Host security trend prediction method based on dynamic space-time diagram neural network

Abstract

The invention relates to a host security trend prediction method based on a dynamic space-time diagram neural network, and belongs to the technical field of computer network space security. Compared with the prior art, the method has the advantages that prediction precision and perspectiveness are remarkably improved, relation changes can be predicted through simultaneous and deep coupling of spatio-temporal information, the capture capacity of the model on a complex attack mode is higher, and prediction is more accurate and advanced. The robustness to a dynamic network environment is high, a dynamic graph learning mechanism enables the model to be adaptive to the change of a network topology and host relationship, and the problem of performance degradation of a static model is avoided. The method has good interpretability, provides a prediction basis through an attention mechanism, enhances the credibility of a result, and is convenient for safety personnel to understand and take actions. And end-to-end automation: from the original multi-source log to the final prediction result, automatic processing is realized, the dependence on manual feature engineering is reduced, and the efficiency is improved.

Description

Technical Field

[0001] This invention belongs to the field of computer network space security technology, specifically relating to a host security trend prediction method based on dynamic spatiotemporal graph neural network. Background Technology

[0002] With the increasing complexity of network attacks and the prevalence of advanced persistent threats (APTs), isolated security analysis of a single host is no longer effective in dealing with coordinated attacks across hosts. Comprehensive and trend-based prediction of host security posture has become crucial for building an active defense system. However, existing host security prediction methods face the following major technical bottlenecks: (1) Lack of spatiotemporal correlation modeling: Traditional time series prediction methods (such as ARIMA and LSTM) learn time patterns only from the historical data of a single host, completely ignoring the spatial correlations formed between hosts through network connections, service dependencies, and other relationships. Lateral movement of attacks utilizes these correlations, making methods based on isolated hosts unable to accurately predict the spread of risks. (2) Poor network dynamic adaptability: Existing graph neural network-based methods mostly assume that the network topology is static. However, in real networks, host online / offline status changes, virtual machine migrations, and network policy adjustments cause the correlations between hosts to change dynamically over time. Static graph models cannot adapt to this dynamic evolution, and their prediction performance significantly decreases after topology changes. (3) Difficulty in fusing multi-source heterogeneous data: Security data such as virus logs, audit events, and vulnerability information differ in format, dimension, and time granularity. Traditional methods struggle to effectively fuse these multi-source heterogeneous data into a unified model for joint analysis, resulting in insufficient information utilization. (4) Insufficient predictive interpretability: Most deep learning models are "black boxes," making it difficult to explain their predictive basis. Security operators cannot trust a predictive result that cannot explain "why the risk of a certain host will increase next month," thus hindering its practical application. Therefore, current technology lacks a predictive scheme that can simultaneously and effectively model the dynamic spatiotemporal dependencies in host security posture and possesses good interpretability. Summary of the Invention

[0003] (a) Technical problems to be solved The technical problem to be solved by this invention is: to address the problems of existing methods being unable to capture the spatiotemporal evolution of host security status, having poor adaptability to network dynamic changes, and having limited prediction accuracy, and to propose a host security trend prediction method.

[0004] (II) Technical Solution To address the aforementioned technical problems, this invention provides a host security trend prediction method based on dynamic spatiotemporal graph neural networks. Through a unified framework capable of adaptively learning dynamic spatial dependencies and temporal evolution patterns among hosts, it achieves high-precision and forward-looking predictions of host security scores and provides interpretable evidence for the prediction results, thereby offering decision support for proactive security defense. This invention integrates cutting-edge artificial intelligence technologies such as graph neural networks, time series analysis, and dynamic graph representation learning, and is a core technology for realizing the transformation of network security from "passive response" to "proactive early warning."

[0005] (III) Beneficial Effects Compared with existing technologies, the method of this invention has the following advantages: Significantly improved prediction accuracy and foresight; by simultaneously and deeply coupling spatiotemporal information and predicting relationship changes, the model has a stronger ability to capture complex attack patterns, resulting in more accurate and earlier predictions. Strong robustness to dynamic network environments; the dynamic graph learning mechanism enables the model to adapt to changes in network topology and host relationships, avoiding the performance degradation problem of static models. Good interpretability; the attention mechanism provides prediction basis, enhancing the credibility of the results and facilitating understanding and action by security personnel. End-to-end automation: from raw multi-source logs to the final prediction results, automated processing is achieved, reducing reliance on manual feature engineering and improving efficiency. Attached Figure Description

[0006] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0007] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0008] To address the core issues in existing methods for host security trend prediction, such as lack of spatiotemporal correlation modeling, poor network dynamic adaptability, difficulty in multi-source data fusion, and insufficient interpretability, this invention proposes a host security trend prediction method and system based on dynamic spatiotemporal graph neural networks. This method is particularly suitable for scenarios involving a large number of hosts and dynamically changing network topologies, such as enterprise networks, cloud platforms, and data centers. The purpose of this invention is to achieve high-precision and forward-looking prediction of host security scores through a unified framework capable of adaptively learning dynamic spatial dependencies and temporal evolution patterns among hosts, and to provide interpretable evidence for the prediction results, thereby providing decision support for proactive security defense. This invention integrates cutting-edge artificial intelligence technologies such as graph neural networks, time series analysis, and dynamic graph representation learning, and is a core technology for realizing the transformation of network security from "passive response" to "proactive early warning."

[0009] refer to Figure 1The present invention provides a host security trend prediction method based on a dynamic spatiotemporal graph neural network, which specifically includes the following steps: Step 1: Multi-source security data fusion and dynamic spatiotemporal graph construction: (4) Node Feature Engineering: Diverse security features of each host at specific time slices (e.g., hourly / daily) are extracted from multi-source data sources such as virus detection systems, Host Intrusion Detection Systems (HIDS), vulnerability scanners, and system audit logs. These diverse security features include: basic features (abnormal CPU / memory usage, number of abnormal network connections), threat features (number and level of detected malicious files, number of intrusion attempts), vulnerability features (number of unpatched high-risk vulnerabilities), and behavioral features (number of abnormal logins, frequency of privileged command execution). Subsequently, the diverse security features are standardized and missing value processing is performed to form the feature vector of each host node at time step t. (N is the number of hosts, F is the feature dimension).

[0010] (5) Definition and Construction of Dynamic Edge Relationships: The edge relationships of the graph are key to modeling spatial dependencies in this invention. Two types of edges are defined: static edges and dynamic edges; where static edges are constructed based on stable network topology relationships, such as the subnet to which an IP address belongs and fixed service call relationships, and their adjacency matrix is ​​denoted as... The dynamic edge is constructed based on host behavior similarity, which is the innovation of this step. By calculating the cosine similarity or dynamic time warping (DTW) distance of security event sequences of different hosts within a time window, a dynamic adjacency matrix that changes with time step t is generated. This dynamic adjacency matrix can capture implicit associations between hosts that are "not directly connected but are affected by the same attack activities".

[0011] (6) Spatiotemporal graph sequence generation: Generate the graph structure of T consecutive time steps These are combined into a spatiotemporal graph sequence, which serves as the input to a dynamic spatiotemporal graph neural network model.

[0012] Step 2: Design of the dynamic spatiotemporal graph neural network model: (1) Spatial Dependency Capture Module (Spatial Graph Convolution): This spatial dependency capture module is used to learn how hosts influence each other within a single time slice, employing a graph attention network (GAT); for node i, its updated features are calculated as follows: ;in The attention weights between nodes i and j are calculated using the attention mechanism: σ is a non-linear activation function, ReLU activation function, N(i) is the set of neighboring nodes of node i, W is a learnable linear transformation matrix, and feature transformation is performed on all nodes. jis the original feature vector of node j; a is the learnable parameter vector of the attention mechanism; This spatial dependency capture module can effectively identify which neighboring hosts have a significant impact on the security status of the current host.

[0013] (2) Temporal Evolution Learning Module (Temporal Convolution): This temporal evolution learning module is used to learn the changes in the security state of a single host over time. It adopts a temporal convolutional network (TCN), and its dilated causal convolution operation is represented as: Where d is the dilation factor and K is the kernel size. The input features are the batch size, feature dimension, and time step; TCN can efficiently capture long-term time dependencies and has a higher parallelism than RNN.

[0014] (3) Dynamic Graph Structure Learning Module (Core Innovation): This module is the key difference from static GNNs. It involves designing a graph generator based on node embeddings to dynamically infer the graph structure for the next time step. ,in It is the node embedding matrix at time step t. These are learnable parameters, which enables dynamic spatiotemporal graph neural network models to predict the propagation paths of security threats.

[0015] (4) Spatiotemporal state synchronization update: The fusion of spatial and temporal features is achieved through a gating mechanism: , where the gate vector . It is a gated vector, where each element is between 0 and 1, and its shape and... and Same, among which These are the output features of the spatial dependency capture module. These are features output by the time evolution learning module. It is a bias term.

[0016] Step 3: Model Optimization and Training Based on Composite Loss Function: To guide the dynamic spatiotemporal graph neural network model to simultaneously learn accurate numerical predictions and correct trend judgments, a composite loss function is designed: ,in To ensure that the predicted value is close to the actual value, Encourage trend consistency, Sparsity constraints are imposed on the dynamic adjacency matrix; the dynamic spatiotemporal graph neural network model is trained end-to-end using the backpropagation algorithm and the Adam optimizer. N It is the number of hosts. It is the number of prediction time steps. Is the i-th host in the i-th position? k The true security score at each time step It is the predicted security score of the i-th host at the k-th time step. It is the change in the true safety score over time step K. It is the amount of change in the predicted safety score over time step K.

[0017] Step 4: Security Trend Prediction and Interpretability Analysis: (1) Multi-step prediction: The prediction of the next K' time steps using a trained dynamic spatiotemporal graph neural network model can be expressed as: ,in Multi-step prediction is used to learn how hosts influence each other within a single time slice, including the security score predictions for all hosts over the next K' time steps. Multi-step prediction is implemented using a Graph Attention Network (GAT). It is a trained dynamic spatiotemporal graph neural network model with parameter θ; (2) Dynamic threshold alarm: The dynamic threshold is calculated based on the prediction results and historical distribution as follows: ,in and These are the mean and standard deviation of the host's historical security score, respectively. This is an adjustable parameter. If... Greater than If the condition is met, an alarm will be issued; otherwise, host i is considered safe. (3) Interpretability analysis: using attention weights Generate interpretable reports and identify key influencing factors. This is the key difference between GNNs and static GNNs.

[0018] This embodiment uses a medium-to-large enterprise network with approximately 500 hosts as an application scenario to deploy the system described in this invention to predict the host security score trend for the next 30 days (one month).

[0019] Deployed in an enterprise data center, the system uses a server equipped with two Intel Xeon Gold 6248R processors (24 cores / 48 threads), 256GB of RAM, and an NVIDIA A100 40GB GPU. The operating system is Ubuntu 20.04 LTS, the deep learning framework is PyTorch 1.12.1 + CUDA 11.6, the database is MySQL 8.0 for storing historical security logs, and Redis is used to cache real-time data. It integrates logs from the enterprise's existing security products, including: an endpoint protection platform providing virus and malware detection logs; a host intrusion detection system providing audit logs for abnormal processes and file modifications; and a vulnerability scanner generating vulnerability data from weekly full scans.

[0020] Step 1: Data Preprocessing and Feature Engineering (1) Data collection and cleaning: Collect historical data for the past 180 days (6 months) at a daily time granularity through the APIs or log proxies of various security products. Handle missing values ​​(using forward filling method), remove obviously erroneous outliers (such as negative connection counts), and unify the timestamp to UTC time.

[0021] (2) Host node feature extraction: A 53-dimensional feature vector is constructed for each host per day. The specific dimensions are shown in the table below: Table 1 Dimension Allocation

[0022] Finally, the feature matrix is ​​formed. (t represents the number of days).

[0023] (3) Graph structure construction: static adjacency matrix Generated based on network management information. If two hosts are on the same IP subnet (e.g., 10.10.1.0 / 24) or have a fixed service dependency (provided by the CMDB database), then an edge exists between them with a weight of 1. Dynamic adjacency matrix. Behavioral similarity is calculated based on network flow logs from the past 7 days. Cosine similarity is used to calculate the similarity between each pair of hosts in terms of features such as traffic volume and destination port distribution. An edge is created if the similarity exceeds a threshold of 0.7, and the weight is the similarity value. Daily graph structure. Depend on , , Common definition. The graph structure over T consecutive time steps. These are combined into a spatiotemporal graph sequence, which serves as the input to the model.

[0024] Step 2: Model Building and Training (1) Model parameter configuration: In this embodiment, the core module parameters of the dynamic spatiotemporal graph neural network are set as follows: 1) Spatial graph convolutional layer: 2 layers of GAT are used, the output dimension of each layer is 64, and the number of attention heads is 4. 2) Temporal convolutional layer: TCN is used, the kernel size K=3, the dilation factor d increases exponentially with the number of layers (1,2,4), and the hidden layer dimension is 64. 3) Dynamic graph learner: a single-layer linear transformation is used. 4) Fusion module: using GRU units, with a hidden state dimension of 128. 5) Prediction layer: a two-layer MLP that maps the 128-dimensional fused features to a 1-dimensional future security score.

[0025] (2) Model Training: 1) Training / Validation Set Partition: The data from the first 150 days is used as the training set, and the data from the last 30 days is used as the validation set. 2) Input Sequence Length: T=30, that is, a continuous 30-day graph sequence is used to predict the next day. A large number of training samples are generated through a sliding window. 3) Loss Function Weights: (Trend loss) (Regularization loss). 4) Optimizer: The Adam optimizer is used, with an initial learning rate of 0.001, which decays to 0.8 every 50 epochs. 4) Training process: The batch size is 16, and the training lasts for 200 epochs. Early stopping is performed on the validation set for 15 epochs.

[0026] Step 3: Forecasting and Deployment (1) Online prediction: The system runs automatically every morning at midnight, taking the graph sequence data of the most recent 30 days (T=30) and inputting it into the trained model. The model performs multi-step prediction in an autoregressive manner: after predicting the score on day 31, the predicted value is used as known data (concatenated with the true value, but only the predicted value is used), and the prediction continues to day 32 until day 60 (i.e., the next 30 days). The final output is a prediction matrix. .

[0027] (2) Dynamic threshold alarm: Calculate the dynamic threshold for the security score of each host i over the past 90 days: If the predicted score for a future day exceeds this threshold, an early warning record is generated, and the extent to which the score exceeds the threshold is calculated as the risk level.

[0028] (3) Interpretability Analysis: The system provides a web interface. When a user clicks on a host predicted to be high-risk, the interface displays its risk trend curve and lists the top 5 associated hosts that contributed the most to its risk prediction (based on GAT attention weights). (Sorting). For example, the system displays: "Host WEB-SRV-01 is expected to see a significant increase in risk in 15 days. The main influencing factors are: database server DB-02 (influence: 35%), WEB-SRV-03 in the same application cluster (influence: 28%)...". This helps security analysts quickly locate potential attack paths.

[0029] As can be seen, this invention achieves optimization through the following technical solutions: First, it integrates multi-source security product logs (such as virus, audit, and vulnerability data) to construct a spatiotemporal graph structure with hosts as nodes and network topology and dynamic behavior associations as edges; second, it designs a dynamic spatiotemporal graph neural network model, which captures spatial dependencies between hosts through a spatial graph convolution module, learns the temporal evolution pattern of a host's own security score through a temporal convolution module, and introduces a dynamic graph attention mechanism to adaptively learn the temporal changes in the graph structure; further, it designs a composite loss function combining mean squared error and trend consistency for model optimization, achieving accurate prediction of host security scores at future time points (such as the following month). Experiments show that in an enterprise network simulation environment, this method improves the monthly security score prediction accuracy (MAPE) for 500 hosts by more than 35.2% compared to the traditional ARIMA model, and maintains an F1-score of over 92% in dynamic network change scenarios. This invention is applicable to large-scale dynamic network environments such as enterprise intranets and cloud data centers, significantly improving the foresight and accuracy of security posture prediction and providing support for proactive defense decisions.

[0030] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A host security trend prediction method based on dynamic spatiotemporal graph neural network, characterized in that, Includes the following steps: Step 1: Multi-source security data fusion and dynamic spatiotemporal graph construction: (1) Node feature engineering: Extract the diverse security features of each host in a specific time slice from multi-source data; These diverse security features include: basic features, threat features, vulnerability features, and behavioral features; subsequently, these diverse security features are standardized and missing values ​​are processed to form a feature vector for each host node at time step t. N is the number of hosts, and F is the feature dimension; (2) Definition and Construction of Dynamic Edge Relationships: Two types of edges are defined: static edges and dynamic edges; among which static edges are constructed based on network topology relationships, and their adjacency matrix is ​​denoted as... Dynamic edges are constructed based on host behavior similarity. By calculating the cosine similarity or dynamic time warping (DTW) distance of security event sequences of different hosts within a time window, a dynamic adjacency matrix that changes with time step t is generated. ; (3) Spatiotemporal graph sequence generation: The graph structure of T consecutive time steps These are combined into a spatiotemporal graph sequence, which serves as the input to a dynamic spatiotemporal graph neural network model. Step 2: Design of the dynamic spatiotemporal graph neural network model: Spatial Dependency Capture Module: This module learns how hosts influence each other within a single time slice, employing a Graph Attention Network (GAT) design. For node i, its updated features are calculated as follows: ;in The attention weights between nodes i and j are calculated using the attention mechanism: σ is a non-linear activation function, ReLU activation function, N(i) is the set of neighboring nodes of node i, W is a learnable linear transformation matrix, and feature transformation is performed on all nodes. j is the original feature vector of node j; a is the learnable parameter vector of the attention mechanism; Temporal Evolution Learning Module: This module learns the changes in the security state of a single host over time. It employs a temporal convolutional network, and its dilated causal convolution operation is represented as follows: Where d is the dilation factor and K is the kernel size. The input features are the batch size, feature dimension, and time step. Dynamic Graph Structure Learning Module: This module designs a graph generator based on node embedding to dynamically infer the graph structure at the next time step. ,in It is the node embedding matrix at time step t. These are learnable parameters, which enables dynamic spatiotemporal graph neural network models to predict the propagation paths of security threats; Spatiotemporal state synchronization update: The fusion of spatial and temporal features is achieved through a gating mechanism. , where the gate vector , It is a gated vector, where each element is between 0 and 1, and its shape and... and Same, among which These are the output features of the spatial dependency capture module. These are features output by the time evolution learning module. It is a bias term; Step 3: Model Optimization and Training Based on Composite Loss Function: To guide the dynamic spatiotemporal graph neural network model to simultaneously learn accurate numerical predictions and correct trend judgments, a composite loss function is designed: ,in To ensure that the predicted value is close to the actual value, Encourage trend consistency, Sparsity constraints are imposed on the dynamic adjacency matrix; the dynamic spatiotemporal graph neural network model is trained end-to-end using the backpropagation algorithm and the Adam optimizer. It is the predicted time step. Is the i-th host in the i-th position? k The true security score at each time step It is the predicted security score of the i-th host at the k-th time step. It is the change in the true safety score over time step K. It is the amount of change in the safety score over time step K; Step 4: Security Trend Prediction and Interpretability Analysis: Multi-step prediction: The prediction of the next K' time steps using a trained dynamic spatiotemporal graph neural network model can be expressed as: ,in Multi-step prediction is used to learn how hosts influence each other within a single time slice, including the security score predictions for all hosts over the next K' time steps; multi-step prediction is implemented using a graph attention network (GAT). It is a trained dynamic spatiotemporal graph neural network model; Dynamic threshold alarm: The dynamic threshold is calculated based on the prediction results and historical distribution. ,in and These are the mean and standard deviation of the host's historical security score, respectively. This is an adjustable parameter; if Greater than If the condition is met, an alarm will be issued; otherwise, host i is considered safe. Interpretability analysis: Utilizing attention weights Generate interpretable reports to identify key influencing factors.

2. The method as described in claim 1, characterized in that, We extract diverse security characteristics of each host in a specific time slice from multi-source data, including virus detection systems, host intrusion detection systems, vulnerability scanners, and system audit logs.

3. The method as described in claim 1, characterized in that, Basic characteristics include abnormal CPU / memory usage and abnormal network connection count.

4. The method as described in claim 1, characterized in that, Threat characteristics include the number and severity of detected malicious files and the number of intrusion attempts.

5. The method as described in claim 1, characterized in that, Vulnerability characteristics include the number of high-risk vulnerabilities that have not been patched.

6. The method as described in claim 1, characterized in that, Behavioral characteristics include the number of abnormal login attempts and the frequency of privileged command execution.

7. The method as described in claim 1, characterized in that, This spatial dependency capture module can identify which neighboring hosts affect the security status of the current host.

8. A system for implementing the method as described in any one of claims 1 to 7.

9. The method as described in any one of claims 1 to 7 is applied in the field of computer network space security technology.

10. The system as described in claim 8 is applied in the field of computer network space security technology.

Images