Malicious subgraph detection method based on graph embedding and time sequence self-coding under multi-modal network
By using graph embedding and temporal autoencoder detection methods in multimodal networks, the problem of accurately identifying malicious subgraphs in existing technologies is solved, enabling efficient and accurate detection and tracing of network attacks.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- NANJING UNIV OF POSTS & TELECOMM
- Filing Date
- 2025-12-18
- Publication Date
- 2026-04-21
AI Technical Summary
Existing technologies struggle to effectively model the dynamic evolution of network attacks, cannot accurately identify malicious subgraphs, and suffer from low detection accuracy and inefficiency, especially lacking end-to-end joint optimization mechanisms in multimodal networks.
A malicious subgraph detection method based on graph embedding and temporal autoencoder under multimodal networks is adopted. By collecting logs under multiple network modalities, a multimodal source graph is constructed, a dynamic sliding window mechanism is used to extract subgraph sequences, and anomaly detection is performed using an improved Node2Vec graph embedding algorithm and an LSTM autoencoder model.
It enables global correlation analysis of attack behaviors, accurately models threat behaviors, improves the detection accuracy and robustness of complex network attacks, and is suitable for multi-stage and highly covert network attack tracing scenarios.
Smart Images
Figure CN121907508A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the fields of cyberspace security and deep learning technology, specifically relating to a malicious subgraph detection method based on graph embedding and temporal autoencoder in multimodal networks. Background Technology
[0002] With the continuous evolution of internet infrastructure and the increasing richness of network application scenarios, the structure of the network environment has become highly complex and dynamic. Traditional threat detection methods based on static structure or single traffic characteristics are no longer suitable for the intelligent, covert, and persistent characteristics of current network attacks.
[0003] Currently, detection technologies for complex network attack behaviors mainly fall into three categories: (1) detection methods based on static rules or signature matching. These methods rely on expert knowledge and known attack characteristics and cannot cope with zero-day attacks or unknown variant attacks; (2) anomaly detection methods based on statistical learning or traditional machine learning. Although they have a certain generalization ability, they usually require a large amount of labeled data and have limited ability to model attack paths in terms of temporal and structural order; (3) methods based on deep learning and graph analysis technology that have emerged in recent years attempt to model attack propagation paths from a global perspective and identify potential malicious behaviors by mining the structural relationships between nodes.
[0004] Multimodal networks refer to network architectures composed of multiple heterogeneous network modes. Each mode differs in protocol stack, address system, forwarding mechanism, traffic characteristics, and security strategies. However, through modality mapping, context association, and semantic fusion, a unified description space can be formed across modal networks, thereby supporting joint analysis and collaborative protection. Although graph neural networks, graph embeddings, and sequence modeling methods have been used in some studies to model attack chain behavior, these methods often have certain limitations. Some models only perform source tracing within a single network modality, neglecting the complementary and synergistic relationships of attack clues in multimodal networks, thus failing to fully characterize the cross-modal propagation characteristics of attack paths. Other models only model on static graphs, ignoring the graph structure changes that evolve over time, resulting in an inability to capture the dynamic evolution characteristics of attack behavior. When processing large-scale data, the subgraph partitioning strategy is coarse, leading to inaccurate modeling of attack chains. Clustering methods are computationally expensive in high-dimensional spaces, making it difficult to meet the requirements of real-time performance and scalability. Loose coupling between different models and the lack of an end-to-end joint optimization mechanism make it difficult to improve the overall accuracy and robustness of detection and source tracing. Therefore, there is an urgent need for a source tracing method oriented towards multimodal network structures with temporal modeling capabilities, capable of simultaneously modeling attack behavior from both structural and temporal dimensions, and possessing efficient data processing capabilities to improve the identification accuracy and source tracing efficiency of complex and persistent network attacks. Summary of the Invention
[0005] To address the shortcomings of existing methods, such as difficulty in effectively modeling the dynamic evolution of network attacks, inability to accurately identify malicious subgraphs, and low detection accuracy and efficiency, this application provides a malicious subgraph detection method based on graph embedding and temporal autoencoder in multimodal networks. This method can comprehensively capture structural information and temporal patterns in the data, while possessing strong robustness and automation capabilities. It does not require a large amount of labeled data and is suitable for anomaly detection tasks in real-world scenarios.
[0006] To achieve the above objectives, this application employs the following technical solution:
[0007] This application discloses a malicious subgraph detection method based on graph embedding and temporal autoencoder in multimodal networks, which specifically includes the following steps:
[0008] Step 1: Collect logs from multiple network modalities and extract multimodal source graphs from the logs.
[0009] Step 2: Based on the timestamp information of the nodes in the multimodal source tracing graph, a dynamic sliding window mechanism is adopted on the time axis to identify the features of information mutation and density change, adaptively adjust the size of the time window, gradually slide to extract multiple time segments, and extract the corresponding subgraphs in the multimodal source tracing graph. Multiple subgraphs are used to construct a subgraph sequence.
[0010] Step 3: Use the improved Node2Vec graph embedding algorithm to encode the nodes in each subgraph into vector representations, preserving the structural information between nodes in the subgraph, and forming a subgraph vector sequence;
[0011] Step 4: Input the subgraph vector sequence formed in the previous step into the LSTM autoencoder model for training, learn the normal behavior pattern, and use the reconstruction error to detect abnormal subgraphs and identify potential attack stages.
[0012] A further improvement of this application is that: in step 1, extracting a multimodal source graph from logs under multiple network modalities specifically includes the following steps:
[0013] Step 1.1: Collect logs from multiple network modes, parse each log entry, extract the system entities and the system interaction relationships between user activities, system events, and network behaviors, and extract the network mode information to which the network data belongs.
[0014] Step 1.2: The extracted network modal information is retained as its modal feature. A multimodal source graph G = (V, E) is constructed, with system entities as nodes and system interaction relationships as edges. The node set V = {p1, p2, p3… p} i}, p iRepresents a system entity, including a unique identifier (uuid), entity type, and its modality (m). i The edge set E = {e(t1), e(t2), ..., e(t)} i )}, p k p represents the source node. n Let t represent the target node and t represent the time when the event occurred. Representing the attribute characteristics of the edge, Indicates the data modality or cross-modality type of the interaction.
[0015] A further improvement in this application is that step 2 specifically includes the following steps:
[0016] Step 2.1: Sort the edge set E in ascending order according to the timestamp t to form an ordered edge sequence E. ′ :
[0017] E ′ ={e1(t1),e2(t2),…,e m (t m )},
[0018] Where t1≤t2≤…t m ,
[0019] Simultaneously set the initial window parameters, and denote the initial window time range as:
[0020]
[0021] in, Indicates the start time of the initial window. Δt represents the time at which the initial window ends. min Minimum window duration;
[0022] Step 2.2, in each window Within, select those that satisfy Given the nodes and edges, construct the corresponding subgraph G. k =(V k E k E k Indicates in window W k Given the set of all existing edges within a given time period, compute the subgraph G. k Structural density ρ(G) k ) and the information fluctuation ψ(G) in the subgraph k ):
[0023]
[0024] Where ρ(·) is the structure density function, ψ(·) is the information change detection function, and pj This represents the probability of the j-th type of edge behavior occurring. f j ∑ represents the frequency of occurrence of a certain type of edge behavior. i f i This represents the total number of edges in the subgraph;
[0025] Scanning the time series of the multimodal source map yields the cumulative density ρ at cutoff time t. global The information entropy ψ of (t) and time t up to t global (t);
[0026] Step 2.3: If any of the following conditions are met: the window duration reaches its maximum value, the behavior pattern changes abruptly, or the graph structure becomes sparse, then the current window ends and is marked as a complete subgraph G. k ;
[0027] Step 2.4: Perform a window sliding operation. The starting time of the sliding window is moved forward by a sliding step size δt to generate the next time window.
[0028]
[0029] Step 2.5: Repeat steps 2.1-2.4 until the time span exceeds the maximum timestamp t of the entire graph. m This ultimately results in a sequence of subgraphs consisting of multiple subgraphs: Each subgraph G k This refers to a segment of time in the attack chain or the evolution of behavior.
[0030] A further improvement in this application is that, in step 2.3,
[0031] The maximum window duration is:
[0032] Behavioral pattern mutation:
[0033] The graph structure becomes sparse as follows:
[0034] Where, Δt max Maximum window duration: τ ψ For the set threshold, This refers to the deadline. The full graph information entropy, D JS For Jensen-Shannon divergence, The average connection density is defined from time zero to the end of the current window, and α is the decay coefficient.
[0035] A further improvement in this application is that, in step 2.4, the dynamic adjustment of the sliding step size δt is as follows:
[0036]
[0037] A further improvement in this application is that, in step 3, an improved Node2Vec graph embedding algorithm is used to encode each node as a vector representation, preserving the structural information between nodes to form a subgraph vector sequence, as detailed below:
[0038] Step 3.1: For each subgraph G k =(V k E k Each node v∈V in ) k Perform r random walks, each of length l, to obtain a set of walk paths W. k When performing a random walk, a modality bias factor β and a behavioral attribute bias factor γ are introduced. The transition probability of jumping from the current node v to a neighbor node u of node v is defined as follows:
[0039] P(c i+1 =u|c i =v)∝α pq (t,v,u)·β(m vu )·γ(x vu )
[0040] Where t is the previous hop node, α pq Let β(m) be the second-order walk bias function in Node2Vec. vu γ(x) is the weight function of the mode to which the edge belongs, used to distinguish the behavior of multimodal networks. vu ) represents the edge behavior attribute bias;
[0041] Step 3.2: Treat all traversal paths as "sentences" and use the Skip-Gram model to learn node embedding vectors: A learned function f maps each node v in the graph to a d-dimensional vector z. v The vector z v Preserve the contextual relationships of nodes within the multimodal topology;
[0042] Step 3.3, each subgraph G k All node embeddings constitute the node embedding matrix. The final subgraph vector sequence is obtained:
[0043] A further improvement in this application is as follows: In step 4, the subgraph vector sequence is input into the LSTM autoencoder model for training to learn normal behavior patterns, and abnormal subgraphs are detected using reconstruction errors to identify potential attack phases. The specific details are as follows:
[0044] Step 4.1: The LSTM autoencoder consists of an encoder and a decoder. The encoder is composed of multiple LSTM units and is used to compress the input subgraph vector sequence to low-dimensional latent variables. The decoder performs time-reverse reconstruction of the latent variables and outputs a predicted subgraph vector sequence. Let the input subgraph vector sequence be X = {g1, g2, ..., g...} N The LSTM autoencoder model outputs the reconstructed sequence as follows:
[0045] Step 4.2: For the reconstructed sequence... Calculate the reconstruction error L t If the reconstruction error L t If the threshold τ is exceeded, the corresponding time period G is determined. t If abnormal behavior is detected, the average reconstruction error is used as the loss function:
[0046]
[0047] Step 4.3: Introduce a dynamic threshold strategy, set the threshold as: τ=μ+α·σ, and determine the following:
[0048]
[0049] Where μ is the mean of normal behavior error, σ is the standard deviation of normal behavior error, and α is an adjustable coefficient.
[0050] The beneficial effects of this application are:
[0051] This application employs a multimodal source graph construction method that integrates different network modalities, and combines time window partitioning, structural embedding and temporal reconstruction models to detect abnormal attack subgraphs. It can perform global correlation analysis of attack behavior and achieve accurate modeling and anomaly detection of threat behavior.
[0052] The dynamic sliding window mechanism employed in this application is based on the timestamp information of nodes in a multimodal attribution graph. It identifies abrupt changes and density variations in information along the time axis, adaptively adjusts the size of the time window, and progressively slides to extract multiple time segments, extracting the corresponding subgraphs within the graph. This mechanism effectively characterizes the temporal evolution of attack behavior, possesses strong adaptability and versatility, and is suitable for threat detection and attribution tasks in various complex network environments.
[0053] Compared with existing static graph analysis or single temporal feature modeling methods, the malicious subgraph detection method based on graph embedding and temporal autoencoder in multimodal networks can effectively integrate structural evolution and behavioral temporal features, more sensitively identify abnormal patterns, and improve the detection accuracy and robustness of complex attack behaviors. It is especially suitable for multi-stage and highly concealed network attack tracing scenarios. Attached Figure Description
[0054] Figure 1 This is a flowchart of the method described in this application.
[0055] Figure 2 This is the architecture diagram of the malicious subgraph detection model in this application.
[0056] Figure 3 This is a schematic diagram of the three sub-graph segmentation evaluation criteria of the dynamic sliding window in the embodiments of this application. Detailed Implementation
[0057] The embodiments of the present invention will be disclosed below with reference to the drawings. For clarity, many practical details will be described in the following description. However, it should be understood that these practical details are not intended to limit the invention. That is, in some embodiments of the invention, these practical details are not essential.
[0058] This application presents a malicious subgraph detection method based on graph embedding and temporal autoencoders in multimodal networks. The method comprehensively captures structural information and temporal patterns in the data, and combines spatial and temporal dimensions to detect malicious subgraphs. It achieves accurate modeling and anomaly detection of threat behaviors, possessing both structural expressiveness and temporal analysis capabilities.
[0059] like Figure 1 As shown, the method includes the following steps:
[0060] Step 1: Collect logs from multiple network modes and extract a multimodal source graph from the logs; wherein the logs include user activities, system events, and network behaviors.
[0061] like Figure 2 As shown, extracting a multimodal source graph from logs across multiple network modalities involves the following steps:
[0062] Step 1.1: Collect logs from multiple network modes, perform simple parsing on each log entry, extract the system entities and the system interaction relationships between user activities, system events, and network behaviors, and further extract the network mode information to which the network-related data belongs, such as IPv4, IPv6, MPLS, and SCION. Network-related data refers to fields or information elements in the logs that can reveal the network architecture used for communication (such as IPv4 / IPv6 / MPLS / SCION).
[0063] Step 1.2: The extracted network modal information is retained as its modal feature. A multimodal source graph G = (V, E) is constructed, with system entities as nodes and system interaction relationships as edges. The node set V = {p1, p2, p3… p} i}, p iRepresents a system entity, including a unique identifier (UUID), entity type (e.g., process, file, etc.), and its modality (m). i The edge set E = {e(t1), e(t2), ..., e(t)} i )}, p k p represents the source node. n Let t represent the target node and t represent the time when the event occurred. Representing the attribute characteristics of the edge, Indicates the data modality or cross-modality type of the interaction.
[0064] Step 2: Based on the timestamp information of the nodes in the multimodal source tracing graph, a dynamic sliding window mechanism is adopted on the time axis to identify the characteristics of information mutation and density change, adaptively adjust the size of the time window, gradually slide to extract multiple time segments, and extract the corresponding subgraphs in the multimodal source tracing graph. Each subgraph represents a structural segment of the attack behavior within a certain time period, and multiple subgraphs are used to construct a subgraph sequence.
[0065] like Figure 2 As shown, step 2 specifically includes the following steps:
[0066] Step 2.1: Sort the edge set E in ascending order according to the timestamp t to form an ordered edge sequence E. ′ :
[0067] E ′ ={e1(t1),e2(t2),…,e m (t m )},
[0068] Where t1≤t2≤…t m ,
[0069] Simultaneously set the initial window parameters, and denote the initial window time range as:
[0070]
[0071] in, Indicates the start time of the initial window. Δt represents the time at which the initial window ends. min Minimum window duration;
[0072] Step 2.2, in each window Within, select those that satisfy Given the nodes and edges, construct the corresponding subgraph G. k =(V k E k E k Indicates in window W kGiven the set of all existing edges within a given time period, compute the subgraph G. k Structural density ρ(G) k ) and the information fluctuation ψ(G) in the subgraph k ):
[0073]
[0074] Where ρ(·) is the structure density function, ψ(·) is the information change detection function, and p j This represents the probability of the j-th type of edge behavior occurring. f j ∑ represents the frequency of occurrence of a certain type of edge behavior. i f i This represents the total number of edges in the subgraph;
[0075] Scanning the time series of the multimodal source map yields the cumulative density ρ at cutoff time t. global The information entropy ψ of (t) and time t up to t global (t);
[0076] Step 2.3: If any of the following conditions are met: the window duration reaches its maximum value, the behavior pattern changes abruptly, or the graph structure becomes sparse, then the current window ends and is marked as a complete subgraph G. k .
[0077] like Figure 3 As shown, in this step, the window duration reaches its maximum value: Behavioral pattern mutation: The graph structure becomes sparse as follows: Where, Δt max Maximum window duration: τ ψ The set threshold is used to determine whether changes in behavioral patterns are significant. This refers to the deadline. The full graph information entropy, D JS For Jensen-Shannon divergence, The average connection density is defined from time zero to the end of the current window, and α is the decay coefficient.
[0078] This embodiment effectively utilizes the timestamp information of nodes in the multimodal tracing graph, considering whether the maximum value of the time window is exceeded, whether there is a sudden change in the behavior pattern, and whether the graph structure becomes sparse. By using these three judgment conditions, the position of subgraph segmentation is accurately located, and a subgraph with a relatively complete structure is extracted.
[0079] Step 2.4: Perform a window sliding operation. The starting time of the sliding window is moved forward by a sliding step size δt to generate the next time window.
[0080]
[0081] In this step, the sliding step size δt is dynamically adjusted as follows:
[0082]
[0083] Step 2.5: Repeat steps 2.1-2.4 until the time span exceeds the maximum timestamp t of the entire graph. m The final result is a sequence of subgraphs consisting of multiple subgraphs. Each subgraph G k It represents a time segment in the attack chain or behavioral evolution process, and has a high degree of structural autonomy and temporal continuity.
[0084] This mechanism can effectively characterize the temporal evolution of attack behavior, has strong adaptability and versatility, and is suitable for threat detection and tracing tasks in a variety of complex network environments.
[0085] Step 3: Use the improved Node2Vec graph embedding algorithm to encode the nodes in each subgraph into vector representations, preserving the structural information between nodes in the subgraph, forming a subgraph vector sequence. For example... Figure 2 As shown, this step specifically includes the following steps:
[0086] Step 3.1: For each subgraph G k =(V k E k Each node v∈V in ) k Perform r random walks, each of length l, to obtain a set of walk paths W. k To adapt to the multimodal source graph structure, a modality bias factor β and a behavioral attribute bias factor γ are introduced during random walks. The transition probability of jumping from the current node v to a neighbor node u of node v is defined as follows:
[0087] P(c i+1 =u|c i =v)∝α pq (t,v,u)·β(m vu )·γ(x vu )
[0088] Where t is the previous hop node, α pq Let β(m) be the second-order walk bias function in Node2Vec. vu γ(x) is the weight function for the modality to which the edge belongs, used to distinguish the behavior of multimodal networks such as IPv4, IPv6, MPLS, and SCION. vu ) represents the edge behavior attribute bias;
[0089] Step 3.2: Treat all traversal paths as "sentences" and use the Skip-Gram model to learn node embedding vectors: A learned function f maps each node v in the graph to a d-dimensional vector z. v The vector z v Preserve the contextual relationships of nodes within the multimodal topology;
[0090] Step 3.3, each subgraph G k All node embeddings constitute the node embedding matrix. The final subgraph vector sequence is obtained:
[0091] This embodiment transforms the complex network multimodal source graph structure into a low-dimensional vector representation, fully preserving the topological relationships and semantic features between nodes. Based on this, subgraph embedding sequences from different time segments are input into a time series model. By capturing their dynamic evolution over time, accurate modeling of threat behaviors and anomaly detection are achieved.
[0092] Step 4: Input the subgraph vector sequence formed in the previous step into the LSTM autoencoder model for training, learn the normal behavior pattern, and use the reconstruction error to detect abnormal subgraphs and identify potential attack stages.
[0093] In step 4, the subgraph vector sequence is input into the LSTM autoencoder model for training to learn normal behavior patterns. Abnormal subgraphs are detected using reconstruction errors to identify potential attack phases. The specific details are as follows:
[0094] Step 4.1: The LSTM autoencoder consists of an encoder and a decoder. The encoder is composed of multiple LSTM units and is used to compress the input subgraph vector sequence to low-dimensional latent variables. The decoder performs time-reverse reconstruction of the latent variables and outputs a predicted subgraph vector sequence. Let the input subgraph vector sequence be X = {g1, g2, ..., g...} N The LSTM autoencoder model outputs the reconstructed sequence as follows:
[0095] Step 4.2: For the reconstructed sequence... Calculate the reconstruction error L t If the reconstruction error L t If the threshold τ is exceeded, the corresponding time period G is determined. t If abnormal behavior is detected, the average reconstruction error is used as the loss function:
[0096]
[0097] Step 4.3: To adapt to changes in network load and system behavior fluctuations at different times, a dynamic threshold strategy is introduced, with the threshold set as: τ = μ + α·σ, and the determination is as follows:
[0098]
[0099] Where μ is the mean of the normal behavior error, σ is the standard deviation of the normal behavior error, and α is an adjustable coefficient. This embodiment utilizes an LSTM autoencoder to capture long-short-term dependencies in the sequence during the encoding phase, reconstructs the original sequence during the decoding phase, and identifies abnormal patterns through the reconstruction error. This method not only preserves the structural information of the multimodal source graph but also fully leverages the advantages of the LSTM autoencoder in temporal pattern learning and anomaly detection, achieving accurate characterization and detection of threatening behaviors.
[0100] The above description is merely an embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the present invention should be included within the scope of the claims of the present invention.
Claims
1. A malicious subgraph detection method based on graph embedding and temporal autoencoder in a multimodal network, characterized in that: The malicious subgraph detection method specifically includes the following steps: Step 1: Collect logs from multiple network modalities and extract multimodal source graphs from the logs. Step 2: Based on the timestamp information of the nodes in the multimodal source tracing graph, a dynamic sliding window mechanism is adopted on the time axis to identify the features of information mutation and density change, adaptively adjust the size of the time window, gradually slide to extract multiple time segments, and extract the corresponding subgraphs in the multimodal source tracing graph. Multiple subgraphs are used to construct a subgraph sequence. Step 3: Use the improved Node2Vec graph embedding algorithm to encode the nodes in each subgraph into vector representations, preserving the structural information between nodes in the subgraph, and forming a subgraph vector sequence; Step 4: Input the subgraph vector sequence formed in Step 3 into the LSTM autoencoder model for training, learn the normal behavior pattern, and use the reconstruction error to detect abnormal subgraphs and identify potential attack stages.
2. The malicious subgraph detection method based on graph embedding and temporal autoencoder in multimodal networks according to claim 1, characterized in that: Step 1 involves extracting a multimodal source graph from logs across multiple network modalities, specifically including the following steps: Step 1.1: Collect logs from multiple network modes, parse each log entry, extract the system entities and the system interaction relationships between user activities, system events, and network behaviors, and extract the network mode information to which the network data belongs. Step 1.2: The extracted network modal information is retained as its modal feature. A multimodal source graph G = (V, E) is constructed, with system entities as nodes and system interaction relationships as edges. The node set V = {p1, p2, p3… p} i }, p i Represents a system entity, including a unique identifier (uuid), entity type, and its modality (m). i The edge set E = {e(t1), e(t2), ..., e(t)} i )}, p k p represents the source node. n Let t represent the target node and t represent the time when the event occurred. Representing the attribute characteristics of the edge, Indicates the data modality or cross-modality type of the interaction.
3. The malicious subgraph detection method based on graph embedding and temporal autoencoder in multimodal networks according to claim 2, characterized in that: Step 2 specifically includes the following steps: Step 2.1: Sort the edge set E in ascending order according to the timestamp t to form an ordered edge sequence E′: E′={e1(t1),e2(t2),…,e m (t m )}, Where t1≤t2≤…t m , Simultaneously set the initial window parameters, and denote the initial window time range as: in, Indicates the start time of the initial window. Δt represents the time at which the initial window ends. min Minimum window duration; Step 2.2, in each window Within, select those that satisfy Given the nodes and edges, construct the corresponding subgraph G. k =(V k E k E k Indicates in window W k Given the set of all existing edges within a given time period, compute the subgraph G. k Structural density ρ(G) k ) and the information fluctuation ψ(G) in the subgraph k ): Where ρ(·) is the structure density function, ψ(·) is the information change detection function, and p j This represents the probability of the j-th type of edge behavior occurring. f j ∑ represents the frequency of occurrence of a certain type of edge behavior. i f i This represents the total number of edges in the subgraph; Scanning the time series of the multimodal source map yields the cumulative density ρ at cutoff time t. global The information entropy ψ of (t) and time t up to t global (t); Step 2.3: If any of the following conditions are met: the window duration reaches its maximum value, the behavior pattern changes abruptly, or the graph structure becomes sparse, then the current window ends and is marked as a complete subgraph G. k ; Step 2.4: Perform a window sliding operation. The starting time of the sliding window is moved forward by a sliding step size δt to generate the next time window. Step 2.5: Repeat steps 2.1-2.4 until the time span exceeds the maximum timestamp t of the entire graph. m This ultimately results in a sequence of subgraphs consisting of multiple subgraphs: Each subgraph G k This refers to a segment of time in the attack chain or the evolution of behavior.
4. The malicious subgraph detection method based on graph embedding and temporal autoencoder in multimodal networks according to claim 3, characterized in that: In step 2.3, The maximum window duration is: Behavioral pattern mutation: The graph structure becomes sparse as follows: Where, Δt max Maximum window duration: τ ψ For the set threshold, This refers to the deadline. The full graph information entropy, D JS For Jensen-Shannon divergence, The average connection density is defined from time zero to the end of the current window, and α is the decay coefficient.
5. The malicious subgraph detection method based on graph embedding and temporal autoencoder in multimodal networks according to claim 3, characterized in that: In step 2.4, the dynamic adjustment of the sliding step size δt is as follows:
6. The malicious subgraph detection method based on graph embedding and temporal autoencoder in multimodal networks according to claim 3, characterized in that: In step 3, the improved Node2Vec graph embedding algorithm is used to encode each node as a vector representation, preserving the structural information between nodes, forming a subgraph vector sequence, as detailed below: Step 3.1: For each subgraph G k =(V k E k Each node v∈V in ) k Perform r random walks, each of length l, to obtain a set of walk paths W. k When performing a random walk, a modality bias factor β and a behavioral attribute bias factor γ are introduced. The transition probability of jumping from the current node v to a neighbor node u of node v is defined as follows: P(c i+1 =u|c i =v)∝α pq (t,v,u)·β(m vu )·γ(x vu ) Where t is the previous hop node, α pq Let β(m) be the second-order walk bias function in Node2Vec. vu γ(x) is the weight function of the mode to which the edge belongs, used to distinguish the behavior of multimodal networks. vu ) represents the edge behavior attribute bias; Step 3.2: Treat all traversal paths as "sentences" and use the Skip-Gram model to learn node embedding vectors: A learned function f maps each node v in the graph to a d-dimensional vector z. v The vector z v Preserve the contextual relationships of nodes within the multimodal topology; Step 3.3, each subgraph G k All node embeddings constitute the node embedding matrix. The final subgraph vector sequence is obtained:
7. The malicious subgraph detection method based on graph embedding and temporal autoencoder in multimodal networks according to claim 6, characterized in that: In step 4, the subgraph vector sequence is input into the LSTM autoencoder model for training to learn normal behavior patterns. Abnormal subgraphs are detected using reconstruction errors to identify potential attack phases. The specific details are as follows: Step 4.1: The LSTM autoencoder consists of an encoder and a decoder. The encoder is composed of multiple LSTM units and is used to compress the input subgraph vector sequence to low-dimensional latent variables. The decoder performs time-reverse reconstruction of the latent variables and outputs a predicted subgraph vector sequence. Let the input subgraph vector sequence be X = {g1, g2, ..., g...} N The LSTM autoencoder model outputs the reconstructed sequence as follows: Step 4.2: For the reconstructed sequence... Calculate the reconstruction error L t If the reconstruction error L t If the threshold τ is exceeded, the corresponding time period G is determined. t If abnormal behavior is detected, the average reconstruction error is used as the loss function: Step 4.3: Introduce a dynamic threshold strategy, set the threshold as: τ=μ+α·σ, and determine the following: Where μ is the mean of normal behavior error, σ is the standard deviation of normal behavior error, and α is an adjustable coefficient.