Anomaly attack chain analysis and detection method based on gat-bilstm

Abstract

The application particularly relates to an abnormal attack chain analysis and detection method based on GAT-BiLSTM. The abnormal attack chain analysis and detection system based on GAT-BiLSTM collects data, and carries out cleaning, formatting and standardization processing to generate structured security event data; an attack behavior graph is constructed, feature learning of the attack behavior graph is carried out based on a graph attention network GAT to obtain spatial correlation features of nodes and their correlation; a time sequence feature of the attack behavior is modeled based on a bidirectional long short-term memory network BiLSTM to extract time sequence dependent information of attack chain evolution; spatial correlation features and time sequence dependent features are fused to distinguish abnormal attack chains, and corresponding security protection strategies are executed according to the recognition result. The abnormal attack chain analysis and detection method based on GAT-BiLSTM can effectively identify abnormal attack chains of multiple stages and multiple entities, realize dynamic response of network protection, and improve the intelligent level of a security system.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an analysis and detection method for anomaly attack chains based on GAT-BiLSTM. Background Technology

[0002] With the widespread application of technologies such as cloud computing, big data, and the Internet of Things, the network environment is becoming increasingly complex, and network attack methods are constantly evolving. Traditional single-point attacks have gradually developed into complex attack behaviors characterized by multiple stages, multiple targets, and persistence. Attackers typically carry out attacks step by step through multiple steps such as reconnaissance, vulnerability exploitation, privilege escalation, and lateral movement, forming attack chains with clear stages and connections, posing a serious threat to the security of networks and information systems.

[0003] Existing network attack detection technologies mainly include feature-based rule-based detection methods and data-driven anomaly detection methods. Feature-based rule-based detection methods rely on manually summarized attack features and rule bases. When faced with constantly changing and evolving new attack behaviors, the update and maintenance costs are high, and the detection capability for unknown and variant attacks is limited. Although data-driven methods can discover abnormal behavior by learning from historical data, they mostly analyze single traffic streams or single security events, making it difficult to effectively reveal the inherent correlation between attack behaviors.

[0004] In real-world attack scenarios, attacks often involve complex interactions between multiple entities, such as hosts, accounts, processes, and network connections, with each attack phase exhibiting a clear temporal sequence and dependency. Traditional sequence analysis models struggle to fully represent the structural characteristics of relationships between multiple entities when modeling attack behavior; while methods based solely on graph structure analysis fail to reflect the dynamic evolution of attack behavior over time, resulting in an incomplete characterization of the overall attack chain.

[0005] Therefore, existing technologies for anomaly attack chain analysis and detection generally suffer from problems such as difficulty in simultaneously modeling the association structure and temporal features of attack behaviors, insufficient ability to identify complex multi-stage attacks, and the need to improve the stability and accuracy of detection results. There is an urgent need for an anomaly attack chain analysis and detection method that can integrate the association relationship of attack behaviors and the temporal evolution features.

[0006] Based on the above, this invention proposes an analysis and detection method for anomaly attack chains based on GAT-BiLSTM. Summary of the Invention

[0007] To overcome the shortcomings of existing technologies, this invention provides a simple and efficient method for analyzing and detecting anomaly attack chains based on GAT-BiLSTM.

[0008] This invention is achieved through the following technical solution: An analysis and detection method for anomaly attack chains based on GAT-BiLSTM includes the following steps: Step S1: Collect network logs, traffic data, and security event data; Step S2: Clean, format, and standardize the collected data to generate structured security event data; Step S3: Construct an attack behavior graph based on structured data. In the graph, nodes represent entities and edges represent the interaction relationships or potential attack associations between entities. Step S4: Based on the graph attention network GAT, perform feature learning on the attack behavior graph to obtain the spatial association features of nodes and their relationships; Step S5: Model the temporal series features of the attack behavior based on the Bidirectional Long Short-Term Memory (BiLSTM) network and extract the temporal dependency information of the attack chain evolution. Step S6: Integrate spatial correlation features and temporal dependency features to identify abnormal attack chains and generate network abnormal attack chain identification results; Step S7: Execute the corresponding security protection strategy based on the identification results.

[0009] In step S1, the network logs, as semi-structured data, are divided into a regular expression message part and a feature message part. The regular expression message part contains basic information such as the time the log was generated and the log priority level, while the feature message part, which is the core content of the log, consists of text, numbers and special characters. In step S2, the network logs are cleaned, formatted, and standardized, and feature information of the logs is extracted for modeling. The parsed log fields include timestamps and feature information. The timestamps record when the log was generated, and the feature information describes the current network event.

[0010] In step S3, the Glove encoding method is used to convert the log feature information into a vector. An attack behavior graph G(V,E) is constructed based on log information to uncover hidden information between logs. In the constructed attack behavior graph G(V,E), node V contains word nodes and log nodes, and edge E contains edges connecting logs and words as well as edges connecting words. In step S4, the neighbor node information is aggregated through the graph attention network GAT to obtain the embedded representation of the log.

[0011] In step S5, a bidirectional long short-term memory (BiLSTM) network model with a bidirectional input structure is used to capture the bidirectional semantic dependencies of the context.

[0012] In step S6, given the log set {(D1, l1), (D2, l2), ..., (D...}, ... n 1 n In )}, D n This represents the nth log entry, 1 n This represents the category label of the nth log entry, 1 n ∈ {0, 1, ..., k}, where k represents the number of sample categories; For log (D) k 1 k It consists of several word vectors, represented as {w K1 w K2 , ..., w Kn In the BiLSTM network model, word vectors {w} are input sequentially. K1 w K2 , ..., w Kn ,} to obtain log sequence features H K ; In the attack behavior graph G(V,E), the graph attention network GAT aggregates information from neighboring nodes to obtain the global embedding representation h of the log. k ， ; The adaptive feature fusion calculation for log k is as follows:

[0013] In the formula, α and β represent the importance coefficients of log word sequence information and log inter-log information, respectively, and W1 and W2 are the parameter matrices to be trained; therefore, the fused feature E k The final expression is:

[0014] Finally, the feature vector matrix E of the log is obtained.

[0015] In step S6, after adaptive feature fusion, the feature vector matrix E of the logs is fed into a fully connected layer with a neural network model for classification. The calculation process is as follows:

[0016] Where σ is the ReLU function, W3 and W4 are the matrices to be trained, and b1 and b2 are the bias vectors; the loss value L is calculated using the cross-entropy loss function.

[0017] Among them, y i y represents the actual label of the i-th log category. i ，The model's predicted labels are used; the GAT-BiLSTM model is trained by minimizing the loss function, and Adam is used as the optimizer for gradient descent. Input the log data D and the label y calculated by the fully connected layer into the GAT-BiLSTM model to output the log classification result.

[0018] An analysis and detection system for anomaly attack chains based on GAT-BiLSTM, used to implement the above method, includes: Data acquisition module: used to collect network logs, traffic data, or security incident information; Data processing module: Cleans, formats, and standardizes the collected data to generate structured data; Attack Behavior Graph Construction Module: Maps structured data into an attack behavior graph, constructing spatial relationships between attack behaviors; Graph Attention Network (GAT) Modeling Module: Learns spatial features of the attack behavior graph to obtain the importance weights of nodes and their interaction relationships; Bidirectional Long Short-Term Memory (BiLSTM) modeling module: models the time-series characteristics of attack behavior and captures the dynamic evolution information of the attack chain; Anomaly attack chain identification module: It integrates spatial and temporal features to detect and analyze anomaly attack chains.

[0019] An analysis and detection device for anomaly attack chains based on GAT-BiLSTM includes a memory and a processor; the memory is used to store a computer program, and the processor is used to execute the computer program to implement the above-described method steps.

[0020] A readable storage medium storing a computer program that, when executed by a processor, implements the above-described method steps.

[0021] The beneficial effects of this invention are as follows: This analysis and detection method for anomaly attack chains based on GAT-BiLSTM can not only characterize the spatial correlation between complex attack behaviors, thereby effectively identifying multi-stage, multi-entity anomaly attack chains, but also capture the dynamic characteristics of attack chain evolution, achieve accurate detection of persistent and covert attacks, comprehensively characterize the spatial-temporal characteristics of attack chains, improve the detection accuracy and identification stability of anomaly attack chains, reduce false negatives and false positives, realize dynamic response of network protection, and enhance the intelligence level of security systems. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a schematic diagram of the analysis and detection method for anomaly attack chains based on GAT-BiLSTM according to the present invention.

[0024] Figure 2 This is a schematic diagram illustrating the method of learning spatial features of an attack behavior graph using the Graph Attention Network (GAT) of the present invention. Detailed Implementation

[0025] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions in the embodiments of this invention will be clearly and completely described below in conjunction with the embodiments of this invention. Obviously, the described embodiments are merely some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this invention.

[0026] The analysis and detection method for anomaly attack chains based on GAT-BiLSTM includes the following steps: Step S1: Collect network logs, traffic data, and security event data; Step S2: Clean, format, and standardize the collected data to generate structured security event data; Step S3: Construct an attack behavior graph based on structured data. In the graph, nodes represent entities and edges represent the interaction relationships or potential attack associations between entities. Step S4: Based on the graph attention network GAT, perform feature learning on the attack behavior graph to obtain the spatial association features of nodes and their relationships; Step S5: Model the temporal series features of the attack behavior based on the Bidirectional Long Short-Term Memory (BiLSTM) network and extract the temporal dependency information of the attack chain evolution. Step S6: Integrate spatial correlation features and temporal dependency features to identify abnormal attack chains and generate network abnormal attack chain identification results; Step S7: Execute the corresponding security protection strategy based on the identification results.

[0027] In step S1, the network logs, as semi-structured data, are divided into a regular expression message part and a feature message part. The regular expression message portion contains basic information such as the log generation time and log priority level, while the feature message portion, as the core content of the log, consists of text, numbers, and special characters. In the experimental dataset of this paper, the log format generated by the honeypot system is shown in the following example: 07 / 14-13:01:45.644842 [**][1:2023431:2]ET TROJAN Possible Linux.Mirai Login Attempt(54321)[**] [urgent:Attempted Administrator Privilege Gain][Priority:1] In step S2, the network logs are cleaned, formatted, and standardized, and feature information of the logs is extracted for modeling. The fields after log parsing include timestamps and feature information. The timestamps record the time when the log was generated and are an important basis for the log sequence order. The feature information describes the current network event and is an important criterion for judging the log type.

[0028] The following are examples of data feature fields after log parsing: Timestamp: 07 / 14-13:01:45.644842 Feature information: ET TROJAN Possible Linux.Mirai Login Attempt‖AttemptedAdministrator Privilege Gain The input to deep learning models is typically a numerical vector. Word2Vec and GloVe are commonly used word vector encoding methods in natural language processing. Considering the fast encoding speed of GloVe, step S3 uses GloVe encoding to convert log feature information into vectors. An attack behavior graph G(V,E) is constructed based on log information to mine hidden information between logs and obtain a more comprehensive log feature representation. In the constructed attack behavior graph G(V,E), node V contains word nodes and log nodes, and edge E contains edges connecting logs and words as well as edges connecting words. In step S4, the neighbor node information is aggregated using a graph attention network (GAT) to obtain the embedded representation of the log. The process is shown in the attached figure. Figure 2 As shown.

[0029] In step S5, a bidirectional long short-term memory (BiLSTM) network model with a bidirectional input structure is used to capture the bidirectional semantic dependencies of the context.

[0030] In step S6, given the log set {(D1, l1), (D2, l2), ..., (D...}, ... n 1 n In )}, D n This represents the nth log entry, 1 n This represents the category label of the nth log entry, 1 n ∈ {0, 1, ..., k}, where k represents the number of sample categories; For log (D) k 1 k It consists of several word vectors, represented as {w K1 w K2 , ..., w Kn In the BiLSTM network model, word vectors {w} are input sequentially. K1 w K2 , ..., w Kn ,} to obtain log sequence features H K ; In the attack behavior graph G(V,E), the graph attention network GAT aggregates information from neighboring nodes to obtain the global embedding representation h of the log. k ， ; To improve the model's generalization ability, an adaptive feature fusion strategy is adopted for both spatial correlation features and temporal dependency features. The adaptive feature fusion calculation for log k is as follows:

[0031] In the formula, α and β represent the importance coefficients of log word sequence information and log inter-log information, respectively, and W1 and W2 are the parameter matrices to be trained; therefore, the fused feature E k The final expression is:

[0032] Finally, the feature vector matrix E of the log is obtained.

[0033] In step S6, after adaptive feature fusion, the feature vector matrix E of the logs is fed into a fully connected layer with a neural network model for classification. The calculation process is as follows:

[0034] Where σ is the ReLU function, W3 and W4 are the matrices to be trained, and b1 and b2 are the bias vectors; the loss value L is calculated using the cross-entropy loss function.

[0035] Among them, y iy represents the actual label of the i-th log category. i ， The model's predicted labels are used; the GAT-BiLSTM model is trained by minimizing the loss function, and Adam is used as the optimizer for gradient descent. Input the log data D and the label y calculated by the fully connected layer into the GAT-BiLSTM model to output the log classification result.

[0036] The pseudocode for the GAT-BiLSTM model is shown below: Algorithm 1: GAT-BiLSTM 1. Input: D, y 2 Input Parameters: epoch, GAT_layer, 3D a ←Analysis (D) 4 A←construct(D) a ) 5 X one-hot ←get-one-hot (D) a ) 6 X glove ←get-Glove (D) a ) 7. for in range(epoch) 8 H←BILSTM(X) glove ) 9 h ， ←GAT(X) one-hot A) 10 E=AdaptiveFusion(H, h) ， ) 11 y pred ←softmax(FCN(E)) 12 minimize(loss(ypred,y)) 13 loss.backward() 14 optimizer.Adam.step() 15 end 16 Output: ypred This GAT-BiLSTM-based anomaly attack chain analysis and detection system, used to implement the above method, includes: Data acquisition module: used to collect network logs, traffic data, or security incident information; Data processing module: Cleans, formats, and standardizes the collected data to generate structured data; Attack Behavior Graph Construction Module: Maps structured data into an attack behavior graph, constructing spatial relationships between attack behaviors; Graph Attention Network (GAT) Modeling Module: Learns spatial features of the attack behavior graph to obtain the importance weights of nodes and their interaction relationships; Bidirectional Long Short-Term Memory (BiLSTM) modeling module: models the time-series characteristics of attack behavior and captures the dynamic evolution information of the attack chain; Anomaly attack chain identification module: It integrates spatial and temporal features to detect and analyze anomaly attack chains.

[0037] The analysis and detection device for anomaly attack chains based on GAT-BiLSTM includes a memory and a processor; the memory is used to store computer programs, and the processor is used to execute the computer programs to implement the above-described method steps.

[0038] The readable storage medium stores a computer program that, when executed by a processor, implements the above-described method steps.

[0039] Compared with existing technologies, this analysis and detection method for anomaly attack chains based on GAT-BiLSTM has the following characteristics: 1) Improved multi-stage attack chain identification capability By constructing an attack behavior graph and using the Graph Attention Network (GAT) to model attack behaviors involving multiple entities and relationships, it is possible to characterize the spatial relationships between complex attack behaviors, thereby effectively identifying multi-stage, multi-entity abnormal attack chains.

[0040] 2) Enhanced the ability to analyze the temporal evolution of attacks. By introducing a bidirectional long short-term memory network (BiLSTM) to model the time series of attack behavior, it is possible to capture the dynamic characteristics of the attack chain evolution and achieve accurate detection of persistent and covert attacks.

[0041] 3) Improved detection accuracy and stability. By fusing spatial features extracted by the Graph Attention Network (GAT) with temporal features extracted by the Bidirectional Long Short-Term Memory Network (BiLSTM), the spatial-temporal characteristics of the attack chain can be comprehensively characterized, improving the detection accuracy and identification stability of abnormal attack chains, and reducing the false negative and false positive rates.

[0042] 4) Enhanced network protection intelligence and response capabilities. By combining the protection execution module, security policies are automatically triggered based on the identified abnormal attack chains, enabling dynamic response of network protection and improving the intelligence level of the security system.

[0043] The embodiments described above are merely one specific implementation of the present invention. Ordinary changes and substitutions made by those skilled in the art within the scope of the technical solution of the present invention should be included within the protection scope of the present invention.

Claims

1. An analysis and detection system for anomaly attack chains based on GAT-BiLSTM, characterized in that: Includes the following features: Step S1: Collect network logs, traffic data, and security event data; Step S2: Clean, format, and standardize the collected data to generate structured security event data; Step S3: Construct an attack behavior graph based on structured data. In the graph, nodes represent entities and edges represent the interaction relationships or potential attack associations between entities. Step S4: Based on the graph attention network GAT, perform feature learning on the attack behavior graph to obtain the spatial association features of nodes and their relationships; Step S5: Model the temporal series features of the attack behavior based on the Bidirectional Long Short-Term Memory (BiLSTM) network and extract the temporal dependency information of the attack chain evolution. Step S6: Integrate spatial correlation features and temporal dependency features to identify abnormal attack chains and generate network abnormal attack chain identification results; Step S7: Execute the corresponding security protection strategy based on the identification results.

2. The analysis and detection system for anomaly attack chains based on GAT-BiLSTM according to claim 1, characterized in that: In step S1, the network logs, as semi-structured data, are divided into a regular expression message part and a feature message part. The regular expression message part contains basic information such as the time the log was generated and the log priority level, while the feature message part, which is the core content of the log, consists of text, numbers and special characters. In step S2, the network logs are cleaned, formatted, and standardized, and feature information of the logs is extracted for modeling. The parsed log fields include timestamps and feature information. The timestamps record when the log was generated, and the feature information describes the current network event.

3. The analysis and detection system for anomaly attack chains based on GAT-BiLSTM according to claim 1, characterized in that: In step S3, the Glove encoding method is used to convert the log feature information into a vector. An attack behavior graph G(V,E) is constructed based on log information to uncover hidden information between logs. In the constructed attack behavior graph G(V,E), node V contains word nodes and log nodes, and edge E contains edges connecting logs and words as well as edges connecting words. In step S4, the neighbor node information is aggregated through the graph attention network GAT to obtain the embedded representation of the log. In step S5, a bidirectional long short-term memory (BiLSTM) network model with a bidirectional input structure is used to capture the bidirectional semantic dependencies of the context.

4. The analysis and detection system for anomaly attack chains based on GAT-BiLSTM according to claim 1, characterized in that: In step S6, given the log set {(D1, l1), (D2, l2), ..., (D...}, ... n 1 n In )}, D n This represents the nth log entry, 1 n This represents the category label of the nth log entry, 1 n ∈ {0, 1, ..., k}, where k represents the number of sample categories; For log (D) k 1 k It consists of several word vectors, represented as {w K1 w K2 , ..., w Kn In the BiLSTM network model, word vectors {w} are input sequentially. K1 w K2 , ..., w Kn ,} to obtain log sequence features H K ; In the attack behavior graph G(V,E), the graph attention network GAT aggregates information from neighboring nodes to obtain the global embedding representation h of the log. k ， ; The adaptive feature fusion calculation for log k is as follows: In the formula, α and β represent the importance coefficients of log word sequence information and log inter-log information, respectively, and W1 and W2 are the parameter matrices to be trained; therefore, the fused feature E k The final expression is: Finally, the feature vector matrix E of the log is obtained.

5. The analysis and detection system for anomaly attack chains based on GAT-BiLSTM according to claim 4, characterized in that: In step S6, after adaptive feature fusion, the feature vector matrix E of the logs is fed into a fully connected layer with a neural network model for classification. The calculation process is as follows: Where σ is the ReLU function, W3 and W4 are the matrices to be trained, and b1 and b2 are the bias vectors; the loss value L is calculated using the cross-entropy loss function. Among them, y i y represents the actual label of the i-th log category. i ， The model's predicted labels are used; the GAT-BiLSTM model is trained by minimizing the loss function, and Adam is used as the optimizer for gradient descent. Input the log data D and the label y calculated by the fully connected layer into the GAT-BiLSTM model to output the log classification result.

6. An analysis and detection system for anomaly attack chains based on GAT-BiLSTM, characterized in that: To implement the method according to any one of claims 1 to 5, comprising: Data acquisition module: used to collect network logs, traffic data, or security incident information; Data processing module: Cleans, formats, and standardizes the collected data to generate structured data; Attack Behavior Graph Construction Module: Maps structured data into an attack behavior graph, constructing spatial relationships between attack behaviors; Graph Attention Network (GAT) Modeling Module: Learns spatial features of the attack behavior graph to obtain the importance weights of nodes and their interaction relationships; Bidirectional Long Short-Term Memory (BiLSTM) modeling module: models the time-series characteristics of attack behavior and captures the dynamic evolution information of the attack chain; Anomaly attack chain identification module: It integrates spatial and temporal features to detect and analyze anomaly attack chains.

7. An analysis and detection device for anomaly attack chains based on GAT-BiLSTM, characterized in that: It includes a memory and a processor; the memory is used to store a computer program, and the processor is used to execute the computer program to implement the method according to any one of claims 1 to 5.

8. A readable storage medium, characterized in that: The readable storage medium stores a computer program, which, when executed by a processor, implements the method described in any one of claims 1 to 5.

Images