APT detection method based on heterogeneous traceability graph and Gaussian fusion model

Abstract

The invention belongs to the technical field of network security, and particularly relates to an APT intrusion detection method based on a traceability graph and a Gaussian fusion model. The method comprises the following steps: 1, constructing a traceability graph, and creating a heterogeneous traceability graph comprising a subject, an object and a system call event; 2, a Node2vec algorithm is improved, relevance of a sequence level is considered, type information of nodes and edges is considered, and structural features and semantic features of the nodes are extracted; 3, according to a heterogeneous graph Transform model, double attention of types and intentions and attack time sequence and edge dynamic attributes are fused in a mutual attention module, and hop count perception mapping is adopted in a message passing module; and 4, optimizing the Gaussian mixture model, adapting to a dynamic multi-modal Gaussian mixture model for APT attack detection, and applying to a clustering anomaly detection link of an HGM model. The efficient model can effectively capture the deep mode and the statistical deviation of the attack behavior, the detection accuracy is ensured, and the dependence on the labeled data is reduced.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to an APT detection method based on a heterogeneous traceability graph and a Gaussian fusion model. BACKGROUND

[0002] In recent years, advanced persistent threat (APT) has caused a lot of losses to governments and enterprises. However, the existing technology has the difficulties of incomplete feature extraction and low precision.

[0003] Early researchers mainly based on direct causal analysis on the traceability graph. Wang Liang et al. restored the attack path by constructing a traceability knowledge graph, using local linear relationship and overlapping clustering algorithm. Chen Changhua et al. obtained multi-level log semantics through log fusion, and then obtained the intrusion path through PROGRUARD. (CHEN C H, WAN H, ZHAO X B. Log Re-Fusion: Methods Against Attacks on Application Log Integrity and Defense [J]. Science China: Information Sciences, 2024, 54: 2157-2180.) Al saheel et al. constructed a sequence-based model (ATLAS) to establish key patterns of attack and non-attack behaviors from the causal graph. (SAHEEL A, et al. ATLAS: A Sequence-Based Learning Approach for Attack Investigation [C] / / 30th USENIX Security Symposium (USENIX Security 21). Berkeley: USENIX Association, 2021: 3005-3022.) However, the detection investigation method based on causal analysis has a high degree of dependence on expert or domain knowledge rules, and the obtained context information is not enough, only explicit semantic features can be used, which leads to insufficient ability to find attack clues. By introducing a deep learning intelligent algorithm, the deficiencies in the causal analysis method can be made up, the node behavior on the traceability graph is represented by a high-dimensional vector, and more attack clues are provided. Ouyang Guige et al. obtained features based on graph substructure similarity, and then input them into the HGT model for detection. (OUYANG G G. Research on APT Detection Using Graph Neural Network [D]. Beijing: Beijing University of Posts and Telecommunications, 2021.)

[0004] Graph Neural Networks with Provenance Graph as Input[D].Guilin:Schoolof Cyberspace Security,

[0005] Guilin University of Electronic Technology, 2022.) Li Yuancheng et al. designed the DAGCN model, which uses an attention module to extract persistent attack features over a long period of time, thereby identifying attack nodes. (LI YC, LUO H, WANG XY, et al. Model Construction for APT Attack Detection Based on Provenance Graph and Attention Mechanism[J]. Journal of Communications, 2024, 45(03): 117-130.) However, deep learning-based detection suffers from significant data class imbalance, and the model's capabilities are limited by the data, making it difficult to discover new attack clues. Summary of the Invention

[0006] To address the aforementioned issues, this invention proposes an APT detection method based on a heterogeneous source graph and a Gaussian fusion model. This method effectively captures deep patterns and statistical biases of attack behavior through heterogeneous data fusion, self-supervised feature learning, and probability density modeling, reducing reliance on labeled data while maintaining detection accuracy.

[0007] This invention adopts the following technical solution: an APT detection method based on heterogeneous source mapping graphs and Gaussian fusion model, the APT detection method comprising the following steps:

[0008] Step 1: Construct a source map

[0009] Directed edges are generated for each system call record in the system log stream, with the start and end points serving as two nodes. The direction of the edge depends on the information flow direction of the corresponding system call. For syscalls like recv, exec, and read, the information flow is from the object to the subject; conversely, for system calls like clone, open, unlink, send, and write, the information flow is from the subject to the object, creating an edge from the subject to the object. The source graph is constructed from the system logs and contains a lot of redundant information, which needs to be filtered to better utilize the source graph for APT intrusion detection. The pruning optimization of the source graph mainly revolves around three aspects: if there are isolated nodes and isolated edges in the source graph that do not interact with other elements in the system and do not have the characteristics of APT intrusion, then these isolated nodes and isolated edges are deleted; duplicate edges between nodes are deleted to optimize the source graph, as there are a lot of repeated operations within the system, which can lead to duplicate edges between nodes; if some nodes and edges in the source graph have the same structure, the same nodes are merged into one node, and then the earliest operation among these nodes is retained as the edge of the new node.

[0010] The second step is to improve the Node2Vec algorithm.

[0011] This paper improves upon the limitations of the traditional Node2Vec algorithm. The original Node2Vec algorithm relies solely on the graph's topology, neglecting node attributes (such as process, file, etc.) and edge type information, making it difficult to characterize the semantic features of heterogeneous source graphs. This paper adopts a "structure-attribute" co-encoding strategy, fusing node type and edge type attribute information with topological structure information into the Node2Vec algorithm framework to achieve joint learning of attribute and structural features. The improved Node2Vec algorithm employs an attribute-priority neighbor selection mechanism during random walks; if the current walking node u has the attribute of "file," the algorithm tends to jump to a file node of the same type. Simultaneously, in the transition probability calculation... An attribute similarity term is introduced to quantify the impact of attribute matching degree on the walking direction. Structural feature extraction branches and attribute feature extraction branches are designed separately, and a gating mechanism is used to achieve dynamic weighted fusion of the two types of features. This mechanism can effectively suppress attribute noise interference; for example, when some nodes have missing attributes, the gating module automatically reduces the feature weight of the attribute branch to ensure the reliability of the fused features. To evaluate the quality of node embedding vectors, accuracy and recall from node classification tasks are selected as core indicators. The feature vectors extracted by the improved Node2Vec algorithm can effectively capture the relationships between nodes in heterogeneous source tracing graphs, providing high-quality feature support for subsequent detection models.

[0012] The third step is to modify the heterogeneous neural network model HGT.

[0013] The Heterogeneous Neural Network Model (HGT) is mainly composed of three parts: heterogeneous mutual attention, heterogeneous message passing, and target-specific aggregation. Modifications are made to heterogeneous mutual attention and heterogeneous message passing. The module calculates attention weights through the target node Vt, neighboring nodes Vs, and the tuple relationship <α(s), β(e), α(t)> between them. The original model could only distinguish node types by projecting nodes to different feature spaces through linear mapping, without incorporating type semantic priority into the attention calculation (e.g., exploit-type nodes in APT scenarios should receive higher attention weights than regular access-type nodes). All node types and edge types are pre-trained with learnable type embedding vectors, where Tv is the node type, Te is the edge type, Tvt is the type embedding of the target node t, Te(s,t) is the type embedding of edge e = (s,t), and Edynamic(e) is the dynamic attribute embedding. Before Softmax normalization, type weights ω are introduced for node type and attack intent, respectively. T(s) and intention weight ω I(s，t) This subjectes attention computation to a triple constraint: feature similarity, type importance, and intent relevance. To obtain semantic relationships at different nodes, the model adds an edge-based matrix between the query vector and the key vector. The HGT model performs a Softmax operation on the attention vectors of all neighboring nodes to obtain a normalized attention distribution, as shown in equations (1)-(4).

[0014]

[0015] In the formula, N(t) is the set of neighbors of node t. For feature splicing operations, W k、 b k is the key vector K i Linear transformation parameters of (s) ，W q、 b q is the query vector Q i Linear transformation parameters of (t), ATT-head i In this context, i represents the number of attention heads. The multi-attention-head mechanism enhances the model's ability to express complex semantics.

[0016] The existing HGT model's message passing process only considers messages from first-order direct neighbors, and the edge dependency aggregation method (such as linear mapping) does not fully utilize the higher-order associations (such as multi-step attack links in APT attacks) and dynamic attributes of heterogeneous graphs, resulting in insufficient semantic integrity of message passing. Through the hop count-aware mapping mechanism, messages are propagated among multi-order neighbors while retaining the semantic information corresponding to the hop count (such as 1 hop representing direct association and 2 hops representing indirect association). The heterogeneous message passing module associates each attention head i with the hop count k and introduces hop count weights. During aggregation, the weights are added according to the hop count. At the same time, a hop count-aware linear mapping and weight matrix are defined for each hop count k, so that the source node features of different hop counts are mapped according to the dual conditions of "hop count + edge type", as shown in formulas (5)-(6).

[0017]

[0018]

[0019] In the formula, For feature splicing operations, H (l-1) [s] represents the feature representation of the source node s in layer l-1, [l,h] represents the index range of the attention head, α(t) represents the type of the source node s, and β(t) represents the type of the edge e.

[0020] Step 4: Dynamic Multimodal Gaussian Mixture Model (DM-GMM)

[0021] Traditional Gaussian Mixture Models (GMMs) suffer from weak temporal adaptability, insufficient attack modality matching, and static thresholding in APT attack detection scenarios. This paper addresses the scenario adaptability issues of traditional GMMs in APT detection by using a Dynamic Multimodal Gaussian Mixture Model (DM-GMM). Improvements are made to traditional GMMs in feature processing, cluster number selection, and threshold setting. For APT attack features, the paper breaks through the static normalization logic of traditional GMMs by adding a time-specific normalization, extracting the temporal correlation dimension of the model's HGT output features, and employing in-window normalization. A time-series sliding window normalization based on the mean and standard deviation replaces global static normalization. For the selection of the number of clusters, the traditional Bayesian Information Criterion (BIC) is improved by introducing prior knowledge of multi-stage modalities in APT attacks, which can only balance model complexity and goodness of fit. This optimizes the number of clusters while satisfying the optimal BIC value and the highest matching score of the attack modality. For the threshold setting, the static scheme of fixing the 95th percentile of the negative log-likelihood of normal samples in the traditional GMM is abandoned. Instead, a time-series sliding window adaptive threshold mechanism is designed to take into account the dynamic nature of APT attacks and the time-series drift characteristics of normal behavior.

[0022] Furthermore, in step one, the constructed source map is a source map containing multi-source heterogeneous data.

[0023] Furthermore, in step two, the improved Node2Vec module is used to co-encode attribute information and structural information.

[0024] Furthermore, in step three, the improved HGT module incorporates dual attention of type and intent, as well as attack timing and edge dynamic attributes in the mutual attention module, and adopts hop count-aware mapping in the message passing module to allow messages to propagate among multi-level neighbors.

[0025] Furthermore, in step four, the multimodal Gaussian mixture module is used for the clustering anomaly detection of the model.

[0026] Furthermore, in the APT detection method based on heterogeneous source graph and Gaussian fusion model, the source graph is processed with improved Node2Vec and HGT, and Gaussian fusion is optimized with DM-GMM to adapt to APT detection.

[0027] The beneficial effects of this invention are as follows: It provides an APT detection method based on a heterogeneous source graph and a Gaussian fusion model. In the feature extraction stage, the method improves the Node2Vec module, making it consider not only sequence-level correlations but also the type information of nodes and edges, thus effectively extracting the structural and semantic features of nodes. By introducing a self-supervised feature learning mechanism, the method modifies the Heterogeneous Graph Transformer (HGT) model, incorporating dual attention based on type and intent, as well as attack timing and edge dynamic attributes in the mutual attention module. In the message passing module, it adopts hop count-aware mapping, allowing messages to propagate among multi-level neighbors, effectively improving the model's performance. Simultaneously, the Gaussian Mixture Model (GMM) is optimized, proposing a Dynamic Multimodal Gaussian Mixture Model (DM-GMM) adapted for APT attack detection, used in the clustering anomaly detection stage of the HGM model. Experiments on the StreamSpot dataset show that the accuracy and F1 score of this method both reach over 98%, providing a new solution for APT network security analysis. Its advantages are as follows:

[0028] (1) The feature extraction depth is increased. The original algorithm only relies on the graph structure and ignores the node's own attributes (such as node type and edge type). The attribute information and structural information are co-encoded, and the various types of edges and nodes in the source graph are integrated into Node2Vec and then applied to construct, thereby providing more valuable features for the following text.

[0029] (2) Optimization of heterogeneous mutual attention module: By pre-training learnable type embedding vectors of nodes and edges, type and attack intent weights are introduced and edge basis matrices are added, so that attention calculation is subject to triple constraints of feature similarity, type importance and intent correlation, which makes up for the defects of the original model that only distinguishes node types by linear mapping and has no type semantic priority.

[0030] (3) Optimization of the heterogeneous message passing module: The heterogeneous message passing module uses hop count-aware mapping to achieve multi-order neighbor message propagation and retain hop count semantics. It associates hop count k with message header, introduces hop count weight, and maps source node features in a dual manner of "hop count + edge type". This makes up for the lack of semantic integrity caused by existing HGT message passing only considering first-order neighbors and not making full use of high-order associations and dynamic attributes of heterogeneous graphs.

[0031] (4) Dynamic Multimodal Gaussian Mixture Model (DM-GMM): In response to the limitations of traditional Gaussian Mixture Model (GMM) in APT attack detection, such as weak temporal adaptability, insufficient attack modality matching, and static threshold, Dynamic Multimodal Gaussian Mixture Model (DM-GMM) is innovatively proposed. Its core innovation focuses on customized optimization of APT attack scenarios. Attached Figure Description

[0032] Figure 1 This is a flowchart of the model training and testing process.

[0033] Figure 2 This is the overall architecture diagram of the model.

[0034] Figure 3 This is the architecture diagram of the HGT optimization model.

[0035] Figure 4 This is the ROC curve of STREAMSPOT data.

[0036] Figure 5 It is a visualization of the model clustering. Detailed Implementation

[0037] Example 1

[0038] An APT detection method based on heterogeneous source graph and Gaussian fusion model includes the following steps:

[0039] Step 1: Construct a source map

[0040] Directed edges are generated for each system call record in the system log stream, with the start and end points serving as two nodes. The direction of the edge depends on the information flow direction of the corresponding system call. For syscalls like recv, exec, and read, the information flow is from the object to the subject; conversely, for system calls like clone, open, unlink, send, and write, the information flow is from the subject to the object, creating an edge from the subject to the object. If isolated nodes and edges exist in the source graph, they are deleted. Duplicate edges between nodes are also removed to optimize the source graph. If some nodes and edges in the source graph have the same structure, these identical nodes are merged into one node, and the earliest operation among these nodes is retained as an edge of the new node.

[0041] Compared to simply guiding from subject to object, this construction method better preserves the semantic information on the source graph. Because only threads or processes in the host can initiate system calls, the directions of some subject-object edges are predictable (e.g., an edge between a process node and a file node can only be from the process node to the file node). At this point, using directed edges from subject to object has the same informational content as using undirected edges. However, determining the direction of directed edges based on information flow allows more information to be preserved in the directed graph.

[0042] The second step is the improved Node2Vec algorithm.

[0043] The attribute information and structural information are co-encoded, and the various types of edges and nodes in the traceability graph are integrated into Node2Vec before being applied for construction.

[0044] This paper improves upon the limitations of the traditional Node2Vec algorithm by fusing node type and edge type attribute information with topological structure information from the source graph into the Node2Vec algorithm framework, enabling joint learning of attribute and structural features. The improved Node2Vec algorithm employs an attribute-priority neighbor selection mechanism during random walks; if the attribute of the current walking node u is "file," the algorithm tends to jump to a file node of the same type. Simultaneously, an attribute similarity term is introduced into the transition probability calculation to quantify the impact of attribute matching on the walk direction. Separate structural feature extraction and attribute feature extraction branches are designed, and a gating mechanism is used to achieve dynamic weighted fusion of the two types of features. To evaluate the quality of node embedding vectors, accuracy and recall from node classification tasks are selected as core metrics. The feature vectors extracted by the improved Node2Vec algorithm can effectively capture the relationships between nodes in heterogeneous source graphs, providing high-quality feature support for subsequent detection models. The improved Node2Vec module is used for co-encoding attribute and structural information.

[0045] Node2vec includes:

[0046] 1. When walking, prioritize choosing neighbors with similar attributes; In the source graph, if the attribute of node u is "file", then when walking, it tends to jump to the node that is also marked as "file". The transition probability is added to the attribute similarity term: P(v|u)∝α·structural similarity+(1-α)·attribute similarity (α is the balance coefficient).

[0047] 2. In the design of structural branches and attribute branches, a gating mechanism is used for dynamic fusion. This design can avoid attribute noise interference (e.g., when some node attributes are missing, the gating can automatically reduce the weight of the attribute branch).

[0048] The third step is to modify the heterogeneous neural network model HGT.

[0049] Modifications were made to heterogeneous mutual attention and heterogeneous message passing. The module calculates attention weights using the target node Vt, neighboring nodes Vs, and the tuple relationship <α(s), β(e), α(t)> between them. All node types and edge types are pre-trained with learnable type embedding vectors, where Tv is the node type, Te is the edge type, Tvt is the type embedding of the target node t, Te(s,t) is the type embedding of edge e = (s,t), and Edynamic(e) is the dynamic attribute embedding. Before Softmax normalization, type weights ω are introduced for node type and attack intent, respectively. T(s) and intention weight ω I(s，t) This subjectes attention computation to a triple constraint: feature similarity, type importance, and intent relevance. To obtain semantic relationships at different nodes, the model adds an edge-based matrix between the query vector and the key vector. The HGT model performs a Softmax operation on the attention vectors of all neighboring nodes to obtain a normalized attention distribution, as shown in equations (1)-(4).

[0050]

[0051]

[0052] In the formula, N(t) is the set of neighbors of node t. For feature splicing operations, W k、 b k is the key vector K i Linear transformation parameters of (s) ，W q、 b q is the query vector Q i Linear transformation parameters of (t), ATT-head i In this context, i represents the number of attention heads. The multi-attention-head mechanism enhances the model's ability to express complex semantics.

[0053] The hop count-aware mapping mechanism enables messages to propagate among multi-level neighbors while preserving the semantic information corresponding to the hop count. The heterogeneous message passing module associates each attention head i with the hop count k and introduces hop count weights. During aggregation, the weights are calculated based on the hop count. At the same time, a hop count-aware linear mapping and weight matrix are defined for each hop count k, so that the source node features with different hop counts are mapped according to the dual conditions of "hop count + edge type", as shown in formulas (5)-(6).

[0054]

[0055] In the formula, For feature splicing operations, H (l-1)[s] represents the feature representation of the source node s in layer l-1, [l,h] represents the index range of the attention head, α(t) represents the type of the source node s, and β(t) represents the type of the edge e. The improved HGT module incorporates dual attention of type and intent, as well as attack timing and edge dynamic attributes in the mutual attention module, and adopts hop count-aware mapping in the message passing module to allow messages to propagate among multi-level neighbors.

[0056] Further mining of the feature sequences, HGT includes:

[0057] 1. Semantic priority is incorporated into attention, and learnable type embedding vectors are pre-trained for all node types (such as host nodes, process nodes, and network connection nodes in APT) and edge types (such as calls, accesses, and exploits).

[0058] 2. Introduce type weights and intent weights for node type and attack intent respectively, so that attention calculation is subject to the triple constraints of feature similarity, type importance and intent relevance.

[0059] 3. In order to obtain the semantic relationships on different nodes, an edge-based matrix will be added between the query vector and the key vector.

[0060] 4. Use hop count-aware mapping to allow messages to propagate among multi-level neighbors while preserving the semantics corresponding to the hop count (e.g., 1 hop = direct association, 2 hops = indirect association).

[0061] Step 4: Dynamic Multimodal Gaussian Mixture Model (DM-GMM)

[0062] This paper addresses the scenario adaptability issue of traditional Gaussian Mixture Models (GMMs) in APT detection by employing a Dynamic Multimodal Gaussian Mixture Model (DM-GMM). Improvements are made to the traditional GMM in feature processing, cluster number selection, and threshold setting. For APT attack features, a time-series-specific normalization is added, extracting the time-related dimensions of the model's HGT output features and using a time-series sliding window normalization based on the mean and standard deviation within the window, replacing global static normalization. For cluster number selection, prior knowledge of multi-stage modalities in APT attacks is introduced to achieve the optimal cluster number while satisfying the optimal BIC value and the highest attack modality matching score. For threshold setting, an adaptive threshold mechanism using a time-series sliding window is designed to address the dynamic nature of APT attacks and the time-series drift characteristics of normal behavior. The DM-GMM module is used for the cluster anomaly detection stage of the model.

[0063] Based on the features of HGT output, the advantages of GMM probability density modeling and unsupervised clustering are fully utilized. At the same time, combined with the temporal and multi-stage characteristics of APT attacks, dynamic behavioral baselines can be constructed without manual annotation of abnormal samples.

[0064] 1. In response to the essential characteristics of APT attacks, a time-series-specific normalization strategy is added to the feature preprocessing stage. Instead of treating feature vectors as static data, the time-series-related dimensions in the output features of the HGT model are extracted separately, and time-series sliding window normalization (based on the mean and standard deviation of the time-series features within the window) is used to replace global static normalization.

[0065] 2. To address the characteristics of APT attacks, which are "dynamic and continuous, with normal behavior drifting over time", a time-series sliding window adaptive threshold mechanism is designed.

[0066] 3. The final optimal number of clusters must simultaneously satisfy the optimal BIC value and the highest attack modality matching score, ensuring that the clustering results can not only fit the multimodal distribution of normal behavior, but also accurately capture the abnormal modal boundaries of each stage of APT attacks, avoiding the defect of traditional BIC that easily ignores the semantics of attack scenarios.

[0067] Improved HGT model:

[0068] (1) Mutual attention module optimization: By pre-training learnable type embedding vectors of nodes and edges, type and attack intent weights are introduced and edge basis matrices are added, so that attention calculation is subject to triple constraints of feature similarity, type importance and intent correlation, which makes up for the defects of the original model that only distinguishes node types by linear mapping and has no type semantic priority.

[0069] (2) Message passing module optimization: This heterogeneous message passing module uses hop count-aware mapping to achieve multi-order neighbor message propagation and retain hop count semantics. It associates hop count k with message header, introduces hop count weight, and maps source node features in a dual manner of "hop count + edge type". This makes up for the lack of semantic integrity caused by existing HGT message passing only considering first-order neighbors and not making full use of high-order associations and dynamic attributes of heterogeneous graphs.

[0070] Dynamic multimodal Gaussian mixture model (DM-GMM):

[0071] (1) Standardization logic: In response to the essential characteristics of APT attacks, a time-series-specific normalization strategy is added in the feature preprocessing stage: the feature vector is no longer regarded as static data, but the time-series related dimensions in the output features of the HGT model are extracted separately, and the time-series sliding window normalization (based on the mean and standard deviation of the time-series features within the window) is used to replace the global static normalization.

[0072] (2) Bayesian Information Criterion (BIC): Improve the traditional single cluster number selection logic based on BIC that only balances model complexity and fit, introduce multi-stage modal prior knowledge of APT attacks, and predefine typical feature modalities of core stages such as reconnaissance, penetration, lateral movement and data theft through the APT attack knowledge base; abandon the static threshold scheme of the traditional GMM that takes the 95th percentile of the negative log-likelihood value of normal samples, and design a time-series sliding window adaptive threshold mechanism to address the characteristics of APT attacks that are "dynamic and continuous and normal behavior drifts over time".

[0073] (3) Optimal number of clusters: The final optimal number of clusters must simultaneously satisfy the optimal BIC value and the highest attack modality matching score, ensuring that the clustering results can not only fit the multimodal distribution of normal behavior, but also accurately capture the abnormal modal boundaries of each stage of APT attack, avoiding the defect of traditional BIC that easily ignores the semantics of attack scenarios.

[0074] HGM fusion model:

[0075] By fusing HGT and DM-GMM, this method combines the feature extraction capabilities of HGT with the rate-density modeling and unsupervised clustering capabilities of DM-GMM. This combination enables the model to more flexibly and accurately capture the multimodal distribution characteristics of normal behavior and the dynamic anomalies of attacks, providing more targeted quantitative anomaly clues for APT attack investigations and improving the detection efficiency of APT attacks. Specifically, HGT can capture the complex relationships between different types of nodes and edges in heterogeneous graphs, while DM-GMM can construct a robust behavioral baseline without the need for attack sample annotation through unsupervised clustering and probability density modeling, providing a feasible solution for the detection of unknown threats such as APT attacks. The combination of the two enables the model to detect APT intrusions more accurately.

[0076] Example 2 (Test 1)

[0077] To verify the performance improvement effect of the core module on the model, comparative experiments were conducted. All experiments were performed on the same dataset, with the same partitioning method, the same number of iterations, and under the same experimental conditions, using Accuracy, Precision, Recall, and F1 as evaluation metrics.

[0078] The model performance testing order was as follows: Node2vec network, HGT network only, GMM network only, and finally, HGM network fusion. The evaluation results are shown in Table 1. As can be seen from the evaluation metrics, adding each module improved the metrics to some extent, and adding all modules resulted in optimal results for all metrics.

[0079] Table 1 Ablation Experiment

[0080] Node2Vec HGT GMM Accuracy Precision Recall F1-Score √ × × 0.809 0.823 0.776 0.798 × √ × 0.924 0.932 0.906 0.918 × × √ 0.940 0.952 0.988 0.969

[0081] Example 3 (Test 2)

[0082] The effectiveness of the HGM model in detecting APT intrusions was validated using the STREAMSPOT dataset. The HGM model was compared with other anomaly detection models: four state-of-the-art source graph detection methods: StreamSpot, UNICORN, DACGN, and ProSAGE. In addition to these mainstream methods, the widely used HAN model was used to replace the HGT module, and DBSCAN clustering was used to replace the GMM module, to illustrate the method's advancement. During the comparison, 80% of the benign data in the dataset was used as training data, and the remaining 20% ​​of malicious data was used as test data. The learning rate was set to 0.001 during training.

[0083] Table 2 Comparison of experimental results

[0084]

[0085] Experimental results show that the HGM method performs best, achieving accuracy and precision of 98.8% and 97.8%, respectively. Compared to the StreamSpot model originally used for this dataset, it represents a performance improvement of over 20%. Compared to the newly proposed ProSAGE model from 2024, it improves accuracy and precision by 0.8% and 1.7%, respectively.

[0086] To analyze model performance in depth, the original dataset was split into three subsets, following the partitioning method of the StreamSpot dataset. Given that this dataset contains five benign scenarios and one attack scenario, each subset includes different combinations of benign scenarios while retaining the same attack scenario as a common component. Table 3 shows the specific benign scenario configurations included in each subset. The effectiveness of the proposed model will be further validated using different methods within these three scenarios.

[0087] Table 3 provides an overview of the StreamSpot subset dataset (for benign scenarios only).

[0088]

[0089] Table 4 shows the results of different methods on the StreamSpot subset.

[0090]

[0091] Table 4 lists the accuracy of the HGM model compared to other models on the three subsets of data. It can be seen that the HGM model performs well on datasets of different scales. To visually demonstrate the model's performance on the three subsets, ROC curves were plotted by adjusting the distance threshold, as shown below. Figure 4 As shown, the AUC of all three datasets is greater than or equal to 0.96 under this method. This indicates that there is a clear distinction between benign and malicious processes under the HGM model, and this method can effectively distinguish between benign and malicious processes by adjusting the threshold.

[0092] Example 4 (Test 3)

[0093] This method validates the effectiveness of the HGM model clustering by visualizing the clustering results, demonstrating its ability to effectively distinguish between outliers and normal data. Principal Component 1 (PC1) and Principal Component 2 (PC2) are two new composite variables obtained by performing a linear transformation on the original high-dimensional data. PC1 is the projection of the original data onto the direction of maximum variance, representing the feature direction with the largest variance in the original data. PC2 is the feature direction with the second largest variance in the original data, located orthogonal to PC1.

[0094] Scatter Figure 5 In this model, the distribution of blue (normal) and red (abnormal) samples directly reflects the distinguishability of the two types of data. The distribution of the two types of points in the graph is clearly well separated, indicating that the data features after dimensionality reduction provide some support for the classification task, and the model can effectively distinguish between normal and abnormal behavior. The accuracy and F1 score of this method both reach over 98%, providing a new solution for APT network security analysis.

Claims

1. A method for APT detection based on heterogeneous provenance graph and Gaussian fusion model, characterized in that, The APT detection method comprises the following steps: First step, constructing a traceability graph By generating a directed edge for each system call record in the system log stream, then taking the starting point and the end point as two nodes, and the direction of the edge depends on the direction of the information flow in the corresponding system call; if there are isolated nodes and isolated edges in the traceability graph, delete these isolated nodes and isolated edges; delete the repeated edges between nodes to optimize the traceability graph; if the structure of some nodes and edges in the traceability graph is the same, merge the same nodes into one node, and then keep the earliest operation in these nodes as the edge of the new node; Second step, improving the Node2Vec algorithm The limitations of the traditional Node2Vec algorithm are improved; the node type and edge type attribute information and topological structure information in the traceability graph are fused into the Node2Vec algorithm framework to realize the joint learning of attribute and structure characteristics; the improved Node2Vec algorithm adopts an attribute-preferred neighbor selection mechanism in the random walk process, and if the attribute of the current walk node u is a file, the algorithm tends to jump to a file node of the same type; meanwhile, an attribute similarity term is introduced in the transition probability calculation to quantify the influence of attribute matching degree on the walking direction; a structure feature extraction branch and an attribute feature extraction branch are designed respectively, and the dynamic weighted fusion of the two types of features is realized through a gating mechanism; in order to evaluate the quality of node embedding vectors, the accuracy and recall rates in the node classification task are selected as the core indicators, and the feature vectors extracted by the improved Node2Vec algorithm can effectively capture the correlation between nodes in the heterogeneous traceability graph, providing high-quality feature support for the subsequent detection model; Third step, modifying the heterogeneous neural network model HGT The heterogeneous attention and heterogeneous message passing are modified, and the module calculates the attention weight through the target node Vt, the neighbor node Vs and the tuple relationship <α(s), β(e), α(t)> between them; all node types and edge types are pre-trained to learn type embedding vectors, Tv is the node type, Te is the edge type, Tvt is the type embedding of the target node t, Te(s, t) is the type embedding of the edge e=(s, t), and Edynamic(e) is the dynamic attribute embedding; before Softmax normalization, type weight ω and intention weight ω are introduced for node type and attack intention respectively T(s) and intention weight ω I(s，t) , so that the attention calculation is simultaneously constrained by feature similarity, type importance and intention relevance; the model adds an edge-based matrix between the query vector and the key vector to obtain the semantic relationship on different nodes The HGT model performs Softmax operation on the attention vectors of all neighbor nodes to obtain the normalized attention distribution, as shown in formulas (1)-(4); In the formula, N(t) is a neighbor set of node t, is a feature concatenation operation, W k , b k is a key vector K i , W q , b q is a query vector Q i , ATT-head i i in the formula is the number of attention heads, and the expression ability of the model to complex semantics is enhanced through the multi-attention head mechanism. Through the mapping mechanism of hop number perception, the message is transmitted among multi-hop neighbors, while the semantic information corresponding to the hop number is preserved; the heterogeneous message passing module is associated with the hop number k for each attention head i, and introduces the hop number weight, and is weighted according to the hop number during aggregation, and defines the linear mapping and weight matrix of the hop number perception for each hop number k, so that the source node features of different hop numbers are mapped according to the "hop number+edge type" double conditions, as shown in formulas (5)-(6); In the formula, H is a feature concatenation operation, (l-1) [s] is the feature representation of the source node s in the l-1 layer, [l, h] is the index range of the attention head, a(t) is the type of the source node s, and β(t) is the type of the edge e. Fourth step, dynamic multi-modal Gaussian mixture model DM-GMM The dynamic multi-modal Gaussian mixture model DM-GMM is used to solve the scene adaptability problem of the traditional Gaussian mixture model GMM in APT detection; the traditional Gaussian mixture model GMM is improved from feature processing, cluster number selection and threshold setting; for APT attack features, a time sequence dimension exclusive normalization is added, the time sequence related dimension of the model HGT output feature is extracted, and a time sequence sliding window normalization based on the mean and standard deviation in the window is used instead of global static normalization; for cluster number selection, the prior knowledge of APT attack multi-stage mode is introduced, and the optimal cluster number satisfies the optimal BIC value and the highest attack mode matching score at the same time; for threshold setting, according to the dynamic nature of APT attack and the time sequence drift characteristics of normal behavior, a time sequence sliding window adaptive threshold mechanism is designed.

2. The APT detection method based on heterogeneous provenance graph and Gaussian fusion model according to claim 1, characterized in that, In step one, the constructed traceability graph is a traceability graph containing multi-source heterogeneous data.

3. The APT detection method based on heterogeneous provenance graph and Gaussian fusion model according to claim 1, characterized in that, In step two, the improved Node2Vec module is used to collaboratively encode attribute information and structural information.

4. The APT detection method based on heterogeneous provenance graph and Gaussian fusion model according to claim 1, characterized in that, In step three, the improved HGT module integrates dual attention of type and intent into the attention module and attack timing and edge dynamic attributes, and uses a hop-aware mapping in the message passing module to propagate messages among multi-order neighbors.

5. The APT detection method based on heterogeneous provenance graph and Gaussian fusion model according to claim 1, characterized in that, In step four, the state multi-modal Gaussian mixture module is used for the clustering anomaly detection link of the model.

Images