform relationship type prediction according to the interaction feature vector. A loss function definition unit is configured to obtain a training set, calculate dynamic class weights of each relationship type according to the training set, and define a weighted cross-entropy loss function in combination with the dynamic class weights. A model training unit is configured to train the relationship type prediction model using the training set, obtain a trained prediction model when the weighted cross-entropy loss function converges, and use the prediction model to perform explicit triple completion reasoning and implicit path reasoning of the APT knowledge graph according to the interaction feature vector. The calculation of the dynamic class weights of each relationship type according to the training set includes: obtaining the occurrence frequency of each relationship type in the training set; calculating the initial class weights of each relationship type according to the total number of samples in the training set and the occurrence frequency of each relationship type; and performing exponential compression processing on the initial class weights to obtain the dynamic class weights. The weighted cross-entropy loss function, defined by the dynamic class weights, satisfies the following formula: ,in, Denotes the set of edges in the training set. Represents the edges in the training set. Representing an edge The true type of relationship, Representing relation type The corresponding dynamic class weights, This indicates that the prediction result belongs to the relation type. The predicted probability.

7. A computer-readable storage medium having stored thereon a computer program, characterized in that The computer program, when executed by a processor, implements the collaborative modeling method for the APT knowledge graph reasoning task according to any one of claims 1 to 5.

8. An electronic device, comprising: It includes: a processor and a memory; the memory is configured to store a computer program; the processor is configured to execute the computer program stored in the memory, so that the electronic device executes the collaborative modeling method for the APT knowledge graph reasoning task according to any one of claims 1 to 5.

Images