Multi-source data processing method and device based on graph neural network, and terminal equipment

Abstract

The invention provides a multi-source data processing method and device based on a graph neural network and terminal equipment, and the method comprises the steps: setting a corresponding node-edge set in advance according to different types of multi-source heterogeneous data, and converting the collected data into a data traceability graph of a corresponding data type according to the node-edge set; performing entity similarity matching on nodes in the traceability graph, and performing traceability graph fusion according to a matching result; according to the type of each edge in the multi-source traceability graph, determining the sampling probability of nodes associated with the edge, sampling neighbor nodes of each node based on the sampling probability, and generating a local sampling result of each node; performing local feature aggregation on each node to generate an initial feature vector of each node; according to the type of each edge in the multi-source traceability graph, calculating the attention weight between the nodes and updating the initial feature vector, and generating a feature vector value of each node; the method can effectively improve the representation quality and storage efficiency of the data and improve the detection precision of the traceability graph.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of cyberspace security, in particular to a multi-source data processing method and device based on a graph neural network and a terminal device. BACKGROUND

[0002] Advanced Persistent Threat (APT) detection refers to the process of identifying and preventing attacks that are organized and planned by specific attackers for long-term attacks on specific targets. APT attacks are usually highly covert, targeted and persistent, and attackers will use various advanced technical means to bypass traditional security protection mechanisms, long-term lurk in target systems, steal sensitive information or perform other malicious operations. Effective APT detection can timely discover potential attack behaviors, help organizations take appropriate measures to prevent and respond, protect the security of important information assets, and avoid huge losses to organizations due to data leakage, system paralysis and other problems. Current multi-source heterogeneous data modeling methods in the field of APT detection mainly include two categories: methods based on traceability graphs and methods based on knowledge graphs.

[0003] The method based on traceability graph is to construct a dynamic causal relationship graph through system audit logs. In this graph, nodes represent system entities such as processes, files, and network connections, and edges represent creation, reading, writing, and execution relationships. This method can record system behavior in real time, and by analyzing these causal relationship graphs, it can discover abnormal operations and behavior patterns in the system to determine whether there is an APT attack. However, the traceability graph method mainly relies on a single data source and cannot fully utilize the complementary information of multi-source heterogeneous data, which may miss some important attack clues. Lack of effective multi-source data unified modeling mechanism, unable to integrate information from different data sources into a unified graph structure for joint analysis, limiting its detection capability. SUMMARY

[0004] One of the purposes of the present application is to provide a multi-source data processing method based on a graph neural network to solve the above technical problems, to unify modeling and joint analysis of multi-source heterogeneous data, and to improve the detection accuracy of traceability graphs.

[0005] A multi-source data processing method based on a graph neural network, comprising: Pre-set node-edge sets corresponding to different types of multi-source heterogeneous data according to the node-edge sets, and convert the collected multi-source heterogeneous data into data traceability graphs of corresponding data types; wherein the types of multi-source heterogeneous data include network traffic, system logs, process behavior and threat intelligence; entity similarity matching is performed on each node in the data provenance graph, and provenance graph fusion is performed according to a similarity matching result, to obtain a multi-source provenance graph; wherein each node in the data provenance graph represents an entity identifier; A sampling probability of a node associated with each edge in the multi-source provenance graph is determined according to a type of the edge, neighbor nodes of each node are sampled based on the sampling probability, and a local sampling result of each node is generated; local feature aggregation is performed on each node by using a multi-layer graph neural network and the local sampling result, and an initial feature vector of each node is generated; Attention weights between nodes are calculated according to a type of each edge in the multi-source provenance graph, and a feature vector value of each node is generated by updating the initial feature vector according to the attention weights; wherein the attention weights are used to describe an influence of a neighbor node on a current node.

[0006] In the preferred technical solution of the present application, the node-edge set corresponding to different types of multi-source heterogeneous data is set in advance, and the collected multi-source heterogeneous data is converted into a data provenance graph of a corresponding data type according to the node-edge set, and specifically includes: A first node-edge set is set based on data characteristics of the network traffic; wherein the first node-edge set includes first nodes and first edges, the first nodes include IP addresses, port numbers, protocol types, processes, and files, and the first edges represent network activity relationships; A second node-edge set is set based on data characteristics of the system log; wherein the second node-edge set includes second nodes and second edges, the second nodes include processes, first files, registries, and sockets, and the second edges represent system call relationships; A third node-edge set is set based on data characteristics of the process behavior; wherein the third node-edge set includes third nodes and third edges, the third nodes include parent processes, child processes, second files, and network connections, and the third edges represent process interaction relationships; A fourth node-edge set is set based on data characteristics of the threat intelligence; wherein the fourth node-edge set includes fourth nodes and fourth edges, the fourth nodes include IOCs, malware, attack techniques, and APT organizations, and the fourth edges represent intelligence correlation relationships; The multi-source heterogeneous data is converted into a corresponding data provenance graph by calling a corresponding node-edge set according to a type of the multi-source heterogeneous data.

[0007] In the preferred technical solution of the present application, the entity similarity matching is performed on each node in the data provenance graph, and the provenance graph fusion is performed according to the similarity matching result, to obtain the multi-source provenance graph, and specifically includes: Obtaining nodes and edges of each data provenance graph, generating a unified node type set and an edge type set; wherein the node type set is also used to define the mandatory attributes of each node, and the edge type set is also used to define the core attributes of each edge; Based on the timestamps of the multi-source heterogeneous data and the entity identifiers of the corresponding data provenance graphs, the multi-source heterogeneous data is cross-source aligned; Based on the entity similarity matching formula, nodes representing the same entity and edges representing the same relationship in different data provenance graphs are calculated, and an entity similarity matching result is obtained; wherein the expression of the entity similarity matching formula is:

[0008] According to the entity similarity matching result, the repeated nodes and edges are fused, and the multi-source provenance graph is obtained.

[0009] In the preferred technical scheme of the present application, according to the entity similarity matching result, the repeated nodes and edges are fused, and the multi-source provenance graph is obtained, specifically including: Obtaining completely consistent edges in different data provenance graphs, merging the core attributes of the edges and edge fusion; Merging each data provenance graph to obtain an initial multi-source provenance graph, deleting the repeated nodes in the initial multi-source provenance graph to obtain the multi-source provenance graph; wherein when deleting the repeated nodes, the attribute of the repeated edges between the same entities is merged and the edge is fused.

[0010] In the preferred technical scheme of the present application, according to the type of each edge in the multi-source provenance graph, the sampling probability of the node associated with the edge is determined, based on the sampling probability, the neighbor nodes of each node are sampled, and the local sampling result of each node is generated, specifically including: According to the type of each edge in the multi-source provenance graph, the importance of each edge is evaluated, and an importance score of each edge is generated; wherein the type of the edge includes threat sensitive edge, regular edge and low importance edge; According to the importance score, an importance sampling formula is called to generate the sampling probability of the node associated with each edge; wherein the expression of the importance sampling formula is:

[0011] According to the sampling probability, the neighbor nodes of each node are sampled, and the local sampling result of each node is generated.

[0012] In the preferred technical scheme of the present application, the local feature vector of each node is generated by the multi-layer graph neural network and the local sampling result, specifically including: performing a graph convolution layer stacking on the multi-source provenance graph to obtain a plurality of multi-source provenance graph levels; performing local feature aggregation on each node in each of the multi-source provenance graph levels by using an aggregation formula to obtain a level feature vector of each node and merging the level feature vectors to generate an initial feature vector of each node; wherein an expression of the aggregation formula is:

[0013] In the preferred technical solution of the present application, the attention weight between nodes is calculated according to the type of each edge in the multi-source provenance graph, specifically including: Edge type importance evaluation: according to the threat sensitivity corresponding to the type of each edge, the edges in the multi-source unified provenance graph are divided into three categories of threat-sensitive edges, regular edges and low-importance edges; Calculation of edge type importance weight: for each edge, the edge type importance weight is calculated by using the following formula:

[0014] Calculation of node attention weight: for any node and its neighbor nodes in the multi-source unified provenance graph, based on the feature representation of the nodes and the type importance weight of the edges connecting the two nodes, the attention weight of the nodes to each other is calculated by using the following formula:

[0015] In the preferred technical solution of the present application, after the calculation of the node attention weight, it further includes: Based on the calculated attention weight, the feature representations of all neighbor nodes of the node are weighted and aggregated to obtain an updated feature representation of the node, and the aggregation formula is as follows:

[0016] The second object of the present application is a multi-source data processing device based on a graph neural network, which is used to implement the multi-source data processing method based on a graph neural network as described above.

[0017] The device includes a main control module and a data acquisition interface module, a provenance graph construction module, a multi-source graph fusion module, a graph neural network modeling module, an attention optimization module and a data storage module electrically connected to the main control module; The data acquisition interface module is used to receive heterogeneous security data from different data sources; The provenance graph construction module is connected to the data acquisition interface module and is used to convert each type of heterogeneous security data into a fine-grained provenance graph with causal relationship; the provenance graph takes system entities or threat entities as nodes and takes the interaction relationship between entities as edges, and retains timestamp and attribute information; The multi-source graph fusion module is connected with the provenance graph construction module, and is configured to perform cross-source data alignment and fusion on multiple provenance graphs based on a unified graph mode, and generate a unified provenance graph structure. The graph neural network modeling module is connected with the multi-source graph fusion module, and is configured to perform neighborhood sampling and feature aggregation on the unified provenance graph, and learn an embedding representation of a node. The attention optimization module is connected with the graph neural network modeling module, and is configured to introduce an attention mechanism, calculate an attention weight based on the importance of an edge type and the importance of a node, and optimize the feature aggregation process of the graph neural network modeling module. A data storage module is configured to store original data, intermediate graph data and finally generated optimized graph representation.

[0018] A third object of the present application is a computer device comprising a memory and a processor, the memory storing a computer program, characterized in that the processor implements the multi-source data processing method based on a graph neural network as described above when executing the computer program.

[0019] The present application has the following beneficial effects: The application provides a multi-source data processing method, device and terminal equipment based on a graph neural network, which comprises the following steps: setting a corresponding node-edge set in advance according to different types of multi-source heterogeneous data, converting the collected data into a data provenance graph of a corresponding data type according to the node-edge set, performing entity similarity matching on the nodes in the provenance graph, and performing provenance graph fusion according to the matching result, determining the sampling probability of the nodes associated with each edge in the multi-source provenance graph according to the type of the edge, sampling the neighbor nodes of each node based on the sampling probability, generating a local sampling result of each node, performing local feature aggregation on each node to generate an initial feature vector of each node, calculating the attention weight between the nodes according to the type of each edge in the multi-source provenance graph and updating the initial feature vector to generate a feature vector value of each node. The method sets a special 'node-edge' set for different types of data, converts unstructured / semi-structured data such as network traffic and system logs into a structured provenance graph, and realizes cross-source graph fusion through entity similarity matching, so that the provenance graphs of four types of data can be finally fused into one multi-source provenance, thereby reducing the node redundancy rate and improving the edge attribute integrity. According to the threat sensitivity of the edge type, the sampling probability is set, and the nodes associated with the threat sensitive edge are preferentially sampled, so that the redundant node filtering rate is improved by 35% and the effective sampling neighbor ratio of each node is improved. At the same time, the multi-layer aggregation focuses on high-value features, so that the threat association information density of the initial feature vector is improved, laying a high-quality foundation for subsequent attention optimization. The node feature vector finally output by the method can not only be used for APT detection, but also be extended to scenes such as 'abnormal behavior positioning' and 'threat provenance' of the power dispatching system, and has strong expansibility and adapts to the increasing data monitoring needs of the power system. BRIEF DESCRIPTION OF DRAWINGS

[0020] Figure 1 A flowchart of a multi-source data processing method based on a graph neural network provided in an embodiment of the application is shown. Figure 2 A logic diagram of the multi-source data processing method based on a graph neural network provided in an embodiment of the application is shown. DETAILED DESCRIPTION

[0021] The specific embodiments of the application will be further described in detail below with reference to the accompanying drawings and examples. The following examples are used to illustrate the application, but are not used to limit the scope of the application.

[0022] The terms "first" and "second," etc., in the specification, claims, and drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to such processes, methods, products, or apparatus.

[0023] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0024] Example 1 See Figures 1-2 , Figure 1 This is a flowchart illustrating a multi-source data processing method based on a graph neural network according to an embodiment of the present invention. The embodiment includes steps 101 to 104, each step being as follows: Step 101: Pre-define corresponding node-edge sets according to different types of multi-source heterogeneous data, and convert the collected multi-source heterogeneous data into a data source graph of the corresponding data type according to the node-edge sets; wherein, the types of multi-source heterogeneous data include network traffic, system logs, process behavior and threat intelligence.

[0025] Multi-source heterogeneous data differ significantly in format, source, and meaning. In this embodiment of the invention, a set of node-edges corresponding to different types of multi-source heterogeneous data is pre-defined. Then, based on these sets, the collected multi-source heterogeneous data is transformed into a data source graph of the corresponding type. This can integrate different types of data into the data source graph, break down the barriers between data, and form a holistic dataset that can be analyzed in relation to each other, making it easier to fully understand the system's operating status and security status.

[0026] In an embodiment, the corresponding node-edge set is set in advance according to different types of multi-source heterogeneous data, and the collected multi-source heterogeneous data is converted into a data source graph of a corresponding data type according to the node-edge set, specifically comprising: setting a first node-edge set based on the data characteristics of the network traffic; wherein the first node-edge set includes first nodes and first edges, the first nodes include IP addresses, port numbers, protocol types, processes, and files, and the first edges represent network activity relationships; setting a second node-edge set based on the data characteristics of the system log; wherein the second node-edge set includes second nodes and second edges, the second nodes include processes, first files, registries, and sockets; and the second edges represent system call relationships; setting a third node-edge set based on the data characteristics of the process behavior; wherein the third node-edge set includes third nodes and third edges, the third nodes include parent processes, child processes, second files, and network connections; and the third edges represent process interaction relationships; setting a fourth node-edge set based on the data characteristics of the threat intelligence; wherein the fourth node-edge set includes fourth nodes and fourth edges, the fourth nodes include IOCs, malware, attack techniques, and APT organizations; and the fourth edges represent intelligence correlation relationships; and calling the corresponding node-edge set according to the type of multi-source heterogeneous data to convert the multi-source heterogeneous data into a corresponding data source graph.

[0027] In the embodiments of the present application, the first node-edge set is set based on the data characteristics of network traffic, and the first node includes an IP address, a port number, a protocol type, a process, a first file, etc. Specifically, the IP address (Internet Protocol Address) is a digital label assigned to a device using the Internet Protocol on a network, used to uniquely identify the device in the network, facilitating accurate transmission of data; the port number is used to distinguish different network services or applications on the same device, and one IP address can provide multiple services through different port numbers at the same time; the protocol type specifies the format, rules and process of data transmission in the network, and common ones include TCP protocol, etc.; the process is a process of program execution in an operating system, and each process has its own independent memory space and system resources, used to complete a specific task; the first file is a data set stored on a computer storage device, and the process may access and operate the file during the running process. The first edge represents the network activity relationship in the system, including network connection (such as establishing a TCP connection, transmitting a UDP data packet), process creation (one process creating another new process), file access (process reading, writing, etc. operations on files), etc. The second node-edge set is set based on the data characteristics of system logs, and the second node includes a process, a file, a registry and a socket, etc. Specifically, the process is the same as the process concept in network traffic, which is an execution instance of a program; the file is a data storage entity, and system operations often involve various processing of files; the registry is a database in the Windows operating system for storing system and application configuration information, containing various settings and parameters of the system; the socket is an interface for implementing network communication in network programming, which combines IP address and port number, allowing processes on different devices to exchange network data. The second edge represents the system call relationship, such as read (reading data from a file or device), write (writing data to a file or device), open (opening a file or device), close (closing a file or device), exec (executing a new program), etc. The third node-edge set is set based on the data characteristics of the process behavior, and the third node includes a parent process, a child process, a file and a network connection, etc. Specifically, the parent process refers to a process that creates other processes and is in the upper layer of the process hierarchy; the child process refers to a process created by the parent process, which inherits part of the attributes and resources of the parent process; the second file refers to a file that may be accessed by the process during the running process; the network connection refers to a network communication channel established between the process and other devices or services. The third edge represents the process interaction relationship, including process creation (parent process creating child process), file access (process reading and writing operations on files), network connection (process initiating or accepting network communication), etc.The fourth node-edge set is set based on the data characteristics of threat intelligence, the fourth node includes IOC, malware, attack technology and APT organization, specifically, IOC (Indicator of Compromise) is an attack indicator, which is various signs indicating that a system may have been compromised or there is a security threat, such as abnormal file hash value, malicious IP address, etc.; malware refers to software designed to damage, steal information or interfere with the normal operation of a computer system, such as viruses, Trojans, worms, etc.; attack technology refers to the methods and means used by attackers to carry out attacks, such as SQL injection, cross-site scripting (XSS), etc.; and APT organization refers to an advanced persistent threat organization, which is usually a group of hackers with professional technology and resources, and conducts long-term and organized attacks on specific targets. The fourth edge represents intelligence correlation, such as IOC hit (a certain IOC matches a certain entity in the system), technology use (attack technology is adopted by malware or APT organization), organization affiliation (malware or attack technology belongs to a certain APT organization), etc. Then, according to the types of multi-source heterogeneous data, the corresponding node-edge set is called to convert the collected data into a corresponding data tracing graph. For example, for the collected network traffic data, according to the definition of the first node-edge set, the IP address, port number and other information in the data are mapped to the first node, and the network connection, process creation and other relationships are mapped to the first edge, so as to construct a network connection tracing graph.

[0028] For example, the communication data between devices in the network is collected by a network traffic monitoring device (such as a firewall, an intrusion detection system), including IP address, port number, protocol type and other information; system audit logs are collected from the operating system of the server and client device, recording various operations and system call information of the process; the creation, file access and network connection behaviors of each process are recorded using a process monitoring tool; and the latest IOCs, malware information, attack techniques and APT organization intelligence are obtained from a professional threat intelligence platform. Based on the above means, the collection of multi-source heterogeneous data is completed. Then, the network traffic data collected is converted into a network connection trace graph according to the first node-edge set. For example, it is found that the IP address of a server establishes frequent TCP connections with a suspicious external IP address, and the edge between the two IP address nodes in the trace graph can be clearly seen, prompting the risk of data leakage or external attack. According to the second node-edge set, the system audit logs are converted into a system call trace graph. If it is found that a process frequently reads and writes files, and involves sensitive files, the process and related file nodes can be quickly located through the trace graph, and the specific system call relationship can be viewed to determine whether there is abnormal behavior. According to the third node-edge set, the process behavior data is converted into a process relationship trace graph. If it is found that a parent process creates multiple child processes, and these child processes are all performing abnormal network connections, the activities of the entire process family can be tracked through the trace graph, and potential malicious processes can be discovered in time. According to the fourth node-edge set, the threat intelligence data is converted into an intelligence correlation trace graph. When it is found that a file hash value in the system matches an IOC in the threat intelligence, the edge between the file node and the IOC node in the trace graph can be seen, and the malicious software using the IOC and the corresponding APT organization can be associated, providing strong basis for security response.

[0029] Step 102: Similarity matching is performed on the nodes in each of the data trace graphs, and the trace graphs are fused according to the similarity matching results to obtain a multi-source trace graph.

[0030] In the embodiment of the application, similarity matching is first performed on the nodes in each data trace graph (such as a network stream trace graph, a system log trace graph, a process behavior trace graph and a threat intelligence trace graph), and then the trace graphs are fused according to the matching results to finally form a multi-source trace graph. Different types of data trace graphs focus on specific aspects, and through node similarity matching and trace graph fusion, the information scattered in each trace graph can be integrated to form a complete view covering multiple aspects of information, avoiding information loss, so that the analyst can have a comprehensive understanding of the running state and potential risks of the system.

[0031] In an embodiment, the similarity matching of the nodes in each data provenance graph is performed, and the provenance graphs are fused according to the similarity matching result to obtain a multi-source provenance graph, specifically comprising: obtaining the nodes and edges of each data provenance graph, and generating a unified node type set and an edge type set; wherein the node type set is also used to define the mandatory attributes of each node, and the edge type set is also used to define the core attributes of each edge; based on the timestamps of the multi-source heterogeneous data and the entity identifiers of the corresponding data provenance graphs, the multi-source heterogeneous data is cross-sourced aligned; based on an entity similarity matching formula, the nodes representing the same entity and the edges representing the same relationship in different data provenance graphs are calculated to obtain an entity similarity matching result; wherein the expression of the entity similarity matching formula is:

[0032] In the embodiment of the present application, the node and edge information of each data trace graph is obtained, and on this basis, a unified node type set and edge type set are generated. The node type set not only covers various different types of nodes, but also clearly specifies the mandatory attributes that each node must have. These mandatory attributes are the key information for accurately describing and distinguishing nodes. Similarly, the edge type set defines the core attributes of each edge, which can clearly express the essential characteristics of the relationship represented by the edge. For example, in a trace graph containing network devices and user behavior, the node types may include servers, terminal devices, users, etc., and the mandatory attributes of the server node may include IP address, port number, operating system type, etc.; the edge types may include network connection, data transmission, etc., and the core attributes of the network connection edge may include connection time, transmission protocol, etc. Based on the timestamps of the multi-source heterogeneous data and the entity identifiers of the corresponding data trace graph, the multi-source heterogeneous data is cross-aligned. Due to the differences in time recording methods and accuracy of different data sources, time synchronization means is needed to ensure the consistency of timestamps of different data sources. This can be achieved with the help of professional time synchronization protocols, such as Network Time Protocol (NTP). At the same time, according to the unique identifier of the entity core attribute combination, the nodes representing the same entity and the edges representing the same relationship in different trace graphs are matched. For example, in different log files, the operation behavior of the same user at different times may be recorded, and through the unique identifier of the user (such as user ID) and the operation timestamp, these scattered data are aligned and integrated. Then, based on the entity similarity matching formula, the nodes representing the same entity and the edges representing the same relationship in different data trace graphs are calculated to obtain the entity similarity matching result. The calculation of attribute similarity can use methods such as cosine similarity and edit distance. For numerical attributes, the normalized result of the difference value can be calculated; for text attributes, the similarity can be calculated after converting the text into a word vector. For example, for the CPU usage rate (numerical attribute) of two server nodes, the absolute value of the difference can be calculated and normalized; for the description information (text attribute) of two user nodes, the text can be converted into a word vector, and then the cosine similarity can be calculated. The calculation of time similarity can be calculated according to the difference of the timestamps, and the smaller the difference of the timestamps of two events, the higher the similarity. and is a self-defined weight parameter, which can be defined according to specific requirements and is not limited here. According to the entity similarity matching result, the repeated nodes and edges are fused. When the comprehensive similarity of two nodes or edges exceeds the set threshold, they are considered as the same entity and merged. During the merging process, the attribute information of the two nodes or edges needs to be integrated to ensure that the fused nodes and edges contain more comprehensive information.

[0033] Exemplarily, there are two data provenance graphs (it is to be noted that for the convenience of description, only two data provenance graphs are exemplarily described herein, and a complete multi-source provenance graph should adopt four data provenance graphs, and the merging method is consistent with the description below), respectively from a network monitoring system and a user behavior log system. The network monitoring system provenance graph contains server nodes (node type), and the mandatory attributes include IP address and port number; the edges represent network connections, and the core attributes include connection time; the user behavior log system provenance graph contains user nodes (node type), and the mandatory attributes include user ID and user name; the edges represent user operations, and the core attributes include operation time. The timestamps of the two systems are unified through a time synchronization protocol. It is found that in the network monitoring system, a server with an IP address of 192.168.1.100 is accessed at 10:00 on October 23, 2025, and in the user behavior log system, a user with a user ID of 1001 performs an operation at the same time. Through further analysis, it is found that the operation of the user is associated with the access of the server. Then, through the real-time data analysis platform, it is found that the user ID 1001 corresponds to the user name “John”, and the IP address 192.168.1.100 corresponds to the server name “Server1”. Therefore, the two data provenance graphs are merged into a multi-source provenance graph, as shown in FIG. 2.

[0034] In an embodiment, the multi-source provenance graph is obtained by merging the repeated nodes and edges according to the entity similarity matching result, specifically including: obtaining the edges that are completely consistent in different data provenance graphs, and merging the core attributes of the edges and edge fusion; merging each of the data provenance graphs to obtain an initial multi-source provenance graph, and deleting the repeated nodes in the initial multi-source provenance graph to obtain the multi-source provenance graph; wherein, when deleting the repeated nodes, the attributes of the repeated edges between the same entities are merged and edge fusion is performed.

[0035] In the embodiments of the present application, edges with the same "source node-target node-edge type" in different data provenance graphs are obtained. These repeated edges may come from different data sources, but they describe the same relationship type between the same nodes. For these repeated edges, the core attributes need to be merged. The way of merging the core attributes can be determined according to the type of the attribute, for example, for numerical attributes, the average value, maximum value or sum can be taken; for text attributes, splicing or selecting a more representative description can be performed. After merging the attributes, the repeated edges are fused and treated as one edge, which can avoid data redundancy while retaining more comprehensive edge information. Each data provenance graph is merged to obtain an initial multi-source provenance graph. In this initial graph, there may be a large number of repeated nodes, which represent the same entity but may come from different data sources, and their attributes may partially overlap or complement each other. The repeated nodes are deleted by entity deduplication, and in the deletion process, the attributes of the same entity need to be integrated. When integrating the attributes, the appropriate method is also adopted according to the type of the attribute to ensure that the integrated node attributes are complete and accurate. At the same time, the repeated edges of the same type between the same entities also need to be fused and the attributes aggregated. This means that even if there are multiple edges of the same type between nodes, they are also merged into one edge, and the attributes of these edges are aggregated to further reduce data redundancy and improve the quality of the graph. The final multi-source provenance graph contains node embedding, edge embedding and global attributes, while retaining the characteristics of each data source. Such a graph structure can more comprehensively and accurately reflect the relationship and information between multi-source data.

[0036] For example, the two data provenance graphs mentioned above (the network monitoring system provenance graph and the user behavior log system provenance graph) and the calculated similarity matching results are fused. In the network monitoring system provenance graph, the edge attributes are as follows: the edge between the server node and the user node represents the user's access to the server, the edge between the server node and the user node represents the user's access to the server, and the edge between the server node and the user node represents the user's access to the server. At the same time, for the repeated edges of the same type between the same entities, fusion and attribute aggregation are continued. According to the above method, the final multi-source provenance graph contains node embedding (such as attribute information of server nodes and user nodes), edge embedding (such as attribute information of fused edges), and global attributes (such as the time range of the entire provenance graph), and retains the characteristics of the network monitoring system and the user behavior log system two data sources, which can more comprehensively reflect the interaction relationship between the user and the server.

[0037] Step 103: determining the sampling probability of the nodes associated with each edge in the multi-source provenance graph according to the type of the edge, sampling the neighbor nodes of each node based on the sampling probability to generate a local sampling result of each node, and performing local feature aggregation on each node through a multi-layer graph neural network and the local sampling result to generate an initial feature vector of each node.

[0038] In the embodiments of the present application, the sampling probability of the node associated with the threshold is determined according to the type of the edge in the multi-source traceability graph, and then the neighbor nodes of each node are sampled according to the probability, thereby generating the local sampling result of each node. The multi-layer graph neural network is used to carry out local feature aggregation on the neighbor node set of each node, and finally the initial feature vector of each node is output. The sampling probability is determined according to the type of the edge, so that it is more likely to select the neighbor nodes closely associated with the current node and the information more critical in the sampling process. In this way, the amount of calculation can be reduced, and the information important to the expression of node features can be retained.

[0039] In an embodiment, the sampling probability of the node associated with each edge in the multi-source traceability graph is determined based on the type of the edge, the neighbor nodes of each node are sampled based on the sampling probability, and the local sampling result of each node is generated, specifically including: performing importance evaluation according to the type of each edge in the multi-source traceability graph to generate an importance score of each edge; wherein the type of the edge includes threat-sensitive edge, regular edge and low-importance edge; calling an importance sampling formula according to the importance score to generate the sampling probability of the node associated with each edge; wherein the expression of the importance sampling formula is:

[0040] The neighbor nodes of each node are sampled according to the sampling probability, and the local sampling result of each node is generated.

[0041] In the embodiment of the present application, the importance of each edge in the multi-source provenance graph is evaluated according to the type of each edge, and the importance score of each edge is generated. The types of edges mainly include threat-sensitive edges, regular edges and low-importance edges. Threat-sensitive edges are usually related to potential security threats and have high importance in the provenance graph. For example, in a network security provenance graph, abnormal data transmission edges between nodes, malicious attack behavior association edges, etc. belong to threat-sensitive edges. The existence of these edges means that there may be security risks, so their importance scores should be relatively high; regular edges represent common and normal relationships in the graph. For example, in a social network provenance graph, the ordinary friend relationship edges between users; in a supply chain provenance graph, the normal transaction edges between suppliers and purchasers, etc. The importance scores of these edges are at a medium level. Low-importance edges usually have low value for node feature learning and threat analysis. For example, connection edges between system foundation processes, temporary file and other node transient association edges, etc. These edges may contain a large amount of redundant information, and their importance scores are relatively low. Different importance score ranges are set in advance according to the types of edges. For example, the importance score range of threat-sensitive edges is 0.7-1.0, the importance score range of regular edges is 0.3-0.6, and the importance score range of low-importance edges is 0.1-0.2. The specific score range can be adjusted according to the actual application scenario and data characteristics, which is not limited here. After obtaining the importance score of each edge, we can obtain the initial feature vector of each node according to the importance sampling formula

[0042]

[0043] In an embodiment, the local feature aggregation of each node is performed by a multi-layer graph neural network and the local sampling result, and an initial feature vector of each node is generated, specifically comprising: stacking graph convolution layers on the multi-source provenance graph to obtain a plurality of multi-source provenance graph levels; performing local feature aggregation on nodes in each of the multi-source provenance graph levels by an aggregation formula to obtain a level feature vector of each node and merging to generate an initial feature vector of each node; wherein the expression of the aggregation formula is:

[0044] In the embodiment of the present application, the multi-source provenance graph is subjected to a stacking operation of graph convolution layers, thereby obtaining a plurality of multi-source provenance graph levels. In actual operation, in order to balance the feature capture depth and the risk of overfitting, 2-4 layers of graph neural networks are usually set. If the number of layers is too small, the complex relationships and features between nodes in the graph may not be fully captured. If the number of layers is too large, overfitting problems may occur, which makes the model perform well on training data but poorly on test data. Each layer of graph convolution layer can be regarded as an update and conversion of node features. By continuously stacking graph convolution layers, nodes can gradually aggregate the information of their neighbor nodes, thereby obtaining more extensive and in-depth feature representations. After obtaining the multi-source provenance graph levels, we need to pass the features of each node through a linear factor, a learnable weight matrix and an aggregation function to obtain the final feature vector of each node.

[0045] linear factor, so that the model can learn more complex function mapping relationships; learnable weight matrix is adjusted according to the loss function during model training, so that the model can learn the optimal feature representation. Different weight matrices can weight different types of features, thereby highlighting important feature information; aggregation function is used to aggregate the features of the neighbor nodes of node v. Common aggregation functions include mean aggregation, summation aggregation, maximum value aggregation, etc. Different aggregation functions are suitable for different scenarios. For example, mean aggregation can smooth the feature information of neighbor nodes, while maximum value aggregation can highlight the strongest features in neighbor nodes. After completing local feature aggregation at each layer, the layer-level feature vector of each node at the layer is obtained. In order to fully utilize the feature information of each layer, the feature vectors of each node at different levels are combined to generate the initial feature vector of each node.

[0046] Step 104: calculating the attention weight between nodes according to the type of each edge in the multi-source provenance graph, updating the initial feature vector according to the attention weight, and generating a feature vector value of each node; wherein the attention weight is used to describe the influence of neighbor nodes on the current node.

[0047] In the multi-source traceability graph, the attention weight between nodes is calculated according to the type of each edge in the embodiment of the application, and the weight reflects the influence degree of the neighbor node on the current node; then the initial feature vector of each node obtained before is updated using the attention weight, and finally the new feature vector value of each node is generated. Different types of edges represent different properties of association in the multi-source traceability graph, such as network activity relationship, system call relationship, etc. According to the type of the edge, the attention weight is calculated, which can more accurately depict the close degree and influence direction of the neighbor node and the current node. By updating the initial feature vector through the attention weight, the feature vector value of each node can more comprehensively and accurately reflect its position and role in the graph structure. Different neighbor nodes have different contributions to the current node, and the attention mechanism can distinguishably fuse the features of the neighbor nodes according to the weight, thereby enhancing the expression ability of the node feature vector.

[0048] More specifically, the attention weight between nodes is calculated according to the type of each edge in the multi-source traceability graph, specifically including the following: Edge type importance evaluation: according to the threat sensitivity corresponding to the type of each edge, the edges in the multi-source unified traceability graph are divided into three categories of threat-sensitive edges, regular edges and low-importance edges; Calculation of edge type importance weight: for each edge, the edge type importance weight is calculated by the following formula:

[0049] Calculation of node attention weight: for any node and its neighbor nodes in the multi-source unified traceability graph, based on the feature representation of the node and the node and the type importance weight of the edge connecting the two, the attention weight of the node to the node is calculated by the following formula:

[0050] In addition, after the calculation of the node attention weight, it further includes: Based on the calculated attention weight, the feature representations of all neighbor nodes of the node are weighted and aggregated to obtain the updated feature representation of the node, and the aggregation formula is as follows:

[0051] Embodiment 2 The embodiment provides a multi-source data processing device based on a graph neural network, which is used to implement the multi-source data processing method based on the graph neural network.

[0052] The device comprises a data acquisition interface module, a traceability graph construction module, a multi-source graph fusion module, a graph neural network (GNN) modeling module, an attention optimization module, a data storage module, and a main control module, wherein each module is connected through an industrial-grade PCIe4.0 bus to realize high-speed data interaction. Specifically, the data acquisition interface module is configured to receive heterogeneous security data from different data sources; The traceability graph construction module is connected with the data acquisition interface module and is configured to convert various types of heterogeneous security data into fine-grained traceability graphs with causal relationships; the traceability graph takes system entities or threat entities as nodes and the interaction relationship between entities as edges, and retains timestamp and attribute information; The multi-source graph fusion module is connected with the traceability graph construction module and is configured to perform cross-source data alignment and fusion on multiple traceability graphs based on a unified graph mode to generate a unified traceability graph structure; The graph neural network modeling module is connected with the multi-source graph fusion module and is configured to perform neighborhood sampling and feature aggregation on the unified traceability graph to learn the embedding representation of nodes; The attention optimization module is connected with the graph neural network modeling module and is configured to introduce an attention mechanism to calculate attention weights based on the importance of edge types and node importance to optimize the feature aggregation process of the graph neural network modeling module; The data storage module is configured to store raw data, intermediate graph data, and finally generated optimized graph representation.

[0053] The working process of the device is as follows: The data acquisition interface module collects four types of multi-source data in real time, which are transmitted to the traceability graph construction module after cleaning; The traceability graph construction module generates four types of traceability graphs of network flow, system log, process behavior, and threat intelligence based on the "node-edge" rule; The multi-source graph fusion module generates a multi-source unified traceability graph through entity similarity matching and transmits it to the GNN modeling module; The GNN modeling module performs neighborhood sampling and multi-layer feature aggregation to generate an initial feature vector of nodes; The attention optimization module calculates attention weights to update the final feature vector, which is stored in the data storage module; The main control module uploads the final feature vector to the security management platform to support APT threat detection.

[0054] Embodiment 3 The embodiment provides a terminal device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the graph neural network-based multi-source data processing method as described above when executing the computer program.

[0055] The terminal device provided by the embodiment can be deployed in a power system dispatch center as a hardware carrier for multi-source data processing, and by running a computer program, the aforementioned multi-source data unified modeling method based on a graph neural network is implemented, and the terminal device has integrated capabilities of data acquisition, processing, storage and interaction, and can access distributed monitoring devices (such as firewalls, process monitors and threat intelligence terminals) of an ultrahigh-voltage power transmission system, thereby providing real-time data support for power grid safety decision-making.

[0056] The above is only a preferred embodiment of the present application, and it should be pointed out that for those skilled in the art, without departing from the technical principles of the present application, a number of improvements and substitutions can be made, and these improvements and substitutions should also be considered as the protection scope of the present application.

Claims

1. A multi-source data processing method based on graph neural networks, characterized in that, include: Pre-set corresponding node-edge sets according to different types of multi-source heterogeneous data, and convert the collected multi-source heterogeneous data into a data source graph of the corresponding data type according to the node-edge sets; Entity similarity matching is performed on each node in the data source map, and the source map is fused based on the similarity matching results to obtain a multi-source source map; The sampling probability of a node is determined based on the multi-source tracing graph, and the neighboring nodes of each node are sampled based on the sampling probability to generate a local sampling result for each node. Perform local feature aggregation on each node to generate an initial feature vector for each node; The attention weights between nodes are calculated based on the type of each edge in the multi-source tracing graph. The initial feature vector is then updated based on the attention weights to generate the feature vector value for each node.

2. The multi-source data processing method based on graph neural networks as described in claim 1, characterized in that, The process of pre-setting corresponding node-edge sets based on different types of multi-source heterogeneous data, and converting the collected multi-source heterogeneous data into a data source graph of the corresponding data type based on the node-edge sets, specifically includes: Based on the data characteristics of the network traffic, a first node-edge set is set; wherein, the first node-edge set includes a first node and a first edge, the first node includes IP address, port number, protocol type, process, and file, and the first edge represents network activity relationship; Based on the data characteristics of the system logs, a second node-edge set is defined; wherein, the second node-edge set includes a second node and a second edge, the second node includes a process, a first file, a registry, and a socket; the second edge represents a system call relationship; A third node-edge set is defined based on the data characteristics of the process behavior; wherein, the third node-edge set includes a third node and a third edge, the third node includes a parent process, a child process, a second file, and a network connection; the third edge represents the process interaction relationship; A fourth node-edge set is set based on the data characteristics of the threat intelligence; wherein, the fourth node-edge set includes a fourth node and a fourth edge, the fourth node includes IOCs, malware, attack techniques and APT groups; the fourth edge represents intelligence correlation relationships; Based on the type of multi-source heterogeneous data, the corresponding node-edge set is invoked to convert the multi-source heterogeneous data into a corresponding data tracing graph.

3. The multi-source data processing method based on graph neural networks as described in claim 1, characterized in that, The step of performing similarity matching on each node in the data source map, and fusing the source maps based on the similarity matching results to obtain a multi-source source map, specifically includes: Obtain the nodes and edges of each data source graph, and generate a unified set of node types and a set of edge types; wherein, the set of node types is also used to define the required attributes of each node, and the set of edge types is also used to define the core attributes of each edge; Based on the timestamps of the multi-source heterogeneous data and the entity identifiers of the corresponding data tracing graph, cross-source alignment is performed on the multi-source heterogeneous data; The entity similarity matching formula is used to calculate the nodes representing the same entity and the edges representing the same relationship in different data source graphs, thereby obtaining the entity similarity matching result; wherein, the expression of the entity similarity matching formula is: The duplicate nodes and edges are fused based on the entity similarity matching results to obtain the multi-source tracing graph.

4. The multi-source data processing method based on graph neural networks as described in claim 3, characterized in that, The step of fusing duplicate nodes and edges based on the entity similarity matching results to obtain the multi-source tracing graph specifically includes: Obtain completely consistent edges from different data source graphs, merge the core attributes of the edges, and fuse the edges; Each of the data source graphs is merged to obtain an initial multi-source source graph. Duplicate nodes in the initial multi-source source graph are deleted to obtain the multi-source source graph. When deleting duplicate nodes, attribute merging and edge fusion are performed on duplicate edges between the same entities.

5. The multi-source data processing method based on graph neural networks as described in claim 1, characterized in that, The step of determining the sampling probability of a node based on the multi-source tracing graph, and sampling the neighboring nodes of each node based on the sampling probability to generate a local sampling result for each node specifically includes: The importance of each edge in the multi-source tracing graph is evaluated based on its type, and an importance score is generated for each edge. The edge types include threat-sensitive edges, regular edges, and low-importance edges. Based on the importance score, the importance sampling formula is invoked to generate the sampling probability of the node associated with each edge; wherein, the expression of the importance sampling formula is: Based on the sampling probability, the neighboring nodes of each node are sampled to generate a local sampling result for each node.

6. The multi-source data processing method based on graph neural networks as described in claim 1, characterized in that, The step of aggregating local features for each node using a multi-layer graph neural network and the local sampling results to generate an initial feature vector for each node specifically includes: The multi-source tracing graph is stacked with graph convolutional layers to obtain several multi-source tracing layer levels; Local feature aggregation is performed on nodes in each of the multi-source tracing layers using an aggregation formula to obtain the hierarchical feature vector of each node. These features are then merged to generate the initial feature vector of each node. The expression of the aggregation formula is as follows:

7. The multi-source data processing method based on graph neural networks as described in claim 1, characterized in that, The calculation of attention weights between nodes based on the type of each edge in the multi-source tracing graph specifically includes: Edge type importance assessment: Based on the threat sensitivity corresponding to the type of each edge, the edges in the multi-source unified tracing graph are divided into three categories: threat-sensitive edges, regular edges, and low-importance edges. Calculate edge type importance weights: For each edge, calculate its edge type importance weight using the following formula: Calculate the attention weights between nodes: For any node and its neighboring nodes in the multi-source unified tracing graph, the attention weights between nodes are calculated using the following formula, based on the feature representations of the nodes and the type importance weights of the edges connecting them:

8. The multi-source data processing method based on graph neural networks as described in claim 1, characterized in that: After calculating the attention weights between nodes, the method further includes: Based on the calculated attention weights, the feature representations of all neighboring nodes of a node are weighted and aggregated to obtain the updated feature representation of the node. The aggregation formula is as follows:

9. A multi-source data processing device based on graph neural networks, characterized in that, Used to implement the multi-source data processing method based on graph neural networks as described in any one of claims 1-8; The device includes a main control module and a data acquisition interface module, a source graph construction module, a multi-source graph fusion module, a graph neural network modeling module, an attention optimization module, and a data storage module that are electrically connected to the main control module. The data acquisition interface module is used to receive heterogeneous security data from different data sources; The source map construction module is connected to the data acquisition interface module and is used to convert various heterogeneous security data into fine-grained source maps with causal relationships. The multi-source graph fusion module is connected to the source graph construction module and is used to perform cross-source data alignment and fusion on multiple source graphs based on a unified graph pattern to generate a unified source graph structure. The graph neural network modeling module is connected to the multi-source graph fusion module and is used to perform neighborhood sampling and feature aggregation on the unified source graph, and learn the embedded representation of the nodes; The attention optimization module is connected to the graph neural network modeling module and is used to introduce an attention mechanism to calculate attention weights based on the importance of edge types and node importance, so as to optimize the feature aggregation process of the graph neural network modeling module. The data storage module is used to store the raw data, intermediate graph data, and the final optimized graph representation.

10. A terminal device, comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the multi-source data processing method based on graph neural networks as described in any one of claims 1 to 8.

Images