A host log attack detection method and system based on graph structure modeling

Abstract

The application discloses a host log attack detection method and system based on graph structure modeling, comprising the following steps: acquiring and preprocessing multi-source host log data; extracting behavior elements and object elements based on a standardized log event set; constructing a host log behavior graph based on the object element set and the behavior element set; modeling the correlation relationship constraint of the host log behavior graph, and extracting an attack semantic feature set; performing graph evolution update on the behavior correlation graph; performing geometric constraint and attack semantic constraint feature learning on the evolved behavior correlation graph set based on an improved Geom-GCN model, and extracting a graph structure feature set; performing attack pattern matching and judgment based on the graph structure feature set, and generating an attack detection result set. The application adopts the host log attack detection method based on graph structure modeling, realizes semantic constraint feature learning and accurate judgment of attack behaviors, and has the advantages of high detection accuracy, strong structure interpretability and good adaptability.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a host log attack detection method and system based on graph structure modeling. Background Technology

[0002] As information systems continue to expand, the amount of multi-source log data generated on the host side, including system logs, audit logs, process logs, file access logs, and network connection logs, continues to grow. Existing host security detection technologies are mostly based on rule matching, signature analysis, or single log source analysis, independently parsing and issuing alerts for log events. This makes it difficult to characterize the complex interactions, dependencies, and temporal relationships between different entities. While some methods incorporate statistical analysis or machine learning models, they typically use flattened feature vectors as input, ignoring the overall structural correlations of log behavior, resulting in limited ability to identify complex attack chains and cross-stage attack behaviors.

[0003] Existing technologies generally suffer from insufficient modeling of attack semantics, making it difficult to simultaneously constrain the temporal rationality, causal consistency, and interaction intensity variation characteristics of behavior during detection. They are also susceptible to the influence of noisy logs and anomalous behavior drift. Furthermore, traditional graph modeling methods often lack neighborhood selection mechanisms and causal consistency constraints for attack semantics during graph structure updates and feature learning. This results in the generated graph representation containing a large number of redundant structures unrelated to the attack, reducing detection accuracy and stability.

[0004] Therefore, how to provide a host log attack detection method and system based on graph structure modeling is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] One objective of this invention is to propose a host log attack detection method based on graph structure modeling. This invention adopts a host log attack detection method based on graph structure modeling to achieve semantic constraint feature learning and accurate judgment of attack behavior, and has the advantages of high detection accuracy, strong structural interpretability and good adaptability.

[0006] A host log attack detection method based on graph structure modeling according to an embodiment of the present invention includes the following steps:

[0007] Acquire multi-source host log data generated during host operation and preprocess it to obtain a standardized log event set;

[0008] Based on standardized log event sets, behavioral elements and object elements are extracted, and object element sets and behavioral element sets are output.

[0009] Construct a host log behavior graph based on the set of object elements and the set of behavior elements;

[0010] The host log behavior graph is modeled with attack semantics-oriented relational constraints to construct a behavior relation graph and extract attack semantic feature sets;

[0011] During the continuous host operation period, the behavior association graph is updated based on the newly added logs, and the evolutionary behavior association graph set is generated by summarizing the data in the time order of the update cycle.

[0012] Based on the improved Geom-GCN model, feature learning of geometric constraints and attack semantic constraints is performed on the evolutionary behavior association graph, generating node representation vectors and subgraph representation vectors and extracting graph structure feature set;

[0013] Attack pattern matching and determination are performed based on graph structure feature set, and an attack detection result set is generated.

[0014] Optionally, the multi-source host log data includes system logs, audit logs, process logs, file access logs, and network connection logs, and the preprocessing includes timestamp unification, log field standardization, log event structuring, noise event filtering, and missing field completion.

[0015] Optionally, the output of the object element set and the behavior element set specifically includes:

[0016] Iterate through each standardized log event record in the standardized log event set, and read the log fields related to the event occurrence time, event type, object identification information and behavior context information to obtain the event field set;

[0017] Perform field normalization processing based on the event field set to obtain a normalized event field set;

[0018] Object feature extraction is performed based on the normalized event field set, and a unique object identifier is assigned to each type of object entity and written into the object attribute set;

[0019] Based on the unique identifier of an object, perform deduplication and merging processing on the object entity to generate a set of object elements;

[0020] Based on the standardized event field set and object element set, behavioral element extraction is performed, and a unique behavioral identifier is assigned to each behavioral element and written into the behavioral attribute set;

[0021] Perform behavioral confidence calculation and filtering on the behavioral attribute set to generate a behavioral element set;

[0022] Based on event identifiers, an association index is established between the object feature set and the behavior feature set, and the object feature set and the behavior feature set are output.

[0023] Optionally, the construction of the host log behavior graph specifically includes:

[0024] Receive the set of object elements, the set of behavior elements, and the event identifier association index. Map the object elements to the corresponding host entity nodes, user entity nodes, process entity nodes, file entity nodes, network endpoint entity nodes, and security event entity nodes according to the object type, and construct the node set.

[0025] Associate each node in the node set with a corresponding set of object attributes, and establish a mapping relationship between the unique identifier of the object and the node;

[0026] Traverse the set of behavioral elements, locate the corresponding entity nodes based on the unique identifiers of the subject and object of the behavior recorded in the behavioral attributes, and obtain the node pairs that construct the edge relationship;

[0027] Based on the node-based association of execution behaviors, the process generates behavior interaction edges and associates the corresponding set of behavior attributes with the behavior interaction edges;

[0028] Identify call dependencies and resource dependencies from the object element set and behavior element set, generate dependency edges between the corresponding entity nodes, and write the dependency type and dependency direction attributes into the edge attribute set;

[0029] Based on the source event identifier and the time of occurrence of the behavior, the sequential relationship of the behavior interaction edge and the dependency edge is determined. Causal relationship edges are generated according to the triggering order, and the cause event identifier, result event identifier, causal direction and time interval attributes are written into the edge attribute set.

[0030] Calculate the edge weight value for each edge and write the edge weight value into the edge attribute set;

[0031] The behavioral interaction edges, dependency edges, and causal relationship edges are uniformly organized to generate a host log behavior graph that includes a set of nodes and a set of multiple types of edges.

[0032] Optionally, obtaining the attack semantic feature set specifically includes:

[0033] Parse the node set and edge set in the host log behavior graph, and establish an adjacency association index for the node set and edge set;

[0034] Perform temporal constraint modeling on the edge set, and configure temporal attributes for the edge set based on the behavior occurrence time and time interval attributes;

[0035] Perform causal constraint modeling on the edge set, and configure causal attributes for the edge set based on the causal event identifier, the result event identifier, and the causal direction information;

[0036] Perform interaction strength modeling on the edge set, and configure interaction strength attributes for the edge set based on the edge weight value and the occurrence of the same type of edge within a unit time window;

[0037] The temporal, causal, and interaction intensity attributes are uniformly written into the edge set, and the host log behavior graph is updated to generate a behavior association graph that includes multiple association constraint information.

[0038] Semantic features are extracted from the node set and edge set based on the behavior association graph, and the temporal attributes, causal attributes and interaction strength attributes of the adjacent edges of the nodes are summarized based on the node adjacency association index, resulting in an attack semantic feature set composed of node attack semantic features and edge attack semantic features.

[0039] Optionally, the generation of the evolutionary behavior association atlas specifically includes:

[0040] The update cycle is divided within the continuous host operation time period, and the corresponding new standardized log event set is obtained in each update cycle. The new standardized log event set is associated with the behavior association graph output by the previous update cycle.

[0041] Incremental object element extraction and incremental behavior element extraction are performed on the newly added standardized log event set to obtain the incremental object element set and the incremental behavior element set, and an event identifier association index is established for the incremental object element set and the incremental behavior element set;

[0042] Incremental node updates are performed on the behavior association graph based on the incremental object feature set. The incremental object features are mapped to nodes and added to the node set. The object attribute field values ​​are added to the existing node associations that uniquely identify the objects, and the updated node set is generated.

[0043] Incremental edge updates are performed on the behavior association graph based on the incremental set of behavior elements and the unique identifier of the object. Node pairs are located according to the unique identifier of the behavior subject object and the unique identifier of the behavior object object. New behavior interaction edges are generated and added to the edge set. New dependency relationship edges and new causal relationship edges are generated and added to the edge set according to the call dependency relationship, resource dependency relationship and trigger order relationship.

[0044] Associate the new behavioral interaction edges with the corresponding behavioral attributes, dependency attributes, and causal attributes, and simultaneously update the temporal attributes, causal attributes, and interaction intensity attributes of the affected existing edges;

[0045] The edge weights are updated based on the updated edge set, and the updated edge weights are written to the edge attribute set.

[0046] Based on the updated set of nodes and edges, an evolutionary behavior association graph corresponding to the current update cycle is generated, and the evolutionary behavior association graphs obtained in each update cycle are summarized in chronological order to generate an evolutionary behavior association graph set.

[0047] Optionally, the extraction of the graph structure feature set specifically includes:

[0048] The evolutionary behavior association graphs are input into the improved Geom-GCN model in chronological order of update cycles, and the causal attributes and attack semantic feature sets in the node set, edge set, and edge attribute set of each behavior association graph are read.

[0049] The improved Geom-GCN model, while maintaining the node embedding space construction structure, neighborhood construction structure, region convolution structure and representation output structure, introduces an attack semantic driving module in the neighborhood construction structure and a causal consistency constraint module in the region convolution structure.

[0050] In the node embedding space construction structure, the node set is mapped to the set of node embedding representations in the embedding space;

[0051] In the geometric relationship calculation module of the neighborhood construction structure, the geometric similarity score between nodes is calculated based on the node embedding representation set to generate geometric constraint information of candidate neighborhood relationships;

[0052] In the neighborhood node filtering module, candidate neighborhood nodes of each center node are filtered based on geometric constraint information, and the filtered nodes are combined with the associated edge set to generate a candidate neighborhood substructure set.

[0053] In the attack semantics-driven module, the attack semantics matching score is calculated on the candidate neighborhood substructure set based on the attack semantics feature set, and the attack semantics matching score is fused with the geometric similarity score to obtain the neighborhood selection weight. The attack semantics-constrained neighborhood substructure set is obtained by filtering according to the neighborhood selection weight.

[0054] In the neighborhood region partitioning module, the neighborhood substructure set of attack semantic constraints is partitioned into regions, generating a neighborhood region substructure set, and recording the region node set and region edge set for each neighborhood region substructure.

[0055] In the regional convolution structure, a regional convolution input set is constructed based on the set of neighborhood regional substructures. In the causal consistency constraint module, the set of nodes in the regional convolution input set is filtered according to the causal attributes associated with the edge set in the regional convolution input set to obtain a set of regional convolution nodes that satisfy the causal consistency constraint.

[0056] In the region feature aggregation module, feature aggregation processing is performed on the set of region convolution nodes to obtain the set of region convolution output node representations;

[0057] In the output structure, representation mapping and normalization are performed on the set of output node representations based on region convolution to generate a set of node representation vectors;

[0058] Based on the set of node representation vectors, subgraph aggregation is performed on the set of substructures of the neighborhood region to generate a set of subgraph representation vectors. Based on the set of node representation vectors and the set of subgraph representation vectors, a set of graph structure features is extracted.

[0059] Optionally, the generation of the attack detection result set specifically includes:

[0060] The feature set of the graph structure is aligned and standardized to generate a feature input set;

[0061] The feature input set is compared with the attack mode feature templates corresponding to the attack semantic label set to generate a pattern matching score set for each attack mode.

[0062] Perform pattern score aggregation processing on the pattern matching score set to obtain the attack pattern score value;

[0063] The attack pattern scores are sorted and analyzed. The attack pattern that ranks first in the sorting results is selected to generate an attack judgment result set that includes a set of attack-related nodes, a set of attack-related relationships, a set of attack-related paths, and a set of attack semantic tags.

[0064] Based on the attack determination result set, an object scope mapping process is performed on the attack-related node set. The unique identifier of the object in the attack-related node set is mapped to host entity, user entity, process entity, file entity, network endpoint entity and security event entity, generating the scope of objects involved in the attack.

[0065] Based on the attack determination result set, the attack-related relationship set is processed by relation structuring. The behavioral interaction edges, dependency edges and causal relationship edges in the attack-related relationship set are grouped by relation type and sorted by edge order attribute to generate the attack behavior relationship structure.

[0066] The attack path sequence is obtained by organizing the path relationships formed by the attack-related node set and the attack-related relationship set based on the attack-related path set. Then, the consistency verification between the attack behavior relationship structure and the attack path sequence is performed based on the attack semantic tag set to determine the attack judgment result set that meets the attack judgment conditions.

[0067] Based on the attack determination result set that meets the attack determination conditions, the attack-related node set is processed for event location association. The attack-related node set is associated with the corresponding source event identifier according to the event identifier association index, and event location information corresponding to the attack-related node set is generated.

[0068] The attack detection result set is generated by structurally expressing and outputting the scope of the attack targets, the relationship structure of attack behaviors, the attack path sequence and event location information.

[0069] A host log attack detection system based on graph structure modeling according to an embodiment of the present invention includes:

[0070] The log preprocessing module is used to acquire multi-source host log data generated during host operation and perform preprocessing to generate standardized log event sets;

[0071] The feature extraction module is used to extract object features and behavior features based on a standardized log event set, and generate object feature sets and behavior feature sets.

[0072] The behavior graph construction module is used to construct host log behavior graphs based on object feature sets and behavior feature sets.

[0073] The association constraint modeling module is used to perform attack semantic-oriented association constraint modeling on the host log behavior graph, generate a behavior association graph and extract an attack semantic feature set;

[0074] The graph evolution update module is used to perform graph evolution updates on the behavior association graph based on newly added logs during a continuous host operation period, and to summarize and generate an evolution behavior association graph set according to the time order of the update cycle.

[0075] The feature learning module is used to perform geometric and attack semantic constraints on the evolutionary behavior association graph based on the improved Geom-GCN model, generate node representation vectors, subgraph representation vectors and extract graph structure feature sets;

[0076] The attack determination module is used to perform attack pattern matching and attack determination based on the graph structure feature set, and generate an attack detection result set.

[0077] The beneficial effects of this invention are:

[0078] This invention unifies the modeling of multi-source host logs, transforming scattered and heterogeneous log events into a host log behavior graph with relationships. Based on this, it introduces attack-semantic-oriented relationship constraint modeling and graph evolution update mechanisms, enabling log data to reflect behavioral interactions, dependencies, and temporal causal relationships between object entities at the structural level. Through continuous evolution modeling of the behavior relationship graph, this invention effectively adapts to the characteristics of continuous log generation and changing behavior patterns during host operation, avoiding feature lag issues caused by static modeling, thereby improving the coverage of long-term latent attacks and phased attack behaviors.

[0079] In the feature learning stage, this invention introduces an attack semantics-driven mechanism and a causal consistency constraint mechanism into the graph neural network model. This ensures that the neighborhood construction and region convolution processes not only consider the geometric proximity between nodes but also simultaneously constrain the matching degree and causal consistency of nodes and edges at the attack semantics level. By performing semantic filtering and causal verification on the neighborhood substructures, redundant structures unrelated to the attack can be significantly reduced from participating in feature aggregation. This makes the generated node representation vectors and subgraph representation vectors more focused on attack-related behavioral patterns, thereby improving the expressive and discriminative power of graph structure features for attack semantics.

[0080] In the attack determination phase, this invention performs attack pattern matching and comprehensive scoring based on graph structure features, uniformly determining node-level, path-level, and structure-level information, and further generating structured attack detection results. This approach not only provides a determination of whether an attack has occurred, but also clarifies the scope of the attack-related objects, behavioral relationship structure, attack path sequence, and corresponding event location information, providing traceable and interpretable detection evidence for security analysis and incident response. Compared to existing technologies, this invention significantly improves the accuracy, stability, and interpretability of attack detection, making it suitable for continuous security monitoring scenarios in complex host environments. Attached Figure Description

[0081] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0082] Figure 1 This is a flowchart of a host log attack detection method based on graph structure modeling proposed in this invention;

[0083] Figure 2 This is a schematic diagram illustrating the evolution behavior association graph generation process of a host log attack detection method based on graph structure modeling proposed in this invention.

[0084] Figure 3 This is a flowchart illustrating the graph structure feature set extraction process for a host log attack detection method based on graph structure modeling proposed in this invention. Detailed Implementation

[0085] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0086] like Figure 1 As shown, a host log attack detection method based on graph structure modeling includes the following steps:

[0087] Acquire multi-source host log data generated during host operation and preprocess it to obtain a standardized log event set;

[0088] Based on standardized log event sets, behavioral elements and object elements are extracted, and object element sets and behavioral element sets are output.

[0089] Construct a host log behavior graph based on the set of object elements and the set of behavior elements;

[0090] The host log behavior graph is modeled with attack semantics-oriented relational constraints to construct a behavior relation graph and extract attack semantic feature sets;

[0091] During the continuous host operation period, the behavior association graph is updated based on the newly added logs, and the evolutionary behavior association graph set is generated by summarizing the data in the time order of the update cycle.

[0092] Based on the improved Geom-GCN model, feature learning of geometric constraints and attack semantic constraints is performed on the evolutionary behavior association graph, generating node representation vectors and subgraph representation vectors and extracting graph structure feature sets;

[0093] Attack pattern matching and determination are performed based on graph structure feature set, and an attack detection result set is generated.

[0094] In this embodiment, the multi-source host log data includes system logs, audit logs, process logs, file access logs, and network connection logs. The preprocessing includes timestamp unification, log field standardization, log event structuring, noise event filtering, and missing field completion.

[0095] In this embodiment, the output of the object element set and the behavior element set specifically includes:

[0096] Iterate through each standardized log event record in the standardized log event set, and read the log fields related to the event occurrence time, event type, object identification information and behavior context information to obtain the event field set;

[0097] Based on the event field set, field normalization processing is performed to obtain a normalized event field set. The field normalization processing includes host identifier unification, user identifier unification, process identifier unification, file path normalization, network endpoint normalization, and event type normalization.

[0098] Object feature extraction is performed based on a standardized event field set, and a unique object identifier is assigned to each type of object entity and written into the object attribute set. The object feature extraction includes extracting host entities, user entities, process entities, file entities, network endpoint entities and security event entities according to object type. The object attribute set includes object type, object unique identifier, source log type, source event identifier and object-related field values.

[0099] Based on the unique identifier of an object, the deduplication and merging process is performed on the object entity to generate a set of object elements. The deduplication and merging process includes merging the host identifier, merging the user identifier, merging the process identifier and host identifier together, merging the file path, merging the network endpoint address and port, and merging the security event identifier.

[0100] Behavioral element extraction is performed based on a standardized event field set and object element set. Each behavior is assigned a unique behavior identifier and written into a behavior attribute set. The behavior element extraction includes identifying login behavior, process creation behavior, inter-process call behavior, file read / write behavior, permission change behavior, network connection behavior, and resource access behavior according to the combination relationship between event type and object entity. The behavior attribute set includes behavior type, behavior unique identifier, behavior occurrence time, behavior subject object unique identifier, behavior object unique identifier, source event identifier, and behavior-related field values.

[0101] The behavioral attribute set is subjected to behavioral confidence calculation and filtering to generate a behavioral element set. The behavioral confidence calculation includes weighting and fusing the corresponding scores based on field matching consistency weight, cross-log consistency weight and context consistency weight to obtain the behavioral confidence value. The filtering process includes deleting behavioral elements with behavioral confidence values ​​lower than a preset confidence threshold and performing missing field completion on the retained behavioral elements.

[0102] The field matching consistency weight is calculated by taking into account the proportion of the number of valid fields in the log records corresponding to the statistical behavior to the total number of fields associated with the behavior, and the consistency of field values ​​in the standardized log event set.

[0103] The cross-log consistency weight is obtained by statistically analyzing the frequency of the same behavior in different types of host logs and their corresponding time, and by summarizing and calculating the degree of consistency of behavior in different log sources.

[0104] The context consistency weight is calculated by the time interval relationship between the statistical behavior and the preceding and subsequent behaviors in the host log behavior sequence, the object association continuity relationship, and the rationality of the behavior order.

[0105] Based on event identifiers, an association index is established between the object feature set and the behavior feature set, and the object feature set and the behavior feature set are output.

[0106] In this embodiment, the construction of the host log behavior graph specifically includes:

[0107] Receive the set of object elements, the set of behavior elements, and the event identifier association index. Map the object elements to the corresponding host entity nodes, user entity nodes, process entity nodes, file entity nodes, network endpoint entity nodes, and security event entity nodes according to the object type, and construct the node set.

[0108] Associate each node in the node set with a corresponding set of object attributes, and establish a mapping relationship between the unique identifier of the object and the node;

[0109] Traverse the set of behavioral elements, locate the corresponding entity nodes based on the unique identifiers of the subject and object of the behavior recorded in the behavioral attributes, and obtain the node pairs that construct the edge relationship;

[0110] Based on the node-based behavior association construction process, behavior interaction edges representing the relationship between object elements are generated, and the corresponding behavior attribute set is associated in the behavior interaction edges;

[0111] Identify call dependencies and resource dependencies from the object element set and behavior element set, generate dependency edges between the corresponding entity nodes, and write the dependency type and dependency direction attributes into the edge attribute set;

[0112] Based on the source event identifier and the time of occurrence of the behavior, the sequential relationship of the behavior interaction edge and the dependency edge is determined. Causal relationship edges are generated according to the triggering order, and the cause event identifier, result event identifier, causal direction and time interval attributes are written into the edge attribute set.

[0113] For each edge, calculate the edge weight value and write the edge weight value into the edge attribute set. The edge weight value is obtained by weighted fusion calculation of the behavior confidence value and the number of times the same type of edge appears within a unit time window.

[0114] The behavioral interaction edges, dependency edges, and causal relationship edges are uniformly organized to generate a host log behavior graph that includes a set of nodes and a set of multiple types of edges.

[0115] In this embodiment, obtaining the attack semantic feature set specifically includes:

[0116] Parse the node set and edge set in the host log behavior graph, and establish an adjacency association index for the node set and edge set;

[0117] Temporal constraint modeling is performed on the edge set. Temporal attributes are configured for the edge set based on the behavior occurrence time and time interval attributes. The temporal attributes include edge order attributes and temporal consistency attributes. The edge order attributes are obtained by sorting the edges that connect the unique identifiers of the same behavior subject object and the unique identifiers of the behavior object according to the behavior occurrence time. The temporal consistency attributes are obtained by normalizing and mapping the edge time interval attributes to a unit time window.

[0118] Causal constraint modeling is performed on the edge set. Causal attributes are configured for the edge set based on the cause event identifier, the result event identifier, and the causal direction information. The causal attributes include causal validity attributes and causal consistency attributes. The causal validity attributes are obtained by statistically analyzing the traceability relationship between the cause event identifier and the result event identifier in the event identifier association index. The causal consistency attributes are obtained by matching and calculating the consistency relationship between the causal direction and the edge order attributes.

[0119] The interaction intensity model is performed on the edge set. The interaction intensity attribute is configured for the edge set according to the edge weight value and the occurrence of the same type of edge within a unit time window. The interaction intensity attribute is obtained by weighted fusion calculation of the edge weight value and the occurrence of the same type of edge within a unit time window. The occurrence of the same type of edge is the number of the same type of edge connecting the unique identifier of the same behavior subject object and the unique identifier of the behavior object within a unit time window.

[0120] The temporal, causal, and interaction intensity attributes are uniformly written into the edge set, and the host log behavior graph is updated to generate a behavior association graph that includes multiple association constraint information.

[0121] Semantic features are extracted from the node set and edge set based on the behavioral association graph. The temporal attributes, causal attributes and interaction strength attributes of the adjacent edges of the nodes are summarized based on the node adjacency association index. An attack semantic feature set consisting of node attack semantic features and edge attack semantic features is obtained. The node attack semantic features include login anomaly feature values, permission change anomaly feature values, process chain anomaly feature values, file access anomaly feature values ​​and network connection anomaly feature values. The edge attack semantic features include temporal anomaly feature values, causal conflict feature values ​​and interaction anomaly feature values.

[0122] like Figure 2 As shown, in this embodiment, the generation of the evolutionary behavior association atlas specifically includes:

[0123] The update cycle is divided within the continuous host operation time period, and the corresponding new standardized log event set is obtained in each update cycle. The new standardized log event set is associated with the behavior association graph output by the previous update cycle.

[0124] Incremental object element extraction and incremental behavior element extraction are performed on the newly added standardized log event set to obtain the incremental object element set and the incremental behavior element set, and an event identifier association index is established for the incremental object element set and the incremental behavior element set;

[0125] Incremental node updates are performed on the behavior association graph based on the incremental object feature set. The incremental object features are mapped to nodes and added to the node set. The object attribute field values ​​are added to the existing node associations that uniquely identify the objects, and the updated node set is generated.

[0126] Incremental edge updates are performed on the behavior association graph based on the incremental set of behavior elements and the unique identifier of the object. Node pairs are located according to the unique identifier of the behavior subject object and the unique identifier of the behavior object object. New behavior interaction edges are generated and added to the edge set. New dependency relationship edges and new causal relationship edges are generated and added to the edge set according to the call dependency relationship, resource dependency relationship and trigger order relationship.

[0127] Associate the new behavioral interaction edges with the corresponding behavioral attributes, dependency attributes, and causal attributes, and simultaneously update the temporal attributes, causal attributes, and interaction intensity attributes of the affected existing edges;

[0128] The edge weight values ​​are updated based on the updated edge set, and the updated edge weight values ​​are written into the edge attribute set. The edge weight values ​​are obtained by weighted fusion calculation of the behavior confidence value and the number of times the same type of edge appears within a unit time window.

[0129] Based on the updated set of nodes and edges, an evolutionary behavior association graph corresponding to the current update cycle is generated, and the evolutionary behavior association graphs obtained in each update cycle are summarized in chronological order to generate an evolutionary behavior association graph set.

[0130] like Figure 3 As shown, in this embodiment, the extraction of the graph structure feature set specifically includes:

[0131] The evolutionary behavior association graphs are input into the improved Geom-GCN model in chronological order of update cycles, and the causal attributes and attack semantic feature sets in the node set, edge set, and edge attribute set of each behavior association graph are read.

[0132] The improved Geom-GCN model, while maintaining the node embedding space construction structure, neighborhood construction structure, region convolution structure and representation output structure, introduces an attack semantic driving module in the neighborhood construction structure and a causal consistency constraint module in the region convolution structure.

[0133] In the node embedding space construction structure, the node set is mapped to the set of node embedding representations in the embedding space;

[0134] In the geometric relationship calculation module of the neighborhood construction structure, the geometric similarity score between nodes is calculated based on the node embedding representation set to generate geometric constraint information of candidate neighborhood relationships;

[0135] Obtaining the geometric constraint information includes: in the geometric relationship calculation module, receiving a set of node embedding representations, where each node embedding representation is a vector representation composed of multiple dimensional values; taking any node as the center node, sequentially selecting the remaining nodes in the node embedding representation set as comparison nodes, calculating the numerical differences between the node embedding representations of the center node and the comparison nodes in each corresponding dimension, and squaring and summing the numerical differences in each dimension to obtain the median value of the geometric distance between the center node and the comparison nodes; and performing a square root operation on the median value of the geometric distance to obtain the center node's geometric distance. The geometric distance between the node and the comparison node in the embedding space is calculated. A reverse mapping process is performed on the geometric distance values ​​to convert them into basic similarity values ​​representing the closeness of the nodes. These basic similarity values ​​are then normalized to ensure that the geometric similarity scores fall within a uniform numerical range. The geometric similarity scores corresponding to the center node are sorted, and nodes whose geometric similarity scores satisfy the proximity constraint are selected as candidate neighbor nodes. Geometric proximity relationship data between the candidate neighbor nodes and the center node is constructed based on the geometric similarity scores, and this data is then organized to generate geometric constraint information.

[0136] In the neighborhood node filtering module, candidate neighborhood nodes of each center node are filtered based on geometric constraint information, and the filtered nodes are combined with the associated edge set to generate a candidate neighborhood substructure set.

[0137] In the attack semantics-driven module, the attack semantics matching score is calculated on the candidate neighborhood substructure set based on the attack semantics feature set, and the attack semantics matching score is fused with the geometric similarity score to obtain the neighborhood selection weight. The attack semantics-constrained neighborhood substructure set is obtained by filtering according to the neighborhood selection weight.

[0138] The calculation of the attack semantic matching score specifically includes: in the attack semantic driving module, extracting semantic features related to node behavior type, event timing features, causal relationship features, and interaction strength features from the attack semantic feature set, and mapping the semantic features to semantic feature representations that correspond one-to-one with nodes and edges in the candidate neighborhood substructure; performing consistency comparison processing on the semantic feature representations of each node and edge in the candidate neighborhood substructure with the corresponding semantic features in the attack semantic feature set to generate node-level semantic matching scores and edge-level semantic matching scores; performing a summary calculation on the node-level semantic matching scores and edge-level semantic matching scores to obtain the attack semantic matching score that characterizes the degree of matching between the candidate neighborhood substructure and the attack semantic feature set;

[0139] The specific steps for obtaining the attack semantic constraint neighborhood substructure set include: performing a weighted fusion process on the attack semantic matching score and the geometric similarity score to generate a neighborhood selection weight that characterizes the overall neighborhood credibility of the candidate neighborhood substructure; comparing the neighborhood selection weights corresponding to each candidate neighborhood substructure in the candidate neighborhood substructure set and sorting them from high to low according to the neighborhood selection weights; selecting the candidate neighborhood substructures located in the first interval of the sorting results as retained substructures and eliminating the remaining candidate neighborhood substructures; and summarizing the selected and retained candidate neighborhood substructures to obtain the attack semantic constraint neighborhood substructure set.

[0140] In the neighborhood region partitioning module, the neighborhood substructure set of attack semantic constraints is partitioned into regions, generating a neighborhood region substructure set, and recording the region node set and region edge set for each neighborhood region substructure.

[0141] In the regional convolution structure, a regional convolution input set is constructed based on the set of neighborhood regional substructures. In the causal consistency constraint module, the set of nodes in the regional convolution input set is filtered according to the causal attributes associated with the edge set in the regional convolution input set to obtain a set of regional convolution nodes that satisfy the causal consistency constraint.

[0142] The specific steps for obtaining the set of region convolutional nodes include: in the region convolutional structure, reading the set of region nodes, the set of region edges, and the causal attributes associated with the region edge sets corresponding to the neighboring region substructures; based on the cause event identifier, result event identifier, and causal direction information recorded in the region edge sets, performing causal relationship parsing on the nodes in the region node set to determine the causal relationship position of each node in the region node set within the neighboring region substructure; in the causal consistency constraint module, performing consistency verification on the causal relationship positions corresponding to each node in the region node set, and selecting nodes whose causal direction is consistent with the sequential relationship between nodes as candidate region convolutional nodes; performing integrity verification on the causal relationship between candidate region convolutional nodes, and removing nodes with missing causal relationships or conflicting causal directions; and summarizing the nodes that pass the causal consistency verification and have complete causal relationships to obtain the set of region convolutional nodes.

[0143] In the regional feature aggregation module, feature aggregation processing is performed on the set of regional convolutional nodes to obtain a set of regional convolutional output node representations. The feature aggregation processing includes weighted aggregation of the embedded representations of neighboring nodes according to the neighborhood selection weight and fusion of edge attribute set information.

[0144] In the output structure, representation mapping and normalization are performed on the set of output node representations based on region convolution to generate a set of node representation vectors;

[0145] Based on the set of node representation vectors, subgraph aggregation is performed on the set of substructures of the neighborhood region to generate a set of subgraph representation vectors. Based on the set of node representation vectors and the set of subgraph representation vectors, a set of graph structure features is extracted. The set of graph structure features includes abnormal substructure features, abnormal path features, and abnormal association pattern features.

[0146] In this embodiment, the generation of the attack detection result set specifically includes:

[0147] The feature set of the graph structure is aligned and standardized to generate a feature input set;

[0148] The feature input set is compared with the attack mode feature templates corresponding to the attack semantic label set to generate a pattern matching score set for each attack mode.

[0149] A pattern score aggregation process is performed on the pattern matching score set to obtain the attack pattern score value. The pattern score aggregation process includes weighted fusion of node-level matching score, path-level matching score and associated pattern-level matching score according to the node contribution weight, path contribution weight and associated pattern contribution weight.

[0150] The attack pattern scores are sorted and analyzed. The attack pattern that ranks first in the sorting results is selected to generate an attack judgment result set that includes a set of attack-related nodes, a set of attack-related relationships, a set of attack-related paths, and a set of attack semantic tags.

[0151] The attack-related node set represents the set of nodes in the attack determination result set that correspond to the target attack mode. The unique identifier of the object in the attack-related node set is used to perform object range mapping to obtain the range of objects involved in the attack.

[0152] The attack-related relationship set represents the set of behavioral interaction edges, dependency edges, and causal relationship edges associated with the attack-related node set. The attack-related relationship set is used for relationship structuring to generate an attack behavior relationship structure.

[0153] The attack-related path set represents a set of paths formed by connecting the attack-related node set and the attack-related relationship set. The attack-related path set is used to organize the attack path sequence.

[0154] The attack semantic tag set represents the attack semantic tags corresponding to the target attack mode and the set of attack structure features defined thereto. The attack semantic tag set is used to perform consistency verification on the relation structure and path structure in the attack judgment result set.

[0155] Based on the attack determination result set, an object scope mapping process is performed on the attack-related node set. The unique identifier of the object in the attack-related node set is mapped to host entity, user entity, process entity, file entity, network endpoint entity and security event entity, generating the scope of objects involved in the attack.

[0156] Based on the attack determination result set, the attack-related relationship set is processed by relation structuring. The behavioral interaction edges, dependency edges and causal relationship edges in the attack-related relationship set are grouped by relation type and sorted by edge order attribute to generate the attack behavior relationship structure.

[0157] The attack path sequence is obtained by organizing the path relationships formed by the attack-related node set and the attack-related relationship set based on the attack-related path set. Then, the consistency verification between the attack behavior relationship structure and the attack path sequence is performed based on the attack semantic tag set to determine the attack judgment result set that meets the attack judgment conditions.

[0158] The attack determination criteria include: within the same update cycle, the attack mode that ranks first in the attack mode score ranking, the attack-related node set, attack-related relationship set and attack-related path set corresponding to it, the temporal attribute order of each side is consistent, the causal attribute direction is consistent, and the combination structure of behavioral interaction relationship, dependency relationship and causal relationship corresponds one-to-one with the attack structure features defined in the attack semantic tag set.

[0159] Based on the attack determination result set that meets the attack determination conditions, the attack-related node set is processed for event location association. The attack-related node set is associated with the corresponding source event identifier according to the event identifier association index, and event location information corresponding to the attack-related node set is generated.

[0160] The attack detection result set is generated by structurally expressing and outputting the scope of the attack targets, the relationship structure of attack behaviors, the attack path sequence and event location information.

[0161] A host log attack detection system based on graph structure modeling includes:

[0162] The log preprocessing module is used to acquire multi-source host log data generated during host operation and perform preprocessing to generate standardized log event sets;

[0163] The feature extraction module is used to extract object features and behavior features based on a standardized log event set, and generate object feature sets and behavior feature sets.

[0164] The behavior graph construction module is used to construct host log behavior graphs based on object feature sets and behavior feature sets.

[0165] The association constraint modeling module is used to perform attack semantic-oriented association constraint modeling on the host log behavior graph, generate a behavior association graph and extract an attack semantic feature set;

[0166] The graph evolution update module is used to perform graph evolution updates on the behavior association graph based on newly added logs during a continuous host operation period, and to summarize and generate an evolution behavior association graph set according to the time order of the update cycle.

[0167] The feature learning module is used to perform geometric and attack semantic constraints on the evolutionary behavior association graph based on the improved Geom-GCN model, generate node representation vectors, subgraph representation vectors and extract graph structure feature sets;

[0168] The attack determination module is used to perform attack pattern matching and attack determination based on the graph structure feature set, and generate an attack detection result set. Example 1:

[0169] To verify the feasibility of this invention in practice, it was applied to an enterprise internal server operating environment. This environment deployed multiple business hosts, which continuously carried out database services, file sharing services, and internal application services. During the operation of these hosts, system logs, audit logs, process logs, file access logs, and network connection logs were continuously generated. In this environment, the number of hosts was large and the log sources were complex. Attack behaviors often exhibited combined behaviors across processes, users, and log types. Traditional detection methods based on single log rules or independent alarms were difficult to reconstruct the complete attack process, easily leading to problems such as high false positives, weak correlation, and difficulty in tracing the source.

[0170] In this scenario, the present invention first performs unified access and preprocessing of multi-source logs continuously generated by various hosts, converting different log formats into a standardized log event set, ensuring consistent representation of event time, object identifiers, and behavioral semantics. Based on this, object and behavioral elements are extracted from the standardized log events. Hosts, users, processes, files, network endpoints, and security events are abstracted as object elements, while operations such as login, process creation, file read / write, permission changes, and network connections are abstracted as behavioral elements. Subsequently, a host log behavior graph is constructed based on the object and behavioral elements, unifying the behaviors originally scattered across various logs into nodes and multi-type edges within the graph structure.

[0171] During continuous host operation, the system continuously receives new logs. This invention incrementally updates the behavior association graph through a graph evolution update mechanism, enabling the behavior association graph to evolve over time and fully reflect the stage changes of attack behavior. Based on this, an improved Geom-GCN model is introduced to learn features from the evolving behavior association graph. Geometric constraints characterize the structural similarity between nodes, and attack semantic constraints guide neighborhood construction and region convolution, allowing the model to focus on combinations of behaviors with consistent attack semantics, thereby obtaining more discriminative node representations, subgraph representations, and graph structure features.

[0172] During attack detection, the system matches a graph structure feature set with predefined attack semantic patterns, automatically identifying complex attack paths that evolve from multiple low-risk behaviors. It then outputs detection results containing information about attack-related objects, attack relationship structures, and event location. Continuous application in real-world environments demonstrates that, compared to relying solely on single log rules, this invention can complete overall correlation identification before attacks cause significant damage, reducing scattered alerts and improving the completeness and interpretability of attack path reconstruction. Furthermore, due to the introduction of a graph evolution mechanism, the system can adapt to changes in host operating states and behavioral patterns, maintaining stable detection capabilities and providing operations personnel with clear and traceable security analysis data. This verifies the practicality and effectiveness of this invention in complex host log scenarios.

[0173] Table 1. Performance Comparison of the Invention and Traditional Host Log Attack Detection Methods

[0174]

[0175] As can be clearly seen from Table 1, the method of the present invention is superior to the traditional method in many indicators.

[0176] The attack detection accuracy shows that the traditional method has an accuracy of 86.4%, while the method of this invention achieves 93.8%, an improvement of 7.4 percentage points. This improvement mainly stems from the graph structure modeling used in this invention, which represents behaviors that were originally scattered across different logs as nodes and multi-type relationship edges. This allows attack behaviors to be identified at the overall structural level, rather than relying on the features of a single log entry, thus significantly reducing false positives.

[0177] Regarding the false alarm rate, the traditional method has a false alarm rate of 9.6%, while the method of this invention reduces it to 6.1%. This difference is mainly due to the fact that this invention introduces attack semantic constraints and causal consistency constraints into the behavior association graph, which effectively filters out behavior combinations that only satisfy local anomalies but do not conform to the attack semantic structure, thus avoiding a large number of invalid alarms triggered by normal operation and maintenance behaviors.

[0178] The false negative rate was reduced from 7.8% for traditional methods to 5.2%, indicating that the present invention significantly enhances the ability to detect covert attacks. This improvement is due to the continuous update mechanism of the evolutionary behavior association graph. Even if attack behaviors are scattered over a long time window, they can be gradually aggregated through the graph evolution process, thus avoiding being ignored by traditional methods based on time windows or single-point rules.

[0179] In terms of attack path reconstruction completeness, traditional methods only achieve 68.5%, while the method of this invention improves it to 81.2%. This improvement stems from the explicit construction of behavioral interaction edges, dependency edges, and causal relationship edges in the graph structure, which enables the attack path to be presented in a structured and complete manner, rather than just providing scattered alarm information, thereby significantly enhancing the attack tracing capability.

[0180] Regarding the success rate of cross-log association, the traditional method achieves 62.7%, while the method of this invention reaches 79.4%. This difference demonstrates the significant advantage of this invention in multi-source log fusion. By unifying the identification of object elements and extracting behavioral elements, it maps behaviors from different log sources to the same graph structure, significantly improving the success probability of cross-log behavior association.

[0181] Regarding the average detection latency, the traditional method is 3.4s, while the method of this invention reduces it to 2.1s. Although this invention introduces graph modeling and graph neural network computation, it avoids full-scale repeated computation through incremental graph evolution updates and region-level feature aggregation, thereby optimizing the overall detection response time.

[0182] In terms of complex attack identification rate, traditional methods achieve only 64.9%, while the method of this invention reaches 76.3%. This significant improvement is mainly due to the introduction of attack semantic driving and causal consistency constraints in the neighborhood construction and region convolution stages of the improved Geom-GCN model, which enables the model to focus on substructures with attack evolution characteristics, thereby effectively identifying complex attack behaviors that are multi-stage, low-frequency, and cross-object.

[0183] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for detecting host log attacks based on graph structure modeling, characterized in that, The method comprises the following steps: obtaining multi-source host log data generated during host operation and preprocessing the multi-source host log data to obtain a standardized log event set; performing behavior element extraction and object element extraction based on the standardized log event set to output an object element set and a behavior element set; constructing a host log behavior graph based on the object element set and the behavior element set; performing attack semantic-oriented association relationship constraint modeling on the host log behavior graph, constructing a behavior association graph, and extracting an attack semantic feature set; performing graph evolution update on the behavior association graph based on new logs in a continuous host operation time period, and generating an evolved behavior association graph set in time sequence of an update cycle; performing feature learning of geometric constraint and attack semantic constraint on the evolved behavior association graph set based on an improved Geom-GCN model to generate node representation vectors and subgraph representation vectors and extract a graph structure feature set; performing attack pattern matching and judgment based on the graph structure feature set to generate an attack detection result set. 2.The host log attack detection method based on graph structure modeling according to claim 1, wherein, The multi-source host log data comprises system logs, audit logs, process logs, file access logs, and network connection logs, and the preprocessing comprises timestamp unification, log field standardization, log event structuring, noise event filtering, and missing field completion. 3.The host log attack detection method based on graph structure modeling according to claim 1, wherein, The output of the object element set and the behavior element set specifically comprises: traversing each standardized log event record in the standardized log event set, reading log fields related to event occurrence time, event type, object identification information, and behavior context information to obtain an event field set; performing field standardization processing based on the event field set to obtain a standardized event field set; performing object element extraction based on the standardized event field set, and assigning an object unique identifier to each type of object entity and writing it into an object attribute set; performing de-duplication processing on object entities based on the object unique identifier to generate an object element set; performing behavior element extraction based on the standardized event field set and the object element set, and assigning a behavior unique identifier to each behavior and writing it into a behavior attribute set; performing behavior confidence calculation and screening processing on the behavior attribute set to generate a behavior element set; associating the object element set and the behavior element set based on the event identifier, and outputting the object element set and the behavior element set.

4. The method of claim 1, wherein, The construction of the host log behavior graph specifically comprises: receiving the object element set, the behavior element set, and the event identifier association index, mapping the object elements into corresponding host entity nodes, user entity nodes, process entity nodes, file entity nodes, network endpoint entity nodes, and security event entity nodes according to object types to construct a node set; associating the object attribute set with each node in the node set, and establishing a mapping relationship between the object unique identifier and the node; traversing the behavior element set, locating the corresponding entity nodes according to the behavior subject object unique identifier and the behavior object unique identifier recorded in the behavior attribute, and obtaining a node pair for constructing an edge relationship; performing behavior association construction processing based on the node pair to generate a behavior interaction edge, and associating the corresponding behavior attribute set in the behavior interaction edge; Identify the invocation dependency and resource dependency from the object element set and the behavior element set, generate dependency edges between the corresponding entity nodes respectively, and write the dependency type and dependency direction attributes into the edge attribute set; Determine the precedence relationship of the behavior interaction edge and the dependency edge based on the source event identification and the behavior occurrence time, generate the cause-effect association edge according to the trigger precedence relationship, and write the cause event identification, result event identification, cause-effect direction and time interval attributes into the edge attribute set; Calculate the edge weight value for each edge, and write the edge weight value into the edge attribute set; Unify the behavior interaction edge, the dependency edge and the cause-effect association edge, and generate the host log behavior graph including the node set and the multi-type edge set.

5. The method of claim 1, wherein, The attack semantic feature set is obtained, which specifically includes: Parse the node set and the edge set in the host log behavior graph, and establish the adjacency association index of the node set and the edge set; Perform time sequence constraint modeling on the edge set, and configure the time sequence attribute for the edge set according to the behavior occurrence time and the time interval attribute; Perform cause-effect constraint modeling on the edge set, and configure the cause-effect attribute for the edge set according to the cause event identification, the result event identification and the cause-effect direction information; Perform interaction intensity modeling on the edge set, and configure the interaction intensity attribute for the edge set according to the edge weight value and the occurrence of the same type of edge in the unit time window; Unify the time sequence attribute, the cause-effect attribute and the interaction intensity attribute into the edge set, update the host log behavior graph, and generate the behavior association graph including the multi-relation constraint information; Based on the behavior association graph, the semantic features of the node set and the edge set are extracted, and the time sequence attribute, the cause-effect attribute and the interaction intensity attribute of the adjacent edges of the node are summarized based on the node adjacency association index, to obtain the attack semantic feature set composed of node attack semantic features and edge attack semantic features.

6. The method of claim 1, wherein, The generation of the evolution behavior association graph set specifically includes: Divide the update period in the continuous host running time period, and obtain the corresponding new standardized log event set in each update period, and associate the new standardized log event set with the behavior association graph output in the last update period; Perform incremental object element extraction and incremental behavior element extraction on the new standardized log event set to obtain the incremental object element set and the incremental behavior element set, and establish the event identification association index for the incremental object element set and the incremental behavior element set; Perform incremental node update on the behavior association graph based on the incremental object element set, map the incremental object element to a node and add it to the node set, and associate the object unique identification with the existing node to add the new object attribute field value, to generate the updated node set; Perform incremental edge update on the behavior association graph based on the incremental behavior element set and the object unique identification, locate the node pair according to the behavior subject object unique identification and the behavior object unique identification, generate the new behavior interaction edge and add it to the edge set, and generate the new dependency edge and the new cause-effect association edge according to the invocation dependency, the resource dependency and the trigger precedence relationship, and add them to the edge set; corresponding behavior attributes, dependency attributes and causal attributes of the newly added behavior interaction edges are associated, and the timing attributes, causal attributes and interaction intensity attributes of the affected existing edges are updated synchronously; perform edge weight value updating based on the updated edge set, and write the updated edge weight values into the edge attribute set; generate the evolution behavior association graph corresponding to the current update period based on the updated node set and edge set, and aggregate the evolution behavior association graphs obtained in each update period in chronological order to generate an evolution behavior association graph set.

7. The method of claim 1, wherein the method is based on graph structure modeling. The extraction of the graph structure feature set specifically includes: input the evolution behavior association graph set into the improved Geom-GCN model according to the time sequence of the update periods, read the causal attributes and attack semantic feature set in the node set, edge set and edge attribute set of each behavior association graph; The improved Geom-GCN model keeps the node embedding space construction structure, neighborhood construction structure, regional convolution structure and representation output structure unchanged, introduces an attack semantic driven module in the neighborhood construction structure, and introduces a causal consistency constraint module in the regional convolution structure; In the node embedding space construction structure, the node set is mapped to a node embedding representation set in the embedding space. In the geometric relationship calculation module of the neighborhood construction structure, the geometric proximity scores between nodes are calculated based on the node embedding representation set to generate geometric constraint information of the candidate neighborhood relationship. In the neighborhood node screening module, the geometric constraint information is used to screen the candidate neighborhood nodes of each center node, and the screened nodes and associated edge set are combined to generate a candidate neighborhood substructure set. In the attack semantic driven module, the attack semantic matching degree scores of the candidate neighborhood substructure set are calculated based on the attack semantic feature set, and the attack semantic matching degree scores and the geometric proximity scores are fused to obtain neighborhood selection weights, and the attack semantic constraint neighborhood substructure set is obtained by screening according to the neighborhood selection weights. In the neighborhood region division module, the attack semantic constraint neighborhood substructure set is divided into regions to generate a neighborhood region substructure set, and the region node set and the region edge set are recorded for each neighborhood region substructure. In the regional convolution structure, the regional convolution input set is constructed based on the neighborhood region substructure set, and in the causal consistency constraint module, the node set in the regional convolution input set is screened according to the causal attributes of the edge set associated in the regional convolution input set to obtain the regional convolution node set satisfying the causal consistency constraint. In the regional feature aggregation module, the regional convolution node set is subjected to feature aggregation processing to obtain a regional convolution output node representation set. In the representation output structure, the representation mapping and normalization processing are performed based on the regional convolution output node representation set to generate a node representation vector set. Based on the node representation vector set, the subgraph representation vector set is generated by performing subgraph convergence on the neighborhood region substructure set, and the graph structure feature set is extracted based on the node representation vector set and the subgraph representation vector set.

8. The method of claim 1, wherein, The generation of the attack detection result set specifically includes: perform feature item alignment and standardization arrangement on the graph structure feature set to generate a feature input set; The feature input set is compared with the attack mode feature template corresponding to the attack semantic label set for consistency, and a mode matching score set corresponding to each attack mode is generated; The mode matching score set is subjected to mode score aggregation processing to obtain an attack mode score value; The attack mode score value is sorted and analyzed, and the attack mode located at the top in the sorting result is selected to generate an attack judgment result set including an attack related node set, an attack related relationship set, an attack association path set and an attack semantic label set; Based on the attack judgment result set, the object range mapping processing is performed on the attack related node set, and the object unique identifier in the attack related node set is mapped to the host entity, user entity, process entity, file entity, network endpoint entity and security event entity to generate the attack involved object range; Based on the attack judgment result set, the relationship structuring processing is performed on the attack related relationship set, and the behavior interaction edge, dependency relationship edge and causal association edge in the attack related relationship set are grouped according to the relationship type and sorted according to the edge sequence attribute to generate the attack behavior relationship structure; Based on the attack association path set, the path relationship formed by the attack related node set and the attack related relationship set is subjected to path arrangement to obtain an attack path sequence, and based on the attack semantic label set, the attack behavior relationship structure and the attack path sequence are subjected to consistency verification to determine the attack judgment result set that meets the attack judgment condition; Based on the attack judgment result set that meets the attack judgment condition, the event positioning association processing is performed on the attack related node set, and the attack related node set is associated with the corresponding source event identifier according to the event identifier association index to generate the event positioning information corresponding to the attack related node set; The attack involved object range, attack behavior relationship structure, attack path sequence and event positioning information are structured and output to generate an attack detection result set.

9. A host log attack detection system based on graph structure modeling, performing a host log attack detection method based on graph structure modeling according to any one of claims 1 to 8, characterized in that, It comprises: A log preprocessing module for obtaining multi-source host log data generated during host operation and performing preprocessing to generate a standardized log event set; An element extraction module for extracting object elements and behavior elements based on the standardized log event set to generate an object element set and a behavior element set; A behavior graph construction module for constructing a host log behavior graph based on the object element set and the behavior element set; An association relationship constraint modeling module for performing attack semantic oriented association relationship constraint modeling on the host log behavior graph to generate a behavior association graph and extract an attack semantic feature set; A graph evolution update module for performing graph evolution update on the behavior association graph based on new logs in a continuous host operation time period, and generating an evolved behavior association graph set in the time sequence of the update period; A feature learning module for performing feature learning of geometric constraints and attack semantic constraints on the evolved behavior association graph set based on an improved Geom-GCN model to generate node representation vectors, subgraph representation vectors and extract a graph structure feature set; An attack judgment module for performing attack mode matching and attack judgment based on the graph structure feature set to generate an attack detection result set.

Images