An APT attack detection method and system based on small sample learning

Abstract

The application discloses an APT attack detection method and system based on small sample learning, and relates to the technical field of information security. The application comprises the following steps: structurally modeling multi-source security data through a dynamic heterogeneous graph sequence, combining a heterogeneous graph convolution layer to extract local spatial features and a Transformer encoder to extract time sequence features, enhancing the representation ability of a small number of attack samples through a prototype generation based on attention, improving the detection ability of the prototype network through a parameterized relationship network, and realizing self-adaptive optimization of the model through a sample feedback and an incremental learning mechanism, so as to construct an efficient detection system which can effectively identify APT attacks under the condition of small samples, has the ability of space-time perception and continuous learning. The application is favorable to the comprehensiveness and accuracy of feature extraction in the space-time dimension, the weight assignment of samples with different representation qualities is realized through the attention mechanism, and the detection accuracy and robustness of the prototype network are enhanced in combination with the parameterized relationship network.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, and in particular relates to an APT attack detection method and system based on few-shot learning. Background Technology

[0002] Advanced Persistent Threat (APT) attacks represent the pinnacle of complexity and severity in cyberattacks, employing highly customized, multi-stage, and long-term insidious attack strategies. APT attacks integrate diverse techniques such as social engineering, zero-day exploits, and supply chain attacks. Their attack chains, from reconnaissance and intrusion to lateral movement and data breaches, often last for months or even years, and their behavioral patterns are highly indistinguishable from normal activities. This renders traditional detection systems based on known threat characteristics or static rules largely ineffective. To address this challenge, academia and industry have gradually shifted their research focus to dynamic detection technologies based on machine learning and behavioral analysis, aiming to discover unknown threats through data-driven approaches.

[0003] Existing machine learning detection schemes mainly follow two paths: one is baseline modeling based on anomaly detection, which defines a normal behavioral profile and marks activities that significantly deviate from this profile as anomalous; the other is classification modeling based on supervised learning, which trains a binary classification model using labeled attack and normal samples. However, both of these methods have revealed a series of fundamental flaws when dealing with APT attacks:

[0004] First, the extreme scarcity of positive samples and extreme class imbalance are the primary bottlenecks. Successful APT attacks are extremely rare and sensitive, and publicly available datasets can hardly reflect the complexity and diversity of real attacks. Under supervised learning frameworks, models are easily dominated by massive amounts of normal samples, resulting in insufficient learning of the few attack samples, leading to high false negative rates and weak generalization ability. Although techniques such as oversampling and cost-sensitive learning have been used to alleviate the imbalance problem, when the absolute number of samples is insufficient, these methods often lead to model overfitting or getting trapped in local optima, making it difficult to capture the essential characteristics of APT attacks.

[0005] Secondly, the limitations of feature engineering and the fragmentation of spatiotemporal information severely restrict the depth of detection. Existing methods mostly rely on manually designed statistical features, such as packet size, frequency, and session duration, or use networks such as CNNs and RNNs to extract spatial local features and temporal series features respectively. However, APT attacks are a complex process that evolves in both time and space dimensions: temporally, there are long latency intervals and logical dependencies between attack actions at different stages; spatially, attacks jump horizontally between multiple entities such as hosts, networks, and users, forming a relational graph. Traditional methods extract and simply piece together spatiotemporal features in isolation, lacking the ability to uniformly model long-range dependencies and interactions across stages and entities. This makes it impossible to construct a holistic view of the attack chain, resulting in fragmented detection and difficulty in detecting low-intensity, slow-penetrating attacks in the early stages.

[0006] Furthermore, existing few-shot learning techniques lack adaptability in security scenarios. While few-shot learning methods such as meta-learning, metric learning, and data augmentation have made progress in image and natural language processing, their direct transfer to APT detection faces significant challenges. Security data is characterized by high dimensionality, heterogeneity, and strong adversarial nature, and attack patterns actively evade detection and continuously mutate. Current few-shot learning models often assume relatively stable task distributions, making it difficult to cope with the constantly emerging new attack techniques and rapid variants of known attacks in APT attacks. Their generalization performance drops significantly in dynamic adversarial environments.

[0007] Therefore, in order to solve the problems of existing machine learning-based APT attack detection methods, this invention provides an APT attack detection method and system based on few-shot learning. Summary of the Invention

[0008] The purpose of this invention is to provide an APT attack detection method and system based on few-shot learning. It performs structured modeling of multi-source security data through dynamic heterogeneous graph sequences, and combines heterogeneous graph convolutional layers to extract local spatial features with Transformer encoders to extract temporal features, thereby achieving complete spatiotemporal feature fusion and representation. This solves the limitations of existing machine learning-based APT attack detection methods, such as insufficient recognition ability under conditions of scarce samples and class imbalance, and the fragmentation of spatiotemporal information.

[0009] To solve the above-mentioned technical problems, the present invention is achieved through the following technical solution:

[0010] As the first aspect provided by this invention, this invention provides an APT attack detection method based on few-shot learning, comprising the following steps:

[0011] Acquire multi-source security data of the target system and process it to obtain timestamped triples. Construct a dynamic heterogeneous graph sequence that reflects the evolution of system entities and relationships based on a sliding time window mechanism.

[0012] Spatiotemporal features are extracted from dynamic heterogeneous graph sequences to obtain embedded vector sequences that incorporate spatiotemporal context information;

[0013] Based on the improved prototype network, a few-sample task is constructed according to the embedded vector sequence. A category prototype is generated through an attention mechanism. The similarity score between the query sample and the category prototype is calculated using a parameterized relation network. The attack detection of the target system is then performed in combination with the confidence threshold.

[0014] Furthermore, the method for constructing dynamic heterogeneous graph sequences includes the following steps:

[0015] After preprocessing the multi-source security data, entity sets and relation sets are extracted to form structured, timestamped triples containing subject entities, relation types, and object entities. Data preprocessing includes cleaning, handling of missing / outlier values, format standardization, and timestamp granularity alignment of the multi-source security data. Entities include at least one of host, user, and process. Relation types include at least one of access, communication, and authentication.

[0016] Based on the sliding time window mechanism, the continuous triplet stream is divided into multiple time windows, with a window size of [value missing]. The sliding step size is ;

[0017] A heterogeneous graph snapshot is constructed for each time window to form a dynamic heterogeneous graph sequence. The nodes of the heterogeneous graph snapshot correspond to entities and the edges correspond to relationships. The nodes and edges of the heterogeneous graph snapshot have predefined types. The dynamic heterogeneous graph sequence is used to describe the evolution of the system's security state in the spatiotemporal dimension.

[0018] Furthermore, the method for constructing the embedding vector sequence includes the following steps:

[0019] The nodes in the heterogeneous graph snapshots within each time window of the dynamic heterogeneous graph sequence are initialized with features to obtain the initial feature vectors of the nodes.

[0020] S22: Using a relational graph convolutional network as the convolutional layer of a heterogeneous graph, a multi-relational neighbor aggregation operation is performed on the initial feature vectors of each node layer. After aggregation by multiple relational graph convolutional networks, spatially enhanced node embedding vectors are obtained. Then, attention pooling is used to aggregate all node information in the heterogeneous graph snapshot to obtain the spatially enhanced node embedding vector of the corresponding heterogeneous graph snapshot. The spatially enhanced node embedding vectors of multiple heterogeneous graph snapshots constitute a spatially enhanced node embedding vector sequence.

[0021] S23: Use the Transformer encoder to perform temporal modeling on the spatial augmentation node embedding vector sequence across time windows to obtain an embedding vector sequence that integrates spatiotemporal context information.

[0022] Furthermore, the method for initializing the features of nodes includes the following steps:

[0023] For nodes in a heterogeneous graph snapshot, obtain the node type embedding vector through a learnable node type embedding matrix;

[0024] The original numerical attribute feature vectors of the nodes are standardized.

[0025] The node type embedding vector is concatenated with the standardized numerical attribute feature vector to obtain the initial feature vector of the node.

[0026] Furthermore, the method for performing time series modeling includes the following steps:

[0027] The spatial augmentation node embedding vector is added to the learnable temporal encoding vector of the corresponding time window. Through the multi-head self-attention mechanism of the Transformer encoder, the feedforward neural network and the normalization operation of the residual connection layer, the temporal dependency across the time window is established, resulting in an embedding vector sequence that integrates spatiotemporal context information.

[0028] Furthermore, the method for attack detection includes the following steps:

[0029] During the training phase, a support set and a query set are constructed from samples with embedded vector sequences. Based on the support set, prototype vectors for each category are computed using an attention mechanism.

[0030] By using a parameterized relational network, we learn the similarity scores between the query set embedding vector and each prototype vector;

[0031] During the online detection phase, an online prototype library is built and maintained based on historical data, and the similarity score between real-time samples and each prototype in the online prototype library is calculated.

[0032] The category with the highest similarity score is used as the predicted category. When the predicted category is the attack category and the corresponding score exceeds a preset threshold, it is determined to be an attack.

[0033] Furthermore, the parameterized relation network is a multilayer perceptron. The input of the multilayer perceptron is a relation vector formed by concatenating the query set embedding vector and the prototype vector. The relation vector is input into the linear layer of the multilayer perceptron and the output of the Sigmoid activation function is a similarity score between 0 and 1.

[0034] Furthermore, in the support set for few-shot tasks, attention weights are calculated for the sample embedding vectors of each category, and the sample embedding vectors of the corresponding category are weighted and summed based on the attention weights to obtain the prototype vector of that category.

[0035] Furthermore, it also includes a model feedback update step, which includes:

[0036] Collect samples and their labels that have been manually reviewed and confirmed during the online testing phase, and store them in the incremental sample database;

[0037] When the triggering conditions are met, the model is incrementally adjusted based on the incremental sample library, and the online prototype library is updated.

[0038] The triggering conditions are: the number of samples in the incremental sample library reaches a threshold, or the system running time reaches a preset period.

[0039] As a second aspect of the present invention, the present invention provides an APT attack detection system based on few-shot learning, the detection system being used to implement the detection method described in the first aspect, the detection system comprising:

[0040] The data acquisition and graph construction subsystem is used to acquire and process multi-source security data of the target system and output a dynamic heterogeneous graph sequence.

[0041] The spatiotemporal feature extraction subsystem is used to receive dynamic heterogeneous graph sequences and output embedding vector sequences;

[0042] The small sample attack detection and decision-making subsystem is used to construct small sample tasks based on embedded vector sequences that integrate spatiotemporal context information, and to perform attack detection and alarm.

[0043] The model feedback learning subsystem is used for incremental updates and optimization of the model.

[0044] Furthermore, the detection system is deployed in conjunction with the network firewall to detect APT attacks on the data acquired by the firewall and trigger corresponding security protection actions based on the detection results.

[0045] The present invention has the following beneficial effects:

[0046] This invention performs structured modeling of multi-source security data using dynamic heterogeneous graph sequences. It combines heterogeneous graph convolutional layers to extract local spatial features with Transformer encoders to extract temporal features, achieving complete spatiotemporal feature fusion and representation. Using heterogeneous graph sequences containing spatiotemporal information as input data for feature extraction is beneficial for the comprehensiveness and accuracy of feature extraction. The hybrid feature extractor of heterogeneous graph convolutional layers and Transformer encoders is beneficial for extracting feature pattern information of system behavior in the spatiotemporal dimension. The attention mechanism is used to assign weights to samples with different representation qualities, combined with a parameterized relational network, which is beneficial for enhancing the detection accuracy and robustness of the prototype network.

[0047] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0048] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0049] Figure 1 This is a flowchart of the APT attack detection method based on few-shot learning of the present invention;

[0050] Figure 2 This is a flowchart of the APT attack detection method based on few-shot learning in this invention.

[0051] Figure 3 This is a functional block diagram of the APT attack detection system based on few-shot learning of the present invention;

[0052] Figure 4 This is a framework diagram of the APT attack detection system based on few-shot learning according to the present invention. Detailed Implementation

[0053] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0054] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0055] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0056] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0057] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0058] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0059] Example 1:

[0060] This invention relates to an APT attack detection method based on few-shot learning, comprising the following steps:

[0061] Acquire multi-source security data of the target system and process it to obtain timestamped triples. Construct a dynamic heterogeneous graph sequence that reflects the evolution of system entities and relationships based on a sliding time window mechanism.

[0062] Spatiotemporal features are extracted from dynamic heterogeneous graph sequences to obtain embedded vector sequences that incorporate spatiotemporal context information;

[0063] Based on the improved prototype network, a few-sample task is constructed according to the embedded vector sequence. A category prototype is generated through an attention mechanism. The similarity score between the query sample and the category prototype is calculated using a parameterized relation network. The attack detection of the target system is then performed in combination with the confidence threshold.

[0064] By constructing a dynamic heterogeneous graph sequence containing spatiotemporal information as input, this invention provides contextual information for feature extraction that combines topological structure and temporal correlation, thereby improving the comprehensiveness and accuracy of feature extraction. Based on the temporal and topological correlation characteristics of the data, this invention employs a sliding time window mechanism to convert multi-source security data into a heterogeneous graph sequence with temporal information. Each graph snapshot contains entity relationships and topological structure within a specific time window, while the sequence as a whole covers the temporal information of the system's security state. This structure not only preserves the spatiotemporal correlations in the original data but also provides a unified, structured input rich in context for subsequent feature extraction.

[0065] Example 2:

[0066] Please see Figures 1-2 As shown, this invention is an APT attack detection method based on few-shot learning, comprising the following steps:

[0067] Step S1: Obtain multi-source security data such as host logs, network traffic, and authentication records from the system. Extract triples with original timestamps through entity parsing and relation extraction. Construct heterogeneous graphs with different time windows based on the sliding time window mechanism, thereby converting multi-source security data into a dynamic heterogeneous graph sequence containing topology and temporal information.

[0068] Step S2: Initialize node features for each graph snapshot in the dynamic heterogeneous graph sequence. Aggregate the local spatial context of nodes within a single time window based on the heterogeneous graph convolutional layer. Obtain a spatially enhanced embedding vector sequence through graph pooling. Model the temporal dependency relationship of this sequence based on the Transformer encoder, thereby obtaining a set of graph snapshot embedding vector sequences that fuse spatiotemporal feature information. The hybrid feature extractor of heterogeneous graph convolutional layer and Transformer encoder is beneficial for extracting feature pattern information of system behavior in the spatiotemporal dimension. By aggregating the local spatial relationship between multiple types of entities within a single time window through the heterogeneous graph convolutional network, and then combining it with the Transformer encoder to establish temporal dependency across time windows, a deep fusion representation of system behavior in the spatiotemporal dimension can be achieved. This can simultaneously capture the local anomalies of the attack in the topology and the persistent patterns in the temporal information, thereby improving the model's ability to capture the hidden and long-term behavioral patterns in APT attacks.

[0069] Step S3: Based on the embedded vector sequence of fused spatiotemporal feature information obtained after feature extraction, the prototype of the attack sample is generated based on the attention mechanism. The similarity score between the embedded vectors is learned based on the parameterized relation network to achieve a more complex similarity measure. Finally, based on the offline trained attack detection model, the relationship score between the query sample and the prototype of each category is calculated to perform online attack detection.

[0070] Step S4: Model feedback update step, which includes:

[0071] Collect samples and their labels that have been manually reviewed and confirmed during the online testing phase, and store them in the incremental sample database;

[0072] When the triggering conditions are met, the model is incrementally adjusted based on the incremental sample library, and the online prototype library is updated. The triggering conditions are: the number of samples in the incremental sample library reaches a threshold, or the system running time reaches a preset period.

[0073] As an embodiment of the present invention, preferably, the method for constructing an embedded vector sequence includes the following steps:

[0074] S21: Initialize the features of nodes in the heterogeneous graph snapshots within each time window of the dynamic heterogeneous graph sequence to obtain the initial feature vectors of the nodes;

[0075] S22: Using a relational graph convolutional network as the convolutional layer of a heterogeneous graph, a multi-relational neighbor aggregation operation is performed on the initial feature vectors of each node layer. After aggregation by multiple relational graph convolutional networks, spatially enhanced node embedding vectors are obtained. Then, attention pooling is used to aggregate all node information in the heterogeneous graph snapshot to obtain the spatially enhanced node embedding vector of the corresponding heterogeneous graph snapshot. The spatially enhanced node embedding vectors of multiple heterogeneous graph snapshots constitute a spatially enhanced node embedding vector sequence.

[0076] S23: The Transformer encoder is used to perform temporal modeling on the spatial augmented node embedding vector sequence across time windows, resulting in an embedding vector sequence that incorporates spatiotemporal context information. A hybrid feature extractor composed of a heterogeneous graph convolutional layer and a Transformer encoder can effectively fuse the spatial topology and temporal series information of system behavior, thereby extracting more discriminative spatiotemporal feature patterns.

[0077] As an embodiment of the present invention, a preferred method for initializing the features of a node includes the following steps:

[0078] For nodes in a heterogeneous graph snapshot, obtain the node type embedding vector through a learnable node type embedding matrix;

[0079] The original numerical attribute feature vectors of the nodes are standardized.

[0080] The node type embedding vector is concatenated with the standardized numerical attribute feature vector to obtain the initial feature vector of the node.

[0081] As an embodiment of the present invention, a preferred method for attack detection includes the following steps:

[0082] S31: During the training phase, support sets and query sets are constructed from samples of embedded vector sequences, and prototype vectors for each category are computed based on the support sets and using an attention mechanism.

[0083] S32: Using a parameterized relational network, learn the similarity scores between the query set embedding vector and each prototype vector;

[0084] S33: In the online detection phase, an online prototype library is built and maintained based on historical data, and the similarity score between real-time samples and each prototype in the online prototype library is calculated.

[0085] The category with the highest similarity score is used as the predicted category. When the predicted category is the attack category and the corresponding score exceeds a preset threshold, it is determined to be an attack.

[0086] As an embodiment of the present invention, preferably, an attention mechanism is used to assign weights to samples with different representation qualities. Combined with a parameterized relational network, this enhances the detection accuracy and robustness of the prototype network. Introducing an attention mechanism to generate weighted category prototypes on the basis of the prototype network improves the representation quality of minority class samples. Simultaneously, using a parameterized relational network instead of a fixed distance metric enables the learning of more complex similarity relationships. Combined with an online detection and feedback update mechanism, the system can adapt to new attacks through incremental learning during continuous operation, thereby maintaining high detection accuracy and robustness in real-world environments with highly imbalanced samples and dynamically changing attack types.

[0087] As an embodiment of the present invention, preferably, the parameterized relation network is a multilayer perceptron. The input of the multilayer perceptron is a relation vector formed by concatenating the query set embedding vector and the prototype vector. The relation vector is input into the linear layer of the multilayer perceptron and output by the Sigmoid activation function as a similarity score between 0 and 1. In the support set of the few-sample task, attention weights are calculated for the sample embedding vectors of each category. Based on the attention weights, the sample embedding vectors under the corresponding category are weighted and summed to obtain the prototype vector of that category.

[0088] Example 3:

[0089] This invention relates to an APT attack detection method based on few-shot learning. The method for constructing a dynamic heterogeneous graph sequence includes the following steps:

[0090] S11: After preprocessing the multi-source security data, extract the entity set and relation set to form a structured, timestamped triple containing the subject entity, relation type, and object entity; Data preprocessing: Perform cleaning, missing value / outlier handling, format unification, and timestamp granularity alignment operations on the multi-source security data; Entities include at least one of host, user, and process; Relation types include at least one of access, communication, and authentication;

[0091] Extract sets of entities such as hosts, users, and processes, as well as sets of relationships such as access, communication, and authentication, from preprocessed multi-source security data to form structured triples with timestamps:

[0092]

[0093] in As the main entity, For relation types, As an object entity, For a collection of entities, For a set of relation types, For timestamps;

[0094] S12: Based on the sliding time window mechanism, the continuous triplet stream is divided into multiple time windows. Specifically, the continuous time stream is divided into a series of sliding time windows, with a window size of... The window sliding step size is ( Then the time window sequence is represented as:

[0095] ;

[0096] S13: Construct a heterogeneous graph snapshot for each time window to form a dynamic heterogeneous graph sequence. The nodes of the heterogeneous graph snapshot correspond to entities, and the edges correspond to relationships. The nodes and edges of the heterogeneous graph snapshot have predefined types. The dynamic heterogeneous graph sequence is used to describe the evolution of the system's security state in the spatiotemporal dimension.

[0097] As an embodiment of the present invention, a preferred method for constructing dynamic heterogeneous graph sequences is as follows:

[0098] First, construct a snapshot of the heterogeneous graph within a single time window. For the first... Construct a snapshot of the heterogeneous graph within a time window. , A set of nodes, containing windows The set of all unique entities that appear in all triples, where each node has a type mapping, and its node type mapping function is expressed as: ,in For a defined collection of entity types, such as , An edge set containing windows The set of relationships between entities corresponding to all triples within the set, where each edge has a type mapping, and its relationship type mapping function is expressed as follows: ,in For a defined set of relation types, such as .

[0099] Then, based on the graph snapshots within each time window, a dynamic sequence of heterogeneous graphs is obtained:

[0100] ;

[0101] in, Represents a time window The system's state snapshots are matched with sample labels during the training phase. Each graph captures the system's security state and topology within a specific time window, while the entire heterogeneous graph sequence describes the temporal information of the system's security state.

[0102] Example 4:

[0103] This invention relates to an APT attack detection method based on few-shot learning. The method for constructing the embedding vector sequence includes the following steps:

[0104] S21: Node Feature Initialization

[0105] For each graph snapshot Each node in Initialize its original feature vector. Since entities in security data typically contain both categorical and numerical attributes, initialization is performed through embedding lookup and concatenation. For node type features, a learnable node type embedding matrix is ​​set:

[0106] ,in It is the total number of node types. If it is a dimension of type embedding, then the node The type embedding vector is ,in This is a mapping function for node types. For attribute characteristics, use... Represents a node The original numerical attribute feature vector of the node The standardized attribute vector is The node is obtained by concatenating the type embedding and attribute feature vector. The initial feature vector is:

[0107] ;

[0108] superscript Indicates the first The initial layer of a time window, It is an optional linear projection layer for dimension alignment, and the initial feature vectors of all nodes constitute the initial feature matrix of the current time window. ;

[0109] S22: Spatial Feature Extraction Based on Heterogeneous Map Convolutional Layers

[0110] The heterogeneous graph convolutional layer is responsible for aggregating the local spatial context information of nodes within a single time window, capturing the static topology of the system. The heterogeneous graph convolutional layer employs a relational graph convolutional network (R-GCN) for each node. In the Layer embedding vector The graph convolution operation is represented as follows:

[0111]

[0112] in Indicates in relation type Next node The neighborhood group, It is a normalization constant used to balance nodes of different degrees. It is for relationships The trainable weight matrix, It is the weight matrix of the node's self-loop. It is a non-linear activation function, after... Heterogeneous graph convolution of layer R-GCN yields the th Nodes under each time window Spatial augmentation embedding vector The characteristic matrix formed is represented as To further aggregate all node information within a single time window snapshot, attention pooling is performed on the resulting spatially enhanced node embedding vectors for each node. Calculate attention weights:

[0113]

[0114] in These are learnable parameters, attention weights. This represents the spatial embedding vector of each node. To express the importance of the global state of the entire graph, each graph snapshot is finally obtained. The corresponding spatial embedding vector is represented as The resulting spatially enhanced embedding vector sequence is ;

[0115] S23: Temporal Feature Extraction Based on Transformer Encoder

[0116] The Transformer encoder is responsible for modeling the temporal dependencies of node behavior and capturing temporal feature information. A learnable temporal encoding matrix is ​​defined. ,in This is the maximum number of time windows supported by the system. This is the temporal encoding dimension. For the 1st dimension obtained after heterogeneous graph convolution... Spatial embedding vector of a time window Match it with the corresponding time window index Add the time-encoded vectors:

[0117]

[0118] After the injection of temporal information, the initial layer's embedded vector sequence becomes This further ensures that the model can distinguish the node states in different time windows. For the first... Layered Transformer encoders generate query matrices through linear transformations. Key matrix Sum matrix ,in It is a learnable parameter matrix, and the attention weight matrix is ​​represented as follows: ;

[0119] The bullish attention is then represented as:

[0120] ,in Each Transformer encoder also includes a feedforward neural network (FFN) and residual connections and layer normalization, the first... The complete operation of a layer Transformer encoder is represented as follows:

[0121]

[0122]

[0123] in ,go through After the Transformer encoder layer, the first layer is obtained. The snapshot below shows a time window. The corresponding spatiotemporal augmentation embedding vector This includes not only time windows The topological spatial information of the graph snapshot is incorporated, along with its temporal feature information across all time windows. The final embedded vector sequence, obtained after feature extraction and fusion of spatiotemporal feature information, is represented as follows: This serves as prototype input for improving prototype network attack detection.

[0124] Example 5:

[0125] This invention relates to an APT attack detection method based on few-shot learning. The method for attack detection based on an improved prototype network includes the following steps:

[0126] S31: Prototype Generation

[0127] Based on the embedding vector sequence of fused spatiotemporal feature information obtained after feature extraction The set of graph snapshot samples in the current graph sequence is represented as follows: ,in These are the sample labels corresponding to the snapshot image. This represents the set of all categories, including normal classes and various APT attack classes. In each training task, it is the set of graph snapshot samples from the current graph sequence. Randomly construct an N-way K-shot small sample task Among them, from C categories are randomly selected from the data to form a subset of task categories. , and then from Each category M samples are randomly selected from the data to form the support set. A query set is formed by randomly selecting N samples from the remaining samples of that category. ,make sure The support set for each training task and query set It can be represented as:

[0128]

[0129] ;

[0130] Support set for the task An attention mechanism is introduced to generate more representative prototypes for each category. Calculate its prototype vector For categories Support subset Each sample embedding vector Calculate its attention weights:

[0131]

[0132] in These are learnable parameters. Category prototype Represented as:

[0133] Then all the prototypes of all categories constitute the prototype set for this task. .

[0134] S32: Parametric Relational Network

[0135] To overcome the limitations of fixed distance metrics, a parameterized relational network is proposed. This learns the complex similarity relationships between samples and prototypes, replacing the fixed distance formula in prototype networks. For query sets... A sample embedding vector Combine it with each category prototype Concatenate the data to form a relation vector. The relation network employs a small multilayer perceptron; relation vectors are input into the relation network to obtain relation scores. To represent similarity:

[0136]

[0137] in These are the learnable parameters of the relational network. It is the Sigmoid activation function, which maps relation scores to the (0,1) interval. For a single training task The model loss function is defined as the cross-entropy loss of all samples in the query set:

[0138]

[0139] The model training objective is to minimize this loss across all training tasks, optimizing the feature extractor parameters, relational network parameters, and various learnable parameters using stochastic gradient descent based on heterogeneous graph convolutional layers and Transformer encoders.

[0140] S33: Online Attack Detection

[0141] Before conducting online attack detection, the attack detection model is pre-trained using historical data. Support set for online attack detection. It consists of snapshot samples from multiple historical training graph sequences, including selected representative normal samples and all verified APT attack samples, ensuring a relative balance in the number of samples across categories. Furthermore, it calculates an online prototype vector for each category using pre-trained attention mechanism parameters. To create an online prototype library .

[0142] During the online attack detection phase, a real-time snapshot of the system graph is generated at the current point in time. It is an independent sample, for which a short graph sequence is constructed to provide context for detecting target graph snapshots. A fixed backtracking window length is set. At any current point in time Build a collection of recent A sequence of snapshots within a time window. The graph sequence is initialized with node features and then input into a pre-trained feature extractor based on heterogeneous graph convolutional layers and a Transformer encoder to obtain a spatiotemporally enhanced embedding vector sequence corresponding to each graph snapshot. The sample embedding vector at each position in the sequence incorporates the spatiotemporal information of the entire context sequence. The sequence representing the current time point... The sample embedding vector is used as the query sample Through a well-trained relational network Calculate the relationship score between the query sample vector and each prototype in the online prototype library. The category with the highest score is determined as the initial predicted classification result. ,remember Set a uniform confidence threshold. The normal category is represented as The attack detection results are determined based on the following criteria:

[0143] .

[0144] Example 6:

[0145] This invention relates to an APT attack detection method based on few-shot learning. The model feedback update method includes the following steps:

[0146] A feedback sample buffer is set up for the online attack detection phase. The online detection results are confirmed by manual review. The corrected samples and real labels are stored in the incremental sample library. When the set conditions are triggered, the model weight parameters are incrementally fine-tuned, including the feature extractor, relation network and various learnable parameters. At the same time, the online prototype library is updated.

[0147] S41: Manual review and sample bank expansion

[0148] Set a feedback sample buffer during the online attack detection phase. This is used to temporarily store the detection samples to be confirmed and their context information. For attack samples and low-confidence samples marked for online attack detection, their complete input information is recorded:

[0149]

[0150] in It is the input image sequence used for detection. It is the corresponding spatiotemporal augmentation embedding vector sequence. This is the result of online detection and judgment. It is a score vector relating to all known category prototypes. This is the detection time point. Security analysts manually review the samples awaiting confirmation in the buffer zone and, after assessment, issue a final confirmation label for the samples. The results include known attack categories, new attack categories, or normal categories. Confirmed samples and their true labels are then stored in the incremental sample library. .

[0151] S42: Incremental Model Fine-tuning

[0152] The trigger conditions for incremental fine-tuning of the model are set as follows: the number of valid samples in the incremental sample library exceeds a threshold or the online detection system runs for a set period. Incremental fine-tuning of the model is performed when either of these conditions is met. This is based on the incremental sample library. Update the support set for online attack detection For the true label of the sample For existing categories The updated supported sets are:

[0153]

[0154] For samples whose true labels are newly added categories Create a new support subset and update:

[0155]

[0156] Incremental fine-tuning is performed by constructing new small-sample tasks based on the updated support for centralized sampling, assuming the original model's weight parameters are... This includes feature extractors, relational networks, and various learnable parameters, for single small sample tasks. The loss function for incremental fine-tuning is defined as the sum of the cross-entropy loss and the L2 regularization term:

[0157]

[0158] in The cross-entropy loss is calculated on a single incremental fine-tuning task and has the same form as the loss during the original training phase. This is the L2 regularization term. Based on the loss function, the feature extractor parameters, relational network parameters, and various learnable parameters are optimized through stochastic gradient descent. After a few iterations, the fine-tuned model weight parameters are obtained. Based on the fine-tuned model parameters and the updated support set, a complete attention-weighted prototype calculation is performed again to obtain the finely-tuned and updated online prototype library. .

[0159] Example 7:

[0160] Please see Figures 3-4 As shown, this invention is an APT attack detection system based on few-shot learning. The detection system is used to implement the detection methods described in Examples 1 to 7. The detection system mainly consists of four subsystems: a data acquisition and graph construction subsystem, a spatiotemporal feature extraction subsystem, a few-shot attack detection and decision-making subsystem, and a model feedback learning subsystem. Specifically:

[0161] The data acquisition and graph construction subsystem is used to acquire and process multi-source security data of the target system and output a dynamic heterogeneous graph sequence.

[0162] The spatiotemporal feature extraction subsystem is used to receive dynamic heterogeneous graph sequences and output embedding vector sequences;

[0163] The small sample attack detection and decision-making subsystem is used to construct small sample tasks based on embedded vector sequences that integrate spatiotemporal context information, and to perform attack detection and alarm.

[0164] The model feedback learning subsystem is used for incremental updates and optimization of the model.

[0165] As an embodiment of the present invention, preferably, the detection system is deployed in conjunction with a network firewall to perform APT attack detection on the data obtained by the firewall and trigger corresponding security protection actions based on the detection results.

[0166] As an embodiment of the present invention, preferably, the data acquisition and graph construction subsystem is responsible for acquiring multi-source data and converting it into a dynamic heterogeneous graph sequence; the spatiotemporal feature extraction subsystem is based on a deep learning framework and extracts fused spatiotemporal features through a heterogeneous graph convolutional network and a Transformer encoder; the few-shot attack detection and decision-making subsystem achieves high-precision online detection and alarm generation based on an offline trained attack detection model; and the model feedback learning subsystem continuously optimizes the model through sample feedback and incremental learning mechanisms to achieve adaptive optimization and closed-loop security management of the system.

[0167] As an embodiment of the present invention, preferably, the APT attack detection system can be deployed as an intelligent system in conjunction with a manageable firewall. It acquires multi-source data in real time through the firewall's data interface and outputs APT attack detection results with confidence scores. Upon receiving an alarm, the firewall can automatically perform operations such as immediate blocking, network isolation, or access restriction on the attack source IP, malicious session, or infected host according to preset policies. Simultaneously, security personnel can feed back confirmation information about alarms and processing results to the components to optimize their detection model, enabling it to continuously learn and improve detection accuracy in real-world network environments. This gives the firewall not only basic access control capabilities but also intelligent protection features for accurately identifying and responding to advanced threats.

[0168] As an embodiment of the present invention, preferably, the data acquisition and graph construction subsystem is located in the data acquisition and preprocessing layer. It is responsible for real-time acquisition and graph construction of multi-source heterogeneous security data, data cleaning and standardization, and converting the data into a dynamic heterogeneous graph sequence data stream, providing structured input for subsequent feature extraction. Specifically, it includes the following modules:

[0169] Multi-source data acquisition module: This module collects raw security data such as logs, traffic, and authentication records in real time from multiple sources, including hosts, network devices, and authentication systems, by deploying lightweight data acquisition agents or integrating with existing log platforms. The multi-source data acquisition module uses asynchronous queues for buffering and decoupling, supports multi-protocol input and data compression transmission, ensuring high throughput and low packet loss rate.

[0170] The data processing and standardization module, implemented based on a streaming processing framework, receives raw secure data streams from the multi-source acquisition module and sequentially performs preprocessing operations such as data cleaning, format normalization, and time alignment. This module incorporates a rule library for entity recognition and relation extraction, using regular expression matching and keyword extraction to parse entities and extract relations, outputting structured triples with timestamps. The module supports dynamically loading entity and relation type configurations to adapt to different log formats and business scenarios.

[0171] The dynamic heterogeneous graph construction module, based on a graph computing framework, receives standardized data streams and constructs a dynamic heterogeneous graph sequence according to a preset sliding time window. In each graph snapshot within the sequence, nodes correspond to entities such as hosts, users, and processes, while edges correspond to relationships such as access, communication, and authentication, each with a timestamp attribute. This module implements the data transformation from secure data streams to dynamic heterogeneous graph sequences.

[0172] As an embodiment of the present invention, preferably, the spatiotemporal feature extraction subsystem is located at the feature calculation and modeling layer. Based on a deep learning framework, it receives a dynamic heterogeneous graph sequence as input, extracts the spatial features of nodes within a single time window through a heterogeneous graph convolutional network, and then establishes temporal dependencies across time windows using a Transformer encoder. Finally, it outputs an embedding vector sequence corresponding to the graph sequence, which integrates spatiotemporal feature information, providing embedding vector input for downstream few-shot detection tasks. Specifically, it includes the following modules:

[0173] Feature initialization module: This module receives a sequence of dynamic heterogeneous graphs and performs feature vectorization on each node in the graph. Node types are mapped to fixed-dimensional vectors through an embedding lookup table; numerical attributes are standardized and then concatenated with the type vectors. The module supports batch processing and caching mechanisms to improve feature generation efficiency.

[0174] The spatiotemporal feature extraction module is based on a deep learning framework and implements a stacked structure of the heterogeneous graph convolutional network R-GCN and the Transformer encoder. The R-GCN layer performs multi-relation neighbor aggregation within a single time window to extract spatial structure features; the Transformer layer performs self-attention modeling on the node embedding sequence across the window to capture temporal dependencies; the spatiotemporal feature extraction module supports GPU acceleration and distributed training, and outputs an embedding vector sequence that integrates spatiotemporal feature information.

[0175] As an embodiment of the present invention, preferably, the few-shot attack detection and decision-making subsystem is located at the model inference and decision-making layer, and realizes real-time attack detection and classification based on spatiotemporal embedded vector sequences. The few-shot attack detection and decision-making subsystem constructs a category prototype library based on an attention mechanism, learns complex similarity metrics through a parameterized relationship network, outputs the relationship score between the detected sample and each prototype, and the detection engine generates structured alarms and pushes them to the console based on the detection results and confidence thresholds. Specifically, it includes the following modules:

[0176] The prototype management module calculates prototype vectors for each category based on an attention mechanism using support set samples, stores these vectors in a vector database, and supports fast retrieval and dynamic updates. The prototype management module implements the calculation, storage, and maintenance of prototype vectors, providing an scalable category representation library for small-sample classification.

[0177] Online attack detection and relationship scoring module: Based on an offline trained attack detection model, it is deployed as a lightweight inference service. After converting the detection samples into spatiotemporal feature embedding vectors, it calculates the relationship scores between the query samples and each prototype through a parameterized relationship network. The online attack detection and relationship scoring module supports batch inference and real-time response, meeting the requirements for low-latency detection.

[0178] The decision and alert module determines attacks based on relationship scores and preset thresholds, generating structured alert events, including timestamps, entity information, attack type, confidence level, and contextual summaries. Alert events are pushed to the console via message queues. The decision and alert module supports alert deduplication, aggregation, and priority evaluation.

[0179] As an embodiment of the present invention, preferably, the model feedback learning subsystem is located at the system control layer, providing alarm management and a console interface, supporting security analysts to annotate and correct detection results, and providing a model management and update mechanism. It can trigger incremental model fine-tuning based on feedback samples, continuously optimizing model parameters, and realizing closed-loop learning and continuous optimization of the system. Specifically, it includes the following modules:

[0180] The alarm management and console module provides a web-based management and control platform, offering functions such as alarm list display, sample details viewing, manual annotation, feedback submission, and report statistics. Security analysts can review alarms, correct tags, mark false alarms / missed alarms, and store the annotated samples in the incremental sample library through the interface. The alarm management and console module implements a human-machine collaborative sample review and annotation process, providing a high-quality source of annotated data for incremental learning.

[0181] The model management and incremental learning module, implemented using a machine learning pipeline tool, monitors the size or time period of the incremental sample library to trigger incremental fine-tuning tasks. The fine-tuning process employs a few-shot learning strategy, combining pre-trained model weights for lightweight training, updating the feature extractor, relational network, and various learnable parameters. The fine-tuned model is then released to the online detection service through a version management mechanism. This module implements a continuous learning and iterative update mechanism for the model, enabling the system to adaptively optimize and identify novel attacks.

[0182] Example 8:

[0183] Based on Examples 1 to 7, an APT attack detection method and system based on few-shot learning is proposed. This method extracts timestamped triples from multi-source security data, constructs a dynamic heterogeneous graph sequence based on a sliding window, where each graph snapshot reflects the topological state of system entities and relationships within a specific time window. After initializing node features for each graph snapshot in the graph sequence, the local spatial features of nodes are aggregated using a heterogeneous graph convolutional layer. Then, a Transformer encoder performs self-attention modeling on the cross-window node embedding sequence to capture temporal dependencies and output an embedding vector sequence that fuses spatiotemporal features. Furthermore, an attention mechanism is used to weight samples with a support set, generating more... The system employs a class prototype representation method and utilizes a parametric relational network to learn a complex similarity measure between samples and prototypes, replacing traditional fixed distance calculations. During online detection, a prototype library is built based on historical data. After feature extraction from the short-term graph sequences generated in real time, the relational scores between the samples and prototypes of each class are calculated through the relational network, and attack judgment is made in combination with preset thresholds. The system also has a feedback mechanism. The detection results are confirmed by manual review, and the labeled samples are stored in an incremental sample library. Based on conditions, incremental fine-tuning of the model based on small sample tasks is triggered to achieve adaptive optimization of the prototype library and classification model, thereby improving the robustness and adaptability of the system in attack detection scenarios with scarce samples and class imbalance.

[0184] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0185] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. An APT attack detection method based on few-shot learning, characterized in that, Includes the following steps: Acquire multi-source security data of the target system and process it to obtain timestamped triples. Construct a dynamic heterogeneous graph sequence that reflects the evolution of system entities and relationships based on a sliding time window mechanism. Spatiotemporal features are extracted from dynamic heterogeneous graph sequences to obtain embedded vector sequences that incorporate spatiotemporal context information; Based on the improved prototype network, a few-sample task is constructed according to the embedded vector sequence. A category prototype is generated through an attention mechanism. The similarity score between the query sample and the category prototype is calculated using a parameterized relation network. The attack detection of the target system is performed by combining the confidence threshold. The method for constructing a dynamic heterogeneous graph sequence includes the following steps: After preprocessing the multi-source security data, entity sets and relation sets are extracted to form structured, timestamped triples containing subject entities, relation types, and object entities. Based on the sliding time window mechanism, the continuous triple stream is divided into multiple time windows; A heterogeneous graph snapshot is constructed for each time window to form a dynamic heterogeneous graph sequence, where the nodes of the heterogeneous graph snapshot correspond to entities and the edges correspond to relationships.

2. The APT attack detection method based on few-shot learning according to claim 1, characterized in that, The method for constructing an embedding vector sequence includes the following steps: The nodes in the heterogeneous graph snapshots within each time window of the dynamic heterogeneous graph sequence are initialized with features to obtain the initial feature vectors of the nodes. Using a relational graph convolutional network as the convolutional layer of a heterogeneous graph, a multi-relational neighbor aggregation operation is performed on the initial feature vectors of each node layer. After aggregation by multiple relational graph convolutional networks, spatially enhanced node embedding vectors are obtained. Then, attention pooling is used to aggregate all node information in the heterogeneous graph snapshot to obtain the spatially enhanced node embedding vector of the corresponding heterogeneous graph snapshot. The spatially enhanced node embedding vectors of multiple heterogeneous graph snapshots constitute a spatially enhanced node embedding vector sequence. The Transformer encoder is used to perform temporal modeling on the spatial augmentation node embedding vector sequence across time windows, resulting in an embedding vector sequence that incorporates spatiotemporal context information.

3. The APT attack detection method based on few-shot learning according to claim 2, characterized in that, The method for initializing node features includes the following steps: For nodes in a heterogeneous graph snapshot, obtain the node type embedding vector through a learnable node type embedding matrix; The original numerical attribute feature vectors of the nodes are standardized. The node type embedding vector is concatenated with the standardized numerical attribute feature vector to obtain the initial feature vector of the node.

4. The APT attack detection method based on few-shot learning according to claim 2, characterized in that, The method for performing time series modeling includes the following steps: The spatial augmentation node embedding vector is added to the learnable temporal encoding vector of the corresponding time window. Through the multi-head self-attention mechanism of the Transformer encoder, the feedforward neural network and the normalization operation of the residual connection layer, the temporal dependency across the time window is established, resulting in an embedding vector sequence that integrates spatiotemporal context information.

5. The APT attack detection method based on few-shot learning according to claim 1, characterized in that, The methods for attack detection include the following steps: During the training phase, a support set and a query set are constructed from samples with embedded vector sequences. Based on the support set, prototype vectors for each category are computed using an attention mechanism. By using a parameterized relational network, we learn the similarity scores between the query set embedding vector and each prototype vector; During the online detection phase, an online prototype library is built and maintained based on historical data, and the similarity score between real-time samples and each prototype in the online prototype library is calculated. The category with the highest similarity score is used as the predicted category. When the predicted category is the attack category and the corresponding score exceeds a preset threshold, it is determined to be an attack.

6. The APT attack detection method based on few-shot learning according to claim 5, characterized in that, The parameterized relation network is a multilayer perceptron. The input of the multilayer perceptron is a relation vector formed by concatenating the query set embedding vector and the prototype vector. The relation vector is input into the linear layer of the multilayer perceptron and the output of the sigmoid activation function is a similarity score between 0 and 1. In the support set of the few-shot task, attention weights are calculated for the sample embedding vectors of each category. Based on the attention weights, the sample embedding vectors under the corresponding category are weighted and summed to obtain the prototype vector of that category.

7. The APT attack detection method based on few-shot learning according to claim 1, characterized in that, It also includes a model feedback update step, which includes: Collect samples and their labels that have been manually reviewed and confirmed during the online testing phase, and store them in the incremental sample database; When the triggering conditions are met, the model is incrementally adjusted based on the incremental sample library, and the online prototype library is updated. The triggering conditions are: the number of samples in the incremental sample library reaches a threshold, or the system running time reaches a preset period.

8. An APT attack detection system based on few-shot learning, characterized in that, The detection system is used to implement the detection method according to any one of claims 1-7, and the detection system includes: The data acquisition and graph construction subsystem is used to acquire and process multi-source security data of the target system and output a dynamic heterogeneous graph sequence. The spatiotemporal feature extraction subsystem is used to receive dynamic heterogeneous graph sequences and output embedding vector sequences; The small sample attack detection and decision-making subsystem is used to construct small sample tasks based on embedded vector sequences that integrate spatiotemporal context information, and to perform attack detection and alarm. The model feedback learning subsystem is used for incremental updates and optimization of the model.

9. The APT attack detection system based on few-shot learning according to claim 8, characterized in that, The detection system is deployed in conjunction with the network firewall to detect APT attacks on the data acquired by the firewall and trigger corresponding security protection actions based on the detection results.

Images