Log data security behavior extraction method and device and electronic equipment

Abstract

The invention relates to the technical field of graph machine learning, in particular to a log data security behavior extraction method and device and electronic equipment, and the method comprises the steps: obtaining log data of an operating system, and generating a security behavior graph data set containing behavior graphs and label information; training an unwrapping module, an attention module, a reconstructor and a discriminator in the environment unwrapping heterogeneous graph neural network by using the graph data set, unwrapping the behavior graph into a label related sub-graph and an environment sub-graph by using the unwrapping module, and constructing the label related sub-graph into graph-level representation by using the attention module; the reconstructor generates a label guide graph from the label information and the environment sub-graph, and the discriminator determines the joint distribution probability of the two types of sub-graphs according to the graph-level representation and the label guide graph, and determines the security behavior characteristics of the log data according to the probability; and finally, extracting security behavior characteristics of the log data. Therefore, the problems that a semantic gap is easily generated when the log data is used for mining the root cause of the attack, and the solution is difficult to give consideration to both interpretability and robustness are solved.

Description

Technical Field

[0001] This application relates to the field of graph machine learning technology, and in particular to a method, apparatus and electronic device for extracting security behaviors from log data. Background Technology

[0002] Large enterprise systems are facing increasingly sophisticated, globalized attacks. In responding to these attacks, security analysts need to extract the root causes and scope of damage from complex and massive audit logs, which introduces a semantic gap and significantly increases the human workload. Behavior abstraction (BA) has proven to be an effective solution: it abstracts audit logs into multiple behavioral graphs and identifies similar behavioral graphs within them. With the support of BA, similar behavioral graphs can be categorized into human-understandable behavioral categories, allowing analysts to examine only a small number of representative threat-related behavioral graphs instead of reviewing the entire log, thus significantly reducing the human workload.

[0003] Human-based behavioral abstraction methods offer interpretability through explicit pattern matching, but suffer from weak generalization. Learning-based methods, on the other hand, almost entirely ignore interpretability. They are vulnerable to noise and adversarial attacks, exhibiting susceptibility to representational distortions caused by perturbations, insufficient generalization across different attack strategies, and susceptibility to evasion attacks. Therefore, log data is prone to semantic gaps when uncovering the root causes of attacks, making it difficult to achieve a balance between interpretability and robustness in solutions. Summary of the Invention

[0004] This application provides a method, apparatus, and electronic device for extracting security behaviors from log data, in order to address the problems that log data is prone to semantic gaps when mining the root causes of attacks, and that solutions struggle to balance interpretability and robustness.

[0005] The first aspect of this application provides a method for extracting security behavior from log data, comprising the following steps: acquiring operating system log data; generating a graph dataset of operating system security behavior based on the log data, wherein the graph dataset includes a behavior graph and label information; training an environment-unwrapped heterogeneous graph neural network using the graph dataset, the environment-unwrapped heterogeneous graph neural network including an unwrapping module, an attention module, a reconstructor, and a discriminator; the unwrapping module unwrapping the behavior graph into a label-related subgraph and an environment subgraph; the attention module constructing a graph-level representation of the label-related subgraph; the reconstructor generating a label-guided graph from the label information and the environment subgraph; the discriminator determining the joint distribution probability of the label-related subgraph and the environment subgraph based on the graph-level representation and the label-guided graph; determining the security behavior features of the log data based on the joint distribution probability; and extracting the security behavior features of the log data using the trained environment-unwrapped heterogeneous graph neural network.

[0006] According to one embodiment of this application, the untangling module includes a first subgraph extractor and a second subgraph extractor, wherein the first subgraph extractor extracts a label-related subgraph from the behavior graph, and the second subgraph extractor extracts an environment subgraph from the behavior graph.

[0007] According to one embodiment of this application, the extraction process of the first subgraph extractor and the second subgraph extractor is the same, and the extraction process includes: encoding the behavioral graph into node features; generating a concatenated vector based on the node features and the edge features of the behavioral graph; mapping the concatenated vector to an intermediate vector, from... Random attention is sampled in the distribution, and a heterogeneous graph is generated based on the randomly sampled attention and intermediate vectors. The heterogeneous graph includes a label-related subgraph and an environment subgraph.

[0008] According to one embodiment of this application, the attention module rewrites the message passing process of the environment untangled heterogeneous graph neural network on the label-related subgraph, weights the nodes of the label-related subgraph according to the rewritten message passing process to obtain node features, and generates a graph-level representation based on the node features and the importance values ​​of the nodes.

[0009] According to one embodiment of this application, the rewritten expression for the message passing process is as follows:

[0010] The expression for the importance value of a node is:

[0011] The graph-level representation is expressed as:

[0012] in, This represents a graph-level representation.

[0013] According to one embodiment of this application, the reconstructor obtains node embedding vectors based on the message passing process of the environment unwrapped heterogeneous graph neural network on the environment subgraph, reconstructs the adjacency matrix based on the node embedding vectors, and reconstructs the label information and environment subgraph into a label guiding graph based on the adjacency matrix and the reconstruction loss.

[0014] According to one embodiment of this application, the message passing process of the environment unwrapping heterogeneous graph neural network on the environment subgraph is as follows:

[0015]

[0016] The expression for the adjacency matrix is:

[0017]

[0018] The expression for the reconstruction loss is:

[0019]

[0020] According to one embodiment of this application, the discriminator and the main network of the environmental unwrapped heterogeneous graph neural network are trained together. During training, the main network updates its parameters using its own loss function, and the discriminator updates its parameters based on its own loss function. The loss function of the main network is:

[0021]

[0022] The loss function of the discriminator is:

[0023]

[0024] A second aspect of this application provides a security behavior extraction device for log data, comprising: a generation module for acquiring operating system log data and generating a graph dataset of operating system security behavior based on the log data, wherein the graph dataset includes a behavior graph and label information; a training module for training an environment-unwrapped heterogeneous graph neural network using the graph dataset, the environment-unwrapped heterogeneous graph neural network including an unwrapping module, an attention module, a reconstructor, and a discriminator, wherein the unwrapping module unwrappes the behavior graph into a label-related subgraph and an environment subgraph, the attention module constructs a graph-level representation of the label-related subgraph, the reconstructor generates a label-guided graph from the label information and the environment subgraph, and the discriminator determines the joint distribution probability of the label-related subgraph and the environment subgraph based on the graph-level representation and the label-guided graph, and determines the security behavior features of the log data based on the joint distribution probability; and an extraction module for extracting the security behavior features of the log data using the trained environment-unwrapped heterogeneous graph neural network.

[0025] A third aspect of this application provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the aforementioned method for extracting secure behavior from log data.

[0026] Therefore, this application has the following beneficial effects: First, operating system log data is acquired, and a graph dataset is generated based on this data. The graph dataset includes behavioral graphs and label information, presenting behavioral relationships within the system and providing an intuitive analytical source for locating the root cause of attacks. Second, the graph dataset is used to train an environment-unwrapped heterogeneous graph neural network. This network includes an unwrapping module, an attention module, a reconstructor, and a discriminator. The unwrapping module distinguishes between two types of graphs based on the heterogeneity of the behavioral graph, explicitly unwrapping the label-related subgraph and the environment subgraph. The attention module models node importance on the label-related subgraph, maximizing label-related information and improving model interpretability. The reconstructor uses the environment subgraph and labels to reconstruct the original graph structure, maximizing the coverage of environment information. The discriminator reduces information overlap between the label-related subgraph and the environment subgraph through adversarial training, improving unwrapping quality. Finally, the trained environment-unwrapped heterogeneous graph neural network is used to extract security behavioral features from the log data. This method can accurately distinguish label-related information in heterogeneous behavior graphs, comprehensively consider environmental information, and achieve the goals of redundancy removal and interference prevention. The untangling module and discriminator make the model independent of changing environments, thereby improving the model's generalization ability and enhancing the interpretability and robustness of the security behavior extraction method for log data. Thus, it solves the problem that log data easily creates a semantic gap when mining the root causes of attacks, and that solutions often struggle to balance interpretability and robustness.

[0027] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0028] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 This is a flowchart of a method for extracting security behaviors from log data according to an embodiment of this application; Figure 2 The accuracy of Apache-1 and IM-1 under directed and undirected attacks according to embodiments of this application; Figure 3 The accuracy and ROC AUC of the embodiments of this application are related to... A changing curve; Figure 4 This is a framework diagram of an environmental untangling heterogeneous graph neural network model according to an embodiment of this application; Figure 5 This is an example diagram of a security behavior extraction device for log data according to an embodiment of this application; Figure 6 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0029] The embodiments of this application are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.

[0030] To pinpoint the root cause of an attack, behavioral abstraction transforms audit logs into multiple behavioral graphs and searches for similar graphs. Behavioral abstraction work in related technologies can be broadly categorized into two types: rule-based methods and learning-based methods. Rule-based methods rely on expert-defined patterns and rules, lacking generalizability and limiting their practical value. Learning-based methods almost entirely ignore interpretability, making them vulnerable to noise and adversarial attacks. This manifests as representation distortion due to perturbations, insufficient generalization ability across different attack strategies, and susceptibility to evasion attacks. Existing work cannot simultaneously achieve both interpretability and generalizability, and also exhibits poor robustness against adversarial attacks.

[0031] Essentially, the Graph Classification (BA) task can be viewed as a graph classification task. However, while existing methods have explored interpretability and robustness, directly applying them to BA remains insufficient. Previous work typically utilizes the Information Bottleneck (IB) principle to learn the "minimum and sufficient" information, thereby achieving interpretability and robustness. Given an input graph... and tags The graph-based IB method obtains a subgraph associated with the label by optimizing the following formula. :

[0032] in The trade-off between the two is controlled. However, this graph-based IB has two problems: it is difficult to guarantee the amount of information in the label-related subgraph, because the label-related subgraph... Environmental Information Subgraph The boundaries are not clear; to achieve the desired level of compression, it is necessary to start from... Adjust to Multiple adjustments And repeat the optimization.

[0033] These problems can be addressed by explicitly modeling environmental information. Furthermore, behavior graphs are inherently heterogeneous graphs, and previous works have often overlooked the heterogeneity of graphs. Therefore, this application proposes a feasible method: a safe behavior extraction method for log data, which can provide label-related subgraphs for internal interpretation of BA tasks and learn robust and generalizable graph-level representations.

[0034] The following describes a method, apparatus, and electronic device for extracting security behaviors from log data according to embodiments of this application, with reference to the accompanying drawings. Addressing the semantic gap that easily arises when mining the root causes of attacks using log data, as mentioned in the background art, and the difficulty in balancing interpretability and robustness in solutions, this application provides a method for extracting security behaviors from log data. In this method, operating system log data is acquired, and a graph dataset of operating system security behaviors is generated based on the log data. The graph dataset includes a behavior graph and label information. An environment-unwrapped heterogeneous graph neural network is trained using the graph dataset. This network includes an unwrapping module, an attention module, a reconstructor, and a discriminator. The unwrapping module unwrappes the behavior graph into a label-related subgraph and an environment subgraph. The attention module constructs a graph-level representation of the label-related subgraph. The reconstructor generates a label-guided graph from the label information and the environment subgraph. The discriminator determines the joint distribution probability of the label-related subgraph and the environment subgraph based on the graph-level representation and the label-guided graph. The security behavior features of the log data are determined based on the joint distribution probability. The trained environment-unwrapped heterogeneous graph neural network is then used to extract the security behavior features of the log data. This solves the problems of semantic gaps in log data when digging into the root causes of attacks, and the difficulty in balancing interpretability and robustness in solutions.

[0035] Specifically, Figure 1 This is a flowchart of a method for extracting security behaviors from log data, provided as an embodiment of this application.

[0036] like Figure 1 As shown, the method for extracting security behaviors from this log data includes the following steps: In step S101, the operating system log data is obtained, and a graph dataset of operating system security behavior is generated based on the log data. The graph dataset includes a behavior graph and label information.

[0037] It is understood that log data refers to system call logs, network access logs, and user operation logs, etc. Based on operating system log data, a graph dataset is generated using behavioral abstraction. The graph dataset includes behavioral graphs and label information. Behavioral abstraction refers to the technical process of extracting raw log data into information with clear behavioral logic; behavioral graphs refer to a structured and visualized graph model constructed based on log data through the behavioral abstraction process; label information refers to the interpretation and annotation of the behavioral graph. In the scenario of locating the root cause of an attack, behavioral abstraction can perform structured extraction and semantic integration of log data, achieving the effect of removing redundant noise and focusing on key interaction logic, thus reducing the complexity of log data. Behavioral graphs can transform log data into a visualized graph model, thereby clearly presenting the behavioral relationships within the system and providing an intuitive source of analysis for locating the root cause of an attack. In addition, due to the low-level nature of log data, a large number of redundant events unrelated to the behavioral abstraction task will be generated. This application uses existing graph reduction algorithms to simplify the graph and reduce redundancy.

[0038] For example, this application constructs a new dataset containing real-world label information and 4160 behavioral graphs for benchmark evaluation. This overcomes the shortcomings of existing publicly available datasets in terms of interpretable annotations and the limited number of graphs, achieving sufficient scale and diversity.

[0039] In step S102, the environment unwrapped heterogeneous graph neural network is trained using a graph dataset. The environment unwrapped heterogeneous graph neural network includes an unwrapping module, an attention module, a reconstructor, and a discriminator. The unwrapping module unwrappes the behavior graph into a label-related subgraph and an environment subgraph. The attention module constructs a graph-level representation of the label-related subgraph. The reconstructor generates a label guidance graph from the label information and the environment subgraph. The discriminator determines the joint distribution probability of the label-related subgraph and the environment subgraph based on the graph-level representation and the label guidance graph. Based on the joint distribution probability, the security behavior characteristics of the log data are determined.

[0040] Understandably, this application simultaneously learns label-related information and environmental information to construct an unentangled information bottleneck. An information bottleneck is a data analysis and model learning framework based on information theory, capable of efficiently representing data by controlling the filtering and transmission of information. Unentanglement refers to restoring entangled data to its original, continuous, and uninterrupted state through algorithms or operations. By filtering information strongly correlated with attack behavior from log data through the unentangled information bottleneck, the behavior abstraction process can be aided, irrelevant system noise can be eliminated, and the behavior graph can be more focused on the analysis of the root causes of the attack. By constructing the unentangled information bottleneck, maximum compression and better environmental coverage are achieved, while training with an environmental unentangled heterogeneous graph neural network further improves model performance. First, the unentanglement module unentangles the label-related subgraph and environmental subgraph from the behavior graph through random attention; then, the attention module extracts the minimum sufficient graph representation from the label-related subgraph for prediction; the reconstructor uses the environmental subgraph and label information to reconstruct the original graph structure, generating a label guidance graph for modeling environmental information; finally, the discriminator trains the attack representation and label guidance graph through adversarial training to strengthen the unentanglement of the two types of information. This application improves the interpretability and robustness of the process of abstracting log data into behavioral graphs and demonstrates stronger capabilities for real-world application scenarios.

[0041] According to one embodiment of this application, the untangling module includes a first subgraph extractor and a second subgraph extractor, wherein the first subgraph extractor extracts a label-related subgraph from the behavior graph, and the second subgraph extractor extracts an environment subgraph from the behavior graph.

[0042] Understandably, this application proposes an untangling module based on the untangling information bottleneck and graph stochastic attention. Graph stochastic attention, by injecting randomness during attention learning, effectively improves the interpretability and generalization ability of the untangling module. The extraction task of the untangling module is completed by two subgraph extractors. The first subgraph extractor extracts label-related subgraphs from the behavior graph, and the second subgraph extractor extracts environment subgraphs from the behavior graph. By distinguishing between label-related subgraphs and environment subgraphs based on the heterogeneity of the behavior graph, redundant environmental interference is accurately removed, focusing on key relational logic and improving the efficiency of behavior graph analysis.

[0043]

[0044] According to one embodiment of this application, the extraction process of the first subgraph extractor and the second subgraph extractor is the same. The extraction process includes: encoding the behavior graph into node features; generating a concatenation vector based on the node features and the edge features of the behavior graph; mapping the concatenation vector into an intermediate vector; sampling random attention from the Bernoulli distribution; and generating a heterogeneous graph based on the randomly sampled attention and the intermediate vector. The heterogeneous graph includes a label-related subgraph and an environment subgraph.

[0045] Understandably, the subgraph extractor first uses a relational graph convolutional network to encode the input behavioral graph into node features. Relational graph convolutional networks are simple and effective in learning heterogeneous graphs. Based on the node features and the edge features of the behavioral graph, a concatenated vector is generated, where the edge features of the behavioral graph are contained within the edge set of the behavioral graph. For each edge feature, the subgraph extractor uses a sigmoid-based MLP (Multi-Layer Perceptron) to map the concatenated vector into an intermediate vector. The sigmoid function maps the concatenated vector to the [0,1] interval. During training, random attention is sampled from a Bernoulli distribution, and the Gumbel-Softmax reparameterization technique ensures that the intermediate vector is gradient-calculated. Finally, a heterogeneous graph is generated based on the randomly sampled attention and the intermediate vector. This heterogeneous graph includes a label-related subgraph and an environment subgraph. Gumbel-Softmax is a continuous relaxation technique that transforms discrete class selection into continuous differentiable operations, thus ensuring that the intermediate vector is gradient-calculated. The unwrapping module extracts the behavior graph through the first and second subgraph extractors, and explicitly unwrappes the label-related subgraph from the environment subgraph, thereby improving the efficiency of behavior graph analysis.

[0046] Specifically, let's take the extraction of label-related subgraphs by the first subgraph extractor as an example. The first subgraph extractor first uses RGCN to encode the input graph G into node features; for each edge... ,in Represents the set of edges in a behavioral graph. Using an MLP with sigmoid, the concatenated vector is mapped to an intermediate vector, and random attention is sampled from the Bernoulli distribution during the training phase: To ensure that gradients can be calculated for intermediate vectors, the Gumbel-Softmax reparameterization technique is employed. The resulting heterogeneous subgraph is the subgraph selected by attention. It means that, among them All other positions are 0; It is the adjacency matrix of the original graph. This indicates element-wise multiplication. Importance in the label-related subgraph.

[0047]

[0048] According to one embodiment of this application, the attention module rewrites the message passing process of the environment untangled heterogeneous graph neural network on the label-related subgraph, weights the nodes of the label-related subgraph according to the rewritten message passing process to obtain node features, and generates a graph-level representation based on the node features and the importance values ​​of the nodes.

[0049] Understandably, the attention module is used to model node importance on the label-related subgraph to maximize label-related information. In the environment-unwrapped heterogeneous graph neural network, rewriting the message passing process on the label-related subgraph can remove irrelevant noise through environment unwrapping. Based on the rewritten message passing process, each node in the label-related subgraph is weighted to obtain the final node features, reducing the weight of noisy nodes and implementing weight allocation based on node importance. Combining the final node features and the importance value of each node generates a graph-level representation to maximize label-related information.

[0050]

[0051] According to one embodiment of this application, the rewritten expression for the message passing process is as follows:

[0052]

[0053] The expression for the importance value of a node is:

[0054]

[0055] The graph-level representation is expressed as:

[0056] in,

[0057] Understandably, the message passing process is rewritten to maximize label-related information. After rewriting the message passing process of the relational graph convolutional network, the importance of nodes is weighted to generate a graph-level representation. Finally, the graph-level representation is input into the MLP, and the cross-entropy loss is used to maximize the label-related information.

[0058]

[0059] According to one embodiment of this application, the reconstructor obtains node embedding vectors based on the message passing process of the environment unwrapped heterogeneous graph neural network on the environment subgraph, reconstructs the adjacency matrix based on the node embedding vectors, and reconstructs the label information and environment subgraph into a label guiding graph based on the adjacency matrix and the reconstruction loss.

[0060] Understandably, this application utilizes environment subgraphs and labels to reconstruct the input graph, maximizing the coverage of environmental information. Label information is explicitly used, embedding labels into the reconstruction process. By treating labels as the type of each edge in the graph, they are viewed as a unified relation type. The reconstructor obtains node embedding vectors for reconstruction based on the message passing process of the heterogeneous graph neural network on the environment subgraph; it reconstructs the adjacency matrix based on the node embedding vectors, making the graph structure more suitable for the task requirements; finally, based on the adjacency matrix and reconstruction loss, the label information and environment subgraph are reconstructed into a label-guided graph, avoiding the loss of environmental information during the unwrapping process and improving the model's performance in node classification tasks.

[0061]

[0062] According to one embodiment of this application, the message passing process of the environment unwrapping heterogeneous graph neural network on the environment subgraph is as follows:

[0063]

[0064]

[0065]

[0066] The expression for the reconstruction loss is:

[0067]

[0068] Understandably, this application utilizes environment subgraphs and labels to reconstruct the original graph structure, thereby modeling environmental information. Given an environment subgraph, labels are treated as a unified relation type. Combining the importance within the environment subgraph, the message passing process of nodes on the environment subgraph is calculated. Finally, the label information and environment subgraph are reconstructed into a label guidance graph, improving the model's performance in node classification tasks.

[0069]

[0070] According to one embodiment of this application, the discriminator and the main network of the environment-unwrapped heterogeneous graph neural network are trained together. During training, the main network updates its parameters using its own loss function, and the discriminator updates its parameters based on its own loss function. The loss function of the main network is:

[0071]

[0072] The loss function of the discriminator is:

[0073]

[0074] Understandably, this application utilizes the density ratio technique to propose a discriminator. This reduces overlapping information between label-related subgraphs and context subgraphs. The system uses adversarial training, performed by a discriminator. The system is trained together with the main network structure. First, the training set, heterogeneous subgraph extractor, attention module, reconstructor, discriminator, and relevant parameters are defined and input into the system. After repeated training, the system finally outputs the model and the subgraphs related to the labels, thereby improving the robustness of the model.

[0075]

[0076] This application formalizes the objective of the Environment Unwrapped Heterogeneous Graph Neural Network (EDHGNN) by extending the unwrapping information bottleneck as follows:

[0077]

[0078]

[0079]

[0080]

[0081]

[0082] According to the above formula, maximizing Equivalent to:

[0083] The goal of the above formula

[0084] Equivalent to cross-entropy loss:

[0085]

[0086]

[0087]

[0088]

[0089]

[0090]

[0091]

[0092]

[0093]

[0094]

[0095]

[0096] In step S103, the security behavior features of the log data are extracted using the trained environment unwrapped heterogeneous graph neural network.

[0097] Understandably, by training an environmental unentangled heterogeneous graph neural network, behavioral abstraction of the root cause and scope of damage in log data is performed. The log data is then abstracted into multiple behavioral graphs, and similar behavioral graphs are identified. Finally, the security behavioral features of the log data are extracted, thus enabling the localization of the root cause of the attack. At the same time, analysts only need to check a small number of representative behavioral graphs related to the threat, without having to review all the logs, significantly reducing the workload.

[0098] It should be noted that, in order to fully evaluate the effectiveness of the security behavior extraction method for log data, this application constructs a new behavior dataset, HGBE, which is derived from four real attack scenarios: Apache-1: CVE-2017-15715 vulnerability; Apache-2: Apache SSI remote command execution vulnerability; IM-1: ImageMagick arbitrary file read vulnerability CVE-2022-44268; IM-2: ImageMagick command injection vulnerability CVE-2016-3714. The evaluation method compares two dimensions: first, prediction performance, which is compared with Watson, TopkPool (a pooling-based graph neural network method), SagPool (a graph pooling method based on self-attention), SortPool (a pooling method in an end-to-end learning architecture for graph classification), GIB (Graph Information Bottleneck), GSAT (a local search algorithm for solving propositional logic formula satisfiability problems), and PGIB (interpretable prototype-based graph information bottleneck), using accuracy as the evaluation metric; second, interpretability, which is compared with GIB, GSAT, PGIB, PGE (posterior interpretation), and GME (posterior interpretation) interpretation methods, using interpretability ROCAUC (a core performance metric for classification models) to measure the interpretation accuracy of label-related subgraphs.

[0099]

[0100] The final interpretability results are shown in Table 1. The environment untangled heterogeneous graph neural network significantly outperforms the comparison methods on all datasets, with an average improvement of about 3.05% and a maximum improvement of 5.48%, and its interpretability performance is more stable.

[0101]

[0102] The final evaluation results for robustness against adversarial attacks are as follows: Figure 2 As shown, taking Apache-1 as an example: the environment-untangled heterogeneous graph neural network achieves an accuracy of 98.45% on clean data, with an average accuracy decrease of only ~9-10 percentage points under various attacks; in contrast, WatSon and various graph pooling baselines show significant inrocity under structural / feature attacks; even IB-type methods, which are geared towards robustness and generalization, still fall short of the trained model under strong attacks because they do not adequately separate "label-related" and "environment" information and fail to handle heterogeneity challenges.

[0103] Therefore, in non-targeted attacks: WatSon and graph pooling baselines are less robust; although the robustness of the IB series is improved, it is still limited due to insufficient explicit modeling of environmental information; in targeted attacks (including evasion and poisoning): the environmental unwrapped heterogeneous graph neural network has the lowest average accuracy decline on all datasets, confirming its robustness to strong targeted attacks.

[0104]

[0105]

[0106] Table 2 shows that the w / o unwrapping module performs the worst due to a lack of effective modeling of environmental information and heterogeneity. Removing the discriminator leads to a significant performance drop, indicating that explicit unwrapping is crucial for eliminating overlapping information and improving interpretability and robustness. Removing the reconstructor creates spurious correlations between environmental information and labels, impairing prediction and interpretation performance. Without the attention module, a simple readout function struggles to adapt to the heterogeneity of the graph and the differences in node importance, resulting in performance degradation. The complete environmental unwrapped heterogeneous graph neural network achieves the best prediction accuracy and interpretation ROC AUC, demonstrating that the unwrapping module, attention module, reconstructor, and discriminator work synergistically to improve performance.

[0107]

[0108] The following will illustrate the method for extracting security behaviors from log data through a specific embodiment. The process of extracting security behaviors from log data is as follows: Figure 4 As shown, the details are as follows: 1. First, identify the behavior graph from the log data, use an improved forward depth-first search to extract the behavior graph from the log data, and use TransE (knowledge graph embedding model) to initialize the node features.

[0109] 2. The neural network for unwrapping heterogeneous graphs is trained. The unwrapping module uses random attention to unwrap the label-related subgraph and the environment subgraph from the behavior graph. Then, the attention module extracts the minimum sufficient graph-level representation from the label-related subgraph for prediction. The reconstructor uses the environment subgraph and labels to reconstruct the original graph structure for modeling environment information. Finally, the discriminator strengthens the unwrapping of the label-related subgraph and the environment subgraph through adversarial training.

[0110] 3. Utilize the trained environment unwrapped heterogeneous graph neural network to extract security behavior features from log data.

[0111] According to the security behavior extraction method for log data proposed in this application, the method first acquires the operating system's log data and generates a graph dataset based on the log data. The graph dataset includes behavioral graphs and label information, presenting behavioral relationships within the system and providing an intuitive source of analysis for locating the root cause of attacks. Secondly, the graph dataset is used to train an environment-unwrapped heterogeneous graph neural network. The neural network includes an unwrapping module, an attention module, a reconstructor, and a discriminator: the unwrapping module can distinguish between two types of graphs based on the heterogeneity of the behavioral graph, explicitly unwrapping the label-related subgraph and the environment subgraph; the attention module can model the importance of nodes on the label-related subgraph, thereby maximizing label-related information and improving the interpretability of the model; the reconstructor uses the environment subgraph and labels to reconstruct the original graph structure, thereby maximizing the coverage of environment information; the discriminator reduces information overlap between the label-related subgraph and the environment subgraph through adversarial training, improving the unwrapping quality; finally, the trained environment-unwrapped heterogeneous graph neural network is used to extract security behavior features from the log data. This method can accurately distinguish label-related information in heterogeneous behavior graphs, comprehensively consider environmental information, and achieve the goals of redundancy removal and interference prevention. The untangling module and discriminator make the model independent of changing environments, thereby improving the model's generalization ability and enhancing the interpretability and robustness of the security behavior extraction method for log data. Thus, it solves the problem that log data easily creates a semantic gap when mining the root causes of attacks, and that solutions often struggle to balance interpretability and robustness.

[0112] Next, the security behavior extraction apparatus for log data according to the embodiments of this application is described with reference to the accompanying drawings.

[0113] Figure 5 This is a block diagram of a security behavior extraction device for log data according to an embodiment of this application.

[0114] like Figure 5 As shown, the security behavior extraction device 10 for the log data includes: a generation module 110, a training module 120, and an extraction module 130.

[0115] The system includes a generation module 110 for acquiring operating system log data and generating a graph dataset of operating system security behaviors based on the log data. The graph dataset includes a behavior graph and label information. A training module 120 is used to train an environment-unwrapped heterogeneous graph neural network using the graph dataset. The environment-unwrapped heterogeneous graph neural network includes an unwrapping module, an attention module, a reconstructor, and a discriminator. The unwrapping module unwrappes the behavior graph into a label-related subgraph and an environment subgraph. The attention module constructs a graph-level representation of the label-related subgraph. The reconstructor generates a label-guided graph from the label information and the environment subgraph. The discriminator determines the joint distribution probability of the label-related subgraph and the environment subgraph based on the graph-level representation and the label-guided graph, and determines the security behavior features of the log data based on the joint distribution probability. An extraction module 130 is used to extract the security behavior features of the log data using the trained environment-unwrapped heterogeneous graph neural network.

[0116] According to one embodiment of this application, the untangling module includes a first subgraph extractor and a second subgraph extractor, wherein the first subgraph extractor extracts a label-related subgraph from the behavior graph, and the second subgraph extractor extracts an environment subgraph from the behavior graph.

[0117] According to one embodiment of this application, the extraction process of the first subgraph extractor and the second subgraph extractor is the same. The extraction process includes: encoding the behavior graph into node features; generating a concatenation vector based on the node features and the edge features of the behavior graph; mapping the concatenation vector into an intermediate vector; sampling random attention from the Bernoulli distribution; and generating a heterogeneous graph based on the randomly sampled attention and the intermediate vector. The heterogeneous graph includes a label-related subgraph and an environment subgraph.

[0118] According to one embodiment of this application, the attention module rewrites the message passing process of the environment untangled heterogeneous graph neural network on the label-related subgraph, weights the nodes of the label-related subgraph according to the rewritten message passing process to obtain node features, and generates a graph-level representation based on the node features and the importance values ​​of the nodes.

[0119] According to one embodiment of this application, the rewritten expression for the message passing process is as follows:

[0120]

[0121] The expression for the importance value of a node is:

[0122]

[0123] The graph-level representation is expressed as:

[0124] in, This represents a graph-level representation.

[0125] According to one embodiment of this application, the reconstructor obtains node embedding vectors based on the message passing process of the environment unwrapped heterogeneous graph neural network on the environment subgraph, reconstructs the adjacency matrix based on the node embedding vectors, and reconstructs the label information and environment subgraph into a label guiding graph based on the adjacency matrix and the reconstruction loss.

[0126] According to one embodiment of this application, the message passing process of the environment unwrapping heterogeneous graph neural network on the environment subgraph is as follows:

[0127]

[0128] The expression for the adjacency matrix is:

[0129]

[0130] The expression for the reconstruction loss is:

[0131]

[0132] According to one embodiment of this application, the discriminator and the main network of the environment-unwrapped heterogeneous graph neural network are trained together. During training, the main network updates its parameters using its own loss function, and the discriminator updates its parameters based on its own loss function. The loss function of the main network is:

[0133]

[0134] The loss function of the discriminator is:

[0135]

[0136] It should be noted that the foregoing explanation of the method embodiment for extracting security behaviors from log data also applies to the log data security behavior extraction device of this embodiment, and will not be repeated here.

[0137] According to the security behavior extraction device for log data proposed in this application, the generation module first obtains the operating system's log data and generates a graph dataset based on the log data. The graph dataset includes a behavior graph and label information, presenting the behavioral relationships within the system and providing an intuitive source of analysis for locating the root cause of attacks. Secondly, the training module trains an environment-unwrapped heterogeneous graph neural network using the graph dataset. The neural network includes an unwrapping module, an attention module, a reconstructor, and a discriminator: the unwrapping module can distinguish between two types of graphs based on the heterogeneity of the behavior graph, explicitly unwrapping the label-related subgraph and the environment subgraph; the attention module can model the node importance on the label-related subgraph, thereby maximizing label-related information and improving the interpretability of the model; the reconstructor uses the environment subgraph and labels to reconstruct the original graph structure, thereby maximizing the coverage of environment information; the discriminator reduces the information overlap between the label-related subgraph and the environment subgraph through adversarial training, improving the unwrapping quality; finally, the extraction module uses the trained environment-unwrapped heterogeneous graph neural network to extract the security behavior features of the log data. This method can accurately distinguish label-related information in heterogeneous behavior graphs, comprehensively consider environmental information, and achieve the goals of redundancy removal and interference prevention. The untangling module and discriminator make the model independent of changing environments, thereby improving the model's generalization ability and enhancing the interpretability and robustness of the security behavior extraction method for log data. Thus, it solves the problem that log data easily creates a semantic gap when mining the root causes of attacks, and that solutions often struggle to balance interpretability and robustness.

[0138] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of this application. The electronic device may include: The memory 601, the processor 602, and the computer program stored on the memory 601 and capable of running on the processor 602.

[0139] When the processor 602 executes the program, it implements the method for extracting secure behavior of log data provided in the above embodiments.

[0140] Furthermore, electronic devices also include: Communication interface 603 is used for communication between memory 601 and processor 602.

[0141] The memory 601 is used to store computer programs that can run on the processor 602.

[0142] The memory 601 may include high-speed RAM (Random Access Memory) memory, and may also include non-volatile memory, such as at least one disk storage.

[0143] If the memory 601, processor 602, and communication interface 603 are implemented independently, then the communication interface 603, memory 601, and processor 602 can be interconnected via a bus to complete communication between them. The bus can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 6 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0144] Optionally, in a specific implementation, if the memory 601, processor 602, and communication interface 603 are integrated on a single chip, then the memory 601, processor 602, and communication interface 603 can communicate with each other through an internal interface.

[0145] The processor 602 may be a CPU (Central Processing Unit), an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiments of this application.

[0146] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0147] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "N" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0148] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or N executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0149] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. If implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (FPGAs), field-programmable gate arrays (FPGAs), etc.

[0150] Those skilled in the art will understand that all or part of the steps of the methods implementing the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0151] Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of this application.

Claims

1. A method for extracting security behaviors from log data, characterized in that, Includes the following steps: Obtain operating system log data, and generate a graph dataset of the operating system's security behavior based on the log data, wherein the graph dataset includes a behavior graph and label information; The aforementioned graph dataset is used to train an environment-unwrapped heterogeneous graph neural network, which includes an unwrapping module, an attention module, a reconstructor, and a discriminator. The unwrapping module unwrappes the behavior graph into a label-related subgraph and an environment subgraph. The attention module constructs a graph-level representation of the label-related subgraph. The reconstructor generates a label-guided graph from the label information and the environment subgraph. The discriminator determines the joint distribution probability of the label-related subgraph and the environment subgraph based on the graph-level representation and the label-guided graph, and determines the security behavior characteristics of the log data based on the joint distribution probability. Security behavior features of log data are extracted using a trained environment-unwrapped heterogeneous graph neural network.

2. The method for extracting security behaviors from log data according to claim 1, characterized in that, The untangling module includes a first subgraph extractor and a second subgraph extractor, wherein the first subgraph extractor extracts the label-related subgraph from the behavior graph, and the second subgraph extractor extracts the environment subgraph from the behavior graph.

3. The method for extracting security behaviors from log data according to claim 2, characterized in that, The extraction processes of the first subgraph extractor and the second subgraph extractor are the same, and the extraction process includes: The behavior graph is encoded into node features; Generate a splicing vector based on node features and edge features of the behavior graph; Map the concatenated vector to an intermediate vector, from Random attention is sampled in the distribution, and a heterogeneous graph is generated based on the randomly sampled attention and the intermediate vector. The heterogeneous graph includes the label correlation subgraph and the environment subgraph.

4. The method for extracting security behaviors from log data according to claim 1, characterized in that, The attention module rewrites the message passing process of the environment unentangled heterogeneous graph neural network on the label-related subgraph, weights the nodes of the label-related subgraph according to the rewritten message passing process to obtain node features, and generates the graph-level representation based on the node features and the importance values ​​of the nodes.

5. The method for extracting security behaviors from log data according to claim 4, characterized in that, The rewritten expression for the message passing procedure is: The expression for the importance value of the node is: The expression for the graph-level representation is: in, This represents a graph-level representation.

6. The method for extracting security behaviors from log data according to claim 1, characterized in that, The reconstructor obtains node embedding vectors based on the message passing process of the environment unwrapped heterogeneous graph neural network on the environment subgraph, reconstructs the adjacency matrix based on the node embedding vectors, and reconstructs the label information and the environment subgraph into the label guidance graph based on the adjacency matrix and the reconstruction loss.

7. The method for extracting security behaviors from log data according to claim 6, characterized in that, The message passing process of the environment untangling heterogeneous graph neural network on the environment subgraph is as follows: The expression for the adjacency matrix is: The expression for the reconstruction loss is: 。 8. The method for extracting security behaviors from log data according to claim 1, characterized in that, The discriminator and the main network of the environmental unwrapped heterogeneous graph neural network are trained together. During training, the main network updates its parameters using its own loss function, and the discriminator updates its parameters based on its own loss function. The loss function of the main network is: The loss function of the discriminator is: 。 9. A device for extracting security behaviors from log data, characterized in that, include: A generation module is used to acquire operating system log data and generate a graph dataset of the operating system's security behavior based on the log data, wherein the graph dataset includes a behavior graph and label information; The training module is used to train the environment unwrapped heterogeneous graph neural network using the graph dataset. The environment unwrapped heterogeneous graph neural network includes an unwrapping module, an attention module, a reconstructor, and a discriminator. The unwrapping module unwrappes the behavior graph into a label-related subgraph and an environment subgraph. The attention module constructs a graph-level representation of the label-related subgraph. The reconstructor generates a label guidance graph from the label information and the environment subgraph. The discriminator determines the joint distribution probability of the label-related subgraph and the environment subgraph based on the graph-level representation and the label guidance graph, and determines the security behavior characteristics of the log data based on the joint distribution probability. The extraction module is used to extract security behavior features from log data using a trained environment-unwrapped heterogeneous graph neural network.

10. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, the processor executing the program to implement the secure behavior extraction method for log data according to any one of claims 1-8.

Images