An industrial network worm propagation traceability method based on residual graph attention network
By using a residual graph attention network-based method, the attention weights between nodes and their neighbors are dynamically calculated and skip connections are introduced. This solves the problem of insufficient accuracy and robustness in tracing the propagation of worms in industrial networks in existing technologies, and achieves high-precision tracing and rapid response in complex networks.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- SHANGHAI UNIV
- Filing Date
- 2026-04-16
- Publication Date
- 2026-07-21
AI Technical Summary
Existing methods for tracing the propagation of industrial network worms lack accuracy and robustness in complex and dynamic industrial networks, making it difficult to effectively locate the source node. Furthermore, existing graph neural network models have poor generalization ability in scenarios with multi-source propagation and topological heterogeneity.
We adopt a residual graph attention network-based approach, which constructs a model through multi-layer graph attention convolutional layers and skip connections, dynamically calculates the attention weights between nodes and their neighbors, and combines residual connections and random deactivation layers to build a modular source tracing system, reducing the reliance on prior assumptions of the propagation model.
It improves the accuracy and robustness of worm propagation tracing, can accurately locate the propagation source node in multi-source, complex topology industrial networks, meets the real-time response requirements, and has good generalization ability and noise resistance.
Smart Images
Figure CN122437685A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of industrial network security technology, specifically to a method for tracing the propagation of industrial network worms based on residual graph attention networks. Background Technology
[0002] The deep integration of the Industrial Internet, while improving production efficiency, also presents unprecedented cybersecurity challenges to Industrial Control Systems (ICS). Worms, with their self-replicating and proactive propagation characteristics, have become a major threat to industrial networks. Once an outbreak occurs, worms can spread rapidly between network devices, leading to serious consequences such as production interruptions and data breaches. Therefore, quickly and accurately locating the source of worm propagation (i.e., "source tracing") is crucial for containing attacks, patching vulnerabilities, and assigning responsibility.
[0003] Existing propagation tracing methods are mainly divided into two categories: traditional algorithms based on graph theory models and emerging methods based on graph neural networks (GNNs). Traditional algorithms, such as the Jordan center method and the dynamic age method, usually rely on strong prior assumptions about propagation models (such as SI and SIR models) and network topology. In real industrial networks with complex structures and dynamic changes, their accuracy and robustness are often insufficient.
[0004] In recent years, graph neural networks (GCNs) have been introduced into propagation and source tracing tasks due to their powerful ability to learn from graph-structured data. For example, methods based on graph convolutional networks (GCNs) (such as GCNSI) learn node representations by aggregating neighbor information. However, the original GCNs have obvious limitations: first, their aggregation method assigns equal weights to all neighbors or is based solely on fixed topological weights, failing to distinguish the differences in importance between different neighbors during propagation; second, when the number of network layers increases to capture higher-order dependencies, gradient vanishing or network degradation problems easily occur, limiting model depth and performance.
[0005] While existing research has attempted to improve the system by introducing attention mechanisms (such as the attention network GAT) or residual connections (such as the prototype of ResGAT), current solutions still suffer from low source tracing accuracy and weak generalization ability when dealing with complex scenarios unique to industrial networks, such as multi-source propagation, topological heterogeneity, and data sparsity. Therefore, there is an urgent need for a source tracing model that can deeply integrate local fine-grained perception with a globally stable training mechanism. Summary of the Invention
[0006] To overcome the aforementioned deficiencies of the prior art, embodiments of the present invention provide an industrial network worm propagation tracing method based on residual graph attention networks to solve the problems mentioned in the background art.
[0007] The purpose of this invention is to overcome the shortcomings of existing technologies and provide a more accurate, robust, and applicable method and system for tracing the propagation of worms in complex industrial network environments. Specifically, this invention aims to achieve the following objectives: (1) Improve the accuracy of worm propagation tracing, especially in industrial network scenarios with multiple sources and complex topologies, and accurately locate the most likely propagation source node; (2) Enhance the model’s generalization ability and robustness to different network topologies, infection scales and propagation parameters, and reduce the dependence on the prior assumptions of the propagation model; (3) Provide a modular, easy-to-integrate, and fast-inference traceability system to meet the real-time response requirements of industrial networks.
[0008] The objective of this invention is achieved through the following technical solution: This invention provides a method for tracing the propagation of industrial network worms based on residual graph attention networks, comprising the following steps: S1: Data Construction and Feature Extraction Obtain the topology of the target industrial network and the infection status information of all nodes at a specific observation time. The topology includes the connections between nodes, typically represented as an adjacency matrix or edge list; the infection status information includes whether each node has been infected by the worm, typically represented as a binary vector.
[0009] A propagation graph is constructed based on the aforementioned topology and infection status information. ,in For a set of nodes, Let be the set of edges. This is the node feature matrix. Specifically, for nodes containing... A network of nodes, constructed adjacency matrix Indicates edge connection relationships, and Feature matrix Represents each node Dimensional features.
[0010] Preferably, the feature vector of each node includes at least: the binary infection state of the node (0 indicates uninfected, 1 indicates infected), and the number of infected neighboring nodes of the node.
[0011] The number of infected neighbor nodes is calculated as follows: for nodes... Count all its neighbor nodes The number of nodes with an infection status of 1. This feature is used to characterize the intensity of local influence on a node during propagation.
[0012] Furthermore, the data generation parameters used for model training are set as follows: a susceptible-infection propagation model is used for simulation, with the initial proportion of infected source nodes set to 10% or 20% of the total number of nodes in the network, and the infection probability on each edge is... Uniformly distributed within the interval.
[0013] The simulation begins with the initial source of infection spreading, and at each discrete time step, each infected node attempts to infect its susceptible neighbors with a set infection probability.
[0014] The simulation continues until the proportion of infected nodes reaches a preset termination proportion, which must be greater than the initial proportion of infected sources (for example, if the initial proportion is 10%, the termination proportion is set to 30%, and if the initial proportion is 20%, the termination proportion is set to 40%).
[0015] Record the state of all nodes at this time as an observation snapshot, and the real source node label of each simulation sample is the initial set of infected source nodes.
[0016] By repeating the above simulation process, a training dataset containing a large number of samples is generated.
[0017] S2: Model Inference and Source Node Prediction The propagation graph constructed in step S1 is input into a pre-trained residual graph attention network model for forward inference. The residual graph attention network model aggregates the multi-hop neighbor information of each node step by step through multiple graph attention convolutional layers, and maintains the gradient flow of the deep network through the residual structure formed by skip connections, and finally outputs the probability of each node as a propagation source.
[0018] Specifically, the forward propagation process of the model is as follows: the input propagation map is mapped to a high-dimensional space through a feature projection layer, and then features are transformed and aggregated through multiple residual map attention blocks in sequence. Finally, the probability score of each node is generated through the classification output layer.
[0019] S3: Result Output and Judgment After processing the propagation graph, the residual graph attention network model outputs the probability distribution of each node in the propagation graph as a propagation source, and the probability distribution satisfies ,in For nodes The probability of worm propagation is determined by selecting the node with the highest probability value as the source node for worm propagation. .
[0020] The residual graph attention network model is constructed and trained in the following manner: The network structure of the residual graph attention network model includes, in sequence: an input feature projection layer, at least two cascaded residual graph attention blocks, and a node-level classification output layer.
[0021] Input Feature Projection Layer: The input feature projection layer is a linear transformation layer. Its input dimension is the original feature dimension of the nodes (e.g., 2D), and its output dimension is the high-dimensional latent space dimension (e.g., 128D). This layer is used to map the original features to a richer representation space to improve the expressive power of the model.
[0022] Residual Graph Attention Block: The residual graph attention block contains graph attention convolutional layers and skip connections. For node features input to this block... First, it goes through a multi-head graph attention convolutional layer.
[0023] Preferably, the multi-head graph attention convolutional layer employs... A parallel attention head, For positive integers (e.g., 4 or 8), each head has independent learnable parameters: weight matrix and attention vector ,in Weight matrix The dimension is ,in F' is the input feature dimension, and F' is the output feature dimension; attention vector The dimension is .
[0024] Furthermore, for the first Attention head, node Its neighboring nodes Attention weights between The calculation is as follows: in This represents a vector concatenation operation. For nodes The set of neighboring nodes, with a negative slope of 0.2 for LeakyReLU.
[0025] In the above calculation, the nodes are first... and neighboring nodes The features are respectively weighted by the weight matrix Transform, then concatenate, and then combine with the attention vector. The dot product, after LeakyReLU activation, yields the unnormalized attention coefficients. Finally, the attention weights are obtained through softmax normalization. .
[0026] Furthermore, the first Aggregated features of attention heads The Row definition The outputs of each head are fused using either concatenation or averaging to obtain the output of the multi-head graph attention convolution. When using concatenation, the output dimension is... When averaging, the output dimension is F'.
[0027] Residual Connections: Subsequently, residual connections are introduced to process the input features of this block. After linear transformation matrix After adjusting the dimensions, add it to the output of the graph attention convolutional layer: when Dimensions and When the output dimensions are the same, It can be set as an identity matrix or omitted.
[0028] Preferably, the summed results are subjected to batch normalization and dropout processing in sequence. Batch normalization standardizes each feature dimension, accelerating training convergence; dropout randomly sets the output of some neurons to zero with a preset probability (e.g., 0.5) to suppress overfitting.
[0029] Node-level classification output layer: The node-level classification output layer is a fully connected layer. The input is the node feature vector output by the attention block of the last residual map, and the output is the unnormalized score (logit) of the node as a propagation source. Then, the softmax function is applied to the scores of all nodes to obtain a normalized probability distribution, where the probability value of each node represents the likelihood that the node is a propagation source.
[0030] The training process of the model is as follows: using the simulation propagation graph dataset with real source node labels generated in step S1, with multi-class cross-entropy loss as the optimization objective, the Adam optimizer is used to iteratively update the model parameters until the model's performance on the validation set converges.
[0031] Preferably, the multi-class cross-entropy loss function is defined as: in This is the one-hot tag of the real source node (1 for the real source node, 0 for the rest). For model prediction nodes It is the probability that it is the source.
[0032] Furthermore, a mini-batch stochastic gradient descent strategy is employed during training, with a batch size of, for example, 32 or 64. The initial learning rate is set to, for example, 0.001, and the momentum parameter of the Adam optimizer is... Take 0.9, Set the value to 0.999. Use the validation set to monitor the model's source accuracy. If the validation set performance no longer improves after 10 consecutive training epochs, stop training early and restore the optimal model parameters.
[0033] The present invention also provides a network worm propagation tracing system that implements the above method, comprising the following modules: The data construction module is configured to collect the topological connections of the industrial network and the real-time infection status of each node. Based on the collected data, it constructs a propagation graph with node features and outputs the propagation graph to the model processing module. Specifically, this module obtains raw data through network probes or API interfaces, then performs node feature calculations (statistics on the number of infected neighbors) and graph data formatting, ultimately generating an input format acceptable to the model (such as an adjacency matrix and feature tensors).
[0034] Model processing module: Configured to load and run a pre-trained residual graph attention network model, receive the propagation graph and perform forward inference computation, outputting the source probability distribution of all nodes. This module contains model parameter files and an inference engine (such as a runtime based on ONNX or TensorRT), supporting CPU or GPU computation.
[0035] Source tracing output module: Configured to parse the probability distribution output by the model processing module, select the node with the highest probability as the worm propagation source, and output the source tracing results. Output formats include, but are not limited to: node ID, IP address, device name, and corresponding probability values. This module can also provide a visualization interface to highlight the source tracing results in the topology map.
[0036] Preferably, the residual graph attention network model in the model processing module consists of a feature projection layer, at least two residual graph attention blocks, and a node-level classification output layer connected in sequence; the residual graph attention block includes a graph attention convolutional layer, a skip connection, a batch normalization layer, and a random deactivation layer; the node-level classification output layer is a fully connected layer followed by a softmax function.
[0037] Compared with the prior art, the present invention has the following beneficial effects: (1) High source tracing accuracy: This invention uses graph attention convolutional layers to dynamically calculate attention weights for each node and its neighboring nodes, enabling the model to adaptively focus on the neighbor with the most information during propagation. This effectively distinguishes the importance of different neighbors when aggregating features, overcoming the shortcomings of traditional graph convolutional networks that aggregate all neighbors with equal weights. Simultaneously, by stacking at least two residual graph attention blocks and introducing skip connections, the model can construct deeper network structures and capture higher-order propagation dependencies. The identity mapping path provided by residual connections avoids gradient vanishing and network degradation problems in deep networks. Therefore, in multi-source, complex topology industrial network scenarios, this invention can more accurately locate the most likely worm propagation source node.
[0038] (2) Strong robustness and generalization ability: This invention does not rely on strong prior assumptions about parameters such as propagation rate, network topology, and infection probability. Instead, it trains the residual graph attention network model with a large amount of simulation data, enabling the model to directly learn the mapping rules from the propagation graph to the source node from the data. The random deactivation layer introduced in the model randomly discards some neurons during training, which effectively suppresses overfitting and enhances the model's adaptability to unknown data. Therefore, this invention can maintain stable source tracing performance on test sets with different network sizes, different connection densities, and different infection ratios. Even with some node state noise or missing nodes, it can still provide reliable source node predictions.
[0039] (3) Good modularity and practicality: This invention encapsulates data construction, model inference, and source tracing output into independent modules. The modules communicate with each other through a standardized propagation graph data format, which facilitates overall integration into existing industrial security protection platforms. The model processing module adopts a trained residual graph attention network. The inference process only involves forward computation and does not require iterative optimization. Therefore, the calculation speed is fast and it can complete the source tracing inference of the propagation graph of a hundred-node industrial network within milliseconds, meeting the real-time or near-real-time response requirements of industrial networks to security events. In addition, the system supports expansion to multi-source output through threshold configuration, which improves the flexibility of actual deployment. Attached Figure Description
[0040] Fig. 1 This is a flowchart illustrating the overall process of tracing the propagation of an industrial network worm according to an embodiment of the present invention. The method includes: constructing a propagation graph by acquiring the topology and infection state; inputting a ResGAT model; and outputting the probability distribution of source nodes, selecting the node with the highest probability.
[0041] Fig. 2 This is a schematic diagram of the core residual block structure of the Residual Graph Attention Network (ResGAT) in this invention. It shows that the residual block includes: input features, multi-head graph attention convolutional layer, residual connection (skip connection), addition operation, ReLU activation function, batch normalization layer, and random deactivation layer.
[0042] Fig. 3 This is a schematic diagram illustrating the working principle of the graph attention mechanism in this invention for calculating the weights between nodes. It shows the central node and its neighboring nodes, and how the attention coefficient is calculated using a learnable weight matrix W and an attention vector a. After being normalized by softmax, it is used for feature aggregation. Detailed Implementation
[0043] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0044] Example 1 As attached Figs. 1 to 3 The following is a method for tracing the propagation of industrial network worms based on residual graph attention networks, and its specific implementation is as follows: I. Generation of Training Dataset To train and validate the ResGAT model, the first step is to construct a labeled propagation graph dataset.
[0045] Five representative real-world network datasets (e.g., NSFNET, GEANT, Internet2, PowerGrid, AS-733) were selected to simulate different industrial network scenarios.
[0046] Extensive simulations were performed on the topologies of each of the above networks using the Susceptible-Infection (SI) propagation model. The specific steps for each simulation are as follows: (1) Randomly select 10% or 20% of the total number of nodes in the network as the initial source nodes for infection. Let the total number of nodes in the network be... The initial set of infection source nodes is denoted as ,and ,in Take 0.1 or 0.2.
[0047] (2) The infection probability on each directed edge is... Uniform random sampling is performed within the interval, and the edge weights are fixed for this simulation.
[0048] (3) The simulation proceeds in discrete time steps. Initial time ( The initial state of the source node is set to "Infected" (1), and the states of the remaining nodes are set to "Susceptible" (0). At each time step, each infected node attempts to infect all its susceptible neighbors, with each attempt succeeding according to the infection probability corresponding to that edge. The simulation continues until the proportion of infected nodes reaches a preset termination proportion.
[0049] The termination ratio must be greater than the initial infection source ratio: When the initial infection rate is 10%, the termination rate is set at 30%. When the initial infection rate is 20%, the termination rate is set to 40%.
[0050] Record the state of all nodes at this time as an observation snapshot.
[0051] (4) The label of each simulation sample is the initial set of infection source nodes. Simultaneously, a feature vector is constructed for each node: the infection status of that node. (0 or 1), and the number of infected neighboring nodes of this node. ,in Represents a node The set of neighboring nodes.
[0052] By repeating the above simulation process (e.g., generating 2000 samples for each network), a sufficient number of samples are generated for each network, and the samples are divided into training set, validation set and test set in a ratio of 70%:20%:10%.
[0053] II. Construction of the Residual Graph Attention Network Model Construct a Residual Graph Attention Network (ResGAT) model, the structure of which is as follows: Fig. 2 and Fig. 3 As shown, the specific components are as follows: Feature projection layer: A linear layer (fully connected layer) that maps the input 2D node features (infection state, number of infected neighbors) to a high-dimensional space (e.g., 128-dimensional), providing the foundation for subsequent complex calculations. Let the input feature matrix be... Projection layer output ,in , .
[0054] The core feature extraction layer consists of two consecutive residual map attention blocks stacked together. Each block is key to the improvement of this invention, and its internal execution flow is as follows: Fig. 2 As shown: (a) Graph attention convolution: input features (No. The input block first enters a multi-head graph attention convolutional layer (GATConv). This embodiment uses... A parallel attention head. For example... Fig. 3 As shown, the core mechanism of this layer lies in providing each central node with... Dynamically calculate its relationship with each neighboring node Attention weights between For the first Size ( The weight calculation formula is as follows: in For nodes In the The feature vector of the layer (i.e.) The OK), For the first The learnable weight matrix of the size, For the first The size of the learnable attention vector, This represents a vector concatenation operation. Represents a node The set of neighboring nodes of the given set, with a negative slope of 0.2 for LeakyReLU. The aggregation characteristics of the size are: The outputs from each head are merged by splicing: Since the output dimension of each header is set to 32, the concatenated dimension is 128, which is consistent with the input dimension.
[0055] (b) Residual connections: Features obtained after graph attention aggregation , will be the input of the block Fusion is performed via a skip connection. Specifically, the input... After a linear transformation After adjusting the dimensions (in this embodiment, the input and output dimensions are the same, therefore...), (can be omitted or set as identity matrix), and Add: This structure constitutes residual learning, which ensures that even in deep networks, gradients can be effectively backpropagated through this shortcut, alleviating the gradient vanishing and network degradation problems of deep graph neural networks.
[0056] (c) Stabilization: The summed results are subjected to batch normalization and dropout in sequence. Batch normalization standardizes each feature dimension to accelerate training convergence; dropout randomly sets the output of some neurons to zero with a probability of 0.5 to prevent overfitting.
[0057] Classification output layer: Node-level features extracted through two residual map attention blocks Instead of global pooling, it directly maps the features of each node to a scalar value through a linear classification layer (fully connected layer), representing the probability that the node is a propagation source. Specifically, for each node... calculate ,in , Then, the softmax function is applied to the scores of all nodes to obtain a normalized probability distribution: in Represents a node It is the predicted probability of the source of worm transmission.
[0058] III. Model Training The model is trained under supervision using the prepared training set. The cross-entropy loss function is used to measure the difference between the model's predicted probabilities and the true labels. Specifically, for each training sample, the true label is the one-hot encoding of the initial infected source node. ,in If and only if node Belongs to the initial infection source set The loss function is defined as: in For model prediction nodes It is the probability that it is the source.
[0059] The Adam optimizer is used for parameter updates. In this embodiment, the initial learning rate is set to 0.001, and the momentum parameter is... , The weight decays to During training, a batch of samples is randomly selected in each iteration, with a batch size of 32. After each training epoch, the source tracing accuracy (i.e., whether the node with the highest predicted probability belongs to the true source node set) is calculated on the validation set. If the validation set accuracy no longer improves for 10 consecutive epochs, training is stopped early, and the model parameters that performed best on the validation set are restored.
[0060] IV. Model Evaluation (Optional) The trained model is evaluated on the test set. For each test sample, the model outputs a probability distribution. ,Pick As the predicted source node for worm propagation. Statistical prediction accuracy (the proportion of predicted nodes that match the actual source node) and other indicators (such as average reciprocal ranking, average location error).
[0061] V. System Deployment (Optional) The trained ResGAT model is integrated into an industrial network worm propagation tracing system. The system consists of three modules: Data construction module: Collects the topology of the industrial network and the infection status of each node in real time, and constructs a propagation graph according to the method in step one.
[0062] Model processing module: Loads the trained model parameters, performs forward inference on the propagation graph, and outputs the probability distribution of each node as a source.
[0063] Source tracing output module: Select the node with the highest probability as the source of worm propagation, output the identifier of the node (such as IP address, device name), and trigger alarms or linkage actions.
[0064] In this specific embodiment, the variables in each step are given a clear definition and source when they first appear. All parameters are given in the form of "for example" or "in this embodiment," which does not constitute a limitation on the scope of protection, while ensuring the specificity and uniqueness of the implementation. Those skilled in the art can fully implement the present invention according to this embodiment. The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.
Claims
1. A method for tracing the propagation of industrial network worms based on residual graph attention networks, characterized in that, Includes the following steps: S1: Obtain the topology of the target industrial network and the infection status information of the nodes in the network, and construct a propagation graph based on the topology and infection status information; S2: Input the propagation graph into the pre-trained residual graph attention network model; The residual graph attention network model includes multiple graph attention convolutional layers, and skip connections are set on at least one of the graph attention convolutional layers to form a residual structure. S3: Based on the output of the residual graph attention network model, determine the source node in the propagation graph that serves as the source of worm propagation.
2. The method for tracing the propagation of industrial network worms based on residual graph attention networks according to claim 1, characterized in that, The training process of the residual graph attention network model in step S2 includes: The susceptible-infection propagation model is used to simulate on a network with a known topology to generate a training sample set with source node labels. In the simulation, the initial proportion of infected source nodes is set to 10% or 20% of the total number of nodes in the network. The simulation stops when the proportion of infected nodes reaches a preset termination proportion, which is greater than the initial proportion of infected source nodes. The training sample set is input into the residual graph attention network model for iterative training. The residual graph attention network model calculates the attention weights between nodes through a multi-head attention mechanism, and performs forward propagation and backward gradient update through the residual structure formed by the skip connections until the model converges.
3. The method for tracing the propagation of industrial network worms based on residual graph attention networks according to claim 2, characterized in that, The graph attention convolutional layer in the residual graph attention network model updates node features in the following manner: make For the first The feature matrix of all nodes in the layer, For nodes In the The feature vector of the layer, where It is a non-negative integer. For node indexing; let Represents a node The set of neighboring nodes; The multi-head attention mechanism adopts 1 parallel attention head, of which The values are positive integers, and each head has independent learnable parameters: weight matrix. and attention vector ,in ; For the Attention head, node Its neighboring nodes Attention weights between The calculation is as follows: in This represents a vector concatenation operation. For activation functions; No. Aggregated features of attention heads The Row definition ; The output features of each head are fused using either concatenation or averaging to obtain the final multi-head graph attention convolution output: or in This represents vector concatenation. This represents an element-wise average. The residual structure is achieved by... Feature matrix of layer After linear transformation, with the first The output features of the layer-by-layer graph attention convolution are summed to obtain the final result. Layer output: in It is a learnable linear transformation matrix. This is the activation function.
4. The method for tracing the propagation of industrial network worms based on residual graph attention networks according to claim 1, characterized in that, When constructing the propagation graph in step S1, the feature vector of a node shall include at least: the infection status of the node and the number of infected neighboring nodes of the node; The number of infected neighbor nodes refers to the number of nodes in the state of being infected among the neighbors directly connected to this node at the current observation time.
5. The method for tracing the propagation of industrial network worms based on residual graph attention networks according to any one of claims 1-4, characterized in that, In step S3, the residual graph attention network model outputs the probability distribution of each node in the propagation graph as a propagation source, and determines the node with the highest probability as the source node.
6. A network worm propagation tracing system implementing the method of any one of claims 1-5, characterized in that, include: The data construction module is used to collect the topological connections of the industrial network and the real-time infection status of each node, and to construct a propagation graph with node features. The model processing module is used to load and run a pre-trained residual graph attention network model to perform forward inference calculations on the propagation graph. The source tracing output module is used to parse the output of the model processing module, identify and output the node with the highest probability as the source of worm propagation.
7. The network worm propagation tracing system according to claim 6, characterized in that, The residual graph attention network model in the model processing module consists of a feature projection layer, at least two residual graph attention blocks, and a node-level classification output layer connected in sequence. The residual graph attention block includes a graph attention convolutional layer, a skip connection, a batch normalization layer, and a random deactivation layer; The node-level classification output layer is a fully connected layer followed by a softmax function to output the probability of each node.
8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1 to 5.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1 to 5.