Host log attack detection method and system based on graph structure modeling

Abstract

The invention discloses a host log attack detection method and system based on graph structure modeling. The method comprises the following steps: acquiring and preprocessing multi-source host log data; extracting behavior elements and object elements based on the standardized log event set; constructing a host log behavior graph based on the object element set and the behavior element set; performing association constraint modeling on the host log behavior graph, and extracting an attack semantic feature set; executing graph evolution updating on the behavior association graph; carrying out feature learning of geometric constraint and attack semantic constraint on the evolution behavior association graph set based on an improved Geom-GCN model, and extracting a graph structure feature set; and executing attack mode matching and judgment based on the graph structure feature set, and generating an attack detection result set. The host log attack detection method based on graph structure modeling is adopted, semantic constraint feature learning and accurate judgment of attack behaviors are achieved, and the method has the advantages of being high in detection accuracy, high in structure interpretability and good in adaptability.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a host log attack detection method and system based on graph structure modeling. BACKGROUND

[0002] With the continuous expansion of information system scale, multi-source log data such as system logs, audit logs, process logs, file access logs and network connection logs generated on the host side continue to grow. Existing host security detection technologies are mostly based on rule matching, feature signature or single log source analysis methods, and the log events are independently parsed and alarmed and determined, which is difficult to depict the complex interaction relationship, dependency relationship and time sequence correlation relationship between different object entities. Although some methods introduce statistical analysis or machine learning models, they usually take a flattened feature vector as input, ignoring the overall correlation of log behavior at the structure level, which limits the recognition ability of complex attack chains and cross-stage attack behaviors.

[0003] Existing technologies also generally have the problem of insufficient attack semantic modeling, which is difficult to constrain the time sequence rationality, causal consistency and interaction intensity change characteristics of behaviors in the detection process, and is easily affected by noise logs and abnormal behavior drift. In addition, traditional graph modeling methods often lack neighborhood screening mechanisms and causal consistency constraints for attack semantics in the graph structure updating and feature learning process, resulting in a large number of redundant structures in the generated graph representation that are irrelevant to attacks, reducing the detection accuracy and stability.

[0004] Therefore, how to provide a host log attack detection method and system based on graph structure modeling is a problem that those skilled in the art need to solve. SUMMARY

[0005] One object of the present application is to provide a host log attack detection method based on graph structure modeling. The present application adopts a host log attack detection method based on graph structure modeling, realizes semantic constraint feature learning and accurate determination of attack behavior, and has the advantages of high detection accuracy, strong structure interpretability and good adaptability.

[0006] According to the host log attack detection method based on graph structure modeling of the present application, the following steps are included: Obtain multi-source host log data generated during host operation and preprocess to obtain a standardized log event set; Perform behavior element extraction and object element extraction based on the standardized log event set, and output an object element set and a behavior element set; Construct a host log behavior graph based on the object element set and the behavior element set; The host log behavior graph is associated with attack semantics to model the correlation constraints, construct a behavior correlation graph, and extract an attack semantic feature set. The behavior correlation graph is updated based on newly added logs within a continuous host runtime period, and the updated behavior correlation graph set is generated in chronological order according to the update period. The improved Geom-GCN model is used to learn the features of the geometric constraints and attack semantic constraints of the evolution behavior correlation graph set, generate node representation vectors and subgraph representation vectors, and extract a graph structure feature set. Attack pattern matching and judgment are performed based on the graph structure feature set to generate an attack detection result set.

[0007] Optionally, the multi-source host log data includes system logs, audit logs, process logs, file access logs, and network connection logs, and the preprocessing includes timestamp unification, log field standardization, log event structuring, noise event filtering, and missing field completion.

[0008] Optionally, the output of the object element set and the behavior element set includes: Each standardized log event record in the standardized log event set is traversed, and log fields related to event occurrence time, event type, object identification information, and behavior context information are read to obtain an event field set; Field standardization processing is performed based on the event field set to obtain a standardized event field set; Object element extraction is performed based on the standardized event field set, and an object unique identifier is assigned to each type of object entity and written into an object attribute set; The object entity is de-duplicated and merged based on the object unique identifier to generate an object element set; Behavior element extraction is performed based on the standardized event field set and the object element set, and a behavior unique identifier is assigned to each behavior and written into a behavior attribute set; Behavior confidence calculation and filtering processing are performed on the behavior attribute set to generate a behavior element set; The object element set and the behavior element set are associated with the event identifier to establish an association index, and the object element set and the behavior element set are output.

[0009] Optionally, the host log behavior graph is constructed as follows: The object element set, the behavior element set, and the event identifier association index are received, the object elements are mapped to corresponding host entity nodes, user entity nodes, process entity nodes, file entity nodes, network endpoint entity nodes, and security event entity nodes according to object types, and a node set is constructed; Associate each node in the node set with a corresponding set of object attributes, and establish a mapping relationship between the unique identifier of the object and the node; Traverse the set of behavioral elements, locate the corresponding entity nodes based on the unique identifiers of the subject and object of the behavior recorded in the behavioral attributes, and obtain the node pairs that construct the edge relationship; Based on the node-based association of execution behaviors, the process generates behavior interaction edges and associates the corresponding set of behavior attributes with the behavior interaction edges; Identify call dependencies and resource dependencies from the object element set and behavior element set, generate dependency edges between the corresponding entity nodes, and write the dependency type and dependency direction attributes into the edge attribute set; Based on the source event identifier and the time of occurrence of the behavior, the sequential relationship of the behavior interaction edge and the dependency edge is determined. Causal relationship edges are generated according to the triggering order, and the cause event identifier, result event identifier, causal direction and time interval attributes are written into the edge attribute set. Calculate the edge weight value for each edge and write the edge weight value into the edge attribute set; The behavioral interaction edges, dependency edges, and causal relationship edges are uniformly organized to generate a host log behavior graph that includes a set of nodes and a set of multiple types of edges.

[0010] Optionally, obtaining the attack semantic feature set specifically includes: Parse the node set and edge set in the host log behavior graph, and establish an adjacency association index for the node set and edge set; Perform temporal constraint modeling on the edge set, and configure temporal attributes for the edge set based on the behavior occurrence time and time interval attributes; Perform causal constraint modeling on the edge set, and configure causal attributes for the edge set based on the causal event identifier, the result event identifier, and the causal direction information; Perform interaction strength modeling on the edge set, and configure interaction strength attributes for the edge set based on the edge weight value and the occurrence of the same type of edge within a unit time window; The temporal, causal, and interaction intensity attributes are uniformly written into the edge set, and the host log behavior graph is updated to generate a behavior association graph that includes multiple association constraint information. Semantic features are extracted from the node set and edge set based on the behavior association graph, and the temporal attributes, causal attributes and interaction strength attributes of the adjacent edges of the nodes are summarized based on the node adjacency association index, resulting in an attack semantic feature set composed of node attack semantic features and edge attack semantic features.

[0011] Optionally, the generation of the evolutionary behavior association atlas specifically includes: The update cycle is divided within the continuous host operation time period, and the corresponding new standardized log event set is obtained in each update cycle. The new standardized log event set is associated with the behavior association graph output by the previous update cycle. Incremental object element extraction and incremental behavior element extraction are performed on the newly added standardized log event set to obtain the incremental object element set and the incremental behavior element set, and an event identifier association index is established for the incremental object element set and the incremental behavior element set; Incremental node updates are performed on the behavior association graph based on the incremental object feature set. The incremental object features are mapped to nodes and added to the node set. The object attribute field values ​​are added to the existing node associations that uniquely identify the objects, and the updated node set is generated. Incremental edge updates are performed on the behavior association graph based on the incremental set of behavior elements and the unique identifier of the object. Node pairs are located according to the unique identifier of the behavior subject object and the unique identifier of the behavior object object. New behavior interaction edges are generated and added to the edge set. New dependency relationship edges and new causal relationship edges are generated and added to the edge set according to the call dependency relationship, resource dependency relationship and trigger order relationship. Associate the new behavioral interaction edges with the corresponding behavioral attributes, dependency attributes, and causal attributes, and simultaneously update the temporal attributes, causal attributes, and interaction intensity attributes of the affected existing edges; The edge weights are updated based on the updated edge set, and the updated edge weights are written to the edge attribute set. Based on the updated set of nodes and edges, an evolutionary behavior association graph corresponding to the current update cycle is generated, and the evolutionary behavior association graphs obtained in each update cycle are summarized in chronological order to generate an evolutionary behavior association graph set.

[0012] Optionally, the extraction of the graph structure feature set specifically includes: The evolutionary behavior association graphs are input into the improved Geom-GCN model in chronological order of update cycles, and the causal attributes and attack semantic feature sets in the node set, edge set, and edge attribute set of each behavior association graph are read. The improved Geom-GCN model, while maintaining the node embedding space construction structure, neighborhood construction structure, region convolution structure and representation output structure, introduces an attack semantic driving module in the neighborhood construction structure and a causal consistency constraint module in the region convolution structure. In the node embedding space construction structure, the node set is mapped to the set of node embedding representations in the embedding space; In the geometric relationship calculation module of the neighborhood construction structure, the geometric similarity score between nodes is calculated based on the node embedding representation set to generate geometric constraint information of candidate neighborhood relationships; In the neighborhood node filtering module, candidate neighborhood nodes of each center node are filtered based on geometric constraint information, and the filtered nodes are combined with the associated edge set to generate a candidate neighborhood substructure set. In the attack semantics-driven module, the attack semantics matching score is calculated on the candidate neighborhood substructure set based on the attack semantics feature set, and the attack semantics matching score is fused with the geometric similarity score to obtain the neighborhood selection weight. The attack semantics-constrained neighborhood substructure set is obtained by filtering according to the neighborhood selection weight. In the neighborhood region partitioning module, the neighborhood substructure set of attack semantic constraints is partitioned into regions, generating a neighborhood region substructure set, and recording the region node set and region edge set for each neighborhood region substructure. In the regional convolution structure, a regional convolution input set is constructed based on the set of neighborhood regional substructures. In the causal consistency constraint module, the set of nodes in the regional convolution input set is filtered according to the causal attributes associated with the edge set in the regional convolution input set to obtain a set of regional convolution nodes that satisfy the causal consistency constraint. In the region feature aggregation module, feature aggregation processing is performed on the set of region convolution nodes to obtain the set of region convolution output node representations; In the output structure, representation mapping and normalization are performed on the set of output node representations based on region convolution to generate a set of node representation vectors; Based on the set of node representation vectors, subgraph aggregation is performed on the set of substructures of the neighborhood region to generate a set of subgraph representation vectors. Based on the set of node representation vectors and the set of subgraph representation vectors, a set of graph structure features is extracted.

[0013] Optionally, the generation of the attack detection result set specifically includes: The feature set of the graph structure is aligned and standardized to generate a feature input set; The feature input set is compared with the attack mode feature templates corresponding to the attack semantic label set to generate a pattern matching score set for each attack mode. Perform pattern score aggregation processing on the pattern matching score set to obtain the attack pattern score value; The attack pattern scores are sorted and analyzed. The attack pattern that ranks first in the sorting results is selected to generate an attack judgment result set that includes a set of attack-related nodes, a set of attack-related relationships, a set of attack-related paths, and a set of attack semantic tags. Based on the attack determination result set, an object scope mapping process is performed on the attack-related node set. The unique identifier of the object in the attack-related node set is mapped to host entity, user entity, process entity, file entity, network endpoint entity and security event entity, generating the scope of objects involved in the attack. Based on the attack determination result set, the attack-related relationship set is processed by relation structuring. The behavioral interaction edges, dependency edges and causal relationship edges in the attack-related relationship set are grouped by relation type and sorted by edge order attribute to generate the attack behavior relationship structure. The attack path sequence is obtained by organizing the path relationships formed by the attack-related node set and the attack-related relationship set based on the attack-related path set. Then, the consistency verification between the attack behavior relationship structure and the attack path sequence is performed based on the attack semantic tag set to determine the attack judgment result set that meets the attack judgment conditions. Based on the attack determination result set that meets the attack determination conditions, the attack-related node set is processed for event location association. The attack-related node set is associated with the corresponding source event identifier according to the event identifier association index, and event location information corresponding to the attack-related node set is generated. The attack detection result set is generated by structurally expressing and outputting the scope of the attack targets, the relationship structure of attack behaviors, the attack path sequence and event location information.

[0014] A host log attack detection system based on graph structure modeling according to an embodiment of the present invention includes: The log preprocessing module is used to acquire multi-source host log data generated during host operation and perform preprocessing to generate standardized log event sets; The feature extraction module is used to extract object features and behavior features based on a standardized log event set, and generate object feature sets and behavior feature sets. The behavior graph construction module is used to construct host log behavior graphs based on object feature sets and behavior feature sets. The association constraint modeling module is used to perform attack semantic-oriented association constraint modeling on the host log behavior graph, generate a behavior association graph and extract an attack semantic feature set; The graph evolution update module is used to perform graph evolution updates on the behavior association graph based on newly added logs during a continuous host operation period, and to summarize and generate an evolution behavior association graph set according to the time order of the update cycle. The feature learning module is used to perform geometric and attack semantic constraints on the evolutionary behavior association graph based on the improved Geom-GCN model, generate node representation vectors, subgraph representation vectors and extract graph structure feature sets; The attack determination module is used to perform attack pattern matching and attack determination based on the graph structure feature set, and generate an attack detection result set.

[0015] The beneficial effects of this invention are: This invention unifies the modeling of multi-source host logs, transforming scattered and heterogeneous log events into a host log behavior graph with relationships. Based on this, it introduces attack-semantic-oriented relationship constraint modeling and graph evolution update mechanisms, enabling log data to reflect behavioral interactions, dependencies, and temporal causal relationships between object entities at the structural level. Through continuous evolution modeling of the behavior relationship graph, this invention effectively adapts to the characteristics of continuous log generation and changing behavior patterns during host operation, avoiding feature lag issues caused by static modeling, thereby improving the coverage of long-term latent attacks and phased attack behaviors.

[0016] In the feature learning stage, this invention introduces an attack semantics-driven mechanism and a causal consistency constraint mechanism into the graph neural network model. This ensures that the neighborhood construction and region convolution processes not only consider the geometric proximity between nodes but also simultaneously constrain the matching degree and causal consistency of nodes and edges at the attack semantics level. By performing semantic filtering and causal verification on the neighborhood substructures, redundant structures unrelated to the attack can be significantly reduced from participating in feature aggregation. This makes the generated node representation vectors and subgraph representation vectors more focused on attack-related behavioral patterns, thereby improving the expressive and discriminative power of graph structure features for attack semantics.

[0017] In the attack determination phase, this invention performs attack pattern matching and comprehensive scoring based on graph structure features, uniformly determining node-level, path-level, and structure-level information, and further generating structured attack detection results. This approach not only provides a determination of whether an attack has occurred, but also clarifies the scope of the attack-related objects, behavioral relationship structure, attack path sequence, and corresponding event location information, providing traceable and interpretable detection evidence for security analysis and incident response. Compared to existing technologies, this invention significantly improves the accuracy, stability, and interpretability of attack detection, making it suitable for continuous security monitoring scenarios in complex host environments. Attached Figure Description

[0018] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart of a host log attack detection method based on graph structure modeling proposed in this invention; Figure 2 This is a schematic diagram illustrating the evolution behavior association graph generation process of a host log attack detection method based on graph structure modeling proposed in this invention. Figure 3 This is a flowchart illustrating the graph structure feature set extraction process for a host log attack detection method based on graph structure modeling proposed in this invention. Detailed Implementation

[0019] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0020] like Figure 1 As shown, a host log attack detection method based on graph structure modeling includes the following steps: Acquire multi-source host log data generated during host operation and preprocess it to obtain a standardized log event set; Based on standardized log event sets, behavioral elements and object elements are extracted, and object element sets and behavioral element sets are output. Construct a host log behavior graph based on the set of object elements and the set of behavior elements; The host log behavior graph is modeled with attack semantics-oriented relational constraints to construct a behavior relation graph and extract attack semantic feature sets; During the continuous host operation period, the behavior association graph is updated based on the newly added logs, and the evolutionary behavior association graph set is generated by summarizing the data in the time order of the update cycle. Based on the improved Geom-GCN model, feature learning of geometric constraints and attack semantic constraints is performed on the evolutionary behavior association graph, generating node representation vectors and subgraph representation vectors and extracting graph structure feature sets; Attack pattern matching and determination are performed based on graph structure feature set, and an attack detection result set is generated.

[0021] In this embodiment, the multi-source host log data includes system logs, audit logs, process logs, file access logs, and network connection logs. The preprocessing includes timestamp unification, log field standardization, log event structuring, noise event filtering, and missing field completion.

[0022] In this embodiment, the output of the object element set and the behavior element set specifically includes: Iterate through each standardized log event record in the standardized log event set, and read the log fields related to the event occurrence time, event type, object identification information and behavior context information to obtain the event field set; Based on the event field set, field normalization processing is performed to obtain a normalized event field set. The field normalization processing includes host identifier unification, user identifier unification, process identifier unification, file path normalization, network endpoint normalization, and event type normalization. Object feature extraction is performed based on a standardized event field set, and a unique object identifier is assigned to each type of object entity and written into the object attribute set. The object feature extraction includes extracting host entities, user entities, process entities, file entities, network endpoint entities and security event entities according to object type. The object attribute set includes object type, object unique identifier, source log type, source event identifier and object-related field values. Based on the unique identifier of an object, the deduplication and merging process is performed on the object entity to generate a set of object elements. The deduplication and merging process includes merging the host identifier, merging the user identifier, merging the process identifier and host identifier together, merging the file path, merging the network endpoint address and port, and merging the security event identifier. Behavioral element extraction is performed based on a standardized event field set and object element set. Each behavior is assigned a unique behavior identifier and written into a behavior attribute set. The behavior element extraction includes identifying login behavior, process creation behavior, inter-process call behavior, file read / write behavior, permission change behavior, network connection behavior, and resource access behavior according to the combination relationship between event type and object entity. The behavior attribute set includes behavior type, behavior unique identifier, behavior occurrence time, behavior subject object unique identifier, behavior object unique identifier, source event identifier, and behavior-related field values. The behavioral attribute set is subjected to behavioral confidence calculation and filtering to generate a behavioral element set. The behavioral confidence calculation includes weighting and fusing the corresponding scores based on field matching consistency weight, cross-log consistency weight and context consistency weight to obtain the behavioral confidence value. The filtering process includes deleting behavioral elements with behavioral confidence values ​​lower than a preset confidence threshold and performing missing field completion on the retained behavioral elements. The field matching consistency weight is calculated by taking into account the proportion of the number of valid fields in the log records corresponding to the statistical behavior to the total number of fields associated with the behavior, and the consistency of field values ​​in the standardized log event set. The cross-log consistency weight is obtained by statistically analyzing the frequency of the same behavior in different types of host logs and their corresponding time, and by summarizing and calculating the degree of consistency of behavior in different log sources. The context consistency weight is calculated by the time interval relationship between the statistical behavior and the preceding and subsequent behaviors in the host log behavior sequence, the object association continuity relationship, and the rationality of the behavior order. Based on event identifiers, an association index is established between the object feature set and the behavior feature set, and the object feature set and the behavior feature set are output.

[0023] In this embodiment, the construction of the host log behavior graph specifically includes: Receive the set of object elements, the set of behavior elements, and the event identifier association index. Map the object elements to the corresponding host entity nodes, user entity nodes, process entity nodes, file entity nodes, network endpoint entity nodes, and security event entity nodes according to the object type, and construct the node set. Associate each node in the node set with a corresponding set of object attributes, and establish a mapping relationship between the unique identifier of the object and the node; Traverse the set of behavioral elements, locate the corresponding entity nodes based on the unique identifiers of the subject and object of the behavior recorded in the behavioral attributes, and obtain the node pairs that construct the edge relationship; Based on the node-based behavior association construction process, behavior interaction edges representing the relationship between object elements are generated, and the corresponding behavior attribute set is associated in the behavior interaction edges; Identify call dependencies and resource dependencies from the object element set and behavior element set, generate dependency edges between the corresponding entity nodes, and write the dependency type and dependency direction attributes into the edge attribute set; Based on the source event identifier and the time of occurrence of the behavior, the sequential relationship of the behavior interaction edge and the dependency edge is determined. Causal relationship edges are generated according to the triggering order, and the cause event identifier, result event identifier, causal direction and time interval attributes are written into the edge attribute set. For each edge, calculate the edge weight value and write the edge weight value into the edge attribute set. The edge weight value is obtained by weighted fusion calculation of the behavior confidence value and the number of times the same type of edge appears within a unit time window. The behavioral interaction edges, dependency edges, and causal relationship edges are uniformly organized to generate a host log behavior graph that includes a set of nodes and a set of multiple types of edges.

[0024] In this embodiment, obtaining the attack semantic feature set specifically includes: Parse the node set and edge set in the host log behavior graph, and establish an adjacency association index for the node set and edge set; Temporal constraint modeling is performed on the edge set. Temporal attributes are configured for the edge set based on the behavior occurrence time and time interval attribute. The temporal attributes include edge order attribute and temporal consistency attribute. The edge order attribute is obtained by sorting the edges that connect the unique identifier of the same behavior subject object and the unique identifier of the behavior object according to the behavior occurrence time. The temporal consistency attribute is calculated by normalizing the edge time interval attribute and mapping it to a unit time window. Causal constraint modeling is performed on the edge set. Causal attributes are configured for the edge set based on the cause event identifier, the result event identifier, and the causal direction information. The causal attributes include causal validity attributes and causal consistency attributes. The causal validity attributes are obtained by statistically analyzing the traceability relationship between the cause event identifier and the result event identifier in the event identifier association index. The causal consistency attributes are obtained by matching and calculating the consistency relationship between the causal direction and the edge order attributes. The interaction intensity model is performed on the edge set. The interaction intensity attribute is configured for the edge set according to the edge weight value and the occurrence of the same type of edge within a unit time window. The interaction intensity attribute is obtained by weighted fusion calculation of the edge weight value and the occurrence of the same type of edge within a unit time window. The occurrence of the same type of edge is the number of the same type of edge connecting the unique identifier of the same behavior subject object and the unique identifier of the behavior object within a unit time window. The temporal, causal, and interaction intensity attributes are uniformly written into the edge set, and the host log behavior graph is updated to generate a behavior association graph that includes multiple association constraint information. Semantic features are extracted from the node set and edge set based on the behavioral association graph. The temporal attributes, causal attributes and interaction strength attributes of the adjacent edges of the nodes are summarized based on the node adjacency association index. An attack semantic feature set consisting of node attack semantic features and edge attack semantic features is obtained. The node attack semantic features include login anomaly feature values, permission change anomaly feature values, process chain anomaly feature values, file access anomaly feature values ​​and network connection anomaly feature values. The edge attack semantic features include temporal anomaly feature values, causal conflict feature values ​​and interaction anomaly feature values.

[0025] like Figure 2 As shown, in this embodiment, the generation of the evolutionary behavior association atlas specifically includes: The update cycle is divided within the continuous host operation time period, and the corresponding new standardized log event set is obtained in each update cycle. The new standardized log event set is associated with the behavior association graph output by the previous update cycle. Incremental object element extraction and incremental behavior element extraction are performed on the newly added standardized log event set to obtain the incremental object element set and the incremental behavior element set, and an event identifier association index is established for the incremental object element set and the incremental behavior element set; Incremental node updates are performed on the behavior association graph based on the incremental object feature set. The incremental object features are mapped to nodes and added to the node set. The object attribute field values ​​are added to the existing node associations that uniquely identify the objects, and the updated node set is generated. Incremental edge updates are performed on the behavior association graph based on the incremental set of behavior elements and the unique identifier of the object. Node pairs are located according to the unique identifier of the behavior subject object and the unique identifier of the behavior object object. New behavior interaction edges are generated and added to the edge set. New dependency relationship edges and new causal relationship edges are generated and added to the edge set according to the call dependency relationship, resource dependency relationship and trigger order relationship. Associate the new behavioral interaction edges with the corresponding behavioral attributes, dependency attributes, and causal attributes, and simultaneously update the temporal attributes, causal attributes, and interaction intensity attributes of the affected existing edges; The edge weight values ​​are updated based on the updated edge set, and the updated edge weight values ​​are written into the edge attribute set. The edge weight values ​​are obtained by weighted fusion calculation of the behavior confidence value and the number of times the same type of edge appears within a unit time window. Based on the updated set of nodes and edges, an evolutionary behavior association graph corresponding to the current update cycle is generated, and the evolutionary behavior association graphs obtained in each update cycle are summarized in chronological order to generate an evolutionary behavior association graph set.

[0026] like Figure 3 As shown, in this embodiment, the extraction of the graph structure feature set specifically includes: The evolutionary behavior association graphs are input into the improved Geom-GCN model in chronological order of update cycles, and the causal attributes and attack semantic feature sets in the node set, edge set, and edge attribute set of each behavior association graph are read. The improved Geom-GCN model, while maintaining the node embedding space construction structure, neighborhood construction structure, region convolution structure and representation output structure, introduces an attack semantic driving module in the neighborhood construction structure and a causal consistency constraint module in the region convolution structure. In the node embedding space construction structure, the node set is mapped to the set of node embedding representations in the embedding space; In the geometric relationship calculation module of the neighborhood construction structure, the geometric similarity score between nodes is calculated based on the node embedding representation set to generate geometric constraint information of candidate neighborhood relationships; Obtaining the geometric constraint information includes: in the geometric relationship calculation module, receiving a set of node embedding representations, where each node embedding representation is a vector representation composed of multiple dimensional values; taking any node as the center node, sequentially selecting the remaining nodes in the node embedding representation set as comparison nodes, calculating the numerical differences between the node embedding representations of the center node and the comparison nodes in each corresponding dimension, and squaring and summing the numerical differences in each dimension to obtain the median value of the geometric distance between the center node and the comparison nodes; and performing a square root operation on the median value of the geometric distance to obtain the center node's geometric distance. The geometric distance between the node and the comparison node in the embedding space is calculated. A reverse mapping process is performed on the geometric distance values ​​to convert them into basic similarity values ​​representing the closeness of the nodes. These basic similarity values ​​are then normalized to ensure that the geometric similarity scores fall within a uniform numerical range. The geometric similarity scores corresponding to the center node are sorted, and nodes whose geometric similarity scores satisfy the proximity constraint are selected as candidate neighbor nodes. Geometric proximity relationship data between the candidate neighbor nodes and the center node is constructed based on the geometric similarity scores, and this data is then organized to generate geometric constraint information. In the neighborhood node filtering module, candidate neighborhood nodes of each center node are filtered based on geometric constraint information, and the filtered nodes are combined with the associated edge set to generate a candidate neighborhood substructure set. In the attack semantics-driven module, the attack semantics matching score is calculated on the candidate neighborhood substructure set based on the attack semantics feature set, and the attack semantics matching score is fused with the geometric similarity score to obtain the neighborhood selection weight. The attack semantics-constrained neighborhood substructure set is obtained by filtering according to the neighborhood selection weight. The calculation of the attack semantic matching score specifically includes: in the attack semantic driving module, extracting semantic features related to node behavior type, event timing features, causal relationship features, and interaction strength features from the attack semantic feature set, and mapping the semantic features to semantic feature representations that correspond one-to-one with nodes and edges in the candidate neighborhood substructure; performing consistency comparison processing on the semantic feature representations of each node and edge in the candidate neighborhood substructure with the corresponding semantic features in the attack semantic feature set to generate node-level semantic matching scores and edge-level semantic matching scores; performing a summary calculation on the node-level semantic matching scores and edge-level semantic matching scores to obtain the attack semantic matching score that characterizes the degree of matching between the candidate neighborhood substructure and the attack semantic feature set; The specific steps for obtaining the attack semantic constraint neighborhood substructure set include: performing a weighted fusion process on the attack semantic matching score and the geometric similarity score to generate a neighborhood selection weight that characterizes the overall neighborhood credibility of the candidate neighborhood substructure; comparing the neighborhood selection weights corresponding to each candidate neighborhood substructure in the candidate neighborhood substructure set and sorting them from high to low according to the neighborhood selection weights; selecting the candidate neighborhood substructures located in the first interval of the sorting results as retained substructures and eliminating the remaining candidate neighborhood substructures; and summarizing the selected and retained candidate neighborhood substructures to obtain the attack semantic constraint neighborhood substructure set. In the neighborhood region partitioning module, the neighborhood substructure set of attack semantic constraints is partitioned into regions, generating a neighborhood region substructure set, and recording the region node set and region edge set for each neighborhood region substructure. In the regional convolution structure, a regional convolution input set is constructed based on the set of neighborhood regional substructures. In the causal consistency constraint module, the set of nodes in the regional convolution input set is filtered according to the causal attributes associated with the edge set in the regional convolution input set to obtain a set of regional convolution nodes that satisfy the causal consistency constraint. The specific steps for obtaining the set of region convolutional nodes include: in the region convolutional structure, reading the set of region nodes, the set of region edges, and the causal attributes associated with the region edge sets corresponding to the neighboring region substructures; based on the cause event identifier, result event identifier, and causal direction information recorded in the region edge sets, performing causal relationship parsing on the nodes in the region node set to determine the causal relationship position of each node in the region node set within the neighboring region substructure; in the causal consistency constraint module, performing consistency verification on the causal relationship positions corresponding to each node in the region node set, and selecting nodes whose causal direction is consistent with the sequential relationship between nodes as candidate region convolutional nodes; performing integrity verification on the causal relationship between candidate region convolutional nodes, and removing nodes with missing causal relationships or conflicting causal directions; and summarizing the nodes that pass the causal consistency verification and have complete causal relationships to obtain the set of region convolutional nodes. In the regional feature aggregation module, feature aggregation processing is performed on the set of regional convolutional nodes to obtain a set of regional convolutional output node representations. The feature aggregation processing includes weighted aggregation of the embedded representations of neighboring nodes according to the neighborhood selection weight and fusion of edge attribute set information. In the output structure, representation mapping and normalization are performed on the set of output node representations based on region convolution to generate a set of node representation vectors; Based on the set of node representation vectors, subgraph aggregation is performed on the set of substructures of the neighborhood region to generate a set of subgraph representation vectors. Based on the set of node representation vectors and the set of subgraph representation vectors, a set of graph structure features is extracted. The set of graph structure features includes abnormal substructure features, abnormal path features, and abnormal association pattern features.

[0027] In this embodiment, the generation of the attack detection result set specifically includes: The feature set of the graph structure is aligned and standardized to generate a feature input set; The feature input set is compared with the attack mode feature templates corresponding to the attack semantic label set to generate a pattern matching score set for each attack mode. A pattern score aggregation process is performed on the pattern matching score set to obtain the attack pattern score value. The pattern score aggregation process includes weighted fusion of node-level matching score, path-level matching score and associated pattern-level matching score according to the node contribution weight, path contribution weight and associated pattern contribution weight. The attack pattern scores are sorted and analyzed. The attack pattern that ranks first in the sorting results is selected to generate an attack judgment result set that includes a set of attack-related nodes, a set of attack-related relationships, a set of attack-related paths, and a set of attack semantic tags. The attack-related node set represents the set of nodes in the attack determination result set that correspond to the target attack mode. The unique identifier of the object in the attack-related node set is used to perform object range mapping to obtain the range of objects involved in the attack. The attack-related relationship set represents the set of behavioral interaction edges, dependency edges, and causal relationship edges associated with the attack-related node set. The attack-related relationship set is used for relationship structuring to generate an attack behavior relationship structure. The attack-related path set represents a set of paths formed by connecting the attack-related node set and the attack-related relationship set. The attack-related path set is used to organize the attack path sequence. The attack semantic tag set represents the attack semantic tags corresponding to the target attack mode and the set of attack structure features defined thereto. The attack semantic tag set is used to perform consistency verification on the relation structure and path structure in the attack judgment result set. Based on the attack determination result set, an object scope mapping process is performed on the attack-related node set. The unique identifier of the object in the attack-related node set is mapped to host entity, user entity, process entity, file entity, network endpoint entity and security event entity, generating the scope of objects involved in the attack. Based on the attack determination result set, the attack-related relationship set is processed by relation structuring. The behavioral interaction edges, dependency edges and causal relationship edges in the attack-related relationship set are grouped by relation type and sorted by edge order attribute to generate the attack behavior relationship structure. The attack path sequence is obtained by organizing the path relationships formed by the attack-related node set and the attack-related relationship set based on the attack-related path set. Then, the consistency verification between the attack behavior relationship structure and the attack path sequence is performed based on the attack semantic tag set to determine the attack judgment result set that meets the attack judgment conditions. The attack determination criteria include: within the same update cycle, the attack mode that ranks first in the attack mode score ranking, the attack-related node set, attack-related relationship set and attack-related path set corresponding to it, the temporal attribute order of each side is consistent, the causal attribute direction is consistent, and the combination structure of behavioral interaction relationship, dependency relationship and causal relationship corresponds one-to-one with the attack structure features defined in the attack semantic tag set. Based on the attack determination result set that meets the attack determination conditions, the attack-related node set is processed for event location association. The attack-related node set is associated with the corresponding source event identifier according to the event identifier association index, and event location information corresponding to the attack-related node set is generated. The attack detection result set is generated by structurally expressing and outputting the scope of the attack targets, the relationship structure of attack behaviors, the attack path sequence and event location information.

[0028] A host log attack detection system based on graph structure modeling includes: The log preprocessing module is used to acquire multi-source host log data generated during host operation and perform preprocessing to generate standardized log event sets; The feature extraction module is used to extract object features and behavior features based on a standardized log event set, and generate object feature sets and behavior feature sets. The behavior graph construction module is used to construct host log behavior graphs based on object feature sets and behavior feature sets. The association constraint modeling module is used to perform attack semantic-oriented association constraint modeling on the host log behavior graph, generate a behavior association graph and extract an attack semantic feature set; The graph evolution update module is used to perform graph evolution updates on the behavior association graph based on newly added logs during a continuous host operation period, and to summarize and generate an evolution behavior association graph set according to the time order of the update cycle. The feature learning module is used to perform geometric and attack semantic constraints on the evolutionary behavior association graph based on the improved Geom-GCN model, generate node representation vectors, subgraph representation vectors and extract graph structure feature sets; The attack determination module is used to perform attack pattern matching and attack determination based on the graph structure feature set, and generate an attack detection result set. Example 1:

[0029] To verify the feasibility of this invention in practice, it was applied to an enterprise internal server operating environment. This environment deployed multiple business hosts, which continuously carried out database services, file sharing services, and internal application services. During the operation of these hosts, system logs, audit logs, process logs, file access logs, and network connection logs were continuously generated. In this environment, the number of hosts was large and the log sources were complex. Attack behaviors often exhibited combined behaviors across processes, users, and log types. Traditional detection methods based on single log rules or independent alarms were difficult to reconstruct the complete attack process, easily leading to problems such as high false positives, weak correlation, and difficulty in tracing the source.

[0030] In this scenario, the present invention first performs unified access and preprocessing of multi-source logs continuously generated by various hosts, converting different log formats into a standardized log event set, ensuring consistent representation of event time, object identifiers, and behavioral semantics. Based on this, object and behavioral elements are extracted from the standardized log events. Hosts, users, processes, files, network endpoints, and security events are abstracted as object elements, while operations such as login, process creation, file read / write, permission changes, and network connections are abstracted as behavioral elements. Subsequently, a host log behavior graph is constructed based on the object and behavioral elements, unifying the behaviors originally scattered across various logs into nodes and multi-type edges within the graph structure.

[0031] During continuous host operation, the system continuously receives new logs. This invention incrementally updates the behavior association graph through a graph evolution update mechanism, enabling the behavior association graph to evolve over time and fully reflect the stage changes of attack behavior. Based on this, an improved Geom-GCN model is introduced to learn features from the evolving behavior association graph. Geometric constraints characterize the structural similarity between nodes, and attack semantic constraints guide neighborhood construction and region convolution, allowing the model to focus on combinations of behaviors with consistent attack semantics, thereby obtaining more discriminative node representations, subgraph representations, and graph structure features.

[0032] During attack detection, the system matches a graph structure feature set with predefined attack semantic patterns, automatically identifying complex attack paths that evolve from multiple low-risk behaviors. It then outputs detection results containing information about attack-related objects, attack relationship structures, and event location. Continuous application in real-world environments demonstrates that, compared to relying solely on single log rules, this invention can complete overall correlation identification before attacks cause significant damage, reducing scattered alerts and improving the completeness and interpretability of attack path reconstruction. Furthermore, due to the introduction of a graph evolution mechanism, the system can adapt to changes in host operating states and behavioral patterns, maintaining stable detection capabilities and providing operations personnel with clear and traceable security analysis data. This verifies the practicality and effectiveness of this invention in complex host log scenarios.

[0033] Table 1. Performance Comparison of the Invention and Traditional Host Log Attack Detection Methods As can be clearly seen from Table 1, the method of the present invention is superior to the traditional method in many indicators.

[0034] The attack detection accuracy shows that the traditional method has an accuracy of 86.4%, while the method of this invention achieves 93.8%, an improvement of 7.4 percentage points. This improvement mainly stems from the graph structure modeling used in this invention, which represents behaviors that were originally scattered across different logs as nodes and multi-type relationship edges. This allows attack behaviors to be identified at the overall structural level, rather than relying on the features of a single log entry, thus significantly reducing false positives.

[0035] Regarding the false alarm rate, the traditional method has a false alarm rate of 9.6%, while the method of this invention reduces it to 6.1%. This difference is mainly due to the fact that this invention introduces attack semantic constraints and causal consistency constraints into the behavior association graph, which effectively filters out behavior combinations that only satisfy local anomalies but do not conform to the attack semantic structure, thus avoiding a large number of invalid alarms triggered by normal operation and maintenance behaviors.

[0036] The false negative rate was reduced from 7.8% for traditional methods to 5.2%, indicating that the present invention significantly enhances the ability to detect covert attacks. This improvement is due to the continuous update mechanism of the evolutionary behavior association graph. Even if attack behaviors are scattered over a long time window, they can be gradually aggregated through the graph evolution process, thus avoiding being ignored by traditional methods based on time windows or single-point rules.

[0037] In terms of attack path reconstruction completeness, traditional methods only achieve 68.5%, while the method of this invention improves it to 81.2%. This improvement stems from the explicit construction of behavioral interaction edges, dependency edges, and causal relationship edges in the graph structure, which enables the attack path to be presented in a structured and complete manner, rather than just providing scattered alarm information, thereby significantly enhancing the attack tracing capability.

[0038] Regarding the success rate of cross-log association, the traditional method achieves 62.7%, while the method of this invention reaches 79.4%. This difference demonstrates the significant advantage of this invention in multi-source log fusion. By unifying the identification of object elements and extracting behavioral elements, it maps behaviors from different log sources to the same graph structure, significantly improving the success probability of cross-log behavior association.

[0039] Regarding the average detection latency, the traditional method is 3.4s, while the method of this invention reduces it to 2.1s. Although this invention introduces graph modeling and graph neural network computation, it avoids full-scale repeated computation through incremental graph evolution updates and region-level feature aggregation, thereby optimizing the overall detection response time.

[0040] In terms of complex attack identification rate, traditional methods achieve only 64.9%, while the method of this invention reaches 76.3%. This significant improvement is mainly due to the introduction of attack semantic driving and causal consistency constraints in the neighborhood construction and region convolution stages of the improved Geom-GCN model, which enables the model to focus on substructures with attack evolution characteristics, thereby effectively identifying complex attack behaviors that are multi-stage, low-frequency, and cross-object.

[0041] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A host log attack detection method based on graph structure modeling, characterized in that, Includes the following steps: Acquire multi-source host log data generated during host operation and preprocess it to obtain a standardized log event set; Based on standardized log event sets, behavioral elements and object elements are extracted, and object element sets and behavioral element sets are output. Construct a host log behavior graph based on the set of object elements and the set of behavior elements; The host log behavior graph is modeled with attack semantics-oriented relational constraints to construct a behavior relation graph and extract attack semantic feature sets; During the continuous host operation period, the behavior association graph is updated based on the newly added logs, and the evolutionary behavior association graph set is generated by summarizing the data in the time order of the update cycle. Based on the improved Geom-GCN model, feature learning of geometric constraints and attack semantic constraints is performed on the evolutionary behavior association graph, generating node representation vectors and subgraph representation vectors and extracting graph structure feature sets; Attack pattern matching and determination are performed based on graph structure feature set, and an attack detection result set is generated.

2. The host log attack detection method based on graph structure modeling according to claim 1, characterized in that, The multi-source host log data includes system logs, audit logs, process logs, file access logs, and network connection logs. The preprocessing includes timestamp unification, log field standardization, log event structuring, noise event filtering, and missing field completion.

3. The host log attack detection method based on graph structure modeling according to claim 1, characterized in that, The outputs of the object element set and the behavior element set specifically include: Iterate through each standardized log event record in the standardized log event set, and read the log fields related to the event occurrence time, event type, object identification information, and behavioral context information to obtain the event field set; Perform field normalization processing based on the event field set to obtain a normalized event field set; Object feature extraction is performed based on the normalized event field set, and a unique object identifier is assigned to each type of object entity and written into the object attribute set; Based on the unique identifier of an object, perform deduplication and merging processing on the object entity to generate a set of object elements; Based on the standardized event field set and object element set, behavioral element extraction is performed, and a unique behavioral identifier is assigned to each behavioral element and written into the behavioral attribute set; Perform behavioral confidence calculation and filtering on the behavioral attribute set to generate a behavioral element set; Based on event identifiers, an association index is established between the object feature set and the behavior feature set, and the object feature set and the behavior feature set are output.

4. The host log attack detection method based on graph structure modeling according to claim 1, characterized in that, The construction of the host log behavior graph specifically includes: Receive the set of object elements, the set of behavior elements, and the event identifier association index. Map the object elements to the corresponding host entity nodes, user entity nodes, process entity nodes, file entity nodes, network endpoint entity nodes, and security event entity nodes according to the object type, and construct the node set. Associate each node in the node set with a corresponding set of object attributes, and establish a mapping relationship between the unique identifier of the object and the node; Traverse the set of behavioral elements, locate the corresponding entity nodes based on the unique identifiers of the subject and object of the behavior recorded in the behavioral attributes, and obtain the node pairs that construct the edge relationship; Based on the node-based association of execution behaviors, the process generates behavior interaction edges and associates the corresponding set of behavior attributes with the behavior interaction edges; Identify call dependencies and resource dependencies from the object element set and behavior element set, generate dependency edges between the corresponding entity nodes, and write the dependency type and dependency direction attributes into the edge attribute set; Based on the source event identifier and the time of occurrence of the behavior, the sequential relationship of the behavior interaction edge and the dependency edge is determined. Causal relationship edges are generated according to the triggering order, and the cause event identifier, result event identifier, causal direction and time interval attributes are written into the edge attribute set. Calculate the edge weight value for each edge and write the edge weight value into the edge attribute set; The behavioral interaction edges, dependency edges, and causal relationship edges are uniformly organized to generate a host log behavior graph that includes a set of nodes and a set of multiple types of edges.

5. The host log attack detection method based on graph structure modeling according to claim 1, characterized in that, The acquisition of the attack semantic feature set specifically includes: Parse the node set and edge set in the host log behavior graph, and establish an adjacency association index for the node set and edge set; Perform temporal constraint modeling on the edge set, and configure temporal attributes for the edge set based on the behavior occurrence time and time interval attributes; Perform causal constraint modeling on the edge set, and configure causal attributes for the edge set based on the causal event identifier, the result event identifier, and the causal direction information; Perform interaction strength modeling on the edge set, and configure interaction strength attributes for the edge set based on the edge weight value and the occurrence of the same type of edge within a unit time window; The temporal, causal, and interaction intensity attributes are uniformly written into the edge set, and the host log behavior graph is updated to generate a behavior association graph that includes multiple association constraint information. Semantic features are extracted from the node set and edge set based on the behavior association graph, and the temporal attributes, causal attributes and interaction strength attributes of the adjacent edges of the nodes are summarized based on the node adjacency association index, resulting in an attack semantic feature set composed of node attack semantic features and edge attack semantic features.

6. The host log attack detection method based on graph structure modeling according to claim 1, characterized in that, The generation of the evolutionary behavior association atlas specifically includes: The update cycle is divided within the continuous host operation time period, and the corresponding new standardized log event set is obtained in each update cycle. The new standardized log event set is associated with the behavior association graph output by the previous update cycle. Incremental object element extraction and incremental behavior element extraction are performed on the newly added standardized log event set to obtain the incremental object element set and the incremental behavior element set, and an event identifier association index is established for the incremental object element set and the incremental behavior element set; Incremental node updates are performed on the behavior association graph based on the incremental object feature set. The incremental object features are mapped to nodes and added to the node set. The object attribute field values ​​are added to the existing node associations that uniquely identify the objects, and the updated node set is generated. Incremental edge updates are performed on the behavior association graph based on the incremental set of behavior elements and the unique identifier of the object. Node pairs are located according to the unique identifier of the behavior subject object and the unique identifier of the behavior object object. New behavior interaction edges are generated and added to the edge set. New dependency relationship edges and new causal relationship edges are generated and added to the edge set according to the call dependency relationship, resource dependency relationship and trigger order relationship. Associate the new behavioral interaction edges with the corresponding behavioral attributes, dependency attributes, and causal attributes, and simultaneously update the temporal attributes, causal attributes, and interaction intensity attributes of the affected existing edges; The edge weights are updated based on the updated edge set, and the updated edge weights are written to the edge attribute set. Based on the updated set of nodes and edges, an evolutionary behavior association graph corresponding to the current update cycle is generated, and the evolutionary behavior association graphs obtained in each update cycle are summarized in chronological order to generate an evolutionary behavior association graph set.

7. The host log attack detection method based on graph structure modeling according to claim 1, characterized in that, The extraction of the graph structure feature set specifically includes: The evolutionary behavior association graphs are input into the improved Geom-GCN model in chronological order of update cycles, and the causal attributes and attack semantic feature sets in the node set, edge set, and edge attribute set of each behavior association graph are read. The improved Geom-GCN model, while maintaining the node embedding space construction structure, neighborhood construction structure, region convolution structure and representation output structure, introduces an attack semantic driving module in the neighborhood construction structure and a causal consistency constraint module in the region convolution structure. In the node embedding space construction structure, the node set is mapped to the set of node embedding representations in the embedding space; In the geometric relationship calculation module of the neighborhood construction structure, the geometric similarity score between nodes is calculated based on the node embedding representation set to generate geometric constraint information of candidate neighborhood relationships; In the neighborhood node filtering module, candidate neighborhood nodes of each center node are filtered based on geometric constraint information, and the filtered nodes are combined with the associated edge set to generate a candidate neighborhood substructure set. In the attack semantics-driven module, the attack semantics matching score is calculated on the candidate neighborhood substructure set based on the attack semantics feature set, and the attack semantics matching score is fused with the geometric similarity score to obtain the neighborhood selection weight. The attack semantics-constrained neighborhood substructure set is obtained by filtering according to the neighborhood selection weight. In the neighborhood region partitioning module, the neighborhood substructure set of attack semantic constraints is partitioned into regions, generating a neighborhood region substructure set, and recording the region node set and region edge set for each neighborhood region substructure. In the regional convolution structure, a regional convolution input set is constructed based on the set of neighborhood regional substructures. In the causal consistency constraint module, the set of nodes in the regional convolution input set is filtered according to the causal attributes associated with the edge set in the regional convolution input set to obtain a set of regional convolution nodes that satisfy the causal consistency constraint. In the region feature aggregation module, feature aggregation processing is performed on the set of region convolution nodes to obtain the set of region convolution output node representations; In the output structure, representation mapping and normalization are performed on the set of output node representations based on region convolution to generate a set of node representation vectors; Based on the set of node representation vectors, subgraph aggregation is performed on the set of substructures of the neighborhood region to generate a set of subgraph representation vectors. Based on the set of node representation vectors and the set of subgraph representation vectors, a set of graph structure features is extracted.

8. The host log attack detection method based on graph structure modeling according to claim 1, characterized in that, The generation of the attack detection result set specifically includes: The feature set of the graph structure is aligned and standardized to generate a feature input set; The feature input set is compared with the attack mode feature templates corresponding to the attack semantic label set to generate a pattern matching score set for each attack mode. Perform pattern score aggregation processing on the pattern matching score set to obtain the attack pattern score value; The attack pattern scores are sorted and analyzed. The attack pattern that ranks first in the sorting results is selected to generate an attack judgment result set that includes a set of attack-related nodes, a set of attack-related relationships, a set of attack-related paths, and a set of attack semantic tags. Based on the attack determination result set, an object scope mapping process is performed on the attack-related node set. The unique identifier of the object in the attack-related node set is mapped to host entity, user entity, process entity, file entity, network endpoint entity and security event entity, generating the scope of objects involved in the attack. Based on the attack determination result set, the attack-related relationship set is processed by relation structuring. The behavioral interaction edges, dependency edges and causal relationship edges in the attack-related relationship set are grouped by relation type and sorted by edge order attribute to generate the attack behavior relationship structure. The attack path sequence is obtained by organizing the path relationships formed by the attack-related node set and the attack-related relationship set based on the attack-related path set. Then, the consistency verification between the attack behavior relationship structure and the attack path sequence is performed based on the attack semantic tag set to determine the attack judgment result set that meets the attack judgment conditions. Based on the attack determination result set that meets the attack determination conditions, the attack-related node set is processed for event location association. The attack-related node set is associated with the corresponding source event identifier according to the event identifier association index, and event location information corresponding to the attack-related node set is generated. The attack detection result set is generated by structurally expressing and outputting the scope of the attack targets, the relationship structure of attack behaviors, the attack path sequence and event location information.

9. A host log attack detection system based on graph structure modeling, comprising executing the host log attack detection method based on graph structure modeling as described in any one of claims 1 to 8, characterized in that, include: The log preprocessing module is used to acquire multi-source host log data generated during host operation and perform preprocessing to generate standardized log event sets; The feature extraction module is used to extract object features and behavior features based on a standardized log event set, and generate object feature sets and behavior feature sets. The behavior graph construction module is used to construct host log behavior graphs based on object feature sets and behavior feature sets. The association constraint modeling module is used to perform attack semantic-oriented association constraint modeling on the host log behavior graph, generate a behavior association graph and extract an attack semantic feature set; The graph evolution update module is used to perform graph evolution updates on the behavior association graph based on newly added logs during a continuous host operation period, and to summarize and generate an evolution behavior association graph set according to the time order of the update cycle. The feature learning module is used to perform geometric and attack semantic constraints on the evolutionary behavior association graph based on the improved Geom-GCN model, generate node representation vectors, subgraph representation vectors and extract graph structure feature sets; The attack determination module is used to perform attack pattern matching and attack determination based on the graph structure feature set, and generate an attack detection result set.

Images