Method, device and storage medium for homology analysis of internet protocol addresses

Abstract

Embodiments of the present application provide a method and device for homologous analysis of an Internet Protocol address, and a storage medium. The method comprises: obtaining an Internet Protocol address to be analyzed and corresponding original features; obtaining a plurality of reference Internet Protocol addresses and reference features corresponding to each reference Internet Protocol address; establishing a heterogeneous information graph structure based on associated sub-features between the original features and each reference feature; inputting the heterogeneous information graph structure into a target model; updating the original features of a target node based on the reference features associated with each reference node, the associated sub-features between the reference features and the original features associated with the target node, and the associated weights of the connection edges between each reference node and the target node, to obtain target features; and outputting a homologous analysis result corresponding to the Internet Protocol address to be analyzed based on the target features by the target model. In this way, the accuracy of homologous analysis of the Internet Protocol address can be improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus, device and storage medium for same-origin analysis of Internet Protocol addresses. Background Technology

[0002] In the field of cybersecurity, advanced persistent threat attacks, botnet activities, and other malicious behaviors are typically launched from a large number of attacking Internet Protocol (IP) addresses distributed across the internet. These attacking IP addresses often belong to the same attacker or attack organization, exhibiting a high degree of homogeneity. Accurately identifying these IP addresses with a common origin is crucial for security incident detection, tracing the source of attacks, constructing a complete attack chain view, and improving the quality of threat intelligence.

[0003] In related technologies, common methods for analyzing the common origin of Internet Protocol (IP) addresses include clustering. Specifically, clustering algorithms such as K-Means and DBSCAN are used to group the IP address to be analyzed with other IP addresses, grouping addresses with high similarity into the same cluster to infer their common origin. However, while this method can achieve a certain degree of automation, it treats each IP address as an isolated entity for calculation, leading to inaccurate common origin analysis. Summary of the Invention

[0004] This application proposes a method, apparatus, device, and storage medium for same-origin analysis of Internet Protocol (IP) addresses, which can improve the accuracy of same-origin analysis of IP addresses.

[0005] To achieve the above objectives, a first aspect of this application proposes a method for same-origin analysis of Internet Protocol (IP) addresses, the method comprising:

[0006] Obtain the Internet Protocol address to be analyzed and the original features corresponding to the Internet Protocol address to be analyzed;

[0007] Obtain multiple reference Internet Protocol (IP) addresses and reference features corresponding to each reference IP address. Based on the correlation sub-features between the original features and each reference feature, establish a heterogeneous information graph structure between the IP address to be analyzed and the multiple reference IP addresses.

[0008] The heterogeneous information graph structure includes the target node corresponding to the Internet Protocol address to be analyzed, the reference node corresponding to each reference Internet Protocol address, and the connection edge between the target node and the reference node, with each connection edge associated with a correlation weight.

[0009] The heterogeneous information graph structure is input into a pre-trained target model. Through the target model, the original features of the target node are updated according to the reference features associated with each reference node, the associated sub-features between the reference features and the original features associated with the target node, and the associated weights of the connection edges between each reference node and the target node, so as to obtain the target features.

[0010] Based on the target features, the target model outputs the same-source analysis results corresponding to the Internet Protocol address to be analyzed.

[0011] Accordingly, a second aspect of the embodiments of this application proposes a same-origin analysis apparatus for Internet Protocol addresses, the apparatus comprising:

[0012] The acquisition module is used to acquire the Internet Protocol address to be analyzed and the original features corresponding to the Internet Protocol address to be analyzed;

[0013] A module is established to obtain multiple reference Internet Protocol addresses and reference features corresponding to each reference Internet Protocol address. Based on the correlation sub-features between the original features and each reference feature, a heterogeneous information graph structure is established between the Internet Protocol address to be analyzed and the multiple reference Internet Protocol addresses.

[0014] The heterogeneous information graph structure includes the target node corresponding to the Internet Protocol address to be analyzed, the reference node corresponding to each reference Internet Protocol address, and the connection edge between the target node and the reference node, with each connection edge associated with a correlation weight.

[0015] The input module is used to input the heterogeneous information graph structure into the pre-trained target model. Through the target model, the original features of the target node are updated according to the reference features associated with each reference node, the associated sub-features between the reference features and the original features associated with the target node, and the associated weights of the connection edges between each reference node and the target node, so as to obtain the target features.

[0016] The output module is used to output the same-source analysis results corresponding to the Internet Protocol address to be analyzed based on the target features using the target model.

[0017] In some embodiments, the acquisition module is further configured to:

[0018] The Internet Protocol address to be analyzed is obtained, and based on multiple preset security analysis dimensions, the dimension sub-features corresponding to the Internet Protocol address to be analyzed in each preset security analysis dimension are determined. The multiple preset security analysis dimensions include network attribute analysis dimension, transport layer analysis dimension, application layer analysis dimension, behavior analysis dimension, threat intelligence analysis dimension, and time analysis dimension.

[0019] Based on the multiple sub-features corresponding to the multiple preset security analysis dimensions, the original features corresponding to the Internet Protocol address to be analyzed are constructed.

[0020] In some implementations, the establishment module is further configured to:

[0021] Multiple preset association types are obtained. When the target reference feature between the Internet Protocol address to be analyzed and the target reference Internet Protocol address satisfies any preset association type, the associated sub-feature between the original feature and the target reference feature is determined based on the preset association type.

[0022] When any two reference Internet Protocol addresses satisfy any preset association type, a reference association sub-feature between the reference features of the two reference Internet Protocol addresses is determined based on the preset association type.

[0023] Based on the associated sub-features and the reference associated sub-features, a heterogeneous information graph structure is established corresponding to the Internet Protocol address to be analyzed and the multiple reference Internet Protocol addresses.

[0024] In some embodiments, the input module is further configured to:

[0025] By using the target model, the reference features associated with each reference node and the edge features associated with the connecting edges corresponding to the reference nodes are fused to obtain fused reference features;

[0026] The edge features between the target node and each reference node are obtained by concatenating the corresponding association sub-features and the association weights.

[0027] Based on the fused reference features of each reference node, the original features of the target node are updated to obtain intermediate features;

[0028] The intermediate reference features obtained after updating the reference features of each reference node are acquired, and the intermediate reference features are fused with the associated edge features to obtain intermediate fused reference features. The intermediate features of the target node are updated based on the intermediate fused reference features of each reference node to obtain intermediate features. The intermediate features are updated until the number of times the intermediate features are updated reaches a preset number. The intermediate features obtained in the last update are used as the target features of the target node.

[0029] In some embodiments, the input module is further configured to:

[0030] The sum of reference features is obtained by summing multiple fused reference features based on multiple reference nodes;

[0031] Obtain the number of reference nodes among the plurality of reference nodes, and obtain the global reference features based on the ratio between the sum of the reference features and the number of reference nodes;

[0032] The original features of the target node are updated based on the global reference features to obtain intermediate features.

[0033] In some embodiments, the Internet Protocol address same-origin analysis device further includes a training module for:

[0034] Obtain the sample Internet Protocol address and the original sample features corresponding to the sample Internet Protocol address;

[0035] Obtain multiple sample reference Internet Protocol addresses and sample reference features corresponding to each sample reference Internet Protocol address. Based on the sample association sub-features between the original sample features and each sample reference feature, establish a sample heterogeneous information graph structure between the sample Internet Protocol address and the multiple sample reference Internet Protocol addresses.

[0036] The heterogeneous information graph structure includes sample nodes corresponding to the sample Internet Protocol addresses, sample reference nodes corresponding to each sample reference Internet Protocol address, and sample connection edges between the sample nodes and the sample reference nodes, with each sample connection edge associated with a sample association weight.

[0037] The sample heterogeneous information graph structure is input into a preset model. Through the preset model, the original features of the sample nodes are updated according to the sample reference features associated with each sample reference node, the sample association sub-features between the sample reference features and the original sample features associated with the sample nodes, and the sample association weights associated with the sample connection edges between each sample reference node and the sample nodes, so as to obtain the sample target features.

[0038] Based on the target features of the sample, the preset model is used to output the predicted source analysis results corresponding to the Internet Protocol address of the sample.

[0039] Obtain the reference same-source analysis results corresponding to the sample Internet Protocol addresses, and determine the target loss based on the difference between the reference same-source analysis results and the predicted same-source analysis results. Based on the target loss, adjust the parameters of the preset model to obtain the target model.

[0040] In some implementations, the training module is further configured to:

[0041] From the sample heterogeneous information graph structure, sample reference Internet Protocol address pairs that have at least one sample association sub-feature are identified as positive sample pairs, and sample reference Internet Protocol address pairs that do not have the sample association sub-feature are identified as negative sample pairs, wherein each positive sample pair contains a first positive sample and a second positive sample, and each negative sample pair contains a first negative sample and a second negative sample.

[0042] Obtain the first prediction result output by the preset initial model for the first positive sample of each positive sample pair, the second prediction result output by the second positive sample of each positive sample pair, the third prediction result output by the first negative sample of each negative sample pair, and the fourth prediction result output by the second negative sample of each negative sample pair.

[0043] An unsupervised loss is constructed based on the difference between the first and second prediction results for each positive sample pair, and based on the difference between the third and fourth prediction results for each negative sample pair.

[0044] Based on the unsupervised loss, the parameters of the initial model are adjusted to obtain the preset model.

[0045] Accordingly, a third aspect of the embodiments of this application proposes a computer device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the Internet Protocol address same-origin analysis method of any one of the embodiments of the first aspect of this application.

[0046] Accordingly, a fourth aspect of the embodiments of this application proposes a computer-readable storage medium storing a computer program that, when executed by a processor, implements the Internet Protocol address same-origin analysis method of any one of the embodiments of the first aspect of this application.

[0047] This application embodiment obtains the Internet Protocol address to be analyzed and its corresponding original features; obtains multiple reference Internet Protocol addresses and their corresponding reference features; and establishes a heterogeneous information graph structure between the Internet Protocol address to be analyzed and the multiple reference Internet Protocol addresses based on the correlation sub-features between the original features and each reference feature. The heterogeneous information graph structure includes the target node corresponding to the Internet Protocol address to be analyzed, the reference node corresponding to each reference Internet Protocol address, and the connection edges between the target node and the reference nodes, with each connection edge associated with a correlation weight. The heterogeneous information graph structure is input into a pre-trained target model. Through the target model, the original features of the target nodes are updated according to the reference features associated with each reference node, the correlation sub-features between the reference features and the original features associated with the target node, and the correlation weights associated with the connection edges between each reference node and the target node, thus obtaining the target features. Based on the target features, the target model outputs the homology analysis results corresponding to the Internet Protocol address to be analyzed. This approach enables deep homology discrimination, which transcends isolated individual analysis and incorporates network structural context information, by placing the Internet Protocol (IP) address to be analyzed within a network topology explicitly composed of preset association types for feature learning and updating. Specifically, compared to traditional methods in related technologies that treat each IP address as an isolated individual for clustering, the heterogeneous information graph structure constructed in this application quantifies and incorporates complex associations between IP addresses (such as common goals and similar behaviors) into the analysis framework using weighted edges. The target model utilizes this graph structure to dynamically generate target features that simultaneously characterize the node's own attributes and its structural role in the graph by aggregating the features of neighboring nodes and combining association weights. This allows homology judgment to not only be based on the static features of the IP address itself but also fully consider its association patterns and relative positions within the entire attack network, taking into account the reference features of its neighboring nodes, the type associations with reference features, and the weight strength associations. This enables more accurate identification of homologous attack groups with hidden or complex associations with the IP address to be analyzed. In summary, this application improves the accuracy of homology analysis of IP addresses. Attached Figure Description

[0048] Figure 1 This is a schematic diagram of the architecture of the Internet Protocol address same-origin analysis system provided in the embodiments of this application;

[0049] Figure 2 This is a flowchart of the same-origin analysis method for Internet Protocol addresses provided in the embodiments of this application;

[0050] Figure 3 This is a flowchart illustrating the overall process of the same-origin analysis method for Internet Protocol addresses provided in this application embodiment;

[0051] Figure 4 This is a schematic diagram of the functional modules of the Internet Protocol address homology analysis device provided in the embodiments of this application;

[0052] Figure 5 This is a schematic diagram of the hardware structure of the computer device provided in the embodiments of this application. Detailed Implementation

[0053] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0054] It should be noted that although functional modules are divided in the device schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first," "second," etc., in the specification, claims, and the aforementioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0055] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0056] In the field of cybersecurity, advanced persistent threat attacks, botnet activities, and other malicious behaviors are typically launched from a large number of attacking Internet Protocol (IP) addresses distributed across the internet. These attacking IP addresses often belong to the same attacker or attack organization, exhibiting a high degree of homogeneity. Accurately identifying these IP addresses with a common origin is crucial for security incident detection, tracing the source of attacks, constructing a complete attack chain view, and improving the quality of threat intelligence.

[0057] In related technologies, common methods for analyzing the common origin of Internet Protocol (IP) addresses include clustering. Specifically, clustering algorithms such as K-Means and DBSCAN are used to group the IP address to be analyzed with other IP addresses, grouping addresses with high similarity into the same cluster to infer their common origin. However, while this method can achieve a certain degree of automation, it treats each IP address as an isolated entity for calculation, leading to inaccurate common origin analysis.

[0058] Based on this, embodiments of this application provide a method, apparatus, device, and storage medium for same-origin analysis of Internet Protocol (IP) addresses, which can improve the accuracy of same-origin analysis of IP addresses.

[0059] The Internet Protocol address same-origin analysis method, apparatus, device, and storage medium provided in this application are specifically described through the following embodiments. First, the Internet Protocol address same-origin analysis system in this application embodiment is described.

[0060] Please refer to Figure 1 In some implementations, embodiments of this application provide a system for analyzing the same source of Internet Protocol addresses, including a terminal 11 and a server 12.

[0061] In some implementations, terminal 11 can be used to collect and report security data and basic characteristics associated with Internet Protocol addresses. For example, it can be an Intrusion Detection System (IDS), firewall, honeypot terminal deployed at the network boundary, or a user terminal or mobile security device of a Security Operations Center (SOC).

[0062] Furthermore, terminal 11 can capture network traffic, log events, and threat intelligence information in real time or at regular intervals, and perform preliminary feature extraction and encapsulation to provide the server 12 with structured Internet Protocol addresses to be analyzed and their corresponding raw feature data.

[0063] In some implementations, server 12 can be used to perform highly complex graph construction, feature embedding, and model inference tasks. For example, it can be a dedicated server with high-performance computing capabilities, a cloud computing platform, or a network security analysis platform. Server 12 can receive feature data from terminal 11, construct a heterogeneous information graph structure, run a pre-trained target model to update node features and perform homology analysis, so as to generate and feed back homology analysis results.

[0064] In some implementations, the terminal 11 transmits the collected raw features to the server 12. After the server 12 completes the graph neural network operation and prediction, it returns the source analysis results to the terminal 11 for the terminal 11 to perform alarm display, policy distribution or further security response operations.

[0065] The method for same-origin analysis of Internet Protocol addresses in this application can be illustrated through the following embodiments.

[0066] It should be noted that in all specific embodiments of this application, when processing data related to user identity or characteristics, such as user information, user behavior data, user historical data, and user location information, user permission or consent will be obtained first. Furthermore, the collection, use, and processing of this data will comply with relevant laws, regulations, and standards. In addition, when embodiments of this application require access to sensitive personal information of users, separate permission or consent from the user will be obtained through pop-ups or redirects to confirmation pages. Only after obtaining the user's separate permission or consent will the necessary user-related data for the normal operation of the embodiments of this application be obtained.

[0067] In this embodiment, the description will focus on a device for analyzing the same origin of Internet Protocol (IP) addresses, which can be integrated into a computer device. See also... Figure 2 , Figure 2 The flowchart illustrates the steps of the Internet Protocol (IP) address same-origin analysis method provided in this embodiment. Taking the integration of the IP address same-origin analysis device into a terminal or server as an example, the specific process when the processor on the terminal or server executes the program instructions corresponding to the IP address same-origin analysis method is as follows:

[0068] Step 101: Obtain the Internet Protocol address to be analyzed and the original features corresponding to the Internet Protocol address to be analyzed.

[0069] In some implementations, in order to transform unstructured multi-source security data into machine-understandable basic units that can be used for graph structure learning, attributes and behavioral indicators of the Internet Protocol address to be analyzed in multiple preset security dimensions such as network, transmission, application, behavior, threat intelligence, and time can be systematically extracted from various data sources such as intrusion detection events, threat intelligence, and honeypot records. This constitutes a structured, high semantic density feature representation, thereby providing comprehensive and high-quality input for the subsequent construction of graph structures that reflect the complex relationships between Internet Protocol addresses and the learning of graph neural network models.

[0070] Among them, the Internet Protocol address to be analyzed can be a suspected malicious Internet Protocol (IP) address identified in network security detection that needs to be determined for origin attribution. For example, it can be the source IP address from an intrusion detection system alarm event, a malicious IP address marked by a threat intelligence platform, or an attacker's IP address recorded by a honeypot. The Internet Protocol address to be analyzed can serve as the core input object and classification node of the entire origin analysis process.

[0071] The original features can be a collection of quantified or encoded data extracted from multi-source heterogeneous security data to characterize the current Internet Protocol address to be analyzed in terms of multi-dimensional attributes. For example, it can include a feature vector formed by splicing together a series of sub-features such as network affiliation (e.g., C-segment, autonomous system number), transmission behavior (e.g., common ports, protocol distribution), application layer fingerprint (e.g., HTTP header features, TLS fingerprint), attack methods, threat intelligence tags, and time activity patterns.

[0072] In some implementations, one or more Internet Protocol (IP) addresses requiring homology determination can be received as the objects to be analyzed. These IP addresses can originate from real-time network traffic alerts, historical security event logs, or threat intelligence push notifications. Then, for each IP address to be analyzed, sub-features across multiple preset security analysis dimensions are extracted and organized from related heterogeneous data sources such as event logs, network flow records, and threat intelligence databases. Finally, all dimensional sub-features are combined to form the original feature vector corresponding to each IP address to be analyzed. In this way, unstructured security data can be transformed into a structured feature set that can characterize the essential attributes of the IP addresses to be analyzed, providing a high-quality input foundation for subsequent graph construction and model learning.

[0073] Specifically, the multiple preset security analysis dimensions include at least network attribute analysis, transport layer analysis, application layer analysis, behavioral analysis, threat intelligence analysis, and time analysis. For example, the network attribute analysis dimension can be used to characterize the static network affiliation and geographical attributes of the Internet Protocol address to be analyzed; related sub-features can be obtained from the IP address's WHOIS information, geolocation database, or network routing table. The transport layer analysis dimension can be used to describe the behavioral patterns of IP addresses at the network transmission layer, which can be statistically obtained from captured network flow data. The application layer analysis dimension can be used to depict the specific activity details of the Internet Protocol address to be analyzed at the application protocol layer, specifically obtained by parsing the payload content of network data packets. The behavioral analysis dimension can be used to abstract and encode the attack intent and methods of IP addresses, specifically obtained by matching predefined attack pattern libraries or security event classification rules. The threat intelligence analysis dimension can be used to integrate externally known threat knowledge and reputation evaluations, specifically obtained from commercial or open-source threat intelligence platforms. The time analysis dimension can be used to capture the temporal patterns and periodicity of IP address activity, specifically extracted from timestamped security event logs.

[0074] For example, after obtaining the sub-features of all the above dimensions, they can be concatenated in a predetermined order and standardized (e.g., using Z-score standardization or Min-Max scaling) to eliminate the influence of different feature dimensions and value ranges, and finally form a high-dimensional, unified numerical vector, which is the original feature corresponding to the Internet Protocol address to be analyzed.

[0075] The above methods can automatically and structurally extract deep attributes of Internet Protocol addresses to be analyzed from multiple security data dimensions, thereby constructing feature vectors that are rich in information and have strong representation capabilities. This overcomes the one-sidedness of relying on single features or manual rules in related technologies, and provides an accurate and reliable data foundation for subsequent deep association mining and homology determination based on graph neural networks.

[0076] In some implementations, to construct a comprehensive and structured representation of the Internet Protocol address to be analyzed, and to provide high-quality input for subsequent graph neural network learning, sub-features of the Internet Protocol address to be analyzed across multiple preset security dimensions can be systematically extracted from multi-source security data and concatenated into a feature vector. This achieves machine-readable encoding of the multi-dimensional attributes and behaviors of the Internet Protocol address to be analyzed. For example, step 101 may include:

[0077] (101.1) Obtain the Internet Protocol address to be analyzed, and based on multiple preset security analysis dimensions, determine the dimension sub-features corresponding to each preset security analysis dimension of the Internet Protocol address to be analyzed. The multiple preset security analysis dimensions include network attribute analysis dimension, transport layer analysis dimension, application layer analysis dimension, behavior analysis dimension, threat intelligence analysis dimension and time analysis dimension.

[0078] (101.2) Based on multiple sub-features corresponding to multiple preset security analysis dimensions, construct the original features corresponding to the Internet Protocol address to be analyzed.

[0079] Among them, the preset security analysis dimensions can be multiple different levels of analysis angles or categories based on when extracting features from Internet Protocol addresses, such as network attributes, transport layer, application layer, behavior, threat intelligence and time, to ensure comprehensive coverage of the Internet Protocol addresses to be analyzed.

[0080] Among them, the dimension sub-features can be specific quantitative indicators or encoded data items extracted for Internet Protocol addresses under a certain preset security analysis dimension, such as C-segment prefixes, autonomous system numbers, and geographic coordinate codes extracted under the network attribute analysis dimension, which are used to describe in detail the specific attributes of IP addresses in this dimension.

[0081] Among them, the network attribute analysis dimension can be a dimension used to analyze the network layer affiliation and infrastructure attributes of Internet Protocol (IP) addresses. For example, extracting sub-features such as the C-segment prefix, Autonomous System Number (ASN), geolocation code, time zone code, and network area code of the IP address to be analyzed can be used to reflect the network background and geographical distribution of the IP address to be analyzed.

[0082] Among them, the transport layer analysis dimension can be a dimension used to analyze the behavioral characteristics of Internet Protocol addresses on transport layer protocols. For example, it can extract sub-features such as a list of commonly used ports, protocol distribution vectors, and connection persistence indicators, which can be used to describe the communication patterns and connection habits of IP addresses.

[0083] Among them, the application layer analysis dimension can be a dimension used to analyze the characteristics of Internet Protocol addresses in application layer protocols or payloads. For example, it can extract sub-features such as Hypertext Transfer Protocol (HTTP) method distribution, User-Agent string embedding vector, Cookie key patterns, Transport Layer Security (TLS) fingerprints, and payload hash values, which can be used to identify the application tools or attack payloads used by IP addresses.

[0084] Among them, the behavioral analysis dimension can be a dimension used to analyze the behavioral patterns exhibited by Internet Protocol addresses during the attack process. For example, extracting sub-features such as attack technique encoding (such as structured query language injection and vulnerability exploitation) and attack tool family identifiers can be used to characterize the attack strategies and tool usage of IP addresses.

[0085] Among them, the threat intelligence analysis dimension can be a dimension used to integrate security labels and reputation information about Internet Protocol addresses provided by external threat intelligence platforms. For example, it can extract sub-features such as threat intelligence labels (using one-hot encoding), historical activity scores, reputation scores, IP address user type encoding, and whether it is a proxy, which can be used to introduce prior knowledge to enhance the reputation background of the features.

[0086] Among them, the time analysis dimension can be used to analyze the activity patterns of Internet Protocol addresses over time, such as extracting sub-features such as attack timestamp sequences, active time period patterns, and access frequency statistics, which can be used to capture the time behavior patterns and periodicity of IP addresses.

[0087] For example, one or more Internet Protocol addresses (such as 192.168.1.100) that need to be determined to be of the same origin can be obtained from real-time alarms generated by the network security detection system, historical intrusion detection event logs, or push notifications from external threat intelligence platforms as Internet Protocol addresses to be analyzed.

[0088] Furthermore, for each Internet Protocol address to be analyzed, sub-features corresponding to each preset security analysis dimension can be extracted from multiple associated data sources. The preset security analysis dimensions can include at least the following dimensions:

[0089] Network attribute analysis dimensions can be used to characterize the static network affiliation and geographical context of an IP address. The corresponding sub-features of these dimensions can be obtained by querying public or private network infrastructure databases. For example, for the Internet Protocol address A to be analyzed, its C-segment prefix (e.g., 192.168.1) can be extracted as a rough identifier of its network location. Its Autonomous System Number (AS4134) and geographic coordinate code (e.g., latitude and longitude or geographic region code) can then be retrieved, along with the time zone code and more granular network area code (e.g., country / province / city code). By combining these features, dimensional sub-features in the form of [C-segment prefix, ASN number, geographic coordinate code, time zone code, network area code] can be obtained, thus initially outlining the network environment and potential geographical location of the Internet Protocol address to be analyzed.

[0090] The transport layer analysis dimension describes the behavior of the Internet Protocol (IP) address being analyzed at the network transport layer. Relevant data can be obtained from network flow records such as NetFlow and sFlow, or from deep packet inspection (DPI) systems. For example, the top-K most frequently connected target ports (e.g., [80, 443, 22]) of the IP address being analyzed within a preset time window (e.g., the past 24 hours) can be statistically analyzed to form a port list. The distribution ratio of different transport layer protocols (TCP, UDP, ICMP, etc.) used can be calculated and encoded into a protocol distribution vector. The average duration of connection sessions or the rate of new connection establishment can also be calculated as a connection persistence indicator. Concatenating these data in sequence yields a dimensional sub-feature in the form of [Top-K frequently used port list, protocol distribution vector, connection persistence indicator], which characterizes the pattern preferences of the IP address being analyzed in network communication.

[0091] Application layer analysis dimensions can be used to characterize the specific activity details and fingerprint information of the Internet Protocol address being analyzed at the application protocol level. Specifically, this can be obtained by parsing the payloads of captured network packets. For example, for traffic involving HTTP / HTTPS protocols, the distribution of HTTP request methods used (GET, POST, etc.) can be statistically analyzed; the User-Agent string can be word-embedded or hashed to obtain a fixed-dimensional embedding vector; key patterns in cookies or URLs can be extracted; the JA3 / JA3S fingerprint of the TLS handshake message can be calculated; and the hash value (e.g., SHA-256) of the attack payload (such as webshells or exploit code) can be calculated. Concatenating the above data in sequence yields dimensional sub-features in the form of [HTTP method distribution, User-Agent string embedding vector, Cookie key patterns, TLS fingerprint, payload hash value]. This allows for the unique or strongly correlated identification of the attack tools, exploit frameworks, or malware associated with the Internet Protocol address being analyzed.

[0092] Behavioral analysis dimensions can be used to abstract and encode the attack intent, tactics, techniques, and processes exhibited by the Internet Protocol (IP) address being analyzed. Specifically, this can be achieved by matching the activity logs of the IP address with a predefined attack pattern library or security knowledge graph. For example, based on the content of requests initiated by the IP address, its attack methods can be encoded into predefined categories, such as SQL injection, remote command execution, and brute-force attacks. If the security device can identify the tools or malware used in the attack, its tool family identifier (such as "CobaltStrike" or "Meterpreter") can be directly labeled. Concatenating the above data in sequence yields a dimensional sub-feature in the form of [attack method encoding (e.g., SQL injection, vulnerability exploitation), attack tool family identifier].

[0093] Threat intelligence analysis dimensions can be used to integrate known external threat knowledge and reputation assessments, providing prior information for analysis. Specifically, this can be obtained through query results from commercial or open-source threat intelligence platforms (such as VirusTotal, AlienVault OTX). For example, the tags (such as C2 server, scanner, proxy node) tagged by an IP address across multiple intelligence sources can be aggregated and one-hot encoded; its historical activity score (such as the number of times it has been reported in the past week) and overall reputation score can be obtained; its IP address user type can be encoded (such as data center, residential broadband, mobile network); and it can be explicitly marked as whether it is a known proxy or Tor egress node (Boolean value). Concatenating the above data in sequence yields a dimensional sub-feature in the form of [threat intelligence tag, historical activity score, reputation score, IP user type encoding, Boolean value for whether it is a proxy].

[0094] The time-based analysis dimension can be used to capture the temporal regularity, periodicity, and burstiness patterns of the activity of the Internet Protocol (IP) address being analyzed. Specifically, it can be extracted from security event sequences with precise timestamps. For example, the timestamp sequence of attacks launched by the IP address can be obtained; its active time period patterns within a 24-hour period can be analyzed (e.g., whether its activity is concentrated in the early morning hours of Beijing time); and the access frequency statistics of its attack events can be calculated, such as the average interval, the variance of the time series, and the presence of periodic peaks. By concatenating the above data in sequence, a dimensional sub-feature in the form of [attack timestamp sequence, active time period pattern, access frequency statistics] can be obtained. This facilitates the identification of the scheduling patterns of automated attack scripts or the working habits of attackers in their time zones.

[0095] In some implementations, after obtaining the dimensional sub-features of all the above dimensions, since the data types of each dimensional sub-feature are different (including continuous numerical values, discrete categories, strings, Boolean values, etc.), they can be uniformly encoded into numerical form. For example, for the port list, it can be converted into a sparse binary vector of length 65536, with 1 set at the corresponding port position; for classification features (such as attack methods, threat tags), one-hot encoding is used; for text features (such as User-Agent), a word embedding model is used to convert them into fixed-dimensional real-valued vectors; for features that have already been quantized (such as reputation scores, time intervals), they are used directly. Subsequently, all the encoded dimensional sub-features are concatenated in a predetermined order to form a high-dimensional joint feature vector.

[0096] Furthermore, since the numerical ranges of different dimensions in the concatenated joint feature vector can vary greatly (for example, port numbers can reach tens of thousands, while probability values ​​are between 0 and 1), directly inputting them into the model can lead to optimization difficulties, and features with large magnitudes may dominate model learning. Therefore, the original feature vector can be standardized, for example, using Z-score standardization, which processes each feature dimension separately to make its mean 0 and standard deviation 1, in order to eliminate the influence of dimensions, accelerate model convergence, and improve the model's robustness to different feature scales.

[0097] Finally, the high-dimensional numerical vector obtained after splicing and standardization is the original feature corresponding to the Internet Protocol address to be analyzed.

[0098] By using the above methods, we can automatically extract and integrate the sub-features of the Internet Protocol addresses to be analyzed in each key security dimension from multi-source heterogeneous data, thereby constructing a high-dimensional, semantically rich original feature vector. This provides a comprehensive and accurate data foundation for subsequent construction of heterogeneous information graphs and graph neural network learning, improving the accuracy and automation level of homology analysis.

[0099] Step 102: Obtain multiple reference Internet Protocol addresses and reference features corresponding to each reference Internet Protocol address. Based on the correlation sub-features between the original features and each reference feature, establish a heterogeneous information graph structure between the Internet Protocol address to be analyzed and multiple reference Internet Protocol addresses.

[0100] The heterogeneous information graph structure includes the target node corresponding to the Internet Protocol address to be analyzed, the reference node corresponding to each reference Internet Protocol address, and the connection edges between the target node and the reference node, with each connection edge associated with a correlation weight.

[0101] In some implementations, in order to transform the originally independent IP address data into a network representation rich in structural information, at least one isolated Internet Protocol address entity to be analyzed and its characteristics can be organized into a topological network that can explicitly express complex preset association types. This transforms the homology analysis problem into a node classification or community discovery problem on a graph, providing a foundation for graph neural networks to learn deep group patterns.

[0102] The reference Internet Protocol address can be an Internet Protocol address from which the attack source has been successfully traced; or it can be another Internet Protocol address that needs to be analyzed for same-origin analysis, which can be used as a benchmark set for comparison with the Internet Protocol address to be analyzed when constructing the graph structure.

[0103] Among them, the reference features can be quantized or encoded feature data extracted from multiple dimensions corresponding to the reference Internet Protocol address. Their content and composition are the same as the original features of the Internet Protocol address to be analyzed, and they are used as attributes of the reference node in the graph.

[0104] Among them, the correlation sub-feature can be the basis or metric for judging and quantifying whether there is a certain pre-defined correlation type between two Internet Protocol addresses (e.g., the Internet Protocol address to be analyzed and the reference Internet Protocol address). The dimension of the correlation sub-feature corresponds to the total number of all pre-defined correlation types. For example, specific rules such as jointly attacking the same target, having similar network prefixes (C segments), or using the same payload hash value can be used as the basis for determining the connection edges and their weights in the graph.

[0105] Among them, the heterogeneous information graph structure can be a graph data structure used to represent multiple Internet Protocol address entities and various preset association types between them. For example, a graph consisting of a set of nodes and a set of edges, where nodes represent IP addresses (including the Internet Protocol to be analyzed and reference Internet Protocol addresses), and edges represent different types (such as common targets, similar behaviors) and different strengths of association between IP addresses. It can be used to fuse the attribute characteristics and association structure information of IP addresses.

[0106] The target node can be a node in a heterogeneous information graph structure that represents the Internet Protocol address to be analyzed. Each heterogeneous information graph structure has at least one target node, which is the target of the graph neural network for classification.

[0107] The reference node can be a node in a heterogeneous information graph structure that represents a reference Internet Protocol address.

[0108] The connecting edge can be a data structure in a heterogeneous information graph structure used to represent the relationship between two nodes (i.e. two Internet Protocol addresses) that satisfies at least one preset association type. Each preset association type corresponds to a dimension sub-feature, and the combination of dimension sub-features corresponding to multiple preset association types yields the association sub-feature.

[0109] The association weight can be a numerical value assigned to the connecting edge to quantify the strength of the preset association type represented by the edge. For example, it can be a scalar value between 0 and 1 assigned according to the association sub-features, with a dimension of 1; or, it can be a weight corresponding to each preset association type, with a total number of preset association types of T, and the association weight is a T-dimensional data composed of multiple preset association types in sequence.

[0110] In some implementations, the reference features of each reference Internet Protocol address are constructed in the same way as the original features to ensure the consistency and comparability of the feature space. The specific construction method of the original features can be referred to, and will not be elaborated here. For example, multiple reference Internet Protocol addresses may include all IP addresses that have been marked as malicious from the same source within a past period (e.g., the past 30 days), or context IP addresses related to the current security event (such as other Internet Protocol addresses to be analyzed appearing in a batch of alerts).

[0111] Specifically, a set of preset association types can be traversed to check whether the original characteristics of the Internet Protocol address to be analyzed and the reference characteristics of a reference Internet Protocol address satisfy the conditions defined by a certain preset association type. If they satisfy the conditions, it is considered that there is a related sub-characteristic represented by the preset association type between the two IP addresses, and a connection edge is established between the corresponding nodes in the graph accordingly.

[0112] For example, the preset association types may include: co-occurrence attack target (co_target), that is, two Internet Protocol addresses attacked the same target domain name / IP address / asset within a specific time window; similar network attributes (similar_network), that is, two Internet Protocol addresses have similar C-segment prefixes, ASN numbers, geographic coordinate codes, time zone codes, and network area codes, which can be obtained by combining the features of the above information and calculating cosine similarity; similar application fingerprint (similar_application), that is, two Internet Protocol addresses used attack tools or payloads with the same fingerprint or hash value; similar temporal, that is, two Internet Protocol addresses appeared in the same batch of security events with high temporal correlation; threat intelligence association (similar_TI), that is, two Internet Protocol addresses resolved to the same C2 domain name or used the same certificate, the same proxy server, etc.; similar behavior pattern (similar_behavior), that is, the cosine similarity of the attack behavior feature vectors of two IP addresses exceeds a preset threshold.

[0113] When the Internet Protocol address to be analyzed and the reference Internet Protocol address, or any two reference Internet Protocol addresses, satisfy any of the above-mentioned preset association types, then a connection edge can be added to the corresponding two nodes.

[0114] In some implementations, a fixed weight value can be preset for each preset association type (e.g., similar_TI is given a high weight of 0.9, and similar_network is given a medium weight of 0.6). Alternatively, a linear or non-linear transformation can be performed based on the similarity scores of the two, so that the weight can dynamically reflect the tightness of the association. Finally, a connection edge will be established between all node pairs that satisfy at least one preset association type condition. The association sub-features corresponding to the connection edge are the features obtained by sequentially concatenating all preset association types, thus forming a heterogeneous information graph structure containing a target node, multiple reference nodes, and weighted connection edges.

[0115] In some implementations, to construct the graph structure more dynamically and accurately and reduce the interference of noisy edges, a lightweight edge predictor module can be introduced on top of the above-mentioned connection edge establishment based on static rules and thresholds. This module takes the feature vectors of any two nodes as input and directly outputs an association probability score between 0 and 1 through a small neural network (such as a two-layer MLP), which serves as the association weight of the connection edge.

[0116] By using the above methods, a heterogeneous information graph that integrates attributes and complex relationships can be dynamically constructed based on multi-dimensional features and various association rules. This transforms the originally independent IP address data into a network representation rich in structured information, overcoming the defect of treating IP addresses as independent entities and ignoring their associations. This provides a direct and efficient structured input for subsequent deep feature aggregation and homology determination in graph neural networks.

[0117] In some implementations, to construct a graph structure rich in semantic relationships, a set of association determination rules (predefined association types) covering different levels can be predefined. Based on these rules, the association criteria (association sub-features) between any two IP address features can be identified and calculated. This connects scattered IP address entities into an organic network based on their multidimensional feature similarity or behavioral co-occurrence, thereby systematically and systematically identifying and quantifying various implicit associations between IP addresses. For example, step 102, "establishing a heterogeneous information graph structure corresponding to the Internet Protocol address to be analyzed and multiple reference Internet Protocol addresses based on the association sub-features between the original features and each reference feature," may include:

[0118] (102.1) Obtain multiple preset association types. When the target reference feature between the Internet Protocol address to be analyzed and the target reference Internet Protocol address satisfies any preset association type, determine the associated sub-feature between the original feature and the target reference feature based on any preset association type.

[0119] (102.2) When any two reference Internet Protocol addresses satisfy any preset association type, determine the reference association sub-features between the reference features of any two reference Internet Protocol addresses based on any preset association type;

[0120] (102.3) Based on the associated sub-features and reference associated sub-features, a heterogeneous information graph structure corresponding to the Internet Protocol address to be analyzed and multiple reference Internet Protocol addresses is established.

[0121] Among them, the preset association type can be a predefined set of rule categories or standards used to determine whether there is a specific preset association type between two Internet Protocol addresses. For example, it includes types such as common attack targets, similar network attributes, similar application layer fingerprints, similar time behavior, shared threat intelligence indicators, and similar attack behaviors. It can be used to comprehensively and from multiple perspectives explore potential association patterns between IP addresses and provide clear edge establishment criteria for constructing heterogeneous information graphs.

[0122] Among them, the reference association sub-feature can be the basis or measure used to characterize the specific preset association type between any two reference Internet Protocol addresses, based on the preset association type they satisfy. For example, if two reference IP addresses are associated based on similar network attribute types, their reference association sub-feature can be the cosine similarity value of their network feature vectors.

[0123] In some implementations, the preset association types include, but are not limited to, common target attack association, network attribute similarity association, application fingerprint similarity association, time pattern similarity association, threat intelligence association, and behavior pattern similarity association, which have been described above and will not be repeated here.

[0124] Specifically, when determining the correlation between each Internet Protocol address to be analyzed (denoted as IP address_A) and a target reference Internet Protocol address (denoted as IP address_B), the system will filter the data using the aforementioned preset correlation types one by one, comparing and calculating the original features (denoted as F_A) of IP address_A and the target reference features (denoted as F_B) of IP address_B. If the comparison result meets the judgment condition defined by a certain preset correlation type, the correlation is triggered, and a quantified correlation sub-feature is generated based on the correlation features corresponding to the preset correlation type.

[0125] For example, for the preset association type of co-target attack association, the system will extract the target sets attacked by F_A and F_B within a preset time window (e.g., the past 72 hours) from their feature or event logs. If these two sets have an intersection (i.e., they have attacked at least one common target domain name or IP address), then the preset association type is satisfied. In this case, the determined feature can be represented as (preset association type = co_target). By concatenating the preset association types between the two nodes in order, the association sub-features can be obtained. In this way, abstract collaborative attack behavior can be transformed into measurable connections in a graph.

[0126] It should be noted that when there is no preset association type between the Internet Protocol address to be analyzed and the reference Internet Protocol address, it is not necessary to establish a connection edge for the corresponding nodes of the two.

[0127] In some implementations, when any two reference Internet Protocol addresses satisfy any preset association type, the method for determining the reference association sub-features between the reference features of any two reference Internet Protocol addresses based on any preset association type is the same as the method for determining the association sub-features between the Internet Protocol address to be analyzed and the reference Internet Protocol addresses described above, and will not be repeated here.

[0128] In some implementations, in order to transform the high-dimensional, sparse original node features into a low-dimensional, dense, and more expressive vector representation, while performing dimensionality reduction and noise reduction, a multilayer perceptron (MLP) can be used to encode the features of the target node and the reference node.

[0129] Specifically, for the target node, the encoding process is as follows:

[0130] ;

[0131] in, This represents the original feature quantity of the target node i, which has a high dimension (e.g., it is composed of dozens of features). This represents the learnable weight matrix of the initial coding layer, used for feature transformation and dimensionality reduction; It is the corresponding bias vector; It is a nonlinear activation function, such as the rectified linear unit (ReLU), used to introduce nonlinearity and alleviate the gradient vanishing problem; It is the embedding vector of the target node i in the heterogeneous information graph structure after encoding, and its dimension d is much smaller than the original feature dimension D. In this way, the core attribute information of the Internet Protocol address to be analyzed is preserved, and the computational complexity is greatly reduced by using a low-dimensional representation.

[0132] In some implementations, the embedding vector of each reference node j in the heterogeneous information graph structure The encoding process is the same as that of the target node. For details, please refer to the encoding process of the target node. It will not be elaborated here.

[0133] In some implementations, to fully utilize the rich information (type and weight) of edges in heterogeneous graphs, it is necessary to encode them into vectors with the same embedding dimension as the nodes mentioned above, so as to fuse them with node features during information propagation. Specifically, the edge embedding corresponding to the connecting edge can include encoding the associated sub-features of the preset association type corresponding to the connecting edge to obtain the corresponding embedding, expanding the association weights corresponding to the connecting edge to obtain the corresponding embedding, and generating the edge embedding vector corresponding to the connecting edge.

[0134] For example, for a target node and any reference node, when at least one preset association type is satisfied between them, since the preset association type (such as co_target, similar_behavior) is a discrete variable, it can be converted into a numerical vector using one-hot encoding:

[0135] ;

[0136] in, The associated sub-feature corresponding to the preset association type of edge (i, j) is a T-dimensional vector; It is a T-dimensional vector, which is 1 only at the index of the corresponding preset association type, and 0 at the rest. For example, it is 1 if the association type satisfies similar_behavior, and 0 if it does not satisfy co_target association type; T is the total number of preset association types predefined in the system.

[0137] Furthermore, the association weights corresponding to the connecting edges are expanded to obtain the corresponding embeddings. It can be generated through the following process:

[0138] ;

[0139] in, It is the weight of the connecting edge (i, j), assuming that each preset association type corresponds to an association weight. It can be a T-dimensional vector; or, when at least one association weight is assigned based on multiple preset association types corresponding to the connecting edges. For a 1-dimensional vector, The dimensions can be determined based on the actual situation; For dimension A vector of all 1s Let be the dimension of node embedding in the k-th layer of the target model.

[0140] In some implementations, the edge embedding vector corresponding to each connection edge can be obtained by concatenating the embeddings of the associated sub-features of the corresponding preset association type and the embeddings of the corresponding association weights. The specific process is as follows:

[0141] ;

[0142] in, and These are the learnable parameters of the k-th layer edge coding layer. It is the edge embedding vector obtained by encoding, and its dimension is the same as the node embedding of the i-th layer. Maintain consistency.

[0143] It should be noted that the method for obtaining the edge embedding vectors corresponding to the connecting edges between reference nodes is the same as the method for obtaining the edge embedding vectors between the target node and the reference nodes, and will not be repeated here.

[0144] In some implementations, after processing the original features corresponding to each target node, the reference features corresponding to each reference node, the associated sub-features and associated weights of the preset association type between the target node and the reference node, and the reference associated sub-features and reference associated weights of the preset association type between the reference nodes into the heterogeneous information graph structure to obtain the corresponding node embeddings and edge embeddings, the final heterogeneous information graph structure can be obtained.

[0145] This encoding process embeds the semantic information (preset association type) and strength information (association weight) of an edge into a continuous vector space. In subsequent aggregation operations of the target model, this edge embedding vector can interact with the feature vectors of the reference nodes (e.g., through element-wise multiplication), thereby achieving differentiated and quantified information transmission control for different preset association types.

[0146] By using the above methods, a set of predefined association rules covering multiple aspects can be used to automatically and objectively identify various preset association types between IP address pairs (including between the Internet Protocol address to be analyzed and the reference IP address, as well as between the reference IP addresses themselves), generate quantified association sub-features and association weights, and embed the node features, association sub-features, and association weights into a representation. This constructs a heterogeneous information graph with rich edge types and measurable association strength, thus providing a solid and high-quality structured foundation for subsequent model learning of deep embedding representations of nodes in complex relational networks.

[0147] Step 103: Input the heterogeneous information graph structure into the pre-trained target model. Through the target model, update the original features of the target node based on the reference features associated with each reference node, the associated sub-features between the reference features and the original features associated with the target node, and the association weights of the connection edges between each reference node and the target node, to obtain the target features.

[0148] In some implementations, in order to deeply integrate the isolated features of the target node (the Internet Protocol address to be analyzed) with its contextual information (neighbor features and preset association types) in the graph structure, a pre-trained graph neural network model can be used to aggregate the features of neighbor nodes according to the type and weight of the connecting edges, and iteratively update the feature representation of the target node to generate a low-dimensional, highly expressive target feature vector that contains its own attributes and encodes the network association structure.

[0149] The target model can be a graph neural network model that has been unsupervised pre-trained and / or supervised fine-tuned to learn the embedding representation of Internet Protocol addresses in a graph structure and predict their homology. For example, it can be a graph neural network based on the GraphSage architecture.

[0150] The target feature can be the final feature vector representation obtained by iteratively updating the original feature representation of the target node (the Internet Protocol address to be analyzed) based on graph structure information. It integrates the multi-dimensional attributes of the target node itself, the feature information of the reference node that satisfies the preset association type, and the edge embedding of the connecting edge (composed of the embeddings corresponding to the associated sub-features and association weights respectively).

[0151] In some implementations, the embedded representation of the original features of the target node (the Internet Protocol address to be analyzed) can be deeply fused with the feature information of the reference node that meets the preset association type and the edge embedding of the connecting edge (composed of the embeddings corresponding to the associated sub-features and the associated weights respectively) to finally generate a more expressive low-dimensional target feature (i.e., node embedding) corresponding to the target node.

[0152] Specifically, for the target node, in the heterogeneous information graph structure, for each reference node that satisfies a preset association type with the target node, the variable embedding between the target node and the reference node is fused with the embedding of the reference features of the reference node to emphasize the importance of the adjacent reference nodes corresponding to strong association edges. This fusion can be performed through element-wise multiplication, as follows:

[0153] ;

[0154] in, Indicates reference node The embedding vector at the (k-1)th layer; This represents the edge embedding vector from target node i to the adjacent reference node j (target reference node) at layer k. This vector has been obtained by encoding the edge type and weight. The specific acquisition process has been described above and will not be repeated here. This represents the feature vector passed from reference node j to target node i after incorporating edge information.

[0155] In some implementations, for each target node, the result obtained is fused with each adjacent reference node. Then, it can be done through each adjacent reference node. Message passing and message aggregation are performed to obtain the target features corresponding to the target node.

[0156] By using the above methods, the rich neighbor attribute information and differentiated association strength around the target node can be effectively encoded into its own feature representation. This makes the final target feature not only contain the static attributes of the target node, but also its dynamic position and behavior pattern in the attack relationship network. This provides key high-quality feature input for the subsequent accurate and reliable output of homology analysis results.

[0157] In some implementations, to effectively aggregate multi-hop neighbor information of the target node through the target model and finely integrate the influence of different preset association types, edge embedding (obtained by concatenating the embeddings corresponding to the preset association type and association weight) can be introduced to modulate the feature contribution of the neighbor's reference node. A hierarchical iterative aggregation mechanism is then used to update the node features multiple times, gradually generating feature representations that characterize the depth context information of the node in the graph structure. For example, step 103, "updating the original features of the target node using the target model based on the reference features associated with each reference node, the association sub-features between the reference features and the original features associated with the target node, and the association weights of the connecting edges between each reference node and the target node, to obtain the target features," may include:

[0158] (103.1) By using the target model, the reference features associated with each reference node and the edge features associated with the connecting edges of the reference node are fused to obtain the fused reference features;

[0159] The edge features between the target node and each reference node are obtained by concatenating the corresponding association sub-features and association weights.

[0160] (103.2) Based on the fused reference features of each reference node, the original features of the target node are updated to obtain intermediate features;

[0161] (103.3) Obtain the intermediate reference features obtained after updating the reference features of each reference node, and fuse the intermediate reference features with the associated edge features to obtain intermediate fused reference features. Update the intermediate features of the target node based on the intermediate fused reference features of each reference node to obtain intermediate features, until the number of times the intermediate features are updated reaches the preset number, and use the intermediate features obtained in the last update as the target features of the target node.

[0162] Among them, the fused reference feature can be a feature representation obtained by combining the reference feature of the reference node with the edge feature vector connected to the target node. For example, the feature obtained by fusing the embedding corresponding to the reference feature with the edge embedding through element-wise multiplication can be used to emphasize the contribution of each reference node and weaken the influence of weakly associated neighbors during aggregation.

[0163] Among them, intermediate features can be feature vectors of the target node obtained after a feature update operation that have not yet reached the final output state. For example, the node embedding vector obtained after aggregation at layer k-1 is the input basis for the next (layer k) aggregation operation and is used to pass and refine the node representation in the multi-layer network.

[0164] Among them, the intermediate fusion reference feature can be the feature representation obtained by fusing the updated intermediate feature (instead of the initial feature) of the reference node with the same edge feature again during the hierarchical aggregation process. For example, at the k-th layer, the (k-1)-th layer embedding of the neighbor node is used to fuse with the edge embedding. This can be used to incorporate more contextual features of the neighbor node itself, which has also been updated by its neighbors, when aggregating at a deeper level.

[0165] The preset number of iterations can be the total number of layers or iterations of the target model for hierarchical neighbor feature aggregation. It determines how far away the target node can collect information from its neighbors (K hops) and can be used to control the size of the model's receptive field and balance the locality and globality of features.

[0166] In some implementations, the edge features, namely the embeddings of the associated sub-features based on the preset association type described above, are concatenated with the embeddings of the association weights to obtain the embedding vector. Please refer to the above for the acquisition process, which will not be repeated here.

[0167] Furthermore, the fused reference features can be obtained by element-wise multiplication of the reference features associated with each reference node and the edge features of the edges connecting it to the target node. The specific process is as follows:

[0168] ;

[0169] in, Indicates reference node The embedding vector at the (k-1)th layer; This represents the edge embedding vector from target node i to the adjacent reference node j (target reference node) at layer k. This vector has been obtained by encoding the edge type and weight. The specific acquisition process has been described above and will not be repeated here. This represents the feature vector passed from reference node j to target node i after incorporating edge information.

[0170] Furthermore, for each target node, the fused reference features of all adjacent reference nodes can be aggregated using the Mean, as follows:

[0171] ;

[0172] in, Indicates the relationship with the target node The set of adjacent reference nodes; This represents the global reference feature obtained after aggregation. Mean aggregation can effectively smooth noise and preserve the global statistical information of the reference nodes. In addition to Mean aggregation, max pooling aggregation and other methods can also be used. The specific method can be determined according to the actual situation, and this application does not impose any specific limitations.

[0173] Furthermore, the initial embedding corresponding to the original features of the target node can be combined with the global reference features, and an updated node representation can be generated through a nonlinear transformation layer. Specifically, this can be achieved by concatenating the features and then performing a linear transformation and nonlinear activation, as follows:

[0174] ;

[0175] in, Represents the target node The embedding vector at the (k-1)th layer (when k=1, this is the initial embedding) ); This represents a vector concatenation operation. and These are the learnable parameters of the current update layer. It's an activation function. The result is... This refers to the intermediate features after the first round of updates, which integrate the target node's own attributes, the structural information of multi-hop neighbors, and edge attributes.

[0176] In some implementations, in order to capture deeper and more complex dependencies in the network (e.g., indirect associations generated through common neighbors), the features of the target node can be updated in multiple rounds, for example, the preset number of times can be K times, where K can correspond to the number of layers in the network and also determine the number of hops for information propagation.

[0177] Specifically, after the first round of updates, not only does the target node obtain intermediate features, but each reference node also updates its representation based on its neighbors (which may include other reference nodes or other target nodes), obtaining its own intermediate reference features. In the k-th iteration (k=2,...,K), a similar but more informative update process can be repeated: for each adjacent reference node, its latest intermediate reference feature is used and fused again with the fixed edge features between it and the target node to generate the current round's fused intermediate reference feature. Then, the new set of fused intermediate reference features is aggregated to obtain the global reference feature for the k-th round. By concatenating and transforming the target node's intermediate features from the previous round with the updated global reference feature, the updated intermediate feature for the current round can be obtained. The specific process can be found above; formulas are not listed here.

[0178] In some implementations, through K rounds of iteration, the feature representation of the target node can integrate information from its K-hop neighbors. Ultimately, when k=K, the obtained... This is the target feature. This feature is a highly refined vector that simultaneously encodes the multidimensional attributes of the Internet Protocol address to be analyzed, its local and global structural position in the heterogeneous association graph, and the strength and type of various preset association types between it and other reference Internet Protocol addresses in the network. It is an effective basis for the final same-origin determination.

[0179] By using the above methods, the type and strength of the preset association type can be used as learnable edge features to dynamically modulate the contribution of neighbor information in each aggregation. Through a multi-layer iterative mechanism, the features of the target node can integrate contextual information from multi-hop neighbors that has been passed and refined layer by layer. This allows the final target features to reflect the structural position and behavioral patterns of the node in the complex association network more deeply and accurately, thereby providing more discriminative and robust feature basis for subsequent homology determination.

[0180] In some implementations, to balance the contributions of each neighbor node and suppress the influence of outliers when aggregating neighbor information, a global reference feature representing the overall characteristics of the local neighbors can be obtained by calculating the sum of the fused features of all neighbor nodes and taking the average. This provides stable and balanced contextual information for updating the target node's features. For example, (103.2) may include:

[0181] (103.2.1) The sum of reference features is obtained by summing multiple fused reference features based on multiple reference nodes;

[0182] (103.2.2) Obtain the number of reference nodes for multiple reference nodes, and obtain the global reference features based on the ratio between the sum of reference features and the number of reference nodes;

[0183] (103.2.3) Update the original features of the target node based on the global reference features to obtain intermediate features.

[0184] The sum of reference features can be the sum vector obtained by adding the fused reference features corresponding to all reference nodes of the target node.

[0185] The number of reference nodes can be the total number of all reference nodes that have a connection edge with the target node.

[0186] The global reference feature can be the value of the average feature vector of all sampled neighbors of the target node, obtained by dividing the sum of the reference features by the number of reference nodes. It preserves the overall pattern of the adjacent group of reference nodes and reduces the influence of a single abnormal reference node.

[0187] In some implementations, for each target node, the fused reference features of all its neighboring reference nodes can be calculated. The sum of these values ​​yields the total reference features. This is done by summing the contributions of all neighboring nodes. Then, the number of all its neighboring reference nodes, i.e., the number of reference nodes, can be calculated. The global reference features are calculated based on the ratio between the sum of reference features and the number of reference nodes. The specific process is as follows:

[0188] ;

[0189] This can smooth out interference from individual abnormal or noisy neighbors, provide more stable and representative neighbor context information, and help the model focus more on the overall behavior patterns of related groups rather than a single extreme IP address, thereby improving the model's robustness to noise and its generalization ability.

[0190] In some implementations, a global reference feature summarizing information about neighboring groups is obtained. Then, the target model needs to fuse it with the target node's own representation to generate an updated node embedding (intermediate feature). The update method has been explained above, and you can refer to the above for details, which will not be repeated here.

[0191] The above methods can be used to integrate multiple neighbor features modulated by edge features by mean aggregation, thereby obtaining a global reference feature that can reflect the commonalities of the local neighbor group of the target node in a balanced way and has a certain robustness to noise or outliers. This allows the updated intermediate features of the target node to absorb the structural information of its directly associated environment more stably and representatively, laying the foundation for deeper feature iteration and fusion in the future.

[0192] Step 104: Using the target model, output the same-source analysis results corresponding to the Internet Protocol addresses to be analyzed based on the target features.

[0193] In some implementations, in order to transform the node embedding vectors learned by the target model, which contain rich association information, into specific homology determination conclusions, the target features can be input into a classifier (such as a Softmax layer) to calculate the probability distribution of their belonging to various known homologous groups, so as to output a quantifiable and interpretable attribution determination result.

[0194] Among them, the result of homology analysis can be conclusive information obtained after determining the attribution of the Internet protocol address to be analyzed based on the target feature. For example, it can be a probability distribution vector, where each element of the probability distribution vector represents the probability that the Internet protocol address to be analyzed belongs to a certain specific attacker group (such as the same botnet, the same attack organization), or a specific group label (such as taking the group with the highest probability as the determination result), which can be used to automatically identify the attribution of the Internet protocol address to be analyzed, and assist in security event correlation, attack traceability, and threat intelligence production.

[0195] In some embodiments, the last layer of the target model may include a classifier (such as a fully connected layer followed by a Softmax activation function). The classifier can receive the target feature corresponding to each target node as input and output a probability distribution vector. The dimension C of the probability distribution vector is equal to the total number of known homologous groups (determined during the model training phase). The value of each dimension represents the predicted probability that the Internet protocol address to be analyzed belongs to the c-th homologous group, and the label corresponding to the maximum predicted probability is selected as the confidence score for this determination.

[0196] Exemplarily, in order to control the credibility of the prediction, a confidence threshold t (such as t = 0.7) can be set. If the maximum predicted probability ≥ t, it is determined that the Internet protocol address to be analyzed belongs to the corresponding group with high confidence; if the maximum predicted probability < t, the determination result is of low confidence, and it can be marked as an unknown group, etc., for further review by a security analyst. Exemplarily, for a newly captured Internet protocol address to be analyzed, the model may output that it has an 85% probability of belonging to a distributed denial-of-service attack and a 15% probability of belonging to a software attack. Taking the maximum value 0.85 as the result, if the threshold is set to 0.7, the final output of the high-confidence homology analysis result is: belonging to a distributed denial-of-service attack.

[0197] This application embodiment obtains the Internet Protocol address to be analyzed and its corresponding original features; obtains multiple reference Internet Protocol addresses and their corresponding reference features; and establishes a heterogeneous information graph structure between the Internet Protocol address to be analyzed and the multiple reference Internet Protocol addresses based on the correlation sub-features between the original features and each reference feature. The heterogeneous information graph structure includes the target node corresponding to the Internet Protocol address to be analyzed, the reference node corresponding to each reference Internet Protocol address, and the connection edges between the target node and the reference nodes, with each connection edge associated with a correlation weight. The heterogeneous information graph structure is input into a pre-trained target model. Through the target model, the original features of the target nodes are updated according to the reference features associated with each reference node, the correlation sub-features between the reference features and the original features associated with the target node, and the correlation weights associated with the connection edges between each reference node and the target node, thus obtaining the target features. Based on the target features, the target model outputs the homology analysis results corresponding to the Internet Protocol address to be analyzed. This approach enables deep homology discrimination, which transcends isolated individual analysis and incorporates network structural context information, by placing the Internet Protocol (IP) address to be analyzed within a network topology explicitly composed of preset association types for feature learning and updating. Specifically, compared to traditional methods in related technologies that treat each IP address as an isolated individual for clustering, the heterogeneous information graph structure constructed in this application quantifies and incorporates complex associations between IP addresses (such as common goals and similar behaviors) into the analysis framework using weighted edges. The target model utilizes this graph structure to dynamically generate target features that simultaneously characterize the node's own attributes and its structural role in the graph by aggregating the features of neighboring nodes and combining association weights. This allows homology judgment to not only be based on the static features of the IP address itself but also fully consider its association patterns and relative positions within the entire attack network, taking into account the reference features of its neighboring nodes, the type associations with reference features, and the weight strength associations. This enables more accurate identification of homologous attack groups with hidden or complex associations with the IP address to be analyzed. In summary, this application improves the accuracy of homology analysis of IP addresses.

[0198] In some implementations, to enable the target model to more accurately map the learned node embeddings to the correct homology categories, a pre-constructed sample heterogeneity information graph can be input into an initial model (preset model) to obtain prediction results. These predictions are then compared with the ground truth annotations (referencing homology analysis results) to calculate a loss function (target loss). This loss is then used to backpropagate and adjust the model parameters, allowing the model to automatically learn IP address homology discrimination patterns from the data. For example, the target model can be trained in the following way:

[0199] (A.1) Obtain the sample Internet Protocol address and the original sample features corresponding to the sample Internet Protocol address;

[0200] (A.2) Obtain multiple sample reference Internet Protocol addresses and sample reference features corresponding to each sample reference Internet Protocol address. Based on the sample correlation sub-features between the original sample features and each sample reference feature, establish a sample heterogeneous information graph structure corresponding to the sample Internet Protocol address and multiple sample reference Internet Protocol addresses.

[0201] The sample heterogeneous information graph structure includes sample nodes corresponding to sample Internet Protocol addresses, sample reference nodes corresponding to each sample reference Internet Protocol address, and sample connection edges between sample nodes and sample reference nodes. Each sample connection edge is associated with a sample association weight.

[0202] (A.3) Input the heterogeneous information graph structure of the sample into the preset model. Through the preset model, based on the sample reference features associated with each sample reference node, the sample association sub-features between the sample reference features and the original sample features associated with the sample node, and the sample association weights associated with the sample connection edges between each sample reference node and the sample node, update the original sample features of the sample node to obtain the target features of the sample.

[0203] (A.4) Using a pre-set model, output the predicted source analysis results corresponding to the Internet Protocol addresses of the samples based on the target characteristics of the samples;

[0204] (A.5) Obtain the reference source analysis results corresponding to the sample Internet Protocol addresses, and determine the target loss based on the difference between the reference source analysis results and the predicted source analysis results. Based on the target loss, adjust the parameters of the preset model to obtain the target model.

[0205] The preset model can be an initial neural network model to be trained, which has a basic architecture of graph feature learning and homology prediction. For example, an unsupervised fine-tuned GraphSage model architecture whose parameters are in an unoptimized or unsupervised pre-trained state can be used as the starting point for the supervised training stage. By training the preset model, the target model can be obtained.

[0206] The predicted homology analysis result can be the result output by the preset model after determining the homology of the sample Internet Protocol addresses based on the input sample heterogeneity information graph. For example, it can be a probability distribution vector to represent the probability that the model predicts that the sample Internet Protocol address belongs to each known homology group.

[0207] Among them, the reference homology analysis results can be the homology attribution information of sample Internet Protocol addresses that are known in advance and used as training standard labels. For example, real group labels using one-hot encoding. If the sample belongs to the c-th group, the dimension is 1 and otherwise 0. It can be used to provide learning objectives for the model in supervised training.

[0208] The target loss can be a scalar function used during model training to quantify the difference between the predicted and reference homology analysis results. For example, it can be a value calculated using the cross-entropy loss function based on the predicted and reference homology analysis results. It can be used to guide the adjustment direction of the parameters of the preset model through optimization algorithms such as gradient descent, so as to minimize the prediction error.

[0209] In some implementations, the process of obtaining the target features of the sample Internet Protocol address and outputting the predicted source analysis result corresponding to the sample Internet Protocol address based on the target features through a preset model is the same as the operation process described above, which involves obtaining the target features of the Internet Protocol address to be analyzed, and outputting the source analysis result corresponding to the Internet Protocol address to be analyzed based on the target features through a target model. The only difference is that the model state and data are different. The specific process can be referred to above and will not be repeated here.

[0210] Furthermore, the pre-defined model can be optimized by minimizing the difference between the predicted homology analysis results and the reference homology analysis results, specifically by using the cross-entropy loss function as the objective function. The target loss can be calculated using the loss function to measure the distance between the predicted probability distribution output by the model and the true homology group label distribution. The specific process is as follows:

[0211] ;

[0212] Where N can represent the total number of nodes participating in the training (i.e., sample Internet Protocol addresses); C can represent the total number of known homologous groups; It is the one-hot encoding of the real group label of sample node i corresponding to the sample Internet Protocol address. The value is 1 when node i belongs to the c-th group, and 0 otherwise. This could be the probability that node i belongs to the c-th group, as predicted by the pre-defined model. By calculating the target loss and using gradient descent for backpropagation, the classification layer and upstream parameters of the pre-defined model can be adjusted to obtain the optimized target model.

[0213] By using the above methods, supervised end-to-end training of the model can be performed using sample data with real labels. This enables the model to learn the mapping rules that accurately associate complex graph structure information and node features with specific homologous categories, optimize its internal parameters, and thus obtain a target model with stronger generalization ability and more accurate prediction. This provides a reliable technical foundation for analyzing the homology of unknown Internet Protocol addresses in practical applications.

[0214] In some implementations, to improve the robustness and embedding quality of the model, especially when labeled sample data (referencing the homology analysis results) is relatively scarce, an unsupervised pre-training stage can be introduced before the supervised training described above. Specifically, instead of using the reference homology analysis results, a self-supervised task based on the heterogeneous information graph structure itself can be designed to pre-train the model. The resulting preset model is then subjected to the supervised training described above to obtain the target model. In this way, even in the absence of a large amount of manually labeled data, the model can be pre-trained using the preset association types inherent in the graph structure itself. This allows the model to learn the basic rule that connected nodes in the graph should have similar representations, achieving initial capture of IP address association patterns and good initialization of the embedding space. For example, the homology analysis method for Internet Protocol addresses may also include:

[0215] (B.1) From the sample heterogeneous information graph structure, determine the sample reference Internet Protocol address pairs that have at least one sample association sub-feature as positive sample pairs, and the sample reference Internet Protocol address pairs that do not have sample association sub-features as negative sample pairs, wherein each positive sample pair contains a first positive sample and a second positive sample, and each negative sample pair contains a first negative sample and a second negative sample.

[0216] (B.2) Obtain the first prediction result output by the preset initial model for the first positive sample of each positive sample pair, the second prediction result output by the second positive sample of each positive sample pair, the third prediction result output by the first negative sample of each negative sample pair, and the fourth prediction result output by the second negative sample of each negative sample pair;

[0217] (B.3) Construct an unsupervised loss based on the difference between the first and second prediction results for each positive sample pair, and based on the difference between the third and fourth prediction results for each negative sample pair;

[0218] (B.4) Based on unsupervised loss, the parameters of the initial model are adjusted to obtain the preset model.

[0219] The sample reference Internet Protocol address pair can be an address pair composed of two sample reference Internet Protocol addresses selected from the sample heterogeneous information graph structure.

[0220] Among them, positive sample pairs can be sample reference Internet Protocol address pairs in a sample heterogeneous information graph structure, where there is at least one preset association type (i.e., there is at least one sample association sub-feature) between two nodes, such as two IP address pairs with connecting edges in the graph, which are used as positive examples of similarity in unsupervised learning.

[0221] Negative sample pairs can be sample reference Internet Protocol address pairs in a sample heterogeneous information graph structure where there is no preset association type between two nodes (i.e., no sample association sub-features), such as two IP address pairs without edge connections in the graph, used as dissimilar negative examples in unsupervised learning.

[0222] The first positive sample can be the first sample reference Internet Protocol address contained in a positive sample pair, such as IP address_A in the positive sample pair (IP address_A, IP address_B).

[0223] The second positive sample can be the second sample reference Internet Protocol address contained in a positive sample pair, such as IP address_B in the positive sample pair (IP address_A, IP address_B).

[0224] The first negative sample can be the first sample reference Internet Protocol address contained in a negative sample pair, such as IP address_C in the negative sample pair (IP address_C, IP address_D).

[0225] The second negative sample can be the second sample reference Internet Protocol address contained in a negative sample pair, such as IP address_D in the negative sample pair (IP address_C, IP address_D).

[0226] The initial model can be a graph neural network base model with unoptimized parameters before unsupervised pre-training, such as an untrained GraphSage model architecture.

[0227] The first prediction result can be the prediction source analysis result obtained by the initial model for the first positive sample. The specific method of obtaining it is the same as the process of obtaining the source analysis result corresponding to the Internet Protocol address to be analyzed by the target model. The difference lies in the different model states (initial model and target model respectively) and the different data states (sample Internet Protocol address and Internet Protocol address to be analyzed respectively). Therefore, the first prediction result can be obtained by referring to the process of obtaining the source analysis result above. The specific process will not be elaborated here.

[0228] Similarly, the process of obtaining the second, third, and fourth prediction results is the same as the process of obtaining the homology analysis results.

[0229] In some implementations, the first positive sample, the second positive sample, the first negative sample, and the second negative sample do not specifically refer to a single sample Internet Protocol address, but rather to a class of sample Internet Protocol addresses that can construct positive samples and a class of sample Internet Protocol addresses that can construct negative samples.

[0230] Unsupervised loss can be a loss function value calculated solely based on the graph structure (positive / negative sample pair relationship) without relying on manual labeling. For example, negative sampling loss can be used to measure whether the model has successfully brought the representations of positive sample pairs closer together and pushed the representations of negative sample pairs further apart, thereby guiding the parameter updates of the initial model.

[0231] In some implementations, during the unsupervised pre-training phase, positive and negative sample pairs can be determined from the sample heterogeneous information graph structure. Specifically, pairs of nodes directly connected by edges (i.e., possessing at least one associated sub-feature) can be identified as positive sample pairs, each pair containing two associated nodes (a first positive sample and a second positive sample). Simultaneously, negative sample pairs are randomly sampled from nodes without edge connections in the graph, each pair containing two unassociated nodes (a first negative sample and a second negative sample). Subsequently, low-dimensional embedding vectors associated with each node by a pre-defined initial model are obtained from the sample heterogeneous information graph structure.

[0232] In some implementations, this application applies unsupervised learning to the application results of the initial model to encourage related (positive sample pairs) nodes to have similar predicted group distributions, while unrelated (negative sample pairs) nodes have distributions that are far apart. Specifically, this can be achieved by constructing a negative sampling loss function after the model outputs the corresponding prediction results. Specifically, this loss function traverses all edges in the graph (i.e., all positive sample pairs) and calculates the sum of their contrastive losses, as shown in the following formula:

[0233] ;

[0234] in, This represents the set of all edges in the graph. We can iterate through each positive sample pair (u,v) in the graph, calculate the loss, and accumulate the results. and These are the predicted homology analysis results obtained after the initial model performs forward computation on nodes u and v, which are probability distribution vectors representing their belonging to various known homology groups. This represents the inner product of the two probability distribution vectors, used to measure their similarity; It is the Sigmoid function, used to map inner product values ​​to the interval (0,1).

[0235] Where n represents the sampled negative sample nodes, which can be derived from a noise distribution. Extraction from the middle (usually uniformly distributed); This represents the expectation of all possible negative sample nodes sampled. In actual training, this is approximated by sampling a fixed number Q negative sample nodes for each positive sample pair; Q can be the number of negative sample nodes sampled for each positive sample pair. It can represent the inner product of the predicted probability distribution vectors of positive sample node u and negative sample node n.

[0236] By calculating the unsupervised loss (also known as the negative sampling loss), the inner product of the predicted distributions of connected nodes is maximized through the positive sample term, making them similar; while the inner product of the predicted distributions of positive sample nodes and random negative sample nodes is minimized through the negative sample term, making them dissimilar. By summing the losses over all edges, the model learns from the global graph structure, thus obtaining high-quality initial parameters.

[0237] This application calculates the unsupervised loss in the first stage, adjusts the parameters of the initial model to obtain the preset model, and then calculates the target loss in the second stage, adjusts the parameters of the preset model to obtain the target model.

[0238] By training the initial model unsupervised, the correlations (positive sample pairs) and non-correlations (negative sample pairs) existing in the heterogeneous information graph structure can be directly used as self-supervised signals to construct a contrastive learning loss function. This allows the model to automatically learn to map nodes with close topological relationships to similar predictions and unrelated nodes to dissimilar predictions without any manual labeling of the same source. This enables the model to autonomously learn the complex and implicit correlation patterns and commonalities in the group structure between attacking IPs from massive amounts of unlabeled network security event data. This provides a stable and generalizable foundation for parameter initialization and feature representation in the subsequent supervised fine-tuning stage, significantly reducing the dependence on a small amount of labeled data and enhancing the model's ability to discover new and unknown attack organization patterns.

[0239] Please refer to Figure 3 In some implementations, combined with Figure 3The overall flow of the Internet Protocol (IP) address same-origin analysis method according to embodiments of this application is described. Exemplarily, the same-origin analysis method provided by this application can be divided into five sequentially connected steps: attack IP feature extraction (A1), graph ontology construction (A2), feature vector embedding (A3), graph neural network GraphSage model training (A4), and IP same-origin prediction (A5). First, in the attack IP feature extraction stage (A1), features of the IP address to be analyzed and its reference IP addresses in multiple dimensions can be extracted based on multi-source security data (e.g., security events, keystroke records, threat intelligence, and security knowledge bases), forming original features and reference features. Next, in the graph ontology construction stage (A2), related sub-features between features are identified according to preset association types (e.g., common attack targets, similar behavior patterns, etc.), and a heterogeneous information graph structure containing target nodes, reference nodes, and weighted connecting edges is constructed. Subsequently, in the feature vector embedding stage (A3), the node features and edge features in the graph are encoded and embedded, transforming them into low-dimensional vectors suitable for graph neural network processing.

[0240] Furthermore, in the GraphSage model training phase (A4), the constructed heterogeneous information graph structure can be utilized to train the model (including unsupervised pre-training and supervised fine-tuning) by aggregating neighbor node features and combining edge weights. This yields a target model that integrates structural and attribute information. The model training and fine-tuning phases can precede all other phases. Finally, in the IP same-origin prediction phase (A5), the heterogeneous information graph corresponding to the Internet Protocol address to be analyzed can be input into the trained target model. Target features are updated through multi-layer feature aggregation, and the same-origin analysis results for the Internet Protocol address are output, enabling accurate identification of the attack group or organization to which it belongs. In this way, by placing the Internet Protocol address in an explicitly constructed association graph for feature learning, network topology and multi-dimensional attributes are fully utilized, significantly improving the accuracy and interpretability of the same-origin analysis.

[0241] Please see Figure 4 This application also provides a device for same-origin analysis of Internet Protocol (IP) addresses, which can implement the above-mentioned method for same-origin analysis of IP addresses. The device for same-origin analysis of IP addresses includes:

[0242] The acquisition module 41 is used to acquire the Internet Protocol address to be analyzed and the original features corresponding to the Internet Protocol address to be analyzed;

[0243] Module 42 is established to obtain multiple reference Internet Protocol addresses and reference features corresponding to each reference Internet Protocol address. Based on the correlation sub-features between the original features and each reference feature, a heterogeneous information graph structure is established between the Internet Protocol address to be analyzed and multiple reference Internet Protocol addresses.

[0244] The heterogeneous information graph structure includes the target node corresponding to the Internet Protocol address to be analyzed, the reference node corresponding to each reference Internet Protocol address, and the connection edges between the target node and the reference node, with each connection edge associated with a correlation weight.

[0245] Input module 43 is used to input the heterogeneous information graph structure into the pre-trained target model. Through the target model, the original features of the target node are updated according to the reference features associated with each reference node, the associated sub-features between the reference features and the original features associated with the target node, and the association weights of the connection edges between each reference node and the target node, so as to obtain the target features.

[0246] Output module 44 is used to output the same-source analysis results corresponding to the Internet Protocol address to be analyzed based on the target features through the target model.

[0247] The specific implementation of the Internet Protocol address same-source analysis device is basically the same as the specific embodiment of the Internet Protocol address same-source analysis method described above, and will not be repeated here. Provided that the requirements of the embodiments of this application exist, the Internet Protocol address same-source analysis device may also be equipped with other functional modules to implement the Internet Protocol address same-source analysis method in the above embodiments.

[0248] This application also provides a computer device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the aforementioned Internet Protocol address same-origin analysis method. This computer device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0249] Please see Figure 5 , Figure 5 The hardware structure of a computer device according to another embodiment is illustrated. The computer device includes:

[0250] The processor 51 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application.

[0251] The memory 52 can be implemented as a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 52 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 52 and is called and executed by the processor 51 to execute the Internet Protocol address homology analysis method of the embodiments of this application.

[0252] Input / output interface 53 is used to implement information input and output;

[0253] The communication interface 54 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0254] Bus 55 transmits information between various components of the device (e.g., processor 51, memory 52, input / output interface 53, and communication interface 54);

[0255] The processor 51, memory 52, input / output interface 53, and communication interface 54 are connected to each other within the device via bus 55.

[0256] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described Internet Protocol address same-origin analysis method.

[0257] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0258] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0259] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0260] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0261] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0262] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0263] It should be understood that in this application, "at least one" and "several" refer to one or more, and "multiple" refers to two or more. "And / or" describes a predefined association type of the related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0264] In the embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0265] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0266] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0267] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0268] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A method for same-origin analysis of Internet Protocol (IP) addresses, characterized in that, The method includes: Obtain the Internet Protocol address to be analyzed and the original features corresponding to the Internet Protocol address to be analyzed; Obtain multiple reference Internet Protocol (IP) addresses and reference features corresponding to each reference IP address. Based on the correlation sub-features between the original features and each reference feature, establish a heterogeneous information graph structure between the IP address to be analyzed and the multiple reference IP addresses. The heterogeneous information graph structure includes the target node corresponding to the Internet Protocol address to be analyzed, the reference node corresponding to each reference Internet Protocol address, and the connection edge between the target node and the reference node, with each connection edge associated with a correlation weight. The heterogeneous information graph structure is input into a pre-trained target model. The target model fuses the reference features associated with each reference node and the edge features associated with the corresponding connecting edges to obtain fused reference features. The edge features between the target node and each reference node are obtained by concatenating the corresponding associated sub-features with the associated weights. The sum of multiple fused reference features of multiple reference nodes is used to obtain a total reference feature. The number of reference nodes is obtained, and a global reference feature is obtained based on the ratio between the total reference feature and the number of reference nodes. The original features of the target node are updated based on the global reference features to obtain intermediate features. The intermediate reference features obtained after updating the reference features of each reference node are obtained, and fused with the associated edge features to obtain intermediate fused reference features. The intermediate features of the target node are updated based on the intermediate fused reference features of each reference node to obtain intermediate features. This process continues until the number of updates to the intermediate features reaches a preset number, and the intermediate features obtained in the last update are used as the target features of the target node. Based on the target features, the target model outputs the same-source analysis results corresponding to the Internet Protocol address to be analyzed.

2. The method for same-origin analysis of Internet Protocol addresses according to claim 1, characterized in that, The process of obtaining the Internet Protocol address to be analyzed and the original features corresponding to the Internet Protocol address to be analyzed includes: The Internet Protocol address to be analyzed is obtained, and based on multiple preset security analysis dimensions, the dimension sub-features corresponding to the Internet Protocol address to be analyzed in each preset security analysis dimension are determined. The multiple preset security analysis dimensions include network attribute analysis dimension, transport layer analysis dimension, application layer analysis dimension, behavior analysis dimension, threat intelligence analysis dimension, and time analysis dimension. Based on the multiple sub-features corresponding to the multiple preset security analysis dimensions, the original features corresponding to the Internet Protocol address to be analyzed are constructed.

3. The method for same-origin analysis of Internet Protocol addresses according to claim 1, characterized in that, The step of establishing a heterogeneous information graph structure corresponding to the Internet Protocol address to be analyzed and the multiple reference Internet Protocol addresses based on the correlation sub-features between the original feature and each reference feature includes: Multiple preset association types are obtained. When the target reference feature between the Internet Protocol address to be analyzed and the target reference Internet Protocol address satisfies any preset association type, the associated sub-feature between the original feature and the target reference feature is determined based on the preset association type. When any two reference Internet Protocol addresses satisfy any preset association type, a reference association sub-feature between the reference features of the two reference Internet Protocol addresses is determined based on the preset association type. Based on the associated sub-features and the reference associated sub-features, a heterogeneous information graph structure is established corresponding to the Internet Protocol address to be analyzed and the multiple reference Internet Protocol addresses.

4. The method for same-origin analysis of Internet Protocol addresses according to claim 1, characterized in that, The target model is trained in the following way: Obtain the sample Internet Protocol address and the original sample features corresponding to the sample Internet Protocol address; Obtain multiple sample reference Internet Protocol addresses and sample reference features corresponding to each sample reference Internet Protocol address. Based on the sample association sub-features between the original sample features and each sample reference feature, establish a sample heterogeneous information graph structure between the sample Internet Protocol address and the multiple sample reference Internet Protocol addresses. The heterogeneous information graph structure includes sample nodes corresponding to the sample Internet Protocol addresses, sample reference nodes corresponding to each sample reference Internet Protocol address, and sample connection edges between the sample nodes and the sample reference nodes, with each sample connection edge associated with a sample association weight. The sample heterogeneous information graph structure is input into a preset model. Through the preset model, the original features of the sample nodes are updated according to the sample reference features associated with each sample reference node, the sample association sub-features between the sample reference features and the original sample features associated with the sample nodes, and the sample association weights associated with the sample connection edges between each sample reference node and the sample nodes, so as to obtain the sample target features. Based on the target features of the sample, the preset model is used to output the predicted source analysis results corresponding to the Internet Protocol address of the sample. Obtain the reference same-source analysis results corresponding to the sample Internet Protocol addresses, and determine the target loss based on the difference between the reference same-source analysis results and the predicted same-source analysis results. Based on the target loss, adjust the parameters of the preset model to obtain the target model.

5. The method for same-origin analysis of Internet Protocol addresses according to claim 4, characterized in that, The method further includes: From the sample heterogeneous information graph structure, sample reference Internet Protocol address pairs that have at least one sample association sub-feature are identified as positive sample pairs, and sample reference Internet Protocol address pairs that do not have the sample association sub-feature are identified as negative sample pairs, wherein each positive sample pair contains a first positive sample and a second positive sample, and each negative sample pair contains a first negative sample and a second negative sample. Obtain the first prediction result output by the preset initial model for the first positive sample of each positive sample pair, the second prediction result output by the second positive sample of each positive sample pair, the third prediction result output by the first negative sample of each negative sample pair, and the fourth prediction result output by the second negative sample of each negative sample pair. An unsupervised loss is constructed based on the difference between the first and second prediction results for each positive sample pair, and based on the difference between the third and fourth prediction results for each negative sample pair. Based on the unsupervised loss, the parameters of the initial model are adjusted to obtain the preset model.

6. A device for analyzing the same-origin of Internet Protocol (IP) addresses, characterized in that, The device includes: The acquisition module is used to acquire the Internet Protocol address to be analyzed and the original features corresponding to the Internet Protocol address to be analyzed; A module is established to obtain multiple reference Internet Protocol addresses and reference features corresponding to each reference Internet Protocol address. Based on the correlation sub-features between the original features and each reference feature, a heterogeneous information graph structure is established between the Internet Protocol address to be analyzed and the multiple reference Internet Protocol addresses. The heterogeneous information graph structure includes the target node corresponding to the Internet Protocol address to be analyzed, the reference node corresponding to each reference Internet Protocol address, and the connection edge between the target node and the reference node, with each connection edge associated with a correlation weight. An input module is used to input the heterogeneous information graph structure into a pre-trained target model. Through the target model, reference features associated with each reference node and edge features associated with the corresponding connecting edges of the reference node are fused to obtain fused reference features. The edge features between the target node and each reference node are obtained by concatenating the corresponding associated sub-features with the associated weights. A total reference feature is obtained by summing the multiple fused reference features of multiple reference nodes. The number of reference nodes is obtained, and a global reference feature is obtained based on the ratio between the total reference feature and the number of reference nodes. The original features of the target node are updated based on the global reference features to obtain intermediate features. The intermediate reference features obtained after updating the reference features of each reference node are obtained, and fused with the associated edge features to obtain intermediate fused reference features. The intermediate features of the target node are updated based on the intermediate fused reference features of each reference node to obtain intermediate features, until the number of times the intermediate features are updated reaches a preset number. The intermediate features obtained in the last update are used as the target features of the target node. The output module is used to output the same-source analysis results corresponding to the Internet Protocol address to be analyzed based on the target features using the target model.

7. A computer device, characterized in that, The computer device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the same-origin analysis method for Internet Protocol addresses as described in any one of claims 1 to 5.

8. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the same-origin analysis method for Internet Protocol addresses as described in any one of claims 1 to 5.

Images