Intrusion detection model training method, detection method and equipment based on traceability graph and causal invariant

Abstract

The invention provides an intrusion detection model training method, detection method and equipment based on a traceability graph and causal invariants, and the method comprises the steps: obtaining a system traceability graph and each causal invariant, and constructing a violation intensity function of each causal invariant; obtaining the score of each causal invariant of each event in the traceability graph, and forming a causal invariant consistency verification score table; selecting a preset number of fields for masking according to the sequence of values from high to low, and training a graph encoder to reconstruct the fields according to a loss function; constructing a negative sample and a positive sample as input based on the traceability graph and the score table, obtaining an initial encoder embedding feature by using a graph encoder, and mapping the initial encoder embedding feature to a representation space of contrast learning by using a projection head so as to obtain a representation vector and optimize the graph encoder; the graph encoder is configured to output an encoder embedding feature for intrusion detection of a computer system. According to the invention, the problem of intrusion detection failure caused by unreliable semantic information of an existing detection model can be effectively solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, and in particular to an intrusion detection model training method and device based on a traceability graph and causal invariants, and an intrusion detection method. BACKGROUND

[0002] Intrusion detection technology is a key technology for ensuring network and system security, and its main task is to monitor activities in a computer system or network, and to discover and report malicious and security policy violating behaviors.

[0003] Traditional intrusion detection technologies are mainly divided into signature-based detection and anomaly-based detection. A signature-based detection method identifies threats by matching known attack patterns (signatures), which has high accuracy but cannot detect new and unknown attacks (i.e., "zero-day attacks"). An anomaly-based detection method identifies behaviors deviating from a baseline model of normal system behavior as anomalies, which has the potential to detect unknown attacks but faces the challenges of high false positive rates and difficulty in accurately delineating the boundaries of normal system behavior.

[0004] In order to cope with increasingly complex and stealthy advanced persistent threats (APTs), the security field urgently needs new detection methods that can deeply analyze the internal correlations and causal relationships of behaviors from massive system events. SUMMARY

[0005] In view of this, the embodiments of the present application provide an intrusion detection model training method and device based on a traceability graph and causal invariants to eliminate or improve one or more defects in the prior art.

[0006] A first aspect of the present application provides an intrusion detection model training method based on a traceability graph and causal invariants, the method comprising: obtaining a system traceability graph and each causal invariant, and constructing a violation strength function corresponding to each causal invariant; obtaining scores of each causal invariant corresponding to each event in the traceability graph, and constructing a causal invariant consistency check score table based on each score; wherein the causal invariants include reachability data of an executor to a file, consistency data of a file creator and a first writer, timing data for file creation, writing and execution, and detection data of file aliases and homonyms, and the traceability graph is used to represent each event and the interaction relationship between each event; selecting a preset number of fields corresponding to each causal invariant in descending order of numerical values in the score table to mask, and reconstructing the fields according to a first loss function to train a graph encoder; Constructing negative samples and positive samples based on the provenance graph and the score table, taking the negative samples and the positive samples as inputs, obtaining initial encoder embedding features by using the graph encoder, mapping the initial encoder embedding features to a representation space of contrastive learning by using a projection head to obtain a feature vector, and optimizing the graph encoder based on the feature vector to make the graph encoder output target encoder embedding features for intrusion detection of a computer system.

[0007] In some embodiments of the present application, the score of each causal invariant corresponding to each event in the provenance graph is obtained by: The violation strength functions are weighted and fused to obtain a scoring formula. The score of each causal invariant corresponding to each event in the provenance graph is calculated according to the scoring formula.

[0008] In some embodiments of the present application, the first loss function includes a reconstruction loss function and the violation strength function.

[0009] In some embodiments of the present application, the optimization of the graph encoder based on the feature vector includes: A second loss function is constructed based on the feature vector. The parameters of the graph encoder are adjusted according to the second loss function.

[0010] The second aspect of the present application provides an intrusion detection method based on a provenance graph and causal invariants, which includes: Obtaining a causal invariant consistency verification score table and target encoder embedding features, and generating abnormal score data corresponding to each event in the causal invariant consistency verification score table by using an anomaly detection head; wherein the score table and the target encoder embedding features are both trained by the intrusion detection model training method based on a provenance graph and causal invariants of the first aspect.

[0011] In some embodiments of the present application, the generation of abnormal score data corresponding to each event in the causal invariant consistency verification score table by using the anomaly detection head includes: The generation of abnormal score data corresponding to each event by using the anomaly detection head includes: Fusing the score table and the target encoder embedding features to obtain a comprehensive feature vector, and taking the comprehensive feature vector as input; Training an anomaly detection head according to a ranking consistency loss function; Generating abnormal score data corresponding to each event according to a preset activation function by using the anomaly detection head.

[0012] In some embodiments of the present application, after the anomaly score data corresponding to each event in the score table of the causal invariance consistency check is generated by using the anomaly detection head, the method further comprises: selecting a preset number of each causal invariance and the event corresponding to each causal invariance in the score table according to the order from high to low of the numerical value in the score table, to form an initial set; obtaining an initial explanation subgraph corresponding to the provenance graph based on the score table and the anomaly score data corresponding to each event; pruning the initial explanation subgraph to generate a target explanation subgraph.

[0013] In some embodiments of the present application, the initial explanation subgraph corresponding to the provenance graph obtained based on the score table and the anomaly score data corresponding to each event comprises: obtaining a reward value corresponding to each event based on the score table and the anomaly score data corresponding to each event; adding each event in the order from large to small according to the ratio of the reward value to the new event, and checking each event based on the score table, to obtain an initial explanation subgraph corresponding to the provenance graph.

[0014] The third aspect of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method of the first aspect.

[0015] The fourth aspect of the present application provides a computer readable storage medium, which stores a computer program, wherein the computer program is executed by a processor to implement the method of the first aspect.

[0016] The fifth aspect of the present application provides a computer program product, comprising a computer program, wherein the computer program is executed by a processor to implement the method of the first aspect.

[0017] This application provides a training method for an intrusion detection model based on a source graph and causal invariants. The method includes: acquiring a system source graph and various causal invariants; constructing violation strength functions corresponding to each of the causal invariants; acquiring scores for each of the causal invariants corresponding to each event in the source graph; and constructing a consistency check score table for causal invariants based on the scores. The causal invariants include reachability data of the executor to the file, consistency data between the file creator and the first writer, temporal data for file creation, writing, and execution, and detection data for file aliases and homonyms. The source graph is used to represent each of the events and each... The interaction relationships between the events are analyzed; a preset number of fields corresponding to each of the causal invariants are selected in descending order of the values ​​in the score table for masking; a graph encoder is trained according to the first loss function to reconstruct the fields; negative and positive samples are constructed based on the source graph and the score table; the negative and positive samples are used as inputs; the graph encoder is used to obtain initial encoder embedding features; the initial encoder embedding features are mapped to the representation space of contrastive learning using a projection head to obtain a representation vector; the graph encoder is optimized based on the representation vector so that the graph encoder outputs target encoder embedding features for intrusion detection of computer systems. By proposing an explicit risk quantification mechanism based on causal invariants, and utilizing the violation intensity function and fusion scoring formula of causal invariants, this mechanism can break free from dependence on unreliable semantic information and uncover more fundamental and harder-to-forge behavioral patterns, thereby achieving more robust threat perception. Furthermore, by proposing a self-supervised learning mechanism based on causal invariants, and integrating mask reconstruction and destruction discrimination strategies to train a graph encoder, the generated graph representation becomes highly sensitive to behaviors that violate causal invariants. This allows the model to autonomously learn deep semantic and structural features that distinguish normal from abnormal behavior from massive amounts of benign data, improving the model's discriminative ability and enhancing the accuracy and robustness of intrusion detection.

[0018] Additional advantages, objectives, and features of this application will be set forth in part in the description which follows, and will in part become apparent to those skilled in the art upon review of the following description, or may be learned by practice of the application. The objectives and other advantages of this application can be realized and obtained by means of the structures specifically pointed out in the specification and drawings.

[0019] Those skilled in the art will understand that the purposes and advantages that can be achieved with this application are not limited to those specifically described above, and that the above and other purposes that this application can achieve will be more clearly understood from the following detailed description. Attached Figure Description

[0020] The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiments of the application and together with the description serve to explain the principles of the application. The components in the drawings are not necessarily to scale, emphasis instead being placed upon illustrating the principles of the application. For purposes of clarity and understanding, some portions of the drawings can be exaggerated, and others omitted. In the drawings: Figure 1 A flowchart of a method for training an intrusion detection model based on a provenance graph and a causal invariant in an embodiment of the present application.

[0021] Figure 2 A flowchart of a method for constructing a target explanation subgraph in an embodiment of the present application.

[0022] Figure 3 A flowchart of an overall intrusion detection process in an application example of the present application. DETAILED DESCRIPTION

[0023] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the embodiments and drawings. Here, the illustrative embodiments of the present application and their descriptions are used to explain the present application, but are not intended to limit the present application.

[0024] It should also be noted that, in order to avoid obscuring the present application due to unnecessary details, only structures and / or processing steps closely related to the solutions according to the present application are shown in the drawings, and other details not closely related to the present application are omitted.

[0025] It should be emphasized that the terms "comprises / comprising" when used in this specification, specify the presence of stated features, elements, steps or components, but do not preclude the presence or addition of one or more other features, elements, steps or components.

[0026] It should also be noted that, unless otherwise specified, the term "connected" in this specification can not only mean direct connection, but also indirect connection in the presence of an intermediate.

[0027] In the following, embodiments of the present application will be described with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar components, or the same or similar steps.

[0028] Existing detection methods have obvious limitations. Many previous works rely on the analysis and encoding of semantic attributes (e.g., file paths, command-line arguments, or domain names). A serious drawback of this approach is that these semantic attributes are easily controlled and forged by attackers. For example, an attacker can forge a seemingly harmless path or process name by path obfuscation, using symbolic links (soft links), or exploiting homophonic characters, thereby deceiving and misleading the detection model and rendering it ineffective. Therefore, how to get rid of the dependence on unreliable semantic information and mine more essential and difficult-to-forged behavior patterns is a core problem that needs to be solved in the current security analysis field of traceability graphs.

[0029] Therefore, in order to solve the problem that the existing detection model causes the intrusion detection to be ineffective due to unreliable semantic information, embodiments of the present application provide a traceability graph and causal invariant-based intrusion detection model training method, a traceability graph and causal invariant-based intrusion detection method, an electronic device, a computer readable storage medium and a computer program product, to improve the discrimination ability of the model and improve the accuracy and robustness of intrusion detection.

[0030] The embodiments are specifically described as follows.

[0031] Based on this, the embodiments of the present application provide a traceability graph and causal invariant-based intrusion detection model training method that can be executed by a traceability graph and causal invariant-based intrusion detection model training device, referring to Figure 1 The method specifically includes the following contents: Step 100: obtaining a system traceability graph and each causal invariant, constructing a violation strength function corresponding to each causal invariant; obtaining a score of each causal invariant corresponding to each event in the traceability graph, and constructing a causal invariant consistency check score table based on each score; wherein the causal invariant includes executer reachability data of a file, consistency data of a file creator and a first writer, timing data for file creation, writing and execution, and detection data of file aliases and homophonic characters, and the traceability graph is used to represent each event and the interaction relationship between each event.

[0032] It is also worth mentioning that the system trace graph is a directed acyclic graph, which takes various entities in the operating system (such as processes, files, network sockets, etc.) as nodes, and the interaction between these entities (such as process creation, file read / write, network connection, etc.) as edges, thereby constructing a panoramic view that can record the causal dependence relationship of system events. The reachability data of the executor to the file is that before a process executes a certain file, there must be a legal and observable access path, such as read or memory mapping (mmap) operation, between the process and the file. It is highly suspicious for a process to execute a file that has never been seen before; The consistency data of the file creator and the first writer is that in normal operation, the creator of a file and the subject that first writes content to it usually have high consistency in identity, for example, they should belong to the same user or the same application. Abnormal cross-user, cross-permission first write behavior is suspicious; The timing data for file creation, writing, and execution is that the normal life cycle of a file must follow a strict time sequence, which must be created (create) first, then written (write) or mapped as executable, and finally executed (exec); The detection data of file alias and homonym character is that attackers often hide the true identity of malicious files by creating a large number of aliases (such as hard links, soft links) or using similar characters, so when the same file entity exhibits an abnormal number of aliases in a short period of time, or its path name contains suspicious characters, it should be considered as a high-risk signal.

[0033] Specifically, for an event e in the trace graph, the reachability data of the executor to the file violation intensity function is: Where α represents the weight coefficient, Δt represents the time interval, h represents the exponential function, which takes the value 1 when the condition is met, otherwise 0. F represents the time decay function, which measures the time interval Δt since the last legal access (read / mapping). The longer the interval, the more blurred the process's memory of the file, and the higher the violation intensity.

[0034] The violation intensity function of the consistency data of the file creator and the first writer is: Where f represents the file entity accessed / operated by the current event, creator(f) represents the creator of the file f, and first_writer(f) represents the subject that first writes content to f; sim represents the similarity function, which compares the identity attributes of the two subjects. The more inconsistent the identity, the lower the similarity, resulting in a higher violation intensity.

[0035] The violation intensity function of the timing data for file creation, writing, and execution is: where β denotes a weight coefficient, g denotes an exponential function, and Δt denotes a time interval from the last write to the first execution. The shorter this interval (i.e., the write is immediately followed by the execution), the greater the value of the function, indicating that this can be a malicious landing (i.e., execution) behavior and the higher the violation intensity. The first two terms of the formula directly penalize behaviors that miss the pre-step or the order.

[0036] Violation intensity function of the detection data of file alias and homonym characters: where γ denotes a weight coefficient, The function h that represents the number of file aliases is a bounded growth function that maps the number of aliases to a risk value. Using an exponential function can make the risk grow rapidly with the increase in the number of aliases, but it will not increase indefinitely, thus remaining stable.

[0037] Step 200: Selecting a preset number of fields corresponding to each of the causal invariants according to the values in the score table from high to low, and training the graph encoder to reconstruct the fields according to a first loss function.

[0038] Specifically, according to the scores in the CIC score table, the fields that are strongly related to the causal invariants are selectively masked, mainly including identity-related fields, time sequence-related fields, path-related fields, and types of events.

[0039] Step 300: Constructing negative samples and positive samples based on the provenance graph and the score table, taking the negative samples and the positive samples as inputs, obtaining initial encoder embedding features by using the graph encoder, mapping the initial encoder embedding features to a representation space for contrastive learning by using a projection head to obtain a representation vector, and optimizing the graph encoder based on the representation vector to make the graph encoder output target encoder embedding features for intrusion detection of a computer system.

[0040] Specifically, the positive and negative sample subgraphs are respectively passed through the graph encoder to obtain initial encoder embedding features, and then a projection head is used to map the initial encoder embedding features to a representation space for contrastive learning to obtain a representation vector z. The graph encoder is optimized to enable the graph encoder to generate target encoder embedding features that are highly sensitive to changes in causal invariants.

[0041] As can be known from the above description, the method for training an intrusion detection model based on a traceability graph and causal invariants provided by the embodiments of the present application can break away from the dependence on unreliable semantic information and mine more essential and more difficult-to-forgery behavior patterns to achieve more robust threat perception by proposing an explicit risk quantification mechanism based on causal invariants according to a violation intensity function of the causal invariants and a fusion scoring formula. The method can improve the discrimination ability of the model and the accuracy and robustness of intrusion detection by proposing a self-supervised learning based on causal invariants, fusing a mask reconstruction and a destruction discrimination strategy to train a graph encoder, making the graph representation generated by the graph encoder highly sensitive to behaviors that destroy causal invariants, and enabling the graph encoder to autonomously learn deep semantic and structural features for distinguishing normal behaviors from abnormal behaviors from massive benign data.

[0042] To further improve the discrimination ability of the model and the accuracy and robustness of intrusion detection, in the method for training an intrusion detection model based on a traceability graph and causal invariants provided by the embodiments of the present application, in step 100, the scores of the causal invariants corresponding to each event in the traceability graph are obtained, and the method specifically includes the following content. Step 110: The violation intensity functions are weighted to obtain a scoring formula by fusion.

[0043] Step 120: The scores of the causal invariants corresponding to each event in the traceability graph are calculated according to the scoring formula.

[0044] Specifically, according to the kth causal invariant, the violation intensity is defined as The value is normalized to the interval [0, 1], where 0 indicates that the causal invariant is completely met, and 1 indicates that the causal invariant is severely violated. The violation intensities of all causal invariants are fused into a total causal invariant consistency check CIC (Causal Invariant Consistency) score through a weighted nonlinear formula to obtain a causal invariant consistency check score table, and the formula is as follows: wherein, represents the weight of the kth causal invariant, which is used to adjust the importance of different causal invariants in the overall risk assessment. The formula has an important characteristic of risk amplification and superposition effect. As long as any causal invariant is severely violated, the overall risk score will tend to 1. At the same time, even if multiple causal invariants are only slightly violated, the risk will be accumulated in the form of multiplication, resulting in a significant increase in the overall risk score.

[0045] In order to further improve the discriminant ability of the model and improve the accuracy and robustness of the intrusion detection, in the intrusion detection model training method based on the traceability graph and the causal invariant provided in the embodiments of the present application, in step 200, the following contents are specifically included: The first loss function comprises a reconstruction loss function and the violation intensity function.

[0046] Specifically, the first loss function formula is as follows: wherein, is a true value, is a predicted value of the model. The formula comprises two parts, the first part is a standard reconstruction error, and the second part is composed of the violation intensity function formula. The predicted value of the model is brought into the violation intensity function of the kth causal invariant for calculation. If the prediction of the model will cause a certain causal invariant to be destroyed, the value of will become larger, thereby punishing the model, is a weight coefficient for balancing the importance of different invariants, and the second part ensures that the prediction of the model is not only similar but also similar in spirit, that is, conforms to the internal security logic of the system.

[0047] In order to further improve the discriminant ability of the model and improve the accuracy and robustness of the intrusion detection, in the intrusion detection model training method based on the traceability graph and the causal invariant provided in the embodiments of the present application, in step 300, the graph encoder is optimized based on the feature vector, and the following contents are specifically included: A second loss function is constructed based on the feature vector.

[0048] The parameters of the graph encoder are adjusted according to the second loss function.

[0049] Specifically, the second loss function can adopt an InfoNCE loss function to optimize the model, and the second loss function formula is as follows: wherein, is an anchor sample, is a corresponding positive sample, is all negative samples in a batch, s is a cosine similarity function, is a temperature hyperparameter. The target of the loss function is to pull the representation of the anchor sample and its positive sample closer in the representation space, and push the representation of the anchor sample and all negative samples away, so as to optimize the model.

[0050] To further illustrate the above embodiments, the application also provides a specific application example of a method for training an intrusion detection model based on a provenance graph and causal invariants. Specifically, it contains the following contents: Traditional provenance graph-based detection methods often rely on the semantic attributes of nodes, such as file paths, command line arguments, or domain names, etc. However, these attributes can be easily forged by attackers, such as through path obfuscation or the use of symbolic links (soft links), thereby misleading the detection model. To overcome this deficiency, the application example first proposes an explicit risk measurement method that does not rely on these unreliable semantics - Causal Invariant Consistency (CIC).

[0051] The core idea of CIC is: before deep encoding the provenance graph, first measure the intrinsic risk of each system event through a set of verifiable causal invariants rooted in the internal logic of the operating system. In this way, even if the surface attributes such as the name and path of an event appear harmless, as long as its behavior trajectory violates the basic causal constraints, its risk score will still be amplified, thereby achieving more robust threat perception.

[0052] In order to quantify the degree of violation of invariants, a scoring mechanism is designed.

[0053] First, for an event e in the provenance graph and the kth invariant, define its violation strength as This value is normalized to the interval [0, 1], where 0 indicates full compliance with the invariant, and 1 indicates serious violation. Subsequently, the violation strengths of all invariants are fused into a total CIC risk score through a weighted nonlinear formula, which is as follows: Where, represents the weight of the kth invariant, used to adjust the importance of different invariants in the overall risk assessment. This formula has an important characteristic: risk amplification and superposition effect. As long as any invariant is seriously violated, the overall risk score will tend to 1. At the same time, even if multiple invariants are only slightly violated, the risk will be accumulated through the form of multiplication, resulting in a significant increase in the total risk score.

[0054] The application example defines the following four key causal invariants, which cover multiple dimensions of system behavior such as timing, identity, reachability, and name disguise, etc.

[0055] (1) File reachability: A process must logically have a valid, observable access path to a file before it can execute it, such as a read or mmap operation. It is highly suspicious for a process to execute a file it has never seen before.

[0056] Violation strength computation: where h is an exponential function that takes value 1 when the condition is met, and 0 otherwise. f is a time decay function that measures the time interval At since the last legal access (read / mmap) to the file. The longer the interval, the more fuzzy the process’s memory of the file, and the higher the violation strength.

[0057] (2) File reachability: In normal operation, the creator of a file and the subject that first writes content to it are usually highly consistent in identity. For example, they should belong to the same user or the same application. An abnormal cross-user, cross-privilege first-write behavior is suspicious Violation strength computation: where sim is a similarity function that compares the identity attributes of the two subjects. The less consistent the identities, the lower the similarity, and the higher the violation strength.

[0058] (3) Temporal order of create->write->exec: The normal life cycle of a file must follow a strict temporal order: it must be created, then written or mapped as executable, and finally executed.

[0059] Violation strength computation: The first two terms of the formula directly penalize behaviors that miss the preconditions or have the wrong order. Function g is an exponential function that measures the time interval At from the last write to the first execution. The shorter this interval (i.e., the write is immediately followed by an execution), the higher the value of g, indicating a potentially malicious landing (execution) behavior, and the higher the violation strength (4) Multiple aliases and homonyms: Attackers often hide the true identity of malicious files by creating a large number of aliases (such as hard links, soft links) or using characters that look similar. Therefore, when the same file entity exhibits an abnormal number of aliases in a short period of time, or its path name contains suspicious characters, it should be considered a high-risk signal.

[0060] Violation strength computation: The h function is a bounded growth function that takes the number of aliases The mapping is a risk value. Using an exponential function can make the risk grow rapidly with the number of aliases, but not infinitely, so as to keep stable Relying only on explicit CIC risk scores may not capture more complex attack patterns with deeper, longer chains. To enable the model to autonomously learn the deep semantic and structural features that distinguish normal from abnormal behavior from a vast amount of benign data, the application applies an instance design of an invariant-aware self-supervised learning framework. The core goal is to train a powerful graph encoder to generate graph representations (embeddings) that are highly sensitive to behaviors that violate invariants.

[0061] The framework innovatively combines two complementary self-supervised learning strategies: first, through invariant masking and reconstruction tasks, the model is forced to learn the local context information needed to maintain invariants; second, through invariant violation and contrastive learning, the distance between normal and abnormal behaviors in the representation space is explicitly widened, improving the model's discriminative ability The invariant masking and reconstruction strategy draws on the cloze task idea of the BERT model in natural language processing, but the masking and reconstruction targets are closely related to the defined invariants. The purpose is to let the model complete the masked key fields under the observation of only the local graph context. If the model can accurately complete it, it proves that the model has implicitly learned the causal constraints and structural patterns necessary to maintain normal system operation.

[0062] The application instance selectively masks fields that are strongly related to invariant calculation, including identity-related fields, time-related fields, path-related fields, and event types.

[0063] The reconstruction task of the model not only pursues data-level accuracy, but also ensures security semantic-level reasonableness. For this purpose, the application instance designs a loss function. The formula is as follows: The loss function contains two parts, the first part is the standard reconstruction error, where is the true value, is the model's predicted value. The second part is the key innovation of the application instance. The model's predicted value is brought into the kth invariant violation intensity function for calculation. If the model's prediction leads to the violation of an invariant, the value of will become large, thereby punishing the model. is the weight coefficient, used to balance the importance of different invariants. This item ensures that the model's prediction not only looks like it, but also looks like it, that is, it conforms to the internal security logic of the system.

[0064] Only performing the mask reconstruction task can ensure that the model learns to complete the information, but cannot directly ensure that it can effectively distinguish the graph representation of normal and abnormal samples. To this end, the application applies an instance to introduce contrastive learning by constructing a clear positive and negative sample pair, and forces the model to learn a representation space with good discriminability.

[0065] The positive sample is the original, unmodified benign subgraph; the negative sample is automatically generated by a series of carefully designed invariant destruction operations on the benign subgraph. These operations directly simulate the essential characteristics of attack behavior, such as modifying the identity information of the event subject, cross-namespace access, time sequence reverse, permission change, and path dislocation.

[0066] During training, the application applies an instance to adopt an intra-batch strategy, that is, a batch contains the same benign subgraph as a positive sample and a variety of destruction type negative samples derived therefrom. The application applies an instance to preferentially sample difficult negative samples with high violation degree but high semantic similarity, in order to improve the fine-grained discrimination ability of the model.

[0067] First, the application applies an instance to obtain initial encoder embedding features h by respectively passing the positive and negative sample subgraphs through a graph encoder, and then map them to a representation space for contrastive learning through a projection head to obtain vectors z. Then, the application applies an instance can adopt an InfoNCE loss function to optimize the model, as follows: wherein, is an anchor sample, is the corresponding positive sample, is all negative samples in the batch, s is a cosine similarity function, is a temperature hyperparameter. The goal of this loss function is to pull the representation of the anchor sample and its positive sample closer together in the representation space, while pushing it away from all negative samples.

[0068] Through the dual training of mask reconstruction and contrastive learning described above, the output target encoder embedding features h after training are obtained. The graph encoder finally obtained by the application applies an instance can not only capture the complex structure and time sequence information of the traceability graph, but more importantly, it has a deep understanding of the core invariants that maintain system security, laying a solid foundation for subsequent accurate and robust intrusion detection.

[0069] Based on the embodiments and / or application instances of the above intrusion detection model training method based on traceability graph and causal invariants, the application further provides an embodiment of an intrusion detection method based on traceability graph and causal invariants, which specifically includes the following contents: Step 400: obtaining a causal invariance consistency check score table and a target encoder embedding feature, and generating abnormal score data corresponding to each event in the causal invariance consistency check score table by using an anomaly detection head; wherein the score table and the target encoder embedding feature are both trained by the intrusion detection model training method based on a provenance graph and causal invariance described in the above embodiments.

[0070] Specifically, the input of the detection framework is composed of two parts, namely the target encoder embedding feature and the CIC score table, which depict the risk of events from different dimensions. The trained graph encoder generates the target encoder embedding feature h which is highly sensitive to the change of invariants. A hybrid anomaly detection head is designed, and a loss function is used to fuse the data-driven target encoder embedding feature h and the knowledge-driven CIC table. The specific implementation is described in the subsequent embodiments to achieve complementary advantages and improve the accuracy and robustness of detection.

[0071] In order to further improve the accuracy and robustness of intrusion detection, in the intrusion detection method based on a provenance graph and causal invariance provided in the embodiments of the present application, in step 400, the abnormal score data corresponding to each event in the causal invariance consistency check score table is generated by using an anomaly detection head, which specifically includes the following contents: Step 410: fuse the score table and the target encoder embedding feature to obtain a comprehensive feature vector, and take the comprehensive feature vector as input.

[0072] Step 420: train the anomaly detection head according to the ranking consistency loss function.

[0073] Step 430: generate abnormal score data corresponding to each event by using the anomaly detection head according to a preset activation function.

[0074] Specifically, the target encoder embedding feature h is generated by the trained graph encoder, which implicitly learns the anomaly mode from the complex graph structure and context information; the CIC score table is a single risk value composed of the aggregation of multiple invariant violation intensity vectors. The two features are spliced to form a more comprehensive comprehensive feature vector, which is input into an anomaly detection head composed of multiple layers of perception mechanism, and the final abnormal score data can be output by a Sigmoid activation function, whose value range is [0, 1].

[0075] It should be noted that the abnormal score formula is as follows: score= wherein, represents an activation function, w represents a weight matrix, b represents a bias term, h represents a target encoder embedding feature, and CIC represents a score table.

[0076] The formula for order consistency loss is as follows: Here, margin is the sorting interval hyperparameter, which controls how much the outlier scores of two samples should differ at least; i and j represent the two sample indices used to distinguish between samples with high CIC scores and samples with low CIC scores.

[0077] To further improve the accuracy and robustness of intrusion detection, in an intrusion detection method based on source graphs and causal invariants provided in this application embodiment, after step 400, see... Figure 2 After generating the anomaly score data corresponding to each event in the causal invariant consistency verification score table using the anomaly detection head, it also includes the following: Step 500: Select a preset number of causal invariants and the events corresponding to each causal invariant in descending order of the values ​​in the score table to form an initial set.

[0078] Step 600: The initial explanatory subgraph corresponding to the source graph obtained based on the score table and the abnormal score data corresponding to each of the events.

[0079] Step 700: Prune the initial interpretation subgraph to generate the target interpretation subgraph.

[0080] Specifically, the target explanation subgraph extracts the most critical nodes and edges from the complete source graph, forming a connected subgraph that covers the main anomalies while being structurally minimized. This process mainly includes three stages: initialization, expansion, and pruning. While the subgraph obtained during the expansion stage is connected and complete, it may contain redundant paths or nodes that are not essential for explaining the core story. Therefore, pruning is performed to obtain the most concise target explanation subgraph. Starting from the leaf nodes of the subgraph, the process traverses upwards, examining each element (node ​​or edge) one by one. If removing an element does not violate the two key constraints of subgraph connectivity and the completeness of evidence for the core anomalies, then that element is considered redundant and safely removed.

[0081] To further improve the accuracy and robustness of intrusion detection, in an intrusion detection method based on source graphs and causal invariants provided in this application embodiment, in step 400, the initial interpretation subgraph corresponding to the source graph obtained based on the score table and the abnormal score data corresponding to each event specifically includes the following: The reward value for each event is obtained based on the score table and the abnormal score data corresponding to each event.

[0082] The events are increased in order from large to small according to the ratio of the reward value to the new event, and each event is checked based on the score table to obtain an initial explanation subgraph corresponding to the provenance graph.

[0083] Specifically, the top K elements (nodes or edges) in the system anomaly score data are selected as the initial seed set. For each selected high-risk element, the root cause of its high score is traced, i.e., which causal invariants are severely violated. The minimum evidence template (i.e., the nodes and edges necessary to prove the violation) that triggers these invariant violations is added to the initial set. In order to obtain a connected subgraph that can tell a complete attack story, the initial core set is expanded outward step by step to connect various abnormal fragments. The expansion process follows two core strategies: 1) Local benefit expansion: In each step of expansion, the edge or node with the highest cost-effectiveness is selected to join the subgraph. For each element x in the graph, an award value is defined as follows: Wherein, the reward value is composed of the CIC score and the final anomaly score of the element. In each step, all candidate expansion edges are evaluated, and the edge with the largest incremental reward / incremental cost ratio is selected for expansion, ensuring that the expansion of the subgraph is always in the direction of the highest value.

[0084] 2) Evidence completeness expansion: When a high-risk abnormal factor (such as a high-score node) is selected into the subgraph by the greedy strategy, ensure that the minimum evidence set (i.e., all related nodes and edges that trigger its invariant violation) that makes the abnormal factor true is also included in the subgraph, ensuring the logical integrity of the initial explanation subgraph.

[0085] To further illustrate the above embodiment, the application also provides a specific application example of an intrusion detection method based on provenance graph and causal invariants. Specifically, it contains the following contents: After self-supervised learning, the graph encoder can generate target encoder embedding features h that are highly sensitive to invariant changes. However, in order to make the most reliable judgment, the application example does not completely abandon the CIC score table with explicit physical meaning calculated in the previous application example. On the contrary, the application example designs a hybrid anomaly detection head that fuses the data-driven target encoder embedding features h with the knowledge-driven CIC table, and is assisted by a ranking consistency loss function, to realize complementary advantages and improve the accuracy and robustness of detection.

[0086] The anomaly score formula is as follows: score= Wherein, ​where f is the activation function, w is the weight matrix, b is the bias term, h is the target encoder embedding feature, and CIC is the risk score table.

[0087] The ranking consistency loss formula is as follows: where margin is the ranking margin hyperparameter, controlling how much the anomaly scores of two samples should differ at least.

[0088] The input of the detection framework consists of two parts, the encoder embedding feature and the unified CIC risk score, which depict the risk of the event from different dimensions. The target encoder embedding feature h is generated by the trained graph encoder, which implicitly learns the abnormal patterns from complex graph structures and contextual information. The unified CIC risk score is a single risk value composed of the aggregation of multiple violation strength vectors of invariants. In order to ensure the stability and interpretability of the aggregation process, the application example adopts a monotonic fusioner. The fusioner uses a feedforward network with non-negative weights to ensure that any increase in a single violation strength will not lead to a decrease in the final CIC score, while reducing the impact of weak noise invariants.

[0089] The two features are spliced to form a more comprehensive hybrid feature vector, which is sent to an anomaly detection head that can be composed of a multilayer perceptron (MLP). The final anomaly score (Anomaly Score) can be output through a Sigmoid activation function, with a value range of [0, 1].

[0090] After successfully detecting the anomaly, a key challenge is to provide a clear and understandable explanation to the security analyst, answering why this event is abnormal? And what is the related attack path? To solve this problem, the application example proposes a minimum explanation subgraph reconstruction algorithm based on the CIC (Causal Invariant Consistency Check) score table. The algorithm aims to extract the most critical nodes and edges from the complete traceability graph to form a connected subgraph that not only covers the main abnormal points but also minimizes the structure. The algorithm mainly includes three stages of initialization, expansion and post-pruning.

[0091] Initialization: The starting point of the algorithm is to locate the core of the anomaly. First, select the top K elements (nodes or edges) in the system anomaly score data as the initial seed set. For each selected high-risk element, trace the root cause of its high score, i.e., find which causal invariants are severely violated. Add the minimum "evidence template" (i.e., the nodes and edges necessary to prove the violation) that triggers these invariant violations to the initial set. To obtain a connected subgraph that can tell a complete attack story, start from the initial core set and gradually expand outward to connect various anomaly fragments. The expansion process follows two core strategies: 1) Local benefit expansion: At each expansion step, select the highest value edge or node to join the subgraph. Define a reward value for each element x in the graph as follows: where the reward value is composed of the CIC score and the final anomaly score of the element. At each step, evaluate all candidate expansion edges and select the edge that brings the highest incremental reward / incremental cost ratio to expand, ensuring that the subgraph expansion always moves in the direction of the highest value.

[0092] 2) Evidence completeness expansion: When a high-risk anomaly factor (such as a high-score node) is selected into the subgraph due to the greedy strategy, ensure that the minimum evidence set (i.e., all related nodes and edges that trigger its invariant violation) that makes this anomaly factor true is also included in the subgraph, ensuring the logical integrity of the initial explanation subgraph.

[0093] Pruning: Although the subgraph obtained in the expansion phase is connected and complete, it may contain some redundant paths or nodes that are unnecessary for the core story explanation. Therefore, the last step is to perform pruning to obtain the most concise explanation. The algorithm starts from the leaf nodes of the subgraph and traverses upwards, checking each element (node or edge) one by one. If removing a certain element does not violate the two key constraints of subgraph connectivity and core anomaly factor evidence completeness, the element is considered redundant and is safely removed.

[0094] The overall flowchart of the intrusion detection model training method and detection method based on the provenance graph and causal invariants is shown in Figure 3 .

[0095] The embodiments of the present application also provide an electronic device, which can include a processor, a memory, a receiver, and a transmitter. The processor is used to execute the intrusion detection model training method based on the provenance graph and causal invariants mentioned in the above embodiments. The processor and the memory can be connected through a bus or other means to be connected through the bus. The receiver can be connected with the processor and the memory through wired or wireless means. ​

[0096] The processor can be a central processing unit (CPU). The processor can also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic components, discrete hardware components, or a combination thereof.

[0097] The memory, as a non-transitory computer readable storage medium, can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as program instructions / modules corresponding to the intrusion detection model training method based on the provenance graph and the causal invariants in the embodiments of the present application. The processor executes various functions and data processing of the processor by running the non-transitory software programs, instructions and modules stored in the memory, that is, implements the intrusion detection model training method based on the provenance graph and the causal invariants in the above method embodiments.

[0098] The memory can include a program storage area and a data storage area. The program storage area can store an operating system and application programs required by at least one function; the data storage area can store data created by the processor and the like. In addition, the memory can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory can optionally include a memory remotely arranged with respect to the processor, and these remote memories can be connected to the processor through a network. Examples of the above network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0099] The one or more modules are stored in the memory and, when executed by the processor, perform the intrusion detection model training method based on the provenance graph and the causal invariants in the embodiments.

[0100] In some embodiments of the present application, the user equipment can include a processor, a memory and a transceiver unit which can include a receiver and a transmitter, the processor, the memory, the receiver and the transmitter can be connected through a bus system, the memory is used to store computer instructions, and the processor is used to execute the computer instructions stored in the memory to control the transceiver unit to transceive signals.

[0101] As an implementation manner, the functions of the receiver and the transmitter in the present application can be implemented by a transceiver circuit or a transceiver dedicated chip, and the processor can be implemented by a dedicated processing chip, a processing circuit or a general-purpose chip.

[0102] As another implementation manner, the server provided by the embodiments of the present application can be implemented by using a general-purpose computer. That is, the program codes for implementing the functions of the processor, the receiver and the transmitter are stored in the memory, and the general-purpose processor implements the functions of the processor, the receiver and the transmitter by executing the codes in the memory.

[0103] The embodiments of the present application further provide a computer readable storage medium, which stores a computer program. The computer program is executed by a processor to implement the steps of the aforementioned intrusion detection model training method based on a provenance graph and a causal invariant. The computer readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0104] The embodiments of the present application further provide a computer program product, which specifically contains a computer program. The computer program is executed by a processor to implement the steps of the aforementioned intrusion detection model training method based on a provenance graph and a causal invariant.

[0105] Those skilled in the art should understand that the exemplary components, systems and methods described in connection with the embodiments disclosed herein can be implemented in hardware, software or a combination thereof. The actual implementation depends on the specific application and design constraints imposed on the technical solution. Skilled persons can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a functional card, etc. When implemented in software, the elements of the present application are program or code segments used to perform the required tasks. The program or code segments can be stored in a machine readable medium or transmitted through a data signal carried in a carrier wave over a transmission medium or communication link.

[0106] It is to be expressly understood that the application is not limited to the described and illustrated particular configurations and processes. For the sake of clarity, detailed descriptions of known methods are omitted. In the above described embodiments, several specific steps are described and illustrated as examples. However, the method processes of the application are not limited to the specific steps described and illustrated, and the skilled person can make various changes, modifications and additions, or change the order of the steps, after having understood the spirit of the application.

[0107] In this application, features described and / or illustrated with respect to one embodiment can be used in the same or a similar way in one or more other embodiments and / or combined with or substituted for features of other embodiments.

[0108] The above only describes the preferred embodiments of the application, and is not intended to limit the application. The skilled in the art can make various changes and modifications to the embodiments of the application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the application shall be included in the protection scope of the application.

Claims

1. A training method for an intrusion detection model based on source graphs and causal invariants, characterized in that, The method includes: Obtain the system source graph and each causal invariant, and construct the violation intensity function corresponding to each causal invariant; obtain the score of each causal invariant corresponding to each event in the source graph, and construct a causal invariant consistency check score table based on each score; wherein, the causal invariant includes the reachability data of the executor to the file, the consistency data between the file creator and the first writer, the temporal data for file creation, writing and execution, and the detection data of file aliases and homonyms, and the source graph is used to represent each event and the interaction relationship between each event; According to the numerical values ​​in the score table from high to low, a preset number of fields corresponding to each of the causal invariants are selected for masking, and the fields are reconstructed based on the first loss function trained in the graph encoder. Based on the source graph and the score table, negative and positive samples are constructed. The negative and positive samples are used as inputs, and the graph encoder is used to obtain initial encoder embedding features. The initial encoder embedding features are mapped to the representation space of contrastive learning using a projection head to obtain a representation vector. The graph encoder is optimized based on the representation vector so that the graph encoder outputs target encoder embedding features for intrusion detection of computer systems.

2. The intrusion detection model training method based on source graphs and causal invariants according to claim 1, characterized in that, The step of obtaining the scores of each causal invariant corresponding to each event in the source graph includes: The scoring formula is obtained by weighting and combining the various violation intensity functions; The scores for each causal invariant corresponding to each event in the source graph are calculated according to the scoring formula.

3. The intrusion detection model training method based on source graphs and causal invariants according to claim 1, characterized in that, The first loss function includes the reconstruction loss function and the violation intensity function.

4. The intrusion detection model training method based on source graphs and causal invariants according to claim 1, characterized in that, The optimization of the graph encoder based on the representation vector includes: The second loss function is constructed based on the aforementioned representation vector; The parameters of the graph encoder are adjusted according to the second loss function.

5. An intrusion detection method based on source graphs and causal invariants, characterized in that, The method includes: Obtain the causal invariant consistency check score table and the target encoder embedding features, and use the anomaly detection head to generate anomaly score data corresponding to each event in the causal invariant consistency check score table; wherein, the score table and the target encoder embedding features are both trained by the intrusion detection model training method based on source graph and causal invariant as described in any one of claims 1 to 4.

6. The intrusion detection method based on source graphs and causal invariants according to claim 5, characterized in that, The process of generating anomaly score data corresponding to each event in the causal invariant consistency check score table using the anomaly detection head includes: The score table and the target encoder embedding features are fused to obtain a comprehensive feature vector, which is then used as input. Train the anomaly detection head based on the sort consistency loss function; The anomaly detection head is used to generate anomaly score data corresponding to each event according to a preset activation function.

7. The intrusion detection method based on source graphs and causal invariants according to claim 5, characterized in that, After generating the anomaly score data corresponding to each event in the causal invariant consistency check score table using the anomaly detection head, the method further includes: A predetermined number of causal invariants and the events corresponding to each causal invariant are selected in descending order of the values ​​in the score table to form an initial set. The initial explanatory subgraph corresponding to the source graph obtained based on the score table and the abnormal score data corresponding to each of the events; The initial interpretation subgraph is pruned to generate the target interpretation subgraph.

8. The intrusion detection method based on source graphs and causal invariants according to claim 7, characterized in that, The initial explanatory subgraph corresponding to the source graph obtained based on the score table and the abnormal score data corresponding to each of the events includes: Based on the score table and the abnormal score data corresponding to each event, the reward value corresponding to each event is obtained; Each event is added in descending order of the ratio of the reward value to the new event, and each event is checked based on the score table to obtain the initial explanatory subgraph corresponding to the source graph.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the intrusion detection model training method based on source graphs and causal invariants as described in any one of claims 1 to 4, and / or implements the intrusion detection method based on source graphs and causal invariants as described in any one of claims 5 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the intrusion detection model training method based on source graphs and causal invariants as described in any one of claims 1 to 4, and / or implements the intrusion detection method based on source graphs and causal invariants as described in any one of claims 5 to 8.

Images