An APT attack path tracing method and device based on a tracing graph

Abstract

The application discloses an APT attack path tracing method and device based on a tracing graph, and belongs to the technical field of computer network security. The method comprises the following steps: constructing a tracing graph G of a network to be analyzed; encoding semantic information of an interaction event into a vector, and encoding the vector into attributes of two end nodes in chronological order to obtain semantic features x of the nodes i ; calculating a closeness matrix of the tracing graph G, and constructing a correlation subgraph of each node according to the closeness matrix; on the basis of the semantic features x i , the correlation subgraph is combined to generate a deep representation z i of the node; and based on the semantic features x i and the deep representation z i , an abnormal node and an abnormal edge in the tracing graph G are obtained. The application can accurately reconstruct an attack path, and provides accurate tracing basis for security analysts.

Description

Technical Field

[0001] This invention relates to the field of computer network security technology, specifically to a method and apparatus for tracing APT attack paths based on a source graph. Background Technology

[0002] In the field of cybersecurity, attribution analysis is a core technology for dealing with complex attacks such as Advanced Persistent Threats (APTs) and ransomware. By tracing attack paths, locating attack sources, and reconstructing attack chains, it provides crucial evidence for incident response and vulnerability remediation. Attribution graphs, as the core carrier of attribution analysis, are a structured abstraction and visual representation of various entities and their interactions in the network environment. They abstract entities (such as processes, files, and network endpoints) as nodes and interactions between entities (such as process communication, file read / write, and data transfer) as edges, visually presenting the propagation path and dependencies of attack behaviors through a graph structure.

[0003] As network scale expands, source logs exhibit characteristics of massive volume, high dimensionality, and complex structure, making it difficult for traditional rule-based or statistical methods to efficiently process such data. In recent years, graph neural network (GNN)-based methods have shown advantages in graph structure data modeling and have become a research hotspot in source tracing analysis. However, existing graph neural network methods face two major technical bottlenecks when applied to large-scale source tracing graphs: (1) Inherent locality constraints. Such methods, such as typical graph convolutional networks (GCN), graph sampling and aggregation networks (GraphSAGE), and graph attention networks (GAT), essentially follow a message passing paradigm in their information aggregation mechanism. Under this paradigm, the update of node features depends only on the information of its first-order or finite-order neighbor nodes. This means that information propagation is strictly limited to the explicit edge structure of the graph. Even by stacking multiple layers of networks to expand the receptive field, it is difficult to effectively capture long-distance dependencies between nodes in the graph, especially failing to identify key entities that are physically distant but logically closely related in the attack chain. (2) High computational complexity and scalability issues. To overcome locality of reference, some advanced models attempt to introduce global self-attention mechanisms. However, in source graphs with tens of thousands of nodes, such operations incur computational and memory overhead that is quadratic with the number of nodes. This severely limits the model's scalability, making it difficult to perform efficient training and inference in real-world production environments with massive numbers of nodes.

[0004] Therefore, in attack attribution, there is an urgent need for a technical solution that can effectively capture global dependencies, significantly reduce the computational complexity of the model when dealing with large-scale attribution graphs, and automatically reconstruct attack paths, so as to improve the efficiency and accuracy of network attack detection and attribution. Summary of the Invention

[0005] To address the aforementioned issues, this invention proposes an APT attack path tracing method and apparatus based on a source map, which can accurately reconstruct the attack path and provide security analysts with precise tracing evidence.

[0006] To achieve the above objectives, the specific technical solutions adopted by the present invention include the following:

[0007] A source tracing method for APT attack paths based on a source graph, the method comprising:

[0008] Construct the source graph G = (V, E) of the network to be analyzed, where nodes V represent entities and edges E represent interaction events;

[0009] The semantic information of the interaction event is encoded into a vector, and then encoded into the attributes of the two endpoints in chronological order to obtain the semantic feature x of the node. i ;

[0010] Calculate the affinity matrix of the source graph G, and construct the correlation subgraph for each node based on the affinity matrix;

[0011] In semantic feature x i Based on this, the depth representation z of the node is generated by combining the correlation subgraph. i ;

[0012] Based on semantic features x i and depth representation z i Obtain the abnormal nodes and abnormal edges in the source graph G;

[0013] Connecting abnormal nodes and abnormal edges to reconstruct the attack path.

[0014] Furthermore, the source graph G of the network to be analyzed is constructed, including:

[0015] Collect network logs from various entities and devices in the network to be analyzed;

[0016] The network logs are standardized; the standardization process includes: unifying the log format, extracting key information, time synchronization, and removing redundant and invalid data.

[0017] Parse the standardized system logs to construct a source graph G = (V, E).

[0018] Furthermore, the entities include: processes, network objects, files, users, and devices, and the interaction events include: read operations, write operations, send operations, receive operations, create operations, delete operations, and execute operations.

[0019] Further, the affinity matrix of the source graph G is calculated, and a correlation subgraph for each node is constructed based on this affinity matrix, including:

[0020] Calculate the affinity matrix of the source graph Among them, the elements S in the intimacy matrix S i,j Represents node v i and node v j Intimacy score between them, item Let A be the adjacency matrix of the source graph G, and D be a diagonal matrix, where the elements on the diagonal are D(i,i) = ∑ j A(i,j) represents node v i The degree of the value, the parameter α, ranges from 0 to 1;

[0021] For each node, extract k highly intimate related nodes based on the intimacy score, and use the unconnected subgraph formed by the node and the k highly intimate related nodes as the relevance subgraph of the node.

[0022] Furthermore, in semantic feature x i Based on this, the depth representation z of the node is generated by combining the correlation subgraph. i ,include:

[0023] For node v i Correlation subplot g i Extract each node b j semantic features x j And based on this node in the correlation subgraph g i The relative position in the data is used to generate the node v. j Position embedding e j ; where v j ∈g i ;

[0024] semantic feature x j and position embedding e j Add them together to get the node v. j initial representation

[0025] Merge the initial representations Obtain the initialization sequence H (0) ;

[0026] The initialization sequence H (0) The input is fed into the graph Transformer encoder of layer D, and the output of the graph Transformer encoder is pooled to obtain node v. i Depth representation z i .

[0027] Furthermore, based on semantic features x i and depth representation z iObtain the abnormal nodes in the source graph G, including:

[0028] Depth representation z is obtained using a multilayer perceptron. i After the reconstruction representation, based on the semantic feature x i And the depth representation z i The reconstruction represents the computation node v i Reconstruction error;

[0029] Based on depth representation z i To calculate the feature score predicted by the node, and use this feature score as the node v i The uncertainty of classification;

[0030] Calculate the weighted sum of reconstruction error and classification uncertainty to obtain node v. i Abnormal scores;

[0031] According to the node v i The abnormal score is used to determine the node v i Is it an abnormal node?

[0032] Furthermore, the process of obtaining the abnormal edge includes:

[0033] Get edge e ij edge attribute E ij The edge attribute E ij Representative node v i With node v j The intensity of interaction between them;

[0034] node v i Depth representation z i With node v j Depth representation z j After splicing, the data is fed into a multilayer perceptron to obtain edge attributes based on node feature prediction.

[0035] Based on this edge attribute E ij And based on the edge attributes predicted from node features, we obtain edge e. ij Abnormal scores;

[0036] According to the edge e ij The abnormal score determination of edge e ij Is it an abnormal edge?

[0037] Furthermore, the total loss function for training the multilayer perceptron... in, Represents the node feature reconstruction loss. Represents the edge attribute reconstruction loss. Let ω1 represent the node classification loss, and ω2 represent the first weight coefficient and the second weight coefficient.

[0038] Furthermore, abnormal nodes and abnormal edges are connected to reconstruct the attack path, including:

[0039] Construct a complete graph G containing all end nodes. m The set T of terminal nodes contains all abnormal nodes, and the edge weight between any two terminal nodes is set to the shortest path distance between the corresponding nodes in the source graph G.

[0040] In the complete graph G m Run the standard MST algorithm to find the minimum spanning tree T connecting all terminal nodes. m ; where the minimum spanning tree T m Each edge in the graph corresponds to a shortest path in the source graph G. The standard MST algorithm includes either Prim's algorithm or Kruskal's algorithm.

[0041] The minimum spanning tree T m All edges in the tracing graph G are replaced with the corresponding actual paths in the source graph G. All nodes and edges in the actual paths are merged, and redundant cycles are removed to obtain the reconstructed attack path.

[0042] An APT attack path tracing device based on a source graph, the device comprising:

[0043] The source graph construction module is used to construct the source graph G=(V,E) of the network to be analyzed, where nodes V represent entities and edges E represent interaction events;

[0044] The semantic embedding module encodes the semantic information of interaction events into vectors and then encodes them into the attributes of the two endpoints in chronological order to obtain the semantic features x of the nodes. i ;

[0045] The correlation subgraph construction module is used to calculate the affinity matrix of the source graph G and construct the correlation subgraph for each node based on the affinity matrix.

[0046] The node depth representation generation module is used to generate semantic features x. i Based on this, the depth representation z of the node is generated by combining the correlation subgraph. i ;

[0047] Anomaly detection module, used for identifying semantic features x i and depth representation z i Obtain the abnormal nodes and abnormal edges in the source graph G;

[0048] The attack path reconstruction module is used to connect abnormal nodes and abnormal edges to reconstruct the attack path.

[0049] Compared with the prior art, the present invention has the following beneficial effects.

[0050] 1) This invention constructs unconnected subgraphs of nodes through proximity sampling, which breaks through the locality limitation of existing GNN methods and can capture relationships between nodes that are not necessarily directly connected, thus improving the ability to identify complex attack paths.

[0051] 2) This invention leverages the powerful context capture capabilities of the graph Transformer, integrates node semantic features and position embeddings, and through multi-task learning (node ​​feature reconstruction, edge attribute reconstruction, and node classification), enables the model to learn more comprehensive and general graph intrinsic rules. This not only significantly improves the accuracy of identifying abnormal nodes and edges, but also has higher sensitivity to subtle semantic deviations or abnormal interaction patterns carefully disguised by attackers. Furthermore, thanks to the transferability provided by the self-supervised task, it can be quickly adapted to heterogeneous graph data such as different system logs through fine-tuning, significantly enhancing the model's practicality in complex and ever-changing network environments.

[0052] 3) This invention employs the Steiner tree approximation algorithm, which significantly improves the efficiency of finding attack paths in large-scale source graph scenarios, effectively filters massive amounts of irrelevant logs, provides security auditors with a clear attack causal chain, greatly reduces the cost of manual analysis, and significantly improves the efficiency of network attack event response and forensic analysis, providing more intelligent and efficient technical support for network security protection. Attached Figure Description

[0053] Figure 1 This is the overall flowchart of this method.

[0054] Figure 2 This is a flowchart representing the depth of a compute node.

[0055] Figure 3 This is a flowchart of reconstructing the attack path using the Steiner tree approximation algorithm. Detailed Implementation

[0056] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, and to make the objectives, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0057] The source tracing method for APT attack paths based on source graphs of the present invention, such as Figure 1 As shown, it includes steps 100 to 600.

[0058] Step 100: Constructing the source graph.

[0059] Network logs are collected from various entities and related devices in the network environment to be analyzed. Standardized system logs are obtained by standardizing the logs, including unifying the log format, extracting key information, synchronizing time, and removing redundant and invalid data. A source graph G = (V, E) is constructed by parsing the standardized system logs, where nodes V represent entities, and edges E represent interaction events between entities. Entities include processes, network objects, files, users, and devices. Interaction events include read operations, write operations, send operations, receive operations, create operations, delete operations, and execute operations.

[0060] Step 200: Semantic embedding.

[0061] This invention utilizes Word2Vec to aggregate semantic information from an event into the entities at both ends of the event in chronological order, thereby obtaining the semantic features x of the node. i The number of edges between nodes is reduced to only one edge without a phase, and the edge attributes are statistical features of the interaction strength between nodes.

[0062] Step 300: Construct a correlation subgraph.

[0063] This invention employs a proximity sampling mechanism inspired by PageRank and Katz centrality to calculate the proximity matrix S∈R for the entire graph. |V|×|V| For each node in the graph, k highly intimate related nodes are extracted and a correlation subgraph is constructed by sorting them by intimacy.

[0064] Specifically, the process of constructing the correlation subgraph in this invention includes:

[0065] 1) Calculate the affinity matrix of the source map. Each element S i,j Represents node v i and node v j The intimacy score between them. Let A be the column-normalized adjacency matrix, where A is the original adjacency matrix, D is the diagonal matrix, and D(I,i) = ∑ j A(i,j) represents node v i The degree. α is a parameter of the PageRank method, ranging from 0 to 1;

[0066] 2) For each node, extract k related nodes with high intimacy by sorting them by intimacy.

[0067] 3) The unconnected subgraph formed by the node itself and the extracted k nodes is used as the correlation subgraph of the node.

[0068] Step 400: Learn the node depth representation.

[0069] This invention trains a D-layer graph Transformer encoder using a multi-task learning framework, whose total loss function is... Defined as Using the above graph Transformer encoder to fuse the subgraph center node v i Based on the semantic and positional features, the depth representation z of the node is obtained. i .

[0070] Specifically, the process of learning the depth representation of nodes in this invention is as follows: Figure 2 As shown, it includes:

[0071] Step 410: For node v i The subgraph g centered on i Extract each node v j ∈g i The semantic features are used to generate position embeddings based on the relative positions of nodes in the subgraph;

[0072] Step 420: Obtain the initial representation of the node by directly adding the semantic features and the positional embedding. Merging subgraphs g i The initial representation of each node yields the initialized sequence H. (0) ;

[0073] Step 430: Initialize the sequence H (0) The input is a D-layer graph Transformer encoder. Each layer updates the node representation through self-attention and graph residual connections (G-Res), progressively optimizing the feature representation.

[0074] Step 440: Perform a pooling operation on the node representations output by the final layer of the encoder to obtain node v. i Depth representation z i .

[0075] Step 500: Identify abnormal nodes and abnormal edges.

[0076] This invention will node v i abnormal scores Among them, reconstruction error The node feature reconstruction loss derived from the multi-task learning framework, and the classification uncertainty. Calculate the prediction confidence of nodes based on the model.

[0077] Among them, reconstruction error This is derived from the node feature reconstruction loss in a multi-task learning framework. For anomalous nodes, their features often deviate from the normal patterns learned by the model on benign data, thus leading to a significant increase in reconstruction error. In node classification tasks, the model's prediction confidence for a sample reflects its classification judgment; the prediction of node type can be expressed as Softmax(MLP2(z...). i Classification uncertainty is calculated based on the model's prediction confidence for nodes, where confidence is the entropy of the predicted probability vector, representing the model's certainty in predicting. Low-confidence predictions or direct misclassifications indicate that the node possesses ambiguous or anomalous features that the model struggles to understand. A hybrid anomaly detection strategy is employed, utilizing deep features obtained from a transformer and connecting downstream tasks through two MLP layers to perform multiple anomaly detections. The anomaly scores of the reconstructed features and the feature scores of the node predictions are calculated in parallel. Finally, the node anomaly score is compared with a preset threshold τ. node Compare and determine whether the node is abnormal.

[0078] This invention will use the edge (v) i ,v j abnormal scores It is directly defined as its reconstruction error, i.e., the outlier score of the edges. Where E ij As an edge attribute, it represents the statistical characteristics of the interaction between nodes i and j, indicating the strength of the interaction between them. A high... The score indicates that the interaction deviates from the baseline of normal behavior learned by the model. Finally, the edge anomaly score is compared with a preset threshold τ. edge Compare and determine if the edges are abnormal.

[0079] Among them, the total loss function of the multi-task learning framework for training the model Among them, node feature reconstruction loss Use mean squared error loss to ensure z i Preserves original semantic information; edge attribute reconstruction loss By utilizing the depth representation of node pairs (z) through MLP i ,z j Predict edge attributes E ij The graph topology is encoded into the node representation, where (z i ,z j The edge consists of the depth representations of the two nodes connected by the edge; node classification loss. The standard cross-entropy loss is used to complete the final abnormal node identification task, with ω1 and ω2 being the weight coefficients.

[0080] Step 600: Reconstruct the attack path.

[0081] After identifying a series of discrete anomalous nodes and edges in step 500, the ultimate goal of this scheme is to connect these "points" and "lines" to reconstruct a complete attack path in a narrative manner. A typical attack activity, such as an Advanced Persistent Threat (APT), often manifests on the source graph as a series of key malicious operations (anomalous nodes), which are linked together by a series of system calls (edges). However, to conceal themselves, attackers may use a large number of normal system processes (benign nodes) as stepping stones. Therefore, a complete attack path must contain all identified anomalous nodes, as well as the intermediate benign nodes necessary to connect them. This task can be formally modeled as a classic combinatorial optimization problem—the Steiner Tree problem. Given the original source graph G = (V, E), and a set of "terminal" nodes consisting of all nodes judged as anomalous. The objective of this invention is to find a subgraph G′ = (V′, E′) that satisfies the following conditions: G′ is a tree. G′ connects all terminal nodes, i.e. Furthermore, G′ has the lowest total cost. However, since finding the exact Steiner tree in the graph is an NP-hard problem, it is infeasible for large-scale source graphs. Therefore, an efficient approximation algorithm is adopted.

[0082] In one embodiment, such as Figure 3 The process of reconstructing the attack path using the Steiner tree approximation algorithm includes:

[0083] Step 610: Construct a complete graph G containing all end nodes. m The set T of terminal nodes contains all abnormal nodes, and the edge weight between any two terminal nodes is set to the shortest path distance between the corresponding nodes in the source graph G.

[0084] Step 620: In the complete graph G m Run the standard MST algorithm to find the minimum spanning tree T connecting all terminal nodes. m ; where the minimum spanning tree T m Each edge in the graph corresponds to a shortest path in the source graph G. The standard MST algorithm includes either Prim's algorithm or Kruskal's algorithm.

[0085] Step 630: Convert the minimum spanning tree T m All edges in the tracing graph G are replaced with the corresponding actual paths in the source graph G. All nodes and edges in the actual paths are merged, and redundant cycles are removed to obtain the reconstructed attack path.

[0086] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail using examples, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A source tracing method for APT attack paths based on source graphs, characterized in that, The method includes: Constructing the source graph of the network to be analyzed ,node Represents entities, edges Indicates interactive events; The semantic information of the interaction event is encoded into a vector, and then encoded into the attributes of the two endpoints in chronological order to obtain the semantic features of the node. ; Computational source graph The affinity matrix is ​​obtained, and a correlation subgraph for each node is constructed based on the affinity matrix. In semantic features Based on this, a depth representation of the node is generated by combining the correlation subgraph. ; Based on semantic features and depth representation Obtain the source map Abnormal nodes and abnormal edges in the data; Connecting abnormal nodes and abnormal edges to reconstruct the attack path; Among them, in semantic features Based on this, a depth representation of the node is generated by combining the correlation subgraph. ,include: For nodes Correlation subplot Extract each node semantic features And based on this node in the correlation subgraph The relative position in the text is used to generate the node. Position embedding ;in, ; semantic features and position embedding Add them together to get the node. initial representation ; Merge the initial representations , obtain the initialization sequence ; This initialization sequence Enter to A graph Transformer encoder for each layer is used, and its output is pooled to obtain the nodes. Depth representation ; Among them, the computational source graph The affinity matrix is ​​used to construct a correlation subgraph for each node, including: Calculate the affinity matrix of the source graph The intimacy matrix medium elements Represents a node and nodes Intimacy score between them, item This represents the column-normalized adjacency matrix. For tracing the source map The adjacency matrix, For a diagonal matrix, the elements on the diagonal are... Represents a node The degree, parameter The value range is from 0 to 1; For each node, extract based on intimacy score. A number of highly intimate related nodes will be identified, and the relationship between these nodes and... An unconnected subgraph consisting of highly related nodes is used as the related subgraph for that node. Among them, based on semantic features and depth representation Obtain the source map The abnormal nodes include: Depth representation is obtained using a multilayer perceptron. After the reconstruction representation, based on semantic features and the depth representation The reconstruction represents the computing node Reconstruction error; Based on depth representation To calculate the feature score predicted for a node, and use this feature score as the node's prediction score. The uncertainty of classification; Calculate the weighted sum of reconstruction error and classification uncertainty to obtain the node. Abnormal scores; According to this node The abnormal score determines the node Is it an abnormal node? The process of obtaining the abnormal edge includes: Get edges edge attributes The edge attribute Representative node With nodes The intensity of interaction between them; Node Depth representation With nodes Depth representation After splicing, the data is fed into a multilayer perceptron to obtain edge attributes based on node feature prediction. Based on this edge attribute And based on the edge attributes predicted from node features, we obtain the edge Abnormal scores; According to this side The abnormal score determination of this edge Is it an abnormal edge? Among them, connecting abnormal nodes and abnormal edges to reconstruct the attack path includes: Construct a complete graph containing all endpoints. The set of terminal nodes Includes all anomalous nodes, and the edge weight between any two terminal nodes is set to the value in the source graph. The shortest path distance to the corresponding node in the equation; In the complete map Run the standard MST algorithm to find the minimum spanning tree connecting all terminal nodes. ; where the minimum spanning tree Each edge in the graph corresponds to a source graph. The shortest path in the algorithm, the standard MST algorithm includes: Prim's algorithm or Kruskal's algorithm; Minimum Spanning Tree Replace all edges in the source graph The corresponding actual path is obtained by merging all nodes and edges in the actual path and removing redundant cycles to obtain the reconstructed attack path.

2. The method according to claim 1, characterized in that, Constructing the source graph of the network to be analyzed ,include: Collect network logs from various entities and devices in the network to be analyzed; The network logs are standardized; the standardization process includes: unifying the log format, extracting key information, time synchronization, and removing redundant and invalid data. Analyze standardized system logs to construct a source graph. .

3. The method according to claim 1, characterized in that, The entities include: processes, network objects, files, users, and devices, and the interaction events include: read operations, write operations, send operations, receive operations, create operations, delete operations, and execute operations.

4. The method according to claim 1, characterized in that, The total loss function for training the multilayer perceptron ,in, Represents the node feature reconstruction loss. Represents the edge attribute reconstruction loss. Represents the node classification loss. This represents the first weighting coefficient. This represents the second weighting coefficient.

5. An APT attack path tracing device based on a source graph, characterized in that, The device includes: The source graph construction module is used to construct the source graph of the network to be analyzed. ,node Represents entities, edges Indicates interactive events; The semantic embedding module encodes the semantic information of interaction events into vectors and then encodes them into the attributes of the two endpoints in chronological order to obtain the semantic features of the nodes. ; The correlation subgraph construction module is used to calculate the source graph. The affinity matrix is ​​obtained, and a correlation subgraph for each node is constructed based on the affinity matrix. The node depth representation generation module is used for semantic feature generation. Based on this, a depth representation of the node is generated by combining the correlation subgraph. ; Anomaly detection module, used for semantic feature-based detection and depth representation Obtain the source map Abnormal nodes and abnormal edges in the data; The attack path reconstruction module is used to connect abnormal nodes and abnormal edges to reconstruct the attack path; Among them, in semantic features Based on this, a depth representation of the node is generated by combining the correlation subgraph. ,include: For nodes Correlation subplot Extract each node semantic features And based on this node in the correlation subgraph The relative position in the text is used to generate the node. Position embedding ;in, ; semantic features and position embedding Add them together to get the node. initial representation ; Merge the initial representations , obtain the initialization sequence ; This initialization sequence Enter to A graph Transformer encoder for each layer is used, and its output is pooled to obtain the nodes. Depth representation ; Among them, the computational source graph The affinity matrix is ​​used to construct a correlation subgraph for each node, including: Calculate the affinity matrix of the source graph The intimacy matrix medium elements Represents a node and nodes Intimacy score between them, item This represents the column-normalized adjacency matrix. For tracing the source map The adjacency matrix, For a diagonal matrix, the elements on the diagonal are... Represents a node The degree, parameter The value range is from 0 to 1; For each node, extract based on intimacy score. A number of highly intimate related nodes will be identified, and the relationship between these nodes and... An unconnected subgraph consisting of highly related nodes is used as the related subgraph for that node. Among them, based on semantic features and depth representation Obtain the source map The abnormal nodes include: Depth representation is obtained using a multilayer perceptron. After the reconstruction representation, based on semantic features and the depth representation The reconstruction represents the computing node Reconstruction error; Based on depth representation To calculate the feature score predicted for a node, and use this feature score as the node's prediction score. The uncertainty of classification; Calculate the weighted sum of reconstruction error and classification uncertainty to obtain the node. Abnormal scores; According to this node The abnormal score determines the node Is it an abnormal node? The process of obtaining the abnormal edge includes: Get edges edge attributes The edge attribute Representative node With nodes The intensity of interaction between them; Node Depth representation With nodes Depth representation After splicing, the data is fed into a multilayer perceptron to obtain edge attributes based on node feature prediction. Based on this edge attribute And based on the edge attributes predicted from node features, we obtain the edge Abnormal scores; According to this side The abnormal score determination of this edge Is it an abnormal edge? Among them, connecting abnormal nodes and abnormal edges to reconstruct the attack path includes: Construct a complete graph containing all endpoints. The set of terminal nodes Includes all anomalous nodes, and the edge weight between any two terminal nodes is set to the value in the source graph. The shortest path distance to the corresponding node in the equation; In the complete map Run the standard MST algorithm to find the minimum spanning tree connecting all terminal nodes. ; where the minimum spanning tree Each edge in the graph corresponds to a source graph. The shortest path in the algorithm, the standard MST algorithm includes: Prim's algorithm or Kruskal's algorithm; Minimum Spanning Tree Replace all edges in the source graph The corresponding actual path is obtained by merging all nodes and edges in the actual path and removing redundant cycles to obtain the reconstructed attack path.

Images