Unknown threat-oriented host behavior risk real-time detection and interpretable research and judgment method and system
By constructing a host behavior graph and combining it with graph neural networks and large language models, the problem of insufficient unknown threat detection capability in existing technologies is solved, enabling real-time detection and interpretable analysis of new threats, thus improving detection efficiency and reliability.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-01-06
- Publication Date
- 2026-03-27
AI Technical Summary
Existing technologies are insufficient in detecting unknown threats, lack proactive threat scenario exploration and example expansion mechanisms, fail to effectively coordinate graph neural networks and large language models, consume large amounts of computing resources and have poor real-time performance, and rely on historical data for threat behavior example libraries, resulting in incomplete coverage and poor timeliness.
By constructing a host behavior graph and using a sliding window strategy to generate historical behavior subgraphs, combined with graph neural networks and large language models, unsupervised learning and clustering are performed to generate malicious behavior subgraphs, enabling real-time detection and interpretable analysis.
It enhances the detection and generalization capabilities for new threats, ensures the real-time performance and detection efficiency of the system, provides risk levels and detailed judgment criteria in natural language, and strengthens the credibility and operability of the detection results.
Smart Images
Figure CN121750355A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of network security, and in particular relates to a method and system for real-time detection and interpretable analysis of host behavior risks in the face of unknown threats. Background Technology
[0002] As cyberattacks become increasingly complex and covert, traditional host behavior detection methods based on rule matching and statistical analysis are no longer sufficient to address new security challenges such as advanced persistent threats (APTs) and zero-day attacks.
[0003] In existing technologies, host intrusion security detection methods based on graph neural networks transform system call sequences into call graphs for processing, which can solve the analysis difficulties caused by excessively long call chains. However, these methods typically only focus on learning historical normal behavior patterns and lack the ability to proactively explore potential threat scenarios.
[0004] In the field of network security automation, large language models have demonstrated flexibility and efficiency advantages in vulnerability detection and misconfiguration identification, accurately identifying common security issues such as SQL injection and remote code execution. However, using large language models alone to process host behavior data faces challenges such as high computational resource consumption and poor real-time performance, making it difficult to meet the performance requirements of production environments.
[0005] Current mainstream intrusion detection systems, such as THREATRACE, employ graph neural network technologies like GraphSAGE to detect anomalous behavior by learning the roles of entities in a data source graph. However, these systems primarily rely on historical samples of benign behavior for training, limiting their ability to detect novel attack patterns and lacking effective mechanisms for expanding threat examples. Furthermore, while traditional machine learning models can identify anomalous behavior within a single transaction, they struggle to capture complex attack chains spanning multiple entities.
[0006] While the integration of graph neural networks and large-scale language models has attracted widespread attention in academia, its application in practical security products still faces many challenges: performance bottlenecks exist in large-scale graph data processing, and the information processing requirements of dynamic and heterogeneous graphs increase the difficulty of model transfer. Existing technologies often use the two types of models separately, failing to fully leverage their synergistic effects.
[0007] Existing malicious behavior detection technologies largely rely on passively collected historical attack data to build threat databases, resulting in incomplete threat sample coverage and poor timeliness. While applications of large language models, such as automated vulnerability remediation, have been explored in advance, they have not yet been systematically combined with graph neural networks for proactive detection and assessment of host behavior risks. Summary of the Invention
[0008] Purpose of the Invention: This invention provides a method and system for real-time detection and interpretable assessment of host behavior risks in response to unknown threats. It aims to address the problems of existing technologies, such as insufficient detection capabilities for new and unknown threats, lack of proactive threat scenario exploration and example expansion mechanisms, high computational overhead and poor real-time performance when using large language models to process massive behavioral data, failure to effectively coordinate graph neural networks and large language models with their respective advantages not being fully integrated and utilized, and threat behavior example libraries relying on historical data, resulting in incomplete coverage and delayed timeliness.
[0009] Technical Solution: This invention provides a method for real-time detection and interpretable assessment of host behavior risks posed by unknown threats, comprising:
[0010] Collect system behavior data of the target host, and construct a host behavior graph based on the system behavior data;
[0011] The host behavior graph is extracted according to a preset sliding window strategy to generate several historical behavior subgraphs, and the several historical behavior subgraphs are combined into a historical behavior subgraph set.
[0012] Based on historical behavior subgraphs, with the goal of learning to transform historical behavior subgraphs into historical behavior subgraph vectors, a graph neural network model is trained to obtain the trained graph neural network model.
[0013] Using a large language model, a malicious behavior sub-graph set is generated based on a preset security threat scenario description or prompt words. The historical behavior sub-graph set and the malicious behavior sub-graph set are respectively input into a trained graph neural network model to obtain a historical behavior sub-graph vector set and a malicious behavior sub-graph vector set. A clustering algorithm is used to select typical sub-graph vector sets from the historical behavior sub-graph vector set to construct a normal behavior example library, and the malicious behavior sub-graph vector set is used as a threat behavior example library.
[0014] Real-time system behavior data of the target host is collected and converted into real-time behavior subgraphs using a trained graph neural network model. Real-time behavior subgraph vectors are obtained using the trained graph neural network model. The real-time behavior subgraph vectors are matched with the historical behavior subgraph vectors in the normal behavior sample library and the malicious behavior subgraph vectors in the threat behavior sample library for similarity. The real-time behavior subgraphs are preliminarily classified according to the matching threshold. The preliminary classification includes normal behavior and suspicious behavior.
[0015] When the initial classification result is suspicious behavior, the real-time behavior sub-graph, the top-ranking malicious behavior sub-graphs with similarity matching, and the preset analysis prompt template are input into the large language model to output the risk level and judgment basis.
[0016] Furthermore, the process of collecting system behavior data of the target host and modeling the system behavior data into a host behavior graph includes: collecting system behavior data of the target host, including entities and directed interaction behaviors between entities, and constructing a behavior graph based on the entities and directed interaction relationships between entities. In the graph, nodes represent entities, and edges represent operations or interaction behaviors between entities.
[0017] Furthermore, the sliding window strategy can be either a sliding time window or a sliding event window. The sliding time window slides based on a preset time length and a preset step size, while the sliding event window slides based on a preset number of events and a preset step size.
[0018] Furthermore, the training graph neural network model includes: performing unsupervised graph representation learning on the historical behavior subgraph set, using a graph autoencoder or GraphSAGE architecture, taking the structural information of the historical behavior subgraph as input, optimizing the graph neural network parameters by minimizing the reconstruction error of the historical behavior subgraph or maximizing the similarity of adjacent historical behavior subgraphs, and obtaining the trained graph neural network model.
[0019] Furthermore, the clustering algorithm includes any one or more combinations of K-means clustering algorithm, hierarchical clustering algorithm, or DBSCAN density clustering algorithm.
[0020] Furthermore, the step of performing similarity matching between the real-time behavior subgraph vector and the historical behavior subgraph vector in the normal behavior sample library and the malicious behavior subgraph vector in the threat behavior sample library, respectively, and performing preliminary classification of the real-time behavior subgraph based on the matching threshold, includes:
[0021] The cosine similarity between the real-time behavior subgraph vector and the historical behavior subgraph vector in the normal behavior sample library is calculated. If the cosine similarity score between the real-time behavior subgraph and any behavior subgraph vector in the normal behavior sample library is greater than or equal to the first threshold, the real-time behavior subgraph is determined to be normal behavior and the real-time behavior subgraph is filtered.
[0022] Otherwise, calculate the cosine similarity score between the real-time behavior subgraph vector and the threat behavior subgraph vector in the threat behavior sample library. If the similarity score between the real-time behavior subgraph and any behavior subgraph vector in the threat behavior sample library is greater than or equal to the second threshold, then mark the real-time behavior subgraph as a suspicious behavior.
[0023] Furthermore, the process of inputting real-time behavior subgraphs, multiple malicious behavior subgraphs with high similarity matching, and preset analysis prompt templates into the large language model, and outputting risk levels and interpretable judgment criteria, includes:
[0024] Convert real-time behavior subgraphs into natural language descriptions to form real-time behavior text;
[0025] The top-ranking malicious behavior sub-graphs with the highest similarity scores are converted into natural language descriptions to form reference threat text;
[0026] The system combines real-time behavioral text, reference threat text, and preset analysis prompt templates into a complete prompt, which is then input into the large language model. The large language model performs inference based on the complete prompt and outputs the risk level and assessment basis.
[0027] This invention also provides a real-time detection and interpretable assessment system for host behavior risks posed by unknown threats, comprising:
[0028] The data acquisition module is used to collect system behavior data of the target host and construct a host behavior map based on the system behavior data;
[0029] The sliding capture module is used to capture the host behavior graph according to a preset sliding window strategy, generate several historical behavior subgraphs, and combine the several historical behavior subgraphs into a historical behavior subgraph set.
[0030] The graph neural network training module is used to train a graph neural network model based on a set of historical behavior subgraphs, with the goal of learning to transform historical behavior subgraphs into historical behavior subgraph vectors, and to obtain the trained graph neural network model.
[0031] The sample library construction module is used to generate a malicious behavior sub-graph set based on a preset security threat scenario description or prompt words using a large language model; the historical behavior sub-graph set and the malicious behavior sub-graph set are respectively input into a trained graph neural network model to obtain a historical behavior sub-graph vector set and a malicious behavior sub-graph vector set; a clustering algorithm is used to select typical sub-graph vector sets from the historical behavior sub-graph vector set to construct a normal behavior sample library, and the malicious behavior sub-graph vector set is used as a threat behavior sample library;
[0032] The preliminary classification module is used to collect real-time system behavior data of the target host and convert it into real-time behavior subgraphs using a trained graph neural network model. The trained graph neural network model is used to obtain real-time behavior subgraph vectors. The real-time behavior subgraph vectors are matched with the historical behavior subgraph vectors in the normal behavior sample library and the malicious behavior subgraph vectors in the threat behavior sample library for similarity. The real-time behavior subgraphs are then preliminarily classified according to the matching threshold. The preliminary classification includes normal behavior and suspicious behavior.
[0033] The suspicious behavior assessment module is used to input real-time behavior sub-graphs, multiple malicious behavior sub-graphs with the highest similarity match, and preset analysis prompt templates into the large language model when the preliminary classification result is suspicious behavior, and output the risk level and assessment basis.
[0034] The present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described method.
[0035] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the above-described method.
[0036] Beneficial effects: Compared with the prior art, the present invention has the following advantages:
[0037] 1. By using large language models to simulate and generate malicious behavior subgraphs, it breaks through the dependence of traditional threat databases on historical attack data, and can proactively cover a large number of unknown threats and variant attack scenarios, improving the detection generalization ability of new threats such as APTs and zero-day attacks.
[0038] 2. A two-stage collaborative architecture is adopted, consisting of a graph neural network (GNN) for fast filtering and a large language model (LLM) for fine-grained judgment. The graph neural network is responsible for efficiently processing massive behavioral data and performing preliminary screening to ensure the real-time performance of the system. The large language model only performs in-depth analysis in suspicious cases, giving full play to its reasoning advantages while avoiding huge computational overhead, thus achieving an effective balance between detection efficiency and judgment accuracy.
[0039] 3. Deeply integrate the advantages of graph neural networks in relational reasoning and structural representation with the advantages of large language models in semantic understanding, contextual reasoning and content generation, forming complementary advantages and improving collaborative detection results;
[0040] 4. The final assessment results are generated by a large language model, which can provide risk levels described in natural language and detailed assessment basis, enhancing the credibility and operability of the detection results and making it easier for security analysts to understand and respond.
[0041] 5. From threat example generation, behavior encoding, similarity matching to final judgment, the entire process is highly automated, reducing reliance on rules manually formulated by security experts and improving the level of intelligence in responding to complex security threats. Attached Figure Description
[0042] Figure 1 This diagram illustrates the construction process of the sample library and the steps for detecting host behavior risks in this invention. Detailed Implementation
[0043] like Figure 1 As shown, the real-time detection and interpretable assessment method for host behavior risks posed by unknown threats, as described in this invention, includes:
[0044] S1. Collect system behavior data of the target host, and construct a host behavior map based on the system behavior data;
[0045] S2. The host behavior graph is extracted according to the preset sliding window strategy to generate several historical behavior subgraphs, and the several historical behavior subgraphs are combined into a historical behavior subgraph set.
[0046] S3. Based on the historical behavior subgraph set, with the goal of learning to convert historical behavior subgraphs into historical behavior subgraph vectors, train a graph neural network model to obtain the trained graph neural network model; the trained graph neural network model can convert behavior subgraphs into behavior subgraph vectors.
[0047] S4. Using a large language model, generate a malicious behavior sub-graph set based on a preset security threat scenario description or prompt words; input the historical behavior sub-graph set and the malicious behavior sub-graph set into the trained graph neural network model respectively to obtain a historical behavior sub-graph vector set and a malicious behavior sub-graph vector set; use a clustering algorithm to select typical sub-graph vector sets from the historical behavior sub-graph vector set to construct a normal behavior example library, and use the malicious behavior sub-graph vector set as a threat behavior example library;
[0048] S5. Collect real-time system behavior data of the target host, and convert it into real-time behavior subgraphs using a trained graph neural network model. Obtain real-time behavior subgraph vectors using the trained graph neural network model. Perform similarity matching between the real-time behavior subgraph vectors and historical behavior subgraph vectors in the normal behavior sample library and malicious behavior subgraph vectors in the threat behavior sample library, respectively. Perform preliminary classification of the real-time behavior subgraphs based on the matching threshold. The preliminary classification includes normal behavior and suspicious behavior.
[0049] S6. When the preliminary classification result is suspicious behavior, input the real-time behavior sub-graph, the top-ranking malicious behavior sub-graphs with similarity matching, and the preset analysis prompt template into the large language model, and output the risk level and judgment basis.
[0050] In this embodiment,
[0051] S1 collects system behavior data from the target host through an agent program deployed on the target host. This data includes entities and directed interactions between entities. Entities include process creation, file access, network connection, etc. After cleaning, normalizing, and associating the system behavior data with entities, S1 constructs a host behavior graph, which includes nodes and edges. Nodes represent entities (such as processes, files, registry keys, network addresses), and edges represent operations or interactions between entities (such as "process A wrote to file B" or "process C connected to address D"). Edge attributes include information such as timestamps and operation results.
[0052] S2 To analyze behavioral patterns with temporal locality, this invention employs a configurable sliding window to extract host behavior graphs. The sliding window can be either a sliding time window or a sliding event window. The sliding time window slides at a certain step size based on time length (e.g., per minute), and the sliding event window slides at a certain step size based on the number of events (e.g., per thousand events). Through the sliding window, several historical behavior subgraphs can be obtained from the continuously collected and constructed host behavior graph. The historical behavior refers to normal behavior. Each historical behavior subgraph can capture all entities and their relationships that occur within a specific time window or event window. Several historical behavior subgraphs are combined into a historical behavior subgraph set.
[0053] S3. Train a graph neural network model (e.g., using a graph autoencoder or GraphSAGE architecture) on the historical behavior subgraphs using unsupervised learning. The training objective of the graph neural network model is to learn how to compress and map the effective structural information of each behavior subgraph into a low-dimensional, dense vector representation (also known as embedding). The trained graph neural network model will become an efficient graph representation that can transform any input behavior subgraph into a fixed-length vector.
[0054] S4. Input the historical behavior subgraph set into the trained graph neural network model, and output the vectorized historical behavior subgraph set, i.e. the historical behavior subgraph vector set. Use a clustering algorithm (such as K-means) to group the vectorized historical behavior subgraphs, and select the historical behavior subgraph vector of the center point of each cluster or the most representative sample vectors (the instances closest to the cluster center) to form a normal behavior sample library.
[0055] Based on existing security threat scenario frameworks (such as MITRE, ATT&CK, etc.), detailed text description templates are developed and input into a large language model. This guides the large language model to generate logical and structured descriptions of malicious operation sequences. Subsequently, the malicious operation sequence descriptions are parsed and instantiated into structured malicious behavior subgraphs. The trained graph neural network model then converts the malicious behavior subgraphs into malicious behavior subgraph vectors. These vectors are combined into a malicious behavior subgraph vector set. This malicious behavior subgraph vector set serves as a threat behavior example library, enabling proactive and automated expansion of threat behavior examples.
[0056] S5. Collect system behavior data from the target host in real time and convert it into a real-time behavior subgraph. Use the trained graph neural network model to convert the real-time behavior subgraph into a real-time behavior subgraph vector. Calculate the cosine similarity between the real-time behavior subgraph vector and the historical behavior subgraph vectors in the normal behavior sample library. If the cosine similarity score between the real-time behavior subgraph and any behavior subgraph vector in the normal behavior sample library is greater than or equal to the first threshold, the real-time behavior subgraph is determined to be normal behavior and filtered. Otherwise, calculate the cosine similarity score between the real-time behavior subgraph vector and the threat behavior subgraph vectors in the threat behavior sample library. If the similarity score between the real-time behavior subgraph and any behavior subgraph vector in the threat behavior sample library is greater than or equal to the second threshold, the real-time behavior subgraph is marked as suspicious behavior.
[0057] S6. When a real-time behavior subgraph is marked as suspicious behavior, a preset template is used to convert the real-time behavior subgraph into a natural language description, forming real-time behavior text. Several malicious behavior subgraphs with the highest similarity to the real-time behavior subgraph are converted into natural language descriptions, forming reference threat text. The real-time behavior text, reference threat text, and preset analysis prompt template are combined into a complete prompt, which is then input into a security domain-adapted and optimized large language model to perform in-depth comprehensive analysis of suspicious behavior. The security domain-adapted and optimized large language model is obtained by fine-tuning a pre-trained large language model. Finally, the security domain-adapted and optimized large language model outputs its risk level (e.g., high risk) and interpretable judgment basis, explaining why the behavior is determined to be malicious and what attack mode it matches, thereby improving the credibility and operability of the judgment result.
[0058] The real-time detection and interpretable assessment system for host behavior risks posed by unknown threats, as described in this invention, includes:
[0059] The data acquisition module is used to collect system behavior data of the target host and construct a host behavior map based on the system behavior data;
[0060] The sliding capture module is used to capture the host behavior graph according to a preset sliding window strategy, generate several historical behavior subgraphs, and combine the several historical behavior subgraphs into a historical behavior subgraph set.
[0061] The graph neural network training module is used to train a graph neural network model based on a set of historical behavior subgraphs, with the goal of learning to transform historical behavior subgraphs into historical behavior subgraph vectors, and to obtain the trained graph neural network model.
[0062] The sample library construction module is used to generate a malicious behavior sub-graph set based on a preset security threat scenario description or prompt words using a large language model; the historical behavior sub-graph set and the malicious behavior sub-graph set are respectively input into a trained graph neural network model to obtain a historical behavior sub-graph vector set and a malicious behavior sub-graph vector set; a clustering algorithm is used to select typical sub-graph vector sets from the historical behavior sub-graph vector set to construct a normal behavior sample library, and the malicious behavior sub-graph vector set is used as a threat behavior sample library;
[0063] The preliminary classification module is used to collect real-time system behavior data of the target host and convert it into real-time behavior subgraphs using a trained graph neural network model. The trained graph neural network model is used to obtain real-time behavior subgraph vectors. The real-time behavior subgraph vectors are matched with the historical behavior subgraph vectors in the normal behavior sample library and the malicious behavior subgraph vectors in the threat behavior sample library for similarity. The real-time behavior subgraphs are then preliminarily classified according to the matching threshold. The preliminary classification includes normal behavior and suspicious behavior.
[0064] The suspicious behavior assessment module is used to input real-time behavior sub-graphs, multiple malicious behavior sub-graphs with the highest similarity match, and preset analysis prompt templates into the large language model when the preliminary classification result is suspicious behavior, and output the risk level and assessment basis.
[0065] The computer device of the present invention includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above method.
[0066] The computer-readable storage medium of the present invention stores a computer program thereon, which, when executed by a processor, implements the steps of the above-described method.
Claims
1. A method for real-time detection and interpretable assessment of host behavior risks in response to unknown threats, characterized in that, include: Collect system behavior data of the target host, and construct a host behavior graph based on the system behavior data; The host behavior graph is extracted according to a preset sliding window strategy to generate several historical behavior subgraphs, and the several historical behavior subgraphs are combined into a historical behavior subgraph set. Based on historical behavior subgraphs, with the goal of learning to transform historical behavior subgraphs into historical behavior subgraph vectors, a graph neural network model is trained to obtain the trained graph neural network model. Using a large language model, a malicious behavior sub-graph set is generated based on a preset security threat scenario description or prompt words. The historical behavior sub-graph set and the malicious behavior sub-graph set are respectively input into a trained graph neural network model to obtain a historical behavior sub-graph vector set and a malicious behavior sub-graph vector set. A clustering algorithm is used to select typical sub-graph vector sets from the historical behavior sub-graph vector set to construct a normal behavior example library, and the malicious behavior sub-graph vector set is used as a threat behavior example library. Real-time system behavior data of the target host is collected and constructed into a real-time behavior subgraph. The real-time behavior subgraph vector is obtained using a trained graph neural network model. The real-time behavior subgraph vector is matched with the historical behavior subgraph vector in the normal behavior sample library and the malicious behavior subgraph vector in the threat behavior sample library for similarity. The real-time behavior subgraph is preliminarily classified according to the matching threshold. The preliminary classification includes normal behavior and suspicious behavior. When the initial classification result is suspicious behavior, the real-time behavior sub-graph, the top-ranking malicious behavior sub-graphs with similarity matching, and the preset analysis prompt template are input into the large language model to output the risk level and judgment basis.
2. The method for real-time detection and interpretable assessment of host behavior risks posed by unknown threats according to claim 1, characterized in that, The process of collecting system behavior data from the target host and modeling the system behavior data into a host behavior graph includes: collecting system behavior data from the target host, including entities and directed interaction behaviors between entities, and constructing a behavior graph based on the entities and directed interaction relationships between entities. In the graph, nodes represent entities, and edges represent operations or interaction behaviors between entities.
3. The method for real-time detection and interpretable assessment of host behavior risks posed by unknown threats according to claim 1, characterized in that, The sliding window strategy can be either a sliding time window or a sliding event window. The sliding time window slides at a preset step size based on a preset time length, and the sliding event window slides at a preset step size based on a preset number of events.
4. The method for real-time detection and interpretable assessment of host behavior risks posed by unknown threats according to claim 1, characterized in that, The training graph neural network model includes: performing unsupervised graph representation learning on the historical behavior subgraph set, using a graph autoencoder or GraphSAGE architecture, taking the structural information of the historical behavior subgraph as input, optimizing the graph neural network parameters by minimizing the reconstruction error of the historical behavior subgraph or maximizing the similarity of adjacent historical behavior subgraphs, and obtaining the trained graph neural network model.
5. The method for real-time detection and interpretable assessment of host behavior risks posed by unknown threats according to claim 1, characterized in that, The clustering algorithm includes any one or more combinations of K-means clustering algorithm, hierarchical clustering algorithm, or DBSCAN density clustering algorithm.
6. The method for real-time detection and interpretable assessment of host behavior risks posed by unknown threats according to claim 1, characterized in that, The step of performing similarity matching between the real-time behavior subgraph vector and the historical behavior subgraph vector in the normal behavior sample library and the malicious behavior subgraph vector in the threat behavior sample library, respectively, and performing preliminary classification of the real-time behavior subgraph based on the matching threshold, includes: The cosine similarity between the real-time behavior subgraph vector and the historical behavior subgraph vector in the normal behavior sample library is calculated. If the cosine similarity score between the real-time behavior subgraph and any behavior subgraph vector in the normal behavior sample library is greater than or equal to the first threshold, the real-time behavior subgraph is determined to be normal behavior and the real-time behavior subgraph is filtered. Otherwise, calculate the cosine similarity score between the real-time behavior subgraph vector and the threat behavior subgraph vector in the threat behavior sample library. If the similarity score between the real-time behavior subgraph and any behavior subgraph vector in the threat behavior sample library is greater than or equal to the second threshold, then mark the real-time behavior subgraph as a suspicious behavior.
7. The method for real-time detection and interpretable assessment of host behavior risks posed by unknown threats according to claim 1, characterized in that, The process involves inputting real-time behavior subgraphs, multiple malicious behavior subgraphs with high similarity matching, and preset analysis prompt templates into a large language model, outputting risk levels and interpretable judgment criteria, including: Convert real-time behavior subgraphs into natural language descriptions to form real-time behavior text; The top-ranking malicious behavior sub-graphs with the highest similarity scores are converted into natural language descriptions to form reference threat text; The system combines real-time behavioral text, reference threat text, and preset analysis prompt templates into a complete prompt, which is then input into the large language model. The large language model performs inference based on the complete prompt and outputs the risk level and assessment basis.
8. A real-time detection and interpretable assessment system for host behavior risks posed by unknown threats, characterized in that, include: The data acquisition module is used to collect system behavior data of the target host and construct a host behavior map based on the system behavior data; The sliding capture module is used to capture the host behavior graph according to a preset sliding window strategy, generate several historical behavior subgraphs, and combine the several historical behavior subgraphs into a historical behavior subgraph set. The graph neural network training module is used to train a graph neural network model based on a set of historical behavior subgraphs, with the goal of learning to transform historical behavior subgraphs into historical behavior subgraph vectors, and to obtain the trained graph neural network model. The sample library construction module is used to generate a malicious behavior sub-graph set based on a preset security threat scenario description or prompt words using a large language model; the historical behavior sub-graph set and the malicious behavior sub-graph set are respectively input into a trained graph neural network model to obtain a historical behavior sub-graph vector set and a malicious behavior sub-graph vector set; a clustering algorithm is used to select typical sub-graph vector sets from the historical behavior sub-graph vector set to construct a normal behavior sample library, and the malicious behavior sub-graph vector set is used as a threat behavior sample library; The preliminary classification module is used to collect real-time system behavior data of the target host and convert it into real-time behavior subgraphs using a trained graph neural network model. The trained graph neural network model is used to obtain real-time behavior subgraph vectors. The real-time behavior subgraph vectors are matched with the historical behavior subgraph vectors in the normal behavior sample library and the malicious behavior subgraph vectors in the threat behavior sample library for similarity. The real-time behavior subgraphs are then preliminarily classified according to the matching threshold. The preliminary classification includes normal behavior and suspicious behavior. The suspicious behavior assessment module is used to input real-time behavior sub-graphs, multiple malicious behavior sub-graphs with the highest similarity match, and preset analysis prompt templates into the large language model when the preliminary classification result is suspicious behavior, and output the risk level and assessment basis.
9. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.