APT (Advanced Persistent Threat) attack detection method, device and equipment based on community discovery traceability graph implicit relationship and medium

Abstract

The invention discloses an APT attack detection method, device and equipment based on a community discovery traceability graph implicit relationship, and a medium, and relates to the technical field of network security, and the method comprises the steps: collecting security data to construct an original traceability graph; dividing nodes in the original traceability graph to form a plurality of communities; based on the community division result, extracting node features for each node, including a connection density index of the node in the community to which the node belongs, a balance index of connection between the node and different communities, and an influence index and a relative importance index of the node in the whole original traceability graph; mapping the node feature and the graph structure corresponding to each node into a low-dimensional vector by using a preset graph embedding learning model, and calculating the similarity between any two node vectors; judging an implicit dependency relationship between the two nodes; and generating an extended traceability graph based on the implicit dependency relationship and the dependency relationship in the original traceability graph, and detecting the APT attack based on the extended traceability graph. The detection comprehensiveness and accuracy are improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an APT attack detection method, apparatus, device, and medium based on implicit relationships in a community discovery and tracing graph. Background Technology

[0002] In cybersecurity, traditional detection methods based on feature matching or threshold alerts are insufficient to effectively combat APT attacks. Against this backdrop, attribution graphs constructed based on system execution entities and their interactions and dependencies are widely used for security incident analysis and APT attack detection.

[0003] However, in actual cybersecurity operations and digital forensics practices, due to insufficient data collection or attackers deliberately concealing some information, the constructed source graphs often suffer from missing implicit dependencies. Moreover, the analysis methods for source graphs in related technologies mainly rely on directly recorded log information for detection, which has a fundamental limitation in that it fails to fully utilize the potential structural relationships in the graph, affecting the comprehensiveness and accuracy of the detection results. Summary of the Invention

[0004] This invention provides an APT attack detection method, apparatus, device, and medium based on implicit relationships in a community discovery source graph, which solves the problem of missing implicit dependencies in the source graph during APT attack detection.

[0005] To achieve the above objectives, this application adopts the following technical solution: Firstly, this paper provides an APT attack detection method based on implicit relationships in a community discovery and tracing graph, including: S1: Collect security data from the system and construct an original traceability map based on the security data; S2: The nodes in the original source graph are divided into multiple communities using a community detection algorithm; wherein, the affiliation degree of nodes within the same community is higher than the affiliation degree of nodes between different communities; S3: Based on the community segmentation results, extract node features for each node to reflect the community behavior patterns under normal conditions and the possible changes under abnormal conditions; the node features include: the connection density index of the node within its own community, the balance index of the node's connections with different communities, and the influence index and relative importance index of the node in the entire original source graph. S4: Using a pre-defined graph embedding learning model, map the node features and graph structure corresponding to each node into a low-dimensional vector, and calculate the similarity between any two node vectors; when the similarity between two nodes exceeds a pre-defined threshold, determine that there is a implicit dependency between the two nodes; and generate a set of implicit relationships. S5: Generate an extended source graph based on the implicit dependencies in the implicit relation set and the dependencies in the original source graph; S6: Detect APT attacks based on the extended source graph.

[0006] Furthermore, the method of using a community detection algorithm to divide the nodes in the original source graph into multiple communities includes: Assign an initial community tag to each node; Candidate communities are determined based on the strength of connections between nodes, and the affiliation degree of each node in each candidate community is calculated. The node is removed from the current community and assigned to the candidate community with the highest affiliation for the first stage of optimization. The communities obtained from the first stage of optimization are compressed into a new super node for the next stage of optimization; this process is repeated iteratively.

[0007] Furthermore, the connection density index of a node within its community is calculated by the strength of the connection between the node and other nodes within the same community; The balance index of the node's connections with different communities is calculated by the distribution of the node's connections in each community. The influence index and relative importance index of the node in the entire original source graph are calculated by the degree centrality and / or eigenvector centrality of the node.

[0008] Furthermore, before proceeding to step S6: detecting APT attacks based on the extended source graph, the following steps are performed: The extended source map is verified and its parameters are optimized using historical security event data and / or simulated attack scenarios. The optimized parameters are then fed back to steps S2 and / or S3 for iteration.

[0009] Secondly, an APT attack detection device based on implicit relationships in a community discovery and tracing graph is provided, including: The original source map construction module is used to collect security data from the system and construct the original source map based on the security data. The community segmentation module is used to segment the nodes in the original source graph using a community detection algorithm to form multiple communities; wherein, the affiliation degree of nodes within the same community is higher than the affiliation degree of nodes between different communities; The node feature extraction module is used to extract node features for each node based on the community segmentation results, which are used to reflect the community behavior patterns under normal conditions and the possible changes under abnormal conditions. The node features include: the connection density index of the node within its own community, the balance index of the node's connections with different communities, and the influence index and relative importance index of the node in the entire original source graph. The implicit relation inference module is used to map the node features and graph structure corresponding to each node into a low-dimensional vector using a preset graph embedding learning model, and calculate the similarity between any two node vectors; when the similarity between two nodes exceeds a preset threshold, it is determined that there is an implicit dependency relationship between the two nodes; and a set of implicit relations is generated. An extended source graph construction module is used to generate an extended source graph based on the implicit dependencies in the implicit relation set and the dependencies in the original source graph; The APT attack detection module is used to detect APT attacks based on the extended source graph.

[0010] Furthermore, the method of using a community detection algorithm to divide the nodes in the original source graph into multiple communities includes: Assign an initial community tag to each node; Candidate communities are determined based on the strength of connections between nodes, and the affiliation degree of each node in each candidate community is calculated. The node is removed from the current community and assigned to the candidate community with the highest affiliation for the first stage of optimization. The communities obtained from the first stage of optimization are compressed into a new super node for the next stage of optimization; this process is repeated iteratively.

[0011] Furthermore, the connection density index of a node within its community is calculated by the strength of the connection between the node and other nodes within the same community; The balance index of the node's connections with different communities is calculated by the distribution of the node's connections in each community. The influence index and relative importance index of the node in the entire original source graph are calculated by the degree centrality and / or eigenvector centrality of the node.

[0012] Furthermore, the device also includes a verification and optimization module, used to perform the following steps before performing the APT attack detection step based on the extended source graph: The extended source map is verified and its parameters are optimized using historical security event data and / or simulated attack scenarios. The optimized parameters are then fed back to the community segmentation module and / or node feature extraction module for iterative processing.

[0013] Thirdly, an electronic device is provided, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the computer program is executed by the processor, it implements the steps of the APT attack detection method based on implicit relationships in a community discovery source graph as described in the first aspect.

[0014] Fourthly, a readable storage medium is provided, on which a program or instructions are stored, which, when executed by a processor, implement the steps of the APT attack detection method based on implicit relationships in a community discovery source graph as described in the first aspect. Attached Figure Description

[0015] Figure 1 A schematic flowchart illustrating an APT attack detection method based on implicit relationships in a community discovery and tracing graph, provided for an embodiment of this application; Figure 2 A schematic diagram of the structure of an APT attack detection device based on implicit relationships in a community discovery and tracing graph, provided in an embodiment of this application; Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0016] To further illustrate the technical means and effects adopted by the present invention to achieve its intended purpose, the technical solutions in the embodiments of this application are clearly described. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art are within the scope of protection of this application.

[0017] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0018] The steps described in the specification and the flowcharts in the accompanying drawings of this invention are not necessarily strictly executed according to the step numbers; the execution order of the method steps can be changed. Furthermore, certain steps can be omitted, multiple steps can be combined into one step, and / or one step can be broken down into multiple steps.

[0019] In actual cybersecurity operations and digital forensics practices, the resulting source maps are often incomplete. This is because: firstly, in terms of data collection, it is usually impossible to record all system activities at all granularities, resulting in some interactions not being logged; secondly, attackers use anti-forensic techniques such as log erasure, timestamp tampering, and behavior masquerading to hide their key attack steps; and thirdly, when data is integrated to construct the source map, there are issues with association failures or mismatches.

[0020] Based on this, this specification provides an APT attack detection method based on implicit relationships in a community-discovered source graph, and also relates to an APT attack detection device based on implicit relationships in a community-discovered source graph, a computer device, and a computer-readable storage medium. The aim is to accurately infer and complete missing implicit dependencies in the source graph, thereby significantly improving the performance and efficiency of security event source analysis such as APT attack detection. The following detailed description, in conjunction with the accompanying drawings and preferred embodiments, is provided for each of these purposes.

[0021] Please see Figure 1 This application provides an APT attack detection method based on implicit relationships in a community discovery source graph, including: Step S1: Collect the system's security data and construct the original traceability map based on the security data.

[0022] In the construction steps of this original source tracing graph, the system refers to the entire target environment requiring security monitoring and event tracing, including computing devices, network devices, and / or storage devices. The security data includes system audit logs, network event data, etc. The original source tracing graph is a directed graph where nodes represent various entities in the system, and edges represent directly detected interactions and / or dependencies between entities. This graph provides foundational data for subsequent analysis by recording communication and dependency behaviors between entities.

[0023] Specifically, key information is extracted from system audit logs and network event data for preprocessing, and an original source graph describing each entity and its interaction dependencies is generated. In this graph, each node corresponds to a security entity, such as a process, file, or network connection, and the edges between nodes represent directly detected dependencies. During the data preprocessing process, the connection status and interaction frequency of each node are statistically analyzed to provide a foundation for subsequent community detection.

[0024] Step S2: The nodes in the original source graph are divided into multiple communities using a community detection algorithm; wherein, the affiliation degree of nodes within the same community is higher than the affiliation degree of nodes between different communities.

[0025] In this community detection step, the algorithm used is an improved Louvaïn algorithm, which introduces the concept of the proportion of nodes belonging to different communities. By iteratively optimizing and adjusting the node affiliation, the interaction density of nodes within the same community is higher than the interaction density of nodes between different communities. This results in a higher interaction density between nodes within the same community and a sparser connection between different communities. As a result, it can not only capture the close local connections in the graph, but also identify potential abnormal associations across communities.

[0026] Furthermore, step S2 above includes: Step S21: Assign an initial community tag to each node.

[0027] Step S22: Determine candidate communities based on the strength of connections between nodes, and calculate the affiliation degree of each node in each candidate community.

[0028] The strength of the connection between nodes is calculated based on the connection status and interaction frequency of each node, and it is achieved during the data preprocessing process.

[0029] Step S23: Remove the node from the current community and assign it to the candidate community with the highest affiliation for the first stage of optimization.

[0030] Step S24: Compress each community obtained from the first stage of optimization into a new super node, and proceed to the next stage of optimization; iterate repeatedly.

[0031] In each iteration, an improved greedy search and iterative optimization strategy was employed. Nodes were reassigned to communities that resulted in denser intra-community interactions and sparser inter-community interactions in the overall graph. Through repeated iterations to adjust the membership ratio of each node in candidate communities, after multiple iterations, the membership degree of each node in each community was determined, achieving the effect of the densest intra-community connections and the sparsest inter-community connections. These membership degrees reflect the situation where a node belongs to multiple communities simultaneously, laying the foundation for subsequent feature extraction.

[0032] Step S3: Based on the community segmentation results, extract node features for each node to reflect the community behavior patterns under normal conditions and the possible changes under abnormal conditions; the node features include: the connection density index of the node within its own community, the balance index of the node's connections with different communities, and the influence index and relative importance index of the node in the entire original source graph.

[0033] In this node feature extraction step, the connection density of a node within its community is the strength of the connection between the node and other nodes within the same community, which is calculated by the strength of the connection between the node and other nodes within the same community. The balance of connections between a node and different communities is to examine whether its connections are mainly concentrated in a certain community or evenly distributed in multiple communities. This is calculated by the distribution of the node's connections in various communities. The influence and relative importance of a node in the entire original source graph, such as the number of its direct connections and the degree of closeness with neighboring nodes, can be calculated by the degree centrality and / or eigenvector centrality of the node.

[0034] These indicators constitute the feature vector of a node, which can reflect the community behavior pattern under normal conditions and the possible changes under abnormal conditions, providing a basis for inferring implicit relationships.

[0035] Step S4: Using a pre-defined graph embedding learning model, map the node features and graph structure corresponding to each node into a low-dimensional vector, and calculate the similarity between any two node vectors; when the similarity between two nodes exceeds a pre-defined threshold, determine that there is a hidden dependency between the two nodes; and generate a set of hidden relationships.

[0036] This step utilizes graph embedding learning to convert high-dimensional source graph nodes into low-dimensional vector representations. By comparing these vectors, the similarity between any two nodes is evaluated (e.g., using inner product or cosine similarity as a metric). When the vector similarity between two nodes reaches or exceeds a preset threshold, it indicates that although these two nodes are not directly connected in the original graph, their behavioral characteristics and interaction patterns are highly similar. Therefore, an implicit dependency relationship is inferred between them, and all node pairs that meet the criteria are organized into a set of implicit relationships.

[0037] Step S5: Generate an extended source graph based on the implicit dependencies in the implicit relation set and the dependencies in the original source graph.

[0038] This step merges the implicit dependencies obtained from implicit relationship mining with the existing direct dependencies in the original source graph to generate an expanded source graph. This expanded source graph not only reflects the direct interactions recorded in the system but also fills in potential connections that were not recorded due to missing data or the covert nature of security attacks.

[0039] By expanding and updating the source graph, an extended source graph is formed, which enhances the graph's expressive power and provides more complete and dynamic information support for subsequent attack chain analysis and forensics.

[0040] In some possible implementations, the method further includes: Step S51: For the extended source map, use historical security event data and / or simulated attack scenarios to verify and optimize the parameters of the extended source map, and feed back the optimized parameters to step S2 and / or step S3 for iteration.

[0041] By utilizing historical security incidents or simulated APT attack data, the accuracy and coverage of the extended graph are evaluated. Based on the verification results, the parameters and strategies used in community detection and implicit relationship mining are adjusted and iteratively optimized to continuously improve the quality of graph updates and detection performance.

[0042] Step S6: Detect APT attacks based on the extended source graph.

[0043] Based on the extended source map, attack path analysis and / or abnormal pattern matching can be performed to detect APT attacks.

[0044] Based on the above scheme, this application can effectively uncover hidden dependencies in the source graph and complete the missing information in the graph, thereby improving the overall analysis and detection capabilities for security events such as APT attacks. This method can effectively capture changes in the community behavior of nodes within different time windows, sensitively reflecting abnormal behavior at each stage of the entire APT attack lifecycle, thus enabling real-time monitoring and source tracing of complex attack scenarios.

[0045] See Figure 2 Corresponding to the above-described APT attack detection method based on implicit relationships in a community-based source graph, this application provides an APT attack detection device based on implicit relationships in a community-based source graph, comprising: The original source map construction module 1001 is used to collect the system's security data and construct the original source map based on the security data. The community segmentation module 1002 is used to segment the nodes in the original source graph using a community detection algorithm to form multiple communities; wherein, the affiliation degree of a node within the same community is higher than the affiliation degree of a node between different communities. The node feature extraction module 1003 is used to extract node features for each node based on the community segmentation results, which are used to reflect the community behavior pattern under normal conditions and the possible changes under abnormal conditions. The node features include: the connection density index of the node within its own community, the balance index of the connection between the node and different communities, and the influence index and relative importance index of the node in the entire original source graph. The implicit relation inference module 1004 is used to map the node features and graph structure corresponding to each node into a low-dimensional vector using a preset graph embedding learning model, and to calculate the similarity between any two node vectors; when the similarity between two nodes exceeds a preset threshold, it is determined that there is an implicit dependency relationship between the two nodes; and a set of implicit relations is generated. The extended source graph construction module 1005 is used to generate an extended source graph based on the implicit dependencies in the implicit relation set and the dependencies in the original source graph; The APT attack detection module 1006 is used to detect APT attacks based on the extended source graph.

[0046] Furthermore, the method of using a community detection algorithm to divide the nodes in the original source graph into multiple communities includes: Assign an initial community tag to each node.

[0047] Candidate communities are determined based on the strength of connections between nodes, and the affiliation degree of each node in each candidate community is calculated.

[0048] The node is removed from the current community and assigned to the candidate community with the highest affiliation for the first stage of optimization.

[0049] The communities obtained from the first stage of optimization are compressed into a new super node for the next stage of optimization; this process is repeated iteratively.

[0050] Furthermore, the connection density index of a node within its community is calculated by the strength of the connection between the node and other nodes within the same community; The balance index of the node's connections with different communities is calculated by the distribution of the node's connections in each community. The influence index and relative importance index of the node in the entire original source graph are calculated by the degree centrality and / or eigenvector centrality of the node.

[0051] Furthermore, the device also includes a verification and optimization module, used to perform the following steps before performing the APT attack detection step based on the extended source graph: The extended source map is verified and its parameters are optimized using historical security event data and / or simulated attack scenarios. The optimized parameters are then fed back to the community segmentation module 1002 and / or the node feature extraction module 1003 for iterative processing.

[0052] The APT attack detection device based on the implicit relationship of the community discovery tracing graph described above implements the steps and processes of the above-described APT attack detection method based on the implicit relationship of the community discovery tracing graph, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0053] See Figure 3Corresponding to the above-described embodiment of the APT attack detection method based on implicit relationships in a community-based source graph, this application provides an electronic device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the steps and processes of the above-described embodiment of the APT attack detection method based on implicit relationships in a community-based source graph, and achieves the same technical effect. To avoid repetition, these will not be repeated here.

[0054] The memory 1009 can be used to store software programs and various data. The memory 1009 may primarily include a first storage area for storing programs or instructions and a second storage area for storing data. The first storage area may store the operating system, application programs or instructions required for at least one function (such as sound playback function, image playback function, etc.). Furthermore, the memory 1009 may include volatile memory or non-volatile memory, or both. The non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct memory bus RAM (DRRAM). The memory 1009 in the embodiments of this application includes, but is not limited to, these and any other suitable types of memory.

[0055] The processor 1010 may include one or more processing units; optionally, the processor 1010 integrates an application processor and a modem processor, wherein the application processor mainly handles operations involving the operating system, user interface, and applications, and the modem processor mainly handles wireless communication signals, such as a baseband processor. It is understood that the aforementioned modem processor may also not be integrated into the processor 1010.

[0056] Corresponding to the above-described embodiment of the APT attack detection method based on implicit relationships in a community discovery source graph, this application embodiment also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the steps and processes of the above-described embodiment of the APT attack detection method based on implicit relationships in a community discovery source graph, and achieve the same technical effect. To avoid repetition, these will not be described again here.

[0057] The processor is the processor in the electronic device described in the above embodiments of this application. The readable storage medium includes a computer-readable storage medium, such as a computer read-only memory (ROM), random access memory (RAM), a magnetic disk, or an optical disk.

[0058] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0059] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a computer software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0060] It is understood that the embodiments of this application have been described above in conjunction with the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. As those skilled in the art will know, various changes or equivalent substitutions can be made to these features and embodiments without departing from the spirit and scope of the invention. Furthermore, those skilled in the art, under the guidance or instruction of this application, can modify these features and embodiments to adapt to specific situations and materials without departing from the spirit and scope of the invention. Therefore, this invention is not limited to the specific embodiments disclosed herein, and all embodiments falling within the scope of the claims of this application are within the protection scope of this invention.

Claims

1. An APT attack detection method based on community discovery traceability graph implicit relationship, characterized in that, Comprising: S1: collecting security data of a system, and constructing an original traceability graph based on the security data; S2: dividing nodes in the original traceability graph into multiple communities using a community detection algorithm, wherein the belonging degree of nodes in the same community is higher than the belonging degree of nodes between different communities; S3: based on the community division result, extracting node features for each node to reflect the community behavior pattern in the normal state and the possible changes in the abnormal state, wherein the node features include: connection density index of the node in its own community, balance index of the node connection between different communities, and influence index and relative importance index of the node in the entire original traceability graph; S4: using a preset graph embedding learning model to map the node features and graph structure corresponding to each node into a low-dimensional vector, and calculating the similarity between any two node vectors; when the similarity of two nodes exceeds a preset threshold, it is determined that there is an implicit dependency relationship between the two nodes; and an implicit relationship set is generated; S5: generating an extended traceability graph based on the implicit dependency relationship in the implicit relationship set and the dependency relationship in the original traceability graph; S6: detecting APT attacks based on the extended traceability graph.

2. The APT attack detection method based on community discovery traceability graph implicit relationship according to claim 1, wherein the community detection algorithm is used to divide the nodes in the original traceability graph into multiple communities, comprising: assigning an initial community label to each node; determining candidate communities according to the strength of the connection between nodes, and calculating the belonging degree of each node in each candidate community; moving the node out of the current community and assigning it to the candidate community with the highest belonging degree for first-stage optimization; compressing each community obtained by the first-stage optimization into a new super node for next-stage optimization; and repeating the iteration.

3. The APT attack detection method based on community discovery traceability graph implicit relationship according to claim 1, wherein the connection density index of the node in its own community is calculated by the strength of the connection between the node and other nodes in the same community; the balance index of the node connection between different communities is calculated by the distribution of the node connection in each community; the influence index and relative importance index of the node in the entire original traceability graph are calculated by the degree centrality and / or eigenvector centrality of the node.

4. The APT attack detection method based on community discovery traceability graph implicit relationship according to claim 1, wherein before step S6: detecting APT attacks based on the extended traceability graph, the following steps are performed: using historical security event data and / or simulated attack scenarios to verify and optimize the parameters of the extended traceability graph, and feeding back the optimized parameters to steps S2 and / or S3 for iteration. Comprising: an original traceability graph construction module, configured to collect security data of a system, and construct an original traceability graph based on the security data; ​ 5. An APT attack detection device based on community discovery traceability graph implicit relationship, characterized in that, ​ ​ a community division module, configured to divide nodes in the original traceability graph into a plurality of communities by using a community detection algorithm, wherein a node in a same community has a higher belonging degree than a node between different communities; a node feature extraction module, configured to extract node features of each node based on a community division result, to reflect a community behavior pattern in a normal state and a possible change in an abnormal state, wherein the node features include a connection density index of the node in a community to which the node belongs, a balance index of a connection between the node and different communities, and an influence index and a relative importance index of the node in the original traceability graph as a whole; an implied relationship inference module, configured to map the node features and a graph structure corresponding to each node into a low-dimensional vector by using a preset graph embedding learning model, and to calculate a similarity between any two node vectors, and determine that there is an implied dependency relationship between the two nodes when the similarity between the two nodes exceeds a preset threshold, and generate an implied relationship set; an extended traceability graph construction module, configured to generate an extended traceability graph based on implied dependency relationships in the implied relationship set and dependency relationships in the original traceability graph; an APT attack detection module, configured to detect an APT attack based on the extended traceability graph.

6. The APT attack detection device based on community discovery traceability graph implied relationship according to claim 1, wherein the division of nodes in the original traceability graph into a plurality of communities by using a community detection algorithm comprises: assigning an initial community label to each node; determining candidate communities according to the strength of the connection between nodes, and calculating the belonging degree of each node in each candidate community; moving a node out of a current community and assigning it to a candidate community with the highest belonging degree for first-stage optimization; compressing each community obtained by the first-stage optimization into a new supernode for next-stage optimization; and repeating the iteration.

7. The APT attack detection device based on community discovery traceability graph implied relationship according to claim 1, wherein the connection density index of the node in the community to which the node belongs is calculated by the strength of the connection between the node and other nodes in the same community; the balance index of the connection between the node and different communities is calculated by the distribution of the connection of the node in each community; the influence index and the relative importance index of the node in the original traceability graph as a whole are calculated by the degree centrality and / or eigenvector centrality of the node.

8. The APT attack detection device based on community discovery traceability graph implied relationship according to claim 1, wherein the device further comprises a verification and optimization module, configured to perform the following steps before the step of detecting an APT attack based on the extended traceability graph: verify and optimize the extended traceability graph by using historical security event data and / or a simulated attack scenario, and feed back the optimized parameters to the community division module and / or the node feature extraction module for iteration.

9. An electronic device, comprising: The electronic device comprises a memory, a processor, and a computer program stored on the memory and executable on the processor, and the computer program, when executed by the processor, implements the steps of the APT attack detection method based on community discovery and implicit relationship of a traceability graph according to any one of claims 1 to 4.

10. A readable storage medium, characterized by, The readable storage medium stores a program or instructions, and the program or instructions, when executed by a processor, implement the steps of the APT attack detection method based on community discovery and implicit relationship of a traceability graph according to any one of claims 1 to 4.

Images